Hi Linus, Weekly drm fixes, not contributing to things settling down unfortunately, lots of driver fixes for various bounds checks, leaks and UAF type things, i915/xe probably the most sane, amdgpu has a mix of fixes all over, then ethosu has lots of small fixes.
The problem of fixing thing in private has really hit us with the change handle ioctl, and "Sima was right" and we should have disabled the ioctl, since it was only introduced a couple of kernels ago and failed to upstream it's tests in time. The patch here fixes the problems Sima identified, but disables the ioctl as well, with a list of known problems in it and a request for proper tests to be written and upstreamed. It's a niche user ioctl designed for CRIU with AMD ROCm, so I think it's fine to just disable it. Maybe this week will settle down, Dave. drm-fixes-2026-06-06: drm fixes for 7.2-rc6 core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring The following changes since commit e43ffb69e0438cddd72aaa30898b4dc446f664f8: Linux 7.1-rc6 (2026-05-31 15:14:24 -0700) are available in the Git repository at: https://gitlab.freedesktop.org/drm/kernel.git tags/drm-fixes-2026-06-06 for you to fetch changes up to 1a4f03d22fb655e5f192244fb2c87d8066fcfca2: drm/gem: Try to fix change_handle ioctl, attempt 4 (2026-06-06 08:54:55 +1000) ---------------------------------------------------------------- drm fixes for 7.2-rc6 core: - disable the gem change handle ioctl for security reasons (plan to fix it on list later with proper test coverage) dumb-buffer: - remove strict limits on buffer geometry amdgpu: - BT.2020 fix for DCE - DC bounds checking fixes - SDMA 7.1 fix - UserQ fixes - SI fix - SMU 13 fixes - SMU 14 fixes - GC 12.1 fix - Userptr fix - GC 10.1 fix - GART fix for non-4K pages amdkfd: - UAF race fix - Fix a potential NULL pointer dereference - GC 11 buffer overflow fix for SDMA xe: - Revert removing support for unpublished NVL-S GuC - Suspend fixes related to multi-queue i915: - Fix color blob reference handling in intel_plane_state - Revert "drm/i915/backlight: Remove try_vesa_interface" ethosu: - reject unsupported NPU_OP_RESIZE - fix index of IFM region - fix weight index - fix overflows in DMA-size calculations - reject DMA commands with uninitialized length - fix OOB write in ethosu_gem_cmdstream_copy_and_validate imx: - fix kernel-doc warnings ivpu: - add overflow checks in firmware handling and get_info_ioctl v3d: - wait for pending L2T flush before cleaning caches - fix leak of vaddr - skip CSD when it has zeroed workgroups - fix ref counting in performance monitoring ---------------------------------------------------------------- Alex Deucher (1): drm/amdgpu/sdma7.1: fix support for disable_kq Alysa Liu (1): drm/amdkfd: fix UAF race in destroy_queue_cpsch Andrew Martin (1): drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 Andrzej Kacprowski (3): accel/ivpu: Add bounds check for firmware runtime memory accel/ivpu: Add bounds checks for firmware log indices accel/ivpu: Add buffer overflow check in MS get_info_ioctl Chaitanya Kumar Borah (1): drm/i915: Fix color blob reference handling in intel_plane_state Christian König (1): drm/amdgpu: fix waiting for all submissions for userptrs Daniele Ceraolo Spurio (1): Revert "drm/xe/nvls: Define GuC firmware for NVL-S" Dave Airlie (4): Merge tag 'amd-drm-fixes-7.1-2026-06-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes Merge tag 'drm-xe-fixes-2026-06-04' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes Merge tag 'drm-misc-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Merge tag 'drm-intel-fixes-2026-06-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes Donet Tom (1): drm/amdgpu: Fix incorrect VRAM GART mappings on non-4K page size systems Harish Kasiviswanathan (2): drm/amdgpu: Use asic specific pte_addr_mask drm/amdgpu: drm/amdgpu: Set correct DMA mask for gfx12.1 Harry Wentland (7): drm/amd/display: Fix out-of-bounds read in dp_get_eq_aux_rd_interval() drm/amd/display: Clamp VBIOS HDMI retimer register count to array size drm/amd/display: Fix NULL deref and buffer over-read in SDP debugfs drm/amd/display: Use krealloc_array() in dal_vector_reserve() drm/amd/display: Reject gpio_bitshift >= 32 in bios_parser_get_gpio_pin_info() drm/amd/display: Clamp HDMI HDCP2 rx_id_list read to buffer size drm/amd/display: Bound VBIOS record-chain walk loops Leorize (1): drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs Maíra Canal (4): drm/v3d: Wait for pending L2T flush before cleaning caches drm/v3d: Fix vaddr leak when indirect CSD has zeroed workgroups drm/v3d: Skip CSD when it has zeroed workgroups drm/v3d: Fix global performance monitor reference counting Muhammad Bilal (7): drm/amdkfd: fix NULL dereference in get_queue_ids() accel/ethosu: fix IFM region index out-of-bounds in command stream parser accel/ethosu: reject NPU_OP_RESIZE