summaryrefslogtreecommitdiff
path: root/drivers
AgeCommit message (Collapse)Author
2026-08-12drm/amdgpu: Fix UVD min buffer sizesDavid Rosca
Use correct size for message buffer = sizeof(struct ruvd_msg). Add ITSCALING_TABLE_BUFFER size. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 37519d007e4261febbcf35b3045f8344f3145497) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: Fix UVD decode image min size calculationDavid Rosca
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit b41c8cb12e202b220353332ab87dc01a11f69304) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: Fix UVD dpb min size calculation for H264David Rosca
This should use actual number of references from the decode message, instead of maximum derived from level. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 64b525edb7e7bdfcdc77883c5e413804e2396856) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: Reject UVD message with dimensions above 4096David Rosca
Fixes potential overflow in DPB size calculations. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 05e1387d151f71569fbe122d2c89f9db0c21dc10) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: check ASPM on the dGPU host linkYang Wang
dGPUs with an internal PCIe switch expose graphics functions below the switch downstream port. The automatic ASPM check uses the display endpoint and evaluates the internal link instead of the host link. Use the switch upstream port for the check and report the selected link. Fixes: 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 4e0d6f2876e704fff707b18c40dbd383aea4a1c9) Cc: stable@vger.kernel.org
2026-08-12drm/radeon: fix autosuspend cleanup during teardownGuangshuo Li
radeon_driver_load_kms() calls pm_runtime_use_autosuspend() for PX devices, but radeon_driver_unload_kms() does not call the matching pm_runtime_dont_use_autosuspend() during teardown. If the autosuspend delay is set to a negative value while autosuspend is enabled, the runtime PM core increments usage_count to prevent runtime suspend. Without calling pm_runtime_dont_use_autosuspend() during teardown, this reference is not dropped. The documentation for pm_runtime_use_autosuspend() also notes that it is important to undo it with pm_runtime_dont_use_autosuspend() at driver exit time, unless runtime PM was initially enabled with devm_pm_runtime_enable(). Add the missing pm_runtime_dont_use_autosuspend() call to the driver unload path. This issue was found by manual code inspection. Fixes: 10ebc0bc0934 ("drm/radeon: add runtime PM support (v2)") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 0fdc1ff82ea14844c22795e9e0813c3ca03235e1) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: fix missing check in vm_flush()Alex Deucher
We shouldn't return early if we need to emit spm update. Reviewed-by: David Rosca <david.rosca@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 54a118f1d7e184fcbb18f83889f48f17a767878a) Cc: stable@vger.kernel.org
2026-08-12drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()Samuel Pitoiset
amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached to it. BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu] Call Trace: drm_vblank_enable drm_vblank_get drm_crtc_get_sequence_ioctl drm_ioctl_kernel drm_ioctl Reproduced by running VKCTS with WSI tests enabled on RADV. Guard the enable path on acrtc_state->stream being non-NULL, matching the existing checks in this function. Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel") Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 7b1b31bf6942e6f43509b48da23f8e27269aac39) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: validate GEM_CREATE domain combinationsCandice Li
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit db39852d0c39843cb02048dfb47e4b8c703e9080) Cc: stable@vger.kernel.org
2026-08-12drm/amdgpu: disallow multiple FENCE chunks in one submitJunrui Luo
amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p->uf_bo is a single-slot field, so a submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p->uf_bo with a freshly referenced BO without dropping the reference taken by the first. amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit. Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did for p->bo_list. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> (cherry picked from commit 665b1fc2a1845206408f9a2c6da67101789edb82)
2026-08-12drm/amd/display: make DC_RUN_WITH_PREEMPTION_ENABLED misuse a build errorMikhail Gavrilov
