Hi Linus, Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes and another repair for an earlier fix, mostly amdgpu and i915 display with xe/i915 accel, and misc core/driver fixes.
It might be a bit bigger than usual at this stage, but I'm not seeing anything too scary here. Regards, Dave. drm-fixes-2026-05-30: drm fixes for 7.1-rc6 dumb-buffer: - prevent overflows in dumb-buffer creation dma-buf: - fix UAF in dma_buf_fd() tracepoint gem: - fix for the fix for the fix for the change handle ioctl i915: - Fix potential UAF in TTM object purge - Use polling when irqs are unavailable - Fix HDR pre-CSC LUT programming loop - Block DC states on vblank enable when Panel Replay supported - Use DC_OFF wake reference to block DC6 on vblank enable xe: - Restore IDLEDLY regiter on engine reset amdgpu: - GEM_OP warning fix - GEM_OP locking fix - Userq fixes - DCN 2.1 refclk fix - SI fix - HMM fixes amdkfd: - svm_range_set_attr locking fix - CRIU restore fix - KFD debugger fix amdxdna: - require IOMMU on AIE2 hyperv: - improve protocol validation ivpu: - test write offset in debugfs rocket: - fix UAF in bo creation The following changes since commit e7ae89a0c97ce2b68b0983cd01eda67cf373517d: Linux 7.1-rc5 (2026-05-24 13:48:06 -0700) are available in the Git repository at: https://gitlab.freedesktop.org/drm/kernel.git tags/drm-fixes-2026-05-30 for you to fetch changes up to 7164d78559b0ff29931a366a840a9e5dd53d4b7c: drm/gem: fix race between change_handle and handle_delete (2026-05-30 07:01:39 +1000) ---------------------------------------------------------------- drm fixes for 7.1-rc6 dumb-buffer: - prevent overflows in dumb-buffer creation dma-buf: - fix UAF in dma_buf_fd() tracepoint gem: - fix for the fix for the fix for the change handle ioctl i915: - Fix potential UAF in TTM object purge - Use polling when irqs are unavailable - Fix HDR pre-CSC LUT programming loop - Block DC states on vblank enable when Panel Replay supported - Use DC_OFF wake reference to block DC6 on vblank enable xe: - Restore IDLEDLY regiter on engine reset amdgpu: - GEM_OP warning fix - GEM_OP locking fix - Userq fixes - DCN 2.1 refclk fix - SI fix - HMM fixes amdkfd: - svm_range_set_attr locking fix - CRIU restore fix - KFD debugger fix amdxdna: - require IOMMU on AIE2 hyperv: - improve protocol validation ivpu: - test write offset in debugfs rocket: - fix UAF in bo creation ---------------------------------------------------------------- Balasubramani Vivekanandan (1): drm/xe: Restore IDLEDLY regiter on engine reset Berkant Koc (2): drm/hyperv: validate resolution_count and fix WIN8 fallback drm/hyperv: validate VMBus packet size in receive callback Christian König (2): drm/amdgpu: fix amdgpu_hmm_range_get_pages drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx Dan Carpenter (1): accel/ivpu: prevent uninitialized data bug in debugfs Dave Airlie (4): Merge tag 'drm-intel-fixes-2026-05-27' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes Merge tag 'drm-xe-fixes-2026-05-28' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Merge tag 'amd-drm-fixes-7.1-2026-05-28' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes Merge tag 'drm-misc-fixes-2026-05-29' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes David Carlier (1): dma-buf: fix UAF in dma_buf_fd() tracepoint David Francis (1): drm/amdkfd: Check for pdd drm file first in CRIU restore path Dhabaleshwar Das (1): accel/rocket: fix UAF via dangling GEM handle in create_bo Eric Huang (2): drm/amdkfd: fix NULL pointer bug in svm_range_set_attr drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger Ivan Lipski (1): drm/amd/display: Write REFCLK to 48MHz on DCN21 Janusz Krzysztofik (1): drm/i915: Fix potential UAF in TTM object purge Jouni Högander (2): drm/i915/psr: Block DC states on vblank enable when Panel Replay supported drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable Lizhi Hou (1): accel/amdxdna: Block running when IOMMU is off Michael Bommarito (1): drm/amdgpu: fix lock leak on ENOMEM in AMDGPU_GEM_OP_GET_MAPPING_INFO Michał Grzelak (1): drm/i915/aux: use polling when irqs are unavailable Pranay Samala (1): drm/i915/color: Fix HDR pre-CSC LUT programming loop Rajat Gupta (1): drm: prevent integer overflows in dumb buffer creation helpers Stanley.Yang (1): drm/amdgpu: fix potential overflow in fs_info.debugfs_name Sunil Khatri (9): drm/amdgpu/userq: Fix doorbell object cleanup of queue drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails drm/amdgpu/userq: reserve root bo without interruption drm/amdgpu/userq: make sure queue is valid in the hang_detect_work drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid drm/amdgpu/userq: use array instead of list for userq_vas Timur Kristóf (1): drm/amd/pm/si: Disregard vblank time when no displays are connected Zhenghang Xiao (1): drm/gem: fix race between change_handle and handle_delete Ziyi Guo (1): drm/amdgpu: check num_entries in GEM_OP GET_MAPPING_INFO drivers/accel/amdxdna/aie2_pci.c | 5 + drivers/accel/ivpu/ivpu_debugfs.c | 2 +- drivers/accel/rocket/rocket_gem.c | 17 +- drivers/dma-buf/dma-buf.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 11 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 17 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 207 +++++---------------- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 31 ++- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 7 +- drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 47 +++-- drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 10 +- .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 8 +- drivers/gpu/drm/amd/amdkfd/kfd_svm.c | 3 + .../gpu/drm/amd/display/dc/dccg/dcn21/dcn21_dccg.c | 15 +- drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 4 + drivers/gpu/drm/drm_dumb_buffers.c | 14 +- drivers/gpu/drm/drm_gem.c | 2 + drivers/gpu/drm/hyperv/hyperv_drm_proto.c | 113 +++++++++-- drivers/gpu/drm/i915/display/intel_color.c | 2 +- drivers/gpu/drm/i915/display/intel_display_core.h | 1 + drivers/gpu/drm/i915/display/intel_display_irq.c | 8 +- drivers/gpu/drm/i915/display/intel_display_types.h | 2 + drivers/gpu/drm/i915/display/intel_dp_aux.c | 20 +- drivers/gpu/drm/i915/display/intel_psr.c | 25 +-- drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 28 +-- drivers/gpu/drm/xe/xe_guc_ads.c | 5 + 27 files changed, 341 insertions(+), 272 deletions(-)
