kernel/git/next/linux-next.git/drivers/dma-buf, branch pending-fixes

Merge branch 'for-linux-next-fixes' of https://gitlab.freedesktop.org/drm/misc/kernel.git

2026-08-28T12:34:53+00:00

# Conflicts: # drivers/accel/ethosu/ethosu_drv.c # drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h # drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c

dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

2026-08-24T11:57:59+00:00

DMA_HEAP_IOCTL_ALLOC allocates a dma-buf and installs an fd into the caller's fd table via dma_buf_fd() -> fd_install() before dma_heap_ioctl() copies the result back to userspace. If the trailing copy_to_user() fails, userspace never learns the fd number, but the fd (and the underlying dma-buf reference) are already visible to other threads in the same process and are leaked for the lifetime of the process. The obvious "close it on the failure path" fix is unsafe: once fd_install() has run, another thread can already dup() the fd, send it via SCM_RIGHTS, or close() it and let its number be reused, so a subsequent close_fd() from the ioctl path can operate on an unrelated file. This was pointed out by Christian König on v1 [1]. Restructure the allocation path so that fd_install() is the last, unfailable step of a successful ioctl: 1. heap->ops->allocate() creates the dma_buf. 2. get_unused_fd_flags() reserves an fd number in the caller's fd table without publishing it, so no other thread can observe it. 3. copy_to_user() delivers the fd number to userspace; on failure the fd is returned with put_unused_fd() and the dma_buf reference is dropped with dma_buf_put(), leaving no user- visible state behind. 4. dma_buf_fd_install() publishes the fd and emits the trace_dma_buf_fd tracepoint -- from here on the ioctl cannot fail. A new dma_buf_fd_install() helper is introduced in dma-buf.c to wrap fd_install() together with the DMA_BUF_TRACE() call, preserving the export tracing that dma_buf_fd() provides. dma_heap_ioctl_allocate() is refactored to return the struct dma_buf * directly (returning ERR_PTR on failure) so the caller holds the dmabuf reference across steps 3 and 4. The failure at step 3 is easily reachable from userspace: pass a struct dma_heap_allocation_data that lives in a page whose protection is flipped to PROT_READ between copy_from_user() and copy_to_user() (e.g. via mprotect()). Before this change each such ioctl leaks one dmabuf fd; after it, the fd table is unchanged on failure and only /dev/dma_heap/ remains open. No UAPI or heap-driver interface change. [1] https://lore.kernel.org/dri-devel/175e98de-f414-47d7-81c1-c0fe0a8f7f62@amd.com/ Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework") Cc: stable@vger.kernel.org Reviewed-by: T.J. Mercier Acked-by: Christian König Acked-by: Sumit Semwal Signed-off-by: Baineng Shou Link: https://lore.kernel.org/r/20260817050457.1005285-2-shoubaineng@gmail.com Signed-off-by: Christian König

BackMerge tag 'v7.2' into drm-next

2026-08-20T00:58:44+00:00

Linux 7.2 There was a lot of conflicts this round between fixes and next, and I'd like to get the merge resolutions that we have in drm-tip. Signed-off-by: Dave Airlie

dma-buf/udmabuf: Disable the size limit by default

2026-08-04T05:48:11+00:00

As udmabuf increasingly enjoys popularity - being used in projects like libcamera, Gstreamer, Mesa, KWin and Weston - users more frequently encounter cases where the current default size limit of 64MB is too low. Examples include allocating video buffers at a 8K resolution - and even 4K is affected when using non-subsampled video formats and high bit depths. In its current form the size limit for individual buffers does not seem to provide any additional level of protection - such as limiting the amount of memory a process can pin - as the later can just allocate multiple buffers. If additional guardrails are desired, they would likely require some kind accounting not limited to individual buffers. Therefor let's disable the size limit by default by setting it to the maximal possible value, INT_MAX. Signed-off-by: Robert Mader Acked-by: Vivek Kasireddy Link: https://lore.kernel.org/dri-devel/20260711144814.8205-1-robert.mader@collabora.com/ Link: https://lore.kernel.org/dri-devel/6764ca6f-b4d8-4baa-9d27-2ca867ac2d41@amd.com/ Signed-off-by: Vivek Kasireddy Link: https://patch.msgid.link/20260722110145.36641-1-robert.mader@collabora.com

udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

2026-07-10T23:26:39+00:00

The message of commit 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning") says: > The CPU sync at map/unmap time is also redundant for udmabuf: > begin_cpu_udmabuf() and end_cpu_udmabuf() already perform explicit > cache synchronization via dma_sync_sgtable_for_cpu/device() when CPU > access is requested through the dma-buf interface. This, however, does not apply to the first time begin_cpu_udmabuf() is called on an udmabuf, in which case the implementation previously relied on get_sg_table() to perform the cache synchronisation. Ensure to call dma_sync_sgtable_for_cpu() in that case as well. Fixes: 504e2b4ab97a ("dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning") Signed-off-by: Robert Mader Reviewed-by: Mikhail Gavrilov Signed-off-by: Vivek Kasireddy Link: https://patch.msgid.link/20260627105725.9083-1-robert.mader@collabora.com