Inside an FPU compilation unit DC_FP_START() and DC_FP_END() are defined as BUILD_BUG(), so using them there fails the build. That was done on purpose by commit a574f53ed52e ("drm/amd/display: Permit DC_FP_START/END only in non-FP compilation units"). DC_RUN_WITH_PREEMPTION_ENABLED() was added later by commit 3539437f354b ("drm/amd/display: Move FPU Guards From DML To DC - Part 1") and defined as a plain pass-through in that same branch instead. A wrap placed inside an FPU compilation unit therefore compiles cleanly, reads as correct during review, and does nothing at all. This is not hypothetical. While chasing a "scheduling while atomic" splat in dc_create_plane_state() on PREEMPT_RT, an attempt to place the guard further up the call chain, in dml21_add_phantom_plane() in dc/dml2_0/dml21/dml21_utils.c, had no effect for exactly this reason: dc/dml2_0/Makefile applies CC_FLAGS_FPU to every object under that directory, and the top level Makefile adds -D_LINUX_FPU_COMPILATION_UNIT to CC_FLAGS_FPU. Define the macro as BUILD_BUG() there as well, so that the mistake is a compile error rather than a guard that silently does nothing. The code argument is kept in the expansion so the BUILD_BUG() failure is not accompanied by set-but-unused diagnostics for variables assigned inside it. No current user is affected. dc/core/dc_stream.c and dc/resource/dcn32/dcn32_resource.c are outside the dml directories, and dc/dml2_0/dml2_wrapper.c and dc/dml2_0/dml21/dml21_wrapper.c are built without the FPU flags because dc/dml2_0/Makefile replaces their CFLAGS with CC_FLAGS_NO_FPU and removes CC_FLAGS_FPU. Link: https://lore.kernel.org/all/1ead313022bc62dce1f42af9f855727eb9074443.camel@web.de/ Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Reviewed-by: Tom Chung <chiahsuan.chung@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: silence uninitialized variable warningsDan Carpenter
Smatch complains that: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu15/smu_v15_0_8_ppt.c:1964 smu_v15_0_8_set_performance_level() error: uninitialized symbol 'ret'. In this line there is an "if (ret)" condition where "ret" is either zero or uninitialized. Initialize "ret" at the start of the function to avoid a potential uninitialized variable bug. But also delete the condition since it is never true. Fixes: 422b399b09c7 ("drm/amd/pm: Add od_edit_dpm_table support") Reviewed-by: Lijo Lazar <lijo.lazar@amd.com> Signed-off-by: Dan Carpenter <error27@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: skip BOs being torn down during GTT recoveryYifan Zhang
A GPU reset can race with BO teardown after the BO's GTT resource has been marked for deletion but before its drm_mm node is removed. In this window, amdgpu_gtt_mgr_recover() can treat the node as a live BO and try to restore its GART mapping while its TT backing is being destroyed. Recolor the GTT node from amdgpu_bo_delete_mem_notify() so that recovery skips it, reusing the existing color for ranges without a BO. The range stays allocated until the resource is freed. This prevents reset recovery from accessing a BO whose backing storage is no longer valid. v2: refine commit message. (David Francis) v3: Remove new BO color. (Christian) Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com> Acked-by: Christian König <christian.koenig@amd.com> Reviewed-by: Perry Yuan <perry.yuan@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Reject UVD message with invalid number of h265 refsDavid Rosca
Same change as for h264, avoids overflow later when calculating min dpb size. Signed-off-by: David Rosca <david.rosca@amd.com> Reviewed-by: Leo Liu <leo.liu@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: keep PRT mappings off the vm_bo state listsJesse Zhang
A PRT/sparse mapping has no backing BO, so its bo_va->base.bo is NULL. amdgpu_vm_bo_base_init() deliberately keeps such a bo_va off the vm_bo state lists, but the tail of amdgpu_vm_bo_update() unconditionally called amdgpu_vm_bo_idle() for the !always_valid case, putting the NULL-bo PRT bo_va onto the individual.idle list. On a GPU reset amdgpu_vm_bo_reset_state_machine() moves individual.idle to individual.needs_update with moved=true, and amdgpu_vm_handle_moved() then dereferences bo_va->base.bo to read its reservation object, crashing on the NULL bo (e.g. the userq eviction restore worker running during a reset while a user queue is torn down): BUG: kernel NULL pointer dereference, address: 0000000000000158 RIP: 0010:amdgpu_vm_handle_moved+0x17a/0x200 [amdgpu] Call Trace: amdgpu_userq_vm_validate_and_restore_queue+0x2ce/0x920 [amdgpu] amdgpu_userq_restore_worker+0xce/0x210 [amdgpu] Skip amdgpu_vm_bo_idle() when bo is NULL so a PRT mapping never lands on a state list in the first place, and refresh the PRT page tables explicitly in the userq restore path (as the CS path already does) so sparse mappings survive a