kernel/linux.git/drivers/gpu/drm/display, branch v6.19.11

drm/display/dp_mst: Add protection against 0 vcpi

2026-02-26T23:00:57+00:00

[ Upstream commit 342ccffd9f77fc29fe1c05fd145e4d842bd2feaa ] When releasing a timeslot there is a slight chance we may end up with the wrong payload mask due to overflow if the delayed_destroy_work ends up coming into play after a DP 2.1 monitor gets disconnected which causes vcpi to become 0 then we try to make the payload = ~BIT(vcpi - 1) which is a negative shift. VCPI id should never really be 0 hence skip changing the payload mask if VCPI is 0. Otherwise it leads to <7> [515.287237] xe 0000:03:00.0: [drm:drm_dp_mst_get_port_malloc [drm_display_helper]] port ffff888126ce9000 (3) <4> [515.287267] -----------[ cut here ]----------- <3> [515.287268] UBSAN: shift-out-of-bounds in ../drivers/gpu/drm/display/drm_dp_mst_topology.c:4575:36 <3> [515.287271] shift exponent -1 is negative <4> [515.287275] CPU: 7 UID: 0 PID: 3108 Comm: kworker/u64:33 Tainted: G S U 6.17.0-rc6-lgci-xe-xe-3795-3e79699fa1b216e92+ #1 PREEMPT(voluntary) <4> [515.287279] Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER <4> [515.287279] Hardware name: ASUS System Product Name/PRIME Z790-P WIFI, BIOS 1645 03/15/2024 <4> [515.287281] Workqueue: drm_dp_mst_wq drm_dp_delayed_destroy_work [drm_display_helper] <4> [515.287303] Call Trace: <4> [515.287304] <4> [515.287306] dump_stack_lvl+0xc1/0xf0 <4> [515.287313] dump_stack+0x10/0x20 <4> [515.287316] __ubsan_handle_shift_out_of_bounds+0x133/0x2e0 <4> [515.287324] ? drm_atomic_get_private_obj_state+0x186/0x1d0 <4> [515.287333] drm_dp_atomic_release_time_slots.cold+0x17/0x3d [drm_display_helper] <4> [515.287355] mst_connector_atomic_check+0x159/0x180 [xe] <4> [515.287546] drm_atomic_helper_check_modeset+0x4d9/0xfa0 <4> [515.287550] ? __ww_mutex_lock.constprop.0+0x6f/0x1a60 <4> [515.287562] intel_atomic_check+0x119/0x2b80 [xe] <4> [515.287740] ? find_held_lock+0x31/0x90 <4> [515.287747] ? lock_release+0xce/0x2a0 <4> [515.287754] drm_atomic_check_only+0x6a2/0xb40 <4> [515.287758] ? drm_atomic_add_affected_connectors+0x12b/0x140 <4> [515.287765] drm_atomic_commit+0x6e/0xf0 <4> [515.287766] ? _pfx__drm_printfn_info+0x10/0x10 <4> [515.287774] drm_client_modeset_commit_atomic+0x25c/0x2b0 <4> [515.287794] drm_client_modeset_commit_locked+0x60/0x1b0 <4> [515.287795] ? mutex_lock_nested+0x1b/0x30 <4> [515.287801] drm_client_modeset_commit+0x26/0x50 <4> [515.287804] __drm_fb_helper_restore_fbdev_mode_unlocked+0xdc/0x110 <4> [515.287810] drm_fb_helper_hotplug_event+0x120/0x140 <4> [515.287814] drm_fbdev_client_hotplug+0x28/0xd0 <4> [515.287819] drm_client_hotplug+0x6c/0xf0 <4> [515.287824] drm_client_dev_hotplug+0x9e/0xd0 <4> [515.287829] drm_kms_helper_hotplug_event+0x1a/0x30 <4> [515.287834] drm_dp_delayed_destroy_work+0x3df/0x410 [drm_display_helper] <4> [515.287861] process_one_work+0x22b/0x6f0 <4> [515.287874] worker_thread+0x1e8/0x3d0 <4> [515.287879] ? __pfx_worker_thread+0x10/0x10 <4> [515.287882] kthread+0x11c/0x250 <4> [515.287886] ? __pfx_kthread+0x10/0x10 <4> [515.287890] ret_from_fork+0x2d7/0x310 <4> [515.287894] ? __pfx_kthread+0x10/0x10 <4> [515.287897] ret_from_fork_asm+0x1a/0x30 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6303 Signed-off-by: Suraj Kandpal Reviewed-by: Imre Deak Reviewed-by: Lyude Paul Link: https://patch.msgid.link/20251119094650.799135-1-suraj.kandpal@intel.com Stable-dep-of: e05b08d7d016 ("drm/atomic: convert drm_atomic_get_{old, new}_colorop_state() into proper functions") Signed-off-by: Sasha Levin

Merge tag 'drm-misc-next-2025-11-05-1' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next