Merge drm/drm-next into drm-misc-next

2026-07-08T11:00:55+00:00

Backmerging to get updates from v7.2-rc2 into drm-misc-next. Signed-off-by: Thomas Zimmermann

Merge tag 'drm-misc-next-2026-07-02' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-07-06T23:34:04+00:00

drm-misc-next for 7.3: UAPI Changes: Cross-subsystem Changes: Core Changes: - bridge: Add atomic_create_state callback and helpers, drop atomic_reset - dp: Add support for DSC max delta BPP - edid: Parse panel type from DisplayID 2.x Display Parameters - sysfb: Improve panel, stride and framebuffer size validation Driver Changes: - hibmc: Improvements to the plane formats handling, switch to gem-shmem - nouveau: race fixes, misc improvements - bridges: - Convert all bridges to atomic_create_state - panels: - panel-edp: New quirks for BOE NE160QDM-NY1, MB116AS01 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260702-powerful-successful-raptor-eded34@houat

Merge tag 'drm-misc-next-2026-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2026-07-06T07:38:49+00:00

drm-misc-next for 7.3: UAPI Changes: - connector: Add color format property Cross-subsystem Changes: - dmem: introduce a peak file Core Changes: - atomic: Add create_state callback and helpers to all objects, add documentation on atomic commit lifetime - buddy: Fix use-after-free, add per-order free and used block scoreboards - gem: Remove DRIVER_GEM_GPUVA feature flag - hdmi: Hook the color format property in the helpers - mipi-dsi: Add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT flag - sched: Add test suite for concurrent job submissions - virtio: Add support for saving and restoring virtio_gpu_objects, abort virtqueue wait on device removal to avoid hung task Driver Changes: - amdgpu: Implement "color format" DRM property - amdxdna: Disable device buffer exporting - ethosu: Add performance counter support - msm: Support DSC configurations with slice_per_pkt > 1 - mxsfb: Fix disable sequence - panthor: Support sparse mappings - rockchip: Support YUV background color, Fix layer config timeout, add edp support for rk3576, cleanups and formats improvements - solomon: Add a batch command submission function - tegra: Add DSI support for Tegra 20 and 30, fix dsi driver when the firmware hasn't enabled the controller, - v3d: Reduce PM runtime autosuspend delay, Scheduler and submission fixes and refactoring, Deprecate V3D 3.3 and 4.1 support - bridge: - display-connector: don't autoenable HPD IRQ, trigger initial HPD event for DP - dw-dp: Null pointer dereference and use-after-free fixes - ti-sn65dsi83: Remove NO_HFP and NO_HBP mode flags - panel: - himax-hx83121a: add backlight regulator support - novatek-nt36672a: Inline panel init sequences - panel-edp: Add quirks for AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8, BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31, BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25 - New panels: Samsung ATNA40HQ08-0, Anbernic TD4310, Chipone ICNA35XX, Ilitek ILI9488 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://patch.msgid.link/20260619-burgundy-termite-of-whirlwind-f7a4dd@houat

dma_buf: change unsigned int and int types into size_t

2026-07-02T07:27:51+00:00

The num_fences, count, i, and j variables in dma_fence_dedup_array() and __dma_fence_unwrap_merge() have inconsistent integer types, mixing both unsigned int and int. Use type size_t consistently for these instead, and update the return type of dma_fence_dedup_array() accordingly. Signed-off-by: Shahyan Soltani Suggested-by: Philipp Stanner Link: https://lore.kernel.org/r/20260630160401.67544-1-shahyan.soltani@amd.com Reviewed-by: Philipp Stanner Reviewed-by: Christian König Signed-off-by: Christian König

dma-buf: rename dma_fence_enable_sw_signaling

2026-07-01T14:52:48+00:00

Dropping the _sw_ part from the names was proposed multiple times now and IIRC people generally agreed with the idea already. The function requests a fence to signal and triggers some sort of HW interaction on most backends. So this is not really software related at all and the callback is already just named enable_signaling as well. Just streamline that and use a consistent name everywhere. Assisted-by: Claude Sonet 4 Signed-off-by: Christian König Reviewed-by: Matthew Brost Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20260624122917.2483-2-christian.koenig@amd.com