VRAM-lost reset. Because the PRT bo_va is off the state lists, its PTE update fence lands in prt_va->last_pt_update rather than vm->last_update, so wait on it explicitly before restarting the queues (mirroring how the CS path syncs that fence). v2: - keep the PRT bo_va off the vm_bo state lists instead of NULL-guarding bo inside amdgpu_vm_handle_moved(); a PRT mapping should never be on the moved list in the first place (Christian) v3: - the PRT PTEs are updated separately, so their fence is in prt_va->last_pt_update, not vm->last_update; wait on it in the userq restore path before restarting queues, otherwise the queues could restart before the sparse PTEs are written (Christian) Suggested-by: Christian König <christian.koenig@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Jesse Zhang <Jesse.Zhang@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: fix nbif 6.3.1 l1 low power not functionalYang Wang
The PCIe L1 low‑power settings for NBIF 6.3.1 were never applied due to unresolved register mapping, which caused the relevant code to be compiled out. As a result, the PCIe link could not enter L1/L23 power‑down states or transition to L0s. Properly configure the link control register to enable L1 and L23 power‑down, and permit L0s link transitions. Keep LTR disabled and let the PCI core enable it only after verifying end‑to‑end root complex support across switches. Fixes: 894c6d3522d1 ("drm/amdgpu: Add nbif v6_3_1 ip block support") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Signed-off-by: Kenneth Feng <Kenneth.feng@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCENathan Lucas
The commit cited by the Fixes tag added separate limited and full-range BT.2020 YCbCr entries to the DCE output CSC tables, but populated both entries with the same matrix copied from the common DC table. That matrix combined full-range scaling with limited-range luma offset and was incorrect for both limited and full-range output. Replace the coefficients in both entries in the DCE paths with those from the new COLOR_SPACE_YCBCR2020_LIMITED_TYPE and COLOR_SPACE_YCBCR2020_FULL_TYPE entries in the preceding commit ("drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix"). Fixes: 51e6668ab4ba ("drm/amd/display: add missing CSC entries for BT.2020 for DCE IPs") Assisted-by: OpenAI-Codex:GPT-5.6-Sol Tested-by: Igor Paunovic <royalnet026@gmail.com> Tested-by: Satyajit Roy <sroy14@alum.utk.edu> Signed-off-by: Nathan Lucas <nlucasgit@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/display: fix BT.2020 YCbCr limited output CSC matrixNathan Lucas
COLOR_SPACE_YCBCR2020_TYPE, which is selected for COLOR_SPACE_2020_YCBCR_LIMITED color_space, has coefficients that are incorrect for limited-range output. Its luma and chroma scaling is full-range so output is too bright and colors are incorrect. COLOR_SPACE_YCBCR2020_TYPE is closer to a full-range conversion matrix with incorrect luma offset, so correct the luma offset for full-range and rename it to COLOR_SPACE_YCBCR2020_FULL_TYPE. Add COLOR_SPACE_YCBCR2020_LIMITED_TYPE with correct scaling and range for limited-range output. Fix related functions so COLOR_SPACE_YCBCR2020_LIMITED_TYPE and COLOR_SPACE_YCBCR2020_FULL_TYPE are correctly selected based on dc_color_space. Derivation of both matrices follows ITU-T H.273: Table 4, MatrixCoefficients 9, BT.2020-NCL weights: KR = 0.2627, KB = 0.0593, KG = 1 - KR - KB = 0.6780. Equations 45-47 in matrix form: [ KR KG KB 0 ] M2020_NCL = [ -KR/(2(1-KB)) -KG/(2(1-KB)) 1/2 0 ] [ 1/2 -KG/(2(1-KR)) -KB/(2(1-KR)) 0 ] [ 0 0 0 1 ] Limited and Full transforms based on equations 30-32 and 36-38 with bit depth 10, normalized by 1023: [ 876/1023 0 0 64/1023 ] MLimited = [ 0 896/1023 0 512/1023 ] [ 0 0 896/1023 512/1023 ] [ 0 0 0 1 ] [ 1023/1023 0 0 0 ] MFull = [ 0 1023/1023 0 512/1023 ] [ 0 0 1023/1023 512/1023 ] [ 0 0 0 1 ] M2020_NCL_Limited = MLimited x M2020_NCL M2020_NCL_Full = MFull x M2020_NCL The upper three rows of M2020_NCL_* are stored in CR, Y, CB order. Each M2020_NCL_* value is stored as Round(value * 8192) in its 16-bit two's-complement representation. Fixes: 973a9c810c78 ("drm/amd/display: Fix COLOR_SPACE_YCBCR2020_TYPE matrix") Assisted-by: OpenAI-Codex:GPT-5.6-Sol Tested-by: Igor Paunovic <royalnet026@gmail.com> Tested-by: Satyajit Roy <sroy14@alum.utk.edu> Signed-off-by: Nathan Lucas <nlucasgit@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Implement insert_end for VCE 3David Rosca
After a recent change VCE now hangs when VCE_CMD_END is emitted after a pipeline sync without VM flush. Implement insert_end to correctly insert only one VCE_CMD_END per job. Fixes: bc639a9eadc7 ("drm/amdgpu: always emit the job vm fence") Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Fix UVD min buffer sizesDavid Rosca