2025-11-07T02:41:26+00:00

drm-misc-next for v6.19-rc1: UAPI Changes: - Add userptr support to ivpu. - Add IOCTL's for resource and telemetry data in amdxdna. Core Changes: - Improve some atomic state checking handling. - drm/client updates. - Use forward declarations instead of including drm_print.h - RUse allocation flags in ttm_pool/device_init and allow specifying max useful pool size and propagate ENOSPC. - Updates and fixes to scheduler and bridge code. - Add support for quirking DisplayID checksum errors. Driver Changes: - Assorted cleanups and fixes in rcar-du, accel/ivpu, panel/nv3052cf, sti, imxm, accel/qaic, accel/amdxdna, imagination, tidss, sti, panthor, vkms. - Add Samsung S6E3FC2X01 DDIC/AMS641RW, Synaptics TDDI series DSI, TL121BVMS07-00 (IL79900A) panels. - Add mali MediaTek MT8196 SoC gpu support. - Add etnaviv GC8000 Nano Ultra VIP r6205 support. - Document powervr ge7800 support in the devicetree. Signed-off-by: Dave Airlie From: Maarten Lankhorst Link: https://patch.msgid.link/5afae707-c9aa-4a47-b726-5e1f1aa7a106@linux.intel.com

Merge tag 'drm-intel-next-2025-11-04' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next

2025-11-06T23:47:56+00:00

drm/i915 feature pull for v6.19: Features and functionality: - Enable LNL+ content adaptive sharpness filter (CASF) (Nemesa) - Use optimized VRR guardband (Ankit, Ville) - Enable Xe3p LT PHY (Suraj) - Enable FBC support for Xe3p_LPD display (Sai Teja, Vinod) - Specify DMC firmware for display version 30.02 (Dnyaneshwar) - Report reason for disabling PSR to debugfs (Michał) - Extend i915_display_info with Type-C port details (Khaled) - Log DSI send packet sequence errors and contents Refactoring and cleanups: - Refactoring to prepare for VRR guardband optimization (Ankit) - Abstract VRR live status wait (Ankit) - Refactor VRR and DSB timing to handle Set Context Latency explicitly (Ankit) - Helpers for prefill latency calculations (Ville) - Refactor SKL+ watermark latency setup (Ville) - VRR refactoring and cleanups (Ville) - SKL+ universal plane cleanups (Ville) - Decouple CDCLK from state->modeset refactor (Ville) - Refactor VLV/CHV clock functions (Jani) - Refactor fbdev handling (Jani) - Call i915 and xe runtime PM from display via function pointers (Jouni) - IRQ code refactoring (Jani) - Drop display dependency on i915 feature check macros (Jani) - Refactor and unify i915 and xe stolen memory interfaces towards display (Jani) - Switch to driver agnostic drm to display pointer chase (Jani) - Use display version over graphics version in display code (Matt A) - GVT cleanups (Jonathan, Andi) - Rename a VLV clock function to unify (Michał) - Explicitly sanitize DMC package header num entries (Luca) - Remove redundant port clock check from ALPM (Jouni) - Use sysfs_emit() instead of sprintf() in PMU sysfs (Madhur Kumar) - Clean up C20 PHY PLL register macros (Imre, Mika)) - Abstract "address in MMIO table" helper for general use (Matt A) - Improve VRR platform abstractions (Ville) - Move towards more standard PCI PM code usage (Ville) - Framebuffer refactoring (Ville) - Drop display dependency on i915_utils.h (Jani) - Include cleanups (Jani) Fixes: - Workaround docking station DSC issues with high pixel clock and bpp (Imre) - Fix Panel Replay in DSC mode (Imre) - Disable tracepoints for PREEMPT_RT as a workaround (Maarten) - Fix intel_crtc_get_vblank_counter() on PREEMPT_RT (Maarten) - Fix C10 PHY identification on PTL/WCL (Dnyaneshwar) - Take AS SDP into account with optimized guardband (Jouni) - Fix panic structure allocation memory leak (Jani) - Adjust an FBC workaround platforms (Vinod) - Add fallback for CDCLK selection (Naladala) - Avoid using invalid transcoder in MST transport select (Suraj) - Don't use cursor size reduction on display version 14+ (Nemesa) - Fix C20 PHY PLL register programming (Imre, Mika) - Fix PSR frontbuffer flush handling (Jouni) - Store ALPM parameters in crtc state (Jouni) - Defeature DRRS on LNL+ (Ville) - Fix the scope of the large DRAM DIMM workaround (Ville) - Fix PICA vs. AUX power ordering issue (Gustavo) - Fix pixel rate for computing watermark line time (Ville) - Fix framebuffer set_tiling vs. addfb race (Ville) - DMC event handler fixes (Ville) DRM Core: - CRTC sharpness strength property (Nemesa) - DPCD DSC quirk for Synaptics Panamera devices (Imre) - Helpers to query the branch DSC max throughput/line-width (Imre) Merges: - Backmerge drm-next for v6.18-rc and to sync with drm-xe-next (Jani) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://patch.msgid.link/ec5a05f2df6d597a62033ee2d57225cce707b320@intel.com

drm/display: bridge_connector: get/put the panel_bridge

2025-11-03T11:17:54+00:00

The panel_bridge pointer is taken inside the loop and used after the loop. Being a local variable, use a cleanup action to ensure it is put on return. Based on the code structure the panel_bridge pointer might be assigned during multiple loop iterations. Even though this is probably not possible in the practice, ensure there is no reference leak by putting the reference to the old value before overwriting with the new value. Reviewed-by: Louis Chauvet Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # db410c Tested-by: Geert Uytterhoeven Tested-by: Nicolas Frattaroli Tested-by: Tommaso Merciai Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20251017-drm-bridge-alloc-getput-bridge-connector-fix-hdmi_cec-v2-3-667abf6d47c0@bootlin.com Signed-off-by: Luca Ceresoli

drm/display: bridge_connector: get/put the stored bridges

2025-11-03T11:17:54+00:00

drm_bridge_connector_init() takes eight pointers to various bridges, some of which can be identical, and stores them in pointers inside struct drm_bridge_