commands from userspace accel/ethosu: fix wrong weight index in NPU_SET_SCALE1_LENGTH on U85 accel/ethosu: fix arithmetic issues in dma_length() accel/ethosu: reject DMA commands with uninitialized length accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() Niranjana Vishwanathapura (1): drm/xe/multi_queue: skip submit when primary queue is suspended Prike Liang (2): drm/amdgpu: unmap userq for evicting user queue drm/amdgpu: improve the userq seq BO free bit lookup Priya Hosur (1): drm/amd/pm: smu_v14_0_0: use SoftMin for gfxclk in set_soft_freq_limited_range Simona Vetter (1): drm/gem: Try to fix change_handle ioctl, attempt 4 Sunil Khatri (2): drm/amdgpu/userq: remove the vital queue unmap logging drm/amdgpu/userq: move wptr_obj cleanup in mqd_destroy Suraj Kandpal (1): Revert "drm/i915/backlight: Remove try_vesa_interface" Tangudu Tilak Tirumalesh (2): Revert "drm/xe: Skip exec queue schedule toggle if queue is idle during suspend" drm/xe: Clear pending_disable before signaling suspend fence Thomas Zimmermann (1): drm/dumb-buffer: Drop buffer-size limits for now Timur Kristóf (2): drm/amdgpu: Align amdgpu_gtt_mgr entries to TLB size on all SI drm/amdgpu/gfxhub: Program CRASH_ON_*_FAULT bits to 0 as needed Vitaly Prosyak (1): drm/amdgpu: set noretry=1 as default for GFX 10.1.x (Navi10/12/14) Yang Wang (4): drm/amd/pm: apply SMU 13.0.10 workaround during MP1 unload drm/amd/pm: fix smu13 power limit default/cap calculation drm/amd/pm: mark metrics.energy_accumulator is invalid for smu 14.0.2 drm/amd/pm: zero unused SMU argument registers Yicong Hui (1): drm/imx: Fix three kernel-doc warnings in dcss-scaler.c drivers/accel/ethosu/ethosu_gem.c | 35 +++++++--- drivers/accel/ivpu/ivpu_fw.c | 16 +++++ drivers/accel/ivpu/ivpu_fw_log.c | 5 ++ drivers/accel/ivpu/ivpu_ms.c | 7 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_gart.c | 12 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.h | 1 + drivers/gpu/drm/amd/amdgpu/amdgpu_gtt_mgr.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 6 +- drivers/gpu/drm/amd/amdgpu/amdgpu_seq64.c | 11 +-- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.c | 18 ++--- drivers/gpu/drm/amd/amdgpu/amdgpu_userq.h | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 2 +- drivers/gpu/drm/amd/amdgpu/gfxhub_v11_5_0.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v12_0.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v12_1.c | 14 ++-- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_0.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v1_2.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v2_0.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v2_1.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v3_0.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gfxhub_v3_0_3.c | 10 ++- drivers/gpu/drm/amd/amdgpu/gmc_v10_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v11_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v12_0.c | 16 +++-- drivers/gpu/drm/amd/amdgpu/gmc_v6_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c | 1 + drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c | 1 + drivers/gpu/drm/amd/amdgpu/mes_userqueue.c | 5 ++ drivers/gpu/drm/amd/amdgpu/sdma_v7_1.c | 1 + .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 10 ++- drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_v11.c | 49 ++++++++++--- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 5 ++ drivers/gpu/drm/amd/display/dc/basics/vector.c | 4 +- drivers/gpu/drm/amd/display/dc/bios/bios_parser.c | 15 ++-- drivers/gpu/drm/amd/display/dc/bios/bios_parser2.c | 81 ++++++++++++++-------- .../drm/amd/display/dc/bios/bios_parser_helper.h | 5 ++ drivers/gpu/drm/amd/display/dc/dc_dp_types.h | 2 +- drivers/gpu/drm/amd/display/dc/dce/dce_transform.c | 10 ++- .../drm/amd/display/dc/dce110/dce110_opp_csc_v.c | 10 ++- .../gpu/drm/amd/display/modules/hdcp/hdcp_ddc.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_0_ppt.c | 42 ++++++----- .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 32 +++++---- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 3 +- .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 - drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 8 ++- drivers/gpu/drm/drm_dumb_buffers.c | 7 -- drivers/gpu/drm/drm_gem.c | 73 +++++++++---------- drivers/gpu/drm/drm_ioctl.c | 3 +- .../gpu/drm/i915/display/intel_dp_aux_backlight.c | 19 +++-- drivers/gpu/drm/i915/display/intel_plane.c | 27 ++++++++ drivers/gpu/drm/imx/dcss/dcss-scaler.c | 3 + drivers/gpu/drm/v3d/v3d_gem.c | 8 +++ drivers/gpu/drm/v3d/v3d_perfmon.c | 24 +++++-- drivers/gpu/drm/v3d/v3d_sched.c | 17 ++++- drivers/gpu/drm/xe/xe_exec_queue.h | 17 ----- drivers/gpu/drm/xe/xe_guc_submit.c | 62 +++-------------- drivers/gpu/drm/xe/xe_hw_engine_group.c | 10 +-- drivers/gpu/drm/xe/xe_uc_fw.c | 1 - 60 files changed, 472 insertions(+), 323 deletions(-)