Use correct size for message buffer = sizeof(struct ruvd_msg). Add ITSCALING_TABLE_BUFFER size. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Fix UVD decode image min size calculationDavid Rosca
This needs to use pitch instead of width. Also reject pitch over 4096 to avoid overflow. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Fix UVD dpb min size calculation for H264David Rosca
This should use actual number of references from the decode message, instead of maximum derived from level. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Reject UVD message with dimensions above 4096David Rosca
Fixes potential overflow in DPB size calculations. Signed-off-by: David Rosca <david.rosca@amd.com> Acked-by: Leo Liu <leo.liu@amd.com> Reviewed-by: Ruijing Dong <ruijing.dong@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: check ASPM on the dGPU host linkYang Wang
dGPUs with an internal PCIe switch expose graphics functions below the switch downstream port. The automatic ASPM check uses the display endpoint and evaluates the internal link instead of the host link. Use the switch upstream port for the check and report the selected link. Fixes: 0ab5d711ec74 ("drm/amd: Refactor `amdgpu_aspm` to be evaluated per device") Signed-off-by: Yang Wang <kevinyang.wang@amd.com> Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com> Reviewed-by: Kenneth Feng <kenneth.feng@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/radeon: fix autosuspend cleanup during teardownGuangshuo Li
radeon_driver_load_kms() calls pm_runtime_use_autosuspend() for PX devices, but radeon_driver_unload_kms() does not call the matching pm_runtime_dont_use_autosuspend() during teardown. If the autosuspend delay is set to a negative value while autosuspend is enabled, the runtime PM core increments usage_count to prevent runtime suspend. Without calling pm_runtime_dont_use_autosuspend() during teardown, this reference is not dropped. The documentation for pm_runtime_use_autosuspend() also notes that it is important to undo it with pm_runtime_dont_use_autosuspend() at driver exit time, unless runtime PM was initially enabled with devm_pm_runtime_enable(). Add the missing pm_runtime_dont_use_autosuspend() call to the driver unload path. This issue was found by manual code inspection. Fixes: 10ebc0bc0934 ("drm/radeon: add runtime PM support (v2)") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: handle GDS and SPM without a VM fenceAlex Deucher
If we end up emitting a VM fence keep GDS and SPM associated with that fence. If not, emit them as part of the IB fence. Reviewed-by: David Rosca <david.rosca@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: fix missing check in vm_flush()Alex Deucher
We shouldn't return early if we need to emit spm update. Reviewed-by: David Rosca <david.rosca@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/display: Relax frame size limit for dcn5/6 DML core funcs filesIvan Lipski
[Why] During compilation with allmodconfig with KASAN, there appears a Werror: dml2_core_dcn5_funcs_mode_programming.c:11:13: error: stack frame size (2400) exceeds limit (2048) in 'dcn5_mode_programming' [-Werror,-Wframe-larger-than] The dcn5/dcn6 dml2_core_*_funcs_mode_{programming,support} files were split out of dml2_core_dcn4_calcs.o, which carries a relaxed -Wframe-larger-than limit via $(frame_warn_flag) (2056 normally, or 4096 for clang + KASAN/KCSAN + COMPILE_TEST). The split-out files were never added to the per-file CFLAGS override list, so they inherited the strict global default of 2048. This is why these files trip the frame size warning under KASAN while the larger dml2_core_dcn4_calcs.o does not. [How] Apply the same $(frame_warn_flag) and CFLAGS_REMOVE handling used for dml2_core_dcn4_calcs.o to the split-out files: - dml2_core_dcn5_funcs_mode_programming.o - dml2_core_dcn5_funcs_mode_support.o - dml2_core_dcn6_funcs_mode_programming.o - dml2_core_dcn6_funcs_mode_support.o Fixes: 7f7d7ea1fa51 ("drm/amd/display: Add new sources for DCN6") Reviewed-by: Dillon Varone <dillon.varone@amd.com> Signed-off-by: Ivan Lipski <ivan.lipski@amd.com> Reported-by: Mark Brown <broonie@kernel.org> Acked-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu/mes11: disable MES RS64 process/gang context loadingPrike Liang
The MES RS64 local memory process/gang context index may be updated, saved, or restored improperly during queue eviction and restore cycles. Enabling RS64 memory for MES process/gang context loading introduces two known issues: 1. Performance regression on userq due to improper context index handling during RS64 memory access. 2. KFDIPCTest.BasicTest failure on Navi31/32/33: the IPC buffer GPU VA mapping is not correctly reflected in the restored RS64 process context, causing GPU page faults on the IPC shared buffer address, which eventually leads to MES firmware becoming unresponsive and requiring a full GPU reset to recover. Temporarily disable MES RS64 process/gang context loading until both issues are resolved. Signed-off-by: Prike Liang <Prike.Liang@amd.com> Reviewed-by: Michael Chen <michael.chen@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/display: Fix NULL pointer dereference in amdgpu_dm_crtc_set_vblank()Samuel Pitoiset
amdgpu_dm_crtc_set_vblank() dereferences acrtc_state->stream when vblank is enabled/queried from DRM_IOCTL_MODE_CRTC_GET_SEQUENCE before a stream is attached to it. BUG: kernel NULL pointer dereference, address: 0000000000000008 RIP: amdgpu_dm_crtc_set_vblank+0x6b/0x4d0 [amdgpu] Call Trace: drm_vblank_enable drm_vblank_get drm_crtc_get_sequence_ioctl drm_ioctl_kernel drm_ioctl Reproduced by running VKCTS with WSI tests enabled on RADV. Guard the enable path on acrtc_state->stream being non-NULL, matching the existing checks in this function. Fixes: 34d66bc7ff10 ("drm/amd/display: Fix Xorg desktop unresponsive on Replay panel") Reviewed-by: Melissa Wen <mwen@igalia.com> Signed-off-by: Samuel Pitoiset <samuel.pitoiset@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: don't disable ttm buffer funcs on resetPierre-Eric Pelloux-Prayer
Access to hw is already suspended so there are no reasons to disable ttm buffer funcs. Signed-off-by: Pierre-Eric Pelloux-Prayer <pierre-eric.pelloux-prayer@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Reviewed-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: validate GEM_CREATE domain combinationsCandice Li
AMDGPU_GEM_CREATE checked domain bits against AMDGPU_GEM_DOMAIN_MASK, but did not validate domain combinations. Userspace could combine CPU|GTT|VRAM with DOORBELL, GDS, GWS, or OA, making amdgpu_bo_placement_from_domain() exceed AMDGPU_BO_MAX_PLACEMENTS and hit BUG_ON(). Allow combinations only within CPU/GTT/VRAM, and require non-CPU/GTT/ VRAM domains to be specified one at a time. Return -EINVAL for invalid combinations in amdgpu_gem_create_ioctl(). v2: Rename helper from amdgpu_gem_domain_valid() to amdgpu_gem_are_domains_valid() (Christian) Signed-off-by: Candice Li <candice.li@amd.com> Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdkfd: preserve VRAM MQD across hibernation via unpin/repinShikang Fan
On gfx9 ASICs with mqd_on_vram(), a compute queue MQD lives in a pinned VRAM buffer object. Pinned BOs are skipped by the VRAM eviction done at S4 suspend, so the MQD contents are lost across hibernation and the first submission after resume page-faults on a stale MQD. Unpin the MQD BO at suspend so the eviction migrates it into the hibernation image, and pin it back to VRAM on resume. The BO may return at a different VRAM address, so refresh the kernel mapping and cached GPU addresses and patch the MQD self-address via a new update_mqd_gpu_addr() mqd_manager op; skip eviction with a warning if that op is not implemented. v3: use unpin/repin instead of shadowing the MQD into a separate buffer. v4: drop the explicit VRAM->GTT placement at evict (a bare unpin is enough for the eviction pass to move the BO out of VRAM), and also repin at queue destroy. KFD queue restore runs late - user processes thaw before it, and under SR-IOV it is deferred until the VF exits full access - so once the VM has resumed an application can destroy a queue before its MQD BO is repinned, which would otherwise unpin an already-unpinned BO and touch a stale q->mqd. v5: drop support for no-HWS mode, and set q->mqd to NULL at eviction. Signed-off-by: Shikang Fan <shikang.fan@amd.com> Reviewed-by: Felix Kuehling <felix.kuehling@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: disallow multiple FENCE chunks in one submitJunrui Luo
amdgpu_cs_pass1() dispatches on chunk_id once per chunk without rejecting repeated ids. p->uf_bo is a single-slot field, so a submission carrying two AMDGPU_CHUNK_ID_FENCE chunks runs amdgpu_cs_p1_user_fence() twice, and the second run overwrites p->uf_bo with a freshly referenced BO without dropping the reference taken by the first. amdgpu_cs_parser_fini() only unrefs the final p->uf_bo, so every FENCE chunk but the last leaks a BO reference. The leaked BO outlives handle close and process exit. Reject duplicate FENCE chunks the same way commit fec5f8e8c6bc ("drm/amdgpu: disallow multiple BO_HANDLES chunks in one submit") did for p->bo_list. Fixes: d38ceaf99ed0 ("drm/amdgpu: add core driver (v4)") Reported-by: Yuhao Jiang <danisjiang@gmail.com> Assisted-by: Claude:claude-opus-5 Cc: stable@vger.kernel.org Reviewed-by: Christian König <christian.koenig@amd.com> Signed-off-by: Junrui Luo <moonafterrain@outlook.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amdgpu: Enable GFXOFF functionality for SMU IP v15.0.5Shubhankar Milind Sardeshpande
Add clockgating and powergating flags for GC 11.5.6 and allow/disallow GFXOFF for SMU 15.0.5 Signed-off-by: Shubhankar Milind Sardeshpande <Shubhankar.MilindSardeshpande@amd.com> Acked-by: Alex Deucher <alexander.deucher@amd.com> Reviewed-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Keep sub-degree precision in Q10 temperaturesLijo Lazar
The Q10 temperatures were rounded to whole degrees before being scaled to millidegrees, losing sub-degree precision. Convert them while preserving the fractional part. Also, use the standard MILLIDEGREE_PER_DEGREE to represent SMU_TEMPERATURE_UNITS_PER_CENTIGRADES. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Keep sub-watt precision in Q10 socket powerLijo Lazar
The Q10 socket power was rounded to whole watts before scaling to milliwatts, so the reported value lost its sub-watt precision. Add SMUQ10_TO_MILLIWATT to convert while keeping the fractional bits. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12drm/amd/pm: Simplify SoC power printing in debugfsLijo Lazar
Convert SoC power directly from milliwatts using MILLIWATT_PER_WATT and remove redundant variables. Signed-off-by: Lijo Lazar <lijo.lazar@amd.com> Reviewed-by: Asad Kamal <asad.kamal@amd.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
2026-08-12backlight: Use sysfs_emit() instead of sprintf()Levente Szajko
Replace sprintf() with sysfs_emit() in the sysfs show callbacks of backlight.c and lcd.c, as recommended by Documentation/filesystems/sysfs.rst. No functional change intended. Signed-off-by: Levente Szajko <raedrimhun@proton.me> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260805135027.43890-1-raedrimhun@proton.me Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: qcom-wled: Remove redundant dev_err()Pan Chuang
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_threaded_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260722065709.346072-1-panchuang@vivo.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: ktd2801: Fix unmet dependency on GPIOLIBJulian Braha
LEDS_EXPRESSWIRE depends on GPIOLIB, so its selector, BACKLIGHT_KTD2801 also needs to ensure GPIOLIB is enabled. Otherwise: WARNING: unmet direct dependencies detected for LEDS_EXPRESSWIRE Depends on [n]: NEW_LEDS [=n] && GPIOLIB [=n] Selected by [y]: - BACKLIGHT_KTD2801 [=y] && HAS_IOMEM [=y] && BACKLIGHT_CLASS_DEVICE [=y] This unmet dependency was found by kconfirm, a static analysis tool for Kconfig. Fixes: d95963e309bc ("backlight: ktd2801: Depend on GPIOLIB") Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Acked-by: Duje Mihanović <duje@dujemihanovic.xyz> Tested-by: Randy Dunlap <rdunlap@infradead.org> Acked-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260719024902.151710-1-julianbraha@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Honor the core blank state in update_status()Junjie Cao
update_status() passes props.brightness straight to the hardware and ignores the power/blank state tracked by the core. Writing 4 to the bl_power sysfs attribute or blanking the framebuffer therefore leaves the backlight lit. Use backlight_get_brightness(), which returns 0 while the device is blanked. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Cc: stable@vger.kernel.org Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-4-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Validate all DT property values consistentlyJunjie Cao
The lookup helpers for dim-mode and ramp-ctl take a shortcut when lookup_tbl is NULL: they accept any u32 value without range-checking and return success unconditionally. Out-of-range values get silently truncated by regmap_update_bits instead of triggering the dev_warn + default-fallback path that the other properties use. Add a field-width check for the NULL-table case so that values exceeding the register field maximum are rejected the same way a table-lookup miss is. The switching frequency table has a second hole: reserved slots use 0 as their marker, so "awinic,sw-freq-hz = <0>" matches slot 0 and programs a reserved encoding. Make the reserved marker U32_MAX and skip such slots during lookup. While here, also switch the error returns to -EINVAL for consistency. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-3-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12backlight: aw99706: Fix DT property names to match bindingJunjie Cao
The driver reads four tuning properties without the unit suffixes that the binding mandates: "awinic,sw-freq" instead of "awinic,sw-freq-hz", "awinic,sw-ilmt" instead of "awinic,sw-ilmt-microamp", "awinic,iled-max" instead of "awinic,iled-max-microamp", and "awinic,uvlo-thres" instead of "awinic,uvlo-thres-microvolt". As a result, device_property_read_u32() never finds these properties in a binding-conformant device tree and silently falls back to the compiled-in defaults for switching frequency, switching current limit, max LED current, and UVLO threshold. Fix by aligning the property name strings in aw99706_dt_props[] with the binding. No value/range changes are needed since both sides already use the same units and enumerations. Fixes: 147b38a5ad06 ("backlight: aw99706: Add support for Awinic AW99706 backlight") Cc: stable@vger.kernel.org Signed-off-by: Junjie Cao <junjie.cao@linux.dev> Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org> Link: https://patch.msgid.link/20260804030255.1934470-2-junjie.cao@intel.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12soundwire: dmi-quirks: Disable ghost Realtek on Asus ROG Zephyrus DuoCharles Keepax
The Asus ROG Zephyrus Duo also has a Realtek device in the ACPI that doesn't exist in the physical hardware. This confuses the machine driver into attempting to create DAI links for the device. Add a quirk to remove this device. Suggested-by: Bard Liao <yung-chuan.liao@linux.intel.com> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260807121425.1952003-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
2026-08-12RDMA/rxe: Fix OOB in free_rd_atomic_resources()Peiyang He
free_rd_atomic_resources() iterates using qp->attr.max_dest_rd_atomic. Updating max_dest_rd_atomic before freeing the old array can make the free path walk past the old allocation and trigger a slab out-of-bounds write catched by KASAN: ================================================================== BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] BUG: KASAN: slab-out-of-bounds in free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] BUG: KASAN: slab-out-of-bounds in rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 Write of size 4 at addr ffff88802b8dddb8 by task syz.3.451/11063 CPU: 0 UID: 0 PID: 11063 Comm: syz.3.451 Not tainted 7.1.0 #2 PREEMPT(full) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x10e/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xf7/0x600 mm/kasan/report.c:482 kasan_report+0xe4/0x120 mm/kasan/report.c:595 free_rd_atomic_resource drivers/infiniband/sw/rxe/rxe_qp.c:180 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:171 [inline] free_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:163 [inline] rxe_qp_from_attr+0x1e88/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:712 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fefc75a70cd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fefc8495018 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fefc7835fa0 RCX: 00007fefc75a70cd RDX: 0000000000000078 RSI: 0000200000000240 RDI: 0000000000000007 RBP: 00007fefc764f10f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fefc7836038 R14: 00007fefc7835fa0 R15: 00007ffcf0586aa0 </TASK> Allocated by task 11063: kasan_save_stack+0x33/0x60 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5296 [inline] __kmalloc_noprof+0x32a/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] alloc_rd_atomic_resources drivers/infiniband/sw/rxe/rxe_qp.c:155 [inline] rxe_qp_from_attr+0x3f8/0x2150 drivers/infiniband/sw/rxe/rxe_qp.c:714 rxe_modify_qp+0x1e2/0x530 drivers/infiniband/sw/rxe/rxe_verbs.c:623 ib_security_modify_qp+0x223/0xfa0 drivers/infiniband/core/security.c:625 _ib_modify_qp+0x333/0xec0 drivers/infiniband/core/verbs.c:1915 modify_qp+0x13ca/0x1940 drivers/infiniband/core/uverbs_cmd.c:1932 ib_uverbs_modify_qp+0xcb/0x120 drivers/infiniband/core/uverbs_cmd.c:1958 ib_uverbs_write+0xb86/0x1030 drivers/infiniband/core/uverbs_main.c:680 vfs_write+0x2aa/0x1070 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802b8ddd80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes to the right of allocated 56-byte region [ffff88802b8ddd80, ffff88802b8dddb8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b8dd flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff888015c418c0 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4651, tgid 4651 ((udev-worker)), ts 123427165316, free_ts 123425874255 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfc/0x120 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 [inline] get_page_from_freelist+0x75b/0x3220 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x27e/0x2b00 mm/page_alloc.c:5221 alloc_slab_page mm/slub.c:3278 [inline] allocate_slab mm/slub.c:3467 [inline] new_slab+0xa6/0x670 mm/slub.c:3525 refill_objects+0x278/0x420 mm/slub.c:7272 refill_sheaf mm/slub.c:2816 [inline] __pcs_replace_empty_main+0x2ed/0x640 mm/slub.c:4652 alloc_from_pcs mm/slub.c:4750 [inline] slab_alloc_node mm/slub.c:4884 [inline] __do_kmalloc_node mm/slub.c:5295 [inline] __kmalloc_noprof+0x68d/0x850 mm/slub.c:5308 kmalloc_noprof include/linux/slab.h:954 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] tomoyo_encode2+0x100/0x3e0 security/tomoyo/realpath.c:45 tomoyo_encode+0x29/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x18c/0x690 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x2ab/0x3c0 security/tomoyo/file.c:776 tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334 security_file_open+0x7a/0x1b0 security/security.c:2739 do_dentry_open+0x57e/0x1690 fs/open.c:924 vfs_open+0x82/0x3f0 fs/open.c:1079 do_open fs/namei.c:4699 [inline] path_openat+0x218a/0x3190 fs/namei.c:4858 page last free pid 1 tgid 1 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0x763/0xfc0 mm/page_alloc.c:2938 selinux_genfs_get_sid security/selinux/hooks.c:1364 [inline] inode_doinit_with_dentry+0x903/0x1320 security/selinux/hooks.c:1563 selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6658 security_d_instantiate+0x123/0x190 security/security.c:3704 d_splice_alias_ops+0x92/0x850 fs/dcache.c:3141 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1289 lookup_open.isra.0+0x659/0x1080 fs/namei.c:4484 open_last_lookups fs/namei.c:4611 [inline] path_openat+0x17dd/0x3190 fs/namei.c:4855 do_file_open+0x20c/0x430 fs/namei.c:4887 do_sys_openat2+0x101/0x1d0 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x141/0x200 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88802b8ddc80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff88802b8ddd00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88802b8ddd80: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ^ ffff88802b8dde00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc ffff88802b8dde80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc Fix the OOB by moving the assignment after free_rd_atomic_resources() so the old array is freed using the old bound. This matches the original ordering in commit 8700e3e7c485 ("Soft RoCE driver"). Closes: https://lore.kernel.org/all/365C68B4923F8214+30195a67-0b90-4b92-ab96-2ce41517793c@smail.nju.edu.cn/ Fixes: b6bbee0d2438 ("IB/rxe: Properly honor max IRD value for rd/atomic.") Cc: stable@vger.kernel.org Signed-off-by: Peiyang He <peiyang_he@smail.nju.edu.cn> Reviewed-by: Zhu Yanjun <yanjun.zhu@linux.dev> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-08-12leds: is31fl319x: Modernize registrationAndreas Kemnade
Use _ext version to have properties parsed to avoid needing to parse them in the driver itself. More modern properties are recognized and the LEDs can be referenced via phandle. Due to the maximum current mechanics, LEDs are not registered right in the first iteration over the nodes. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260806-led-modern-v4-1-eed715baab2e@kemnade.info Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12mfd: cs42l43: Fix regmap defaults orderingCharles Keepax
The regmap defaults should be ordered as binary search is done on the array. A few registers were added in the wrong places, move these to be in register address order. Fixes: a6fe20d67dc7 ("mfd: cs42l43: Add support for the B variant") Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805120109.4024451-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-12ASoC: es8316: Add regulator supportMark Brown
Hongyang Zhao <hongyang.zhao@thundersoft.com> says: Add regulator support for the four ES8316 power domains so board descriptions can model and control the codec supplies. The binding patch documents AVDD, CPVDD, DVDD and PVDD as optional supplies for ES8316, preserving compatibility with existing device-tree descriptions. The driver patch enables the supplies before initializing the regmap and keeps them enabled for the lifetime of the I2C device. The missing supply model was identified while reviewing the RubikPi 3 audio support: https://lore.kernel.org/linux-arm-msm/c293d9c7-bdb7-4303-80c8-404228c434d7@oss.qualcomm.com/ Link: https://patch.msgid.link/20260812-es8316-regulator-next-20260722-v2-0-e7078bc9bc9c@thundersoft.com
2026-08-12pmdomain: Merge branch fixes into nextUlf Hansson
Merge the pmdomain fixes for v7.2-rc[n] into the next branch, to allow them to get tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulfh@kernel.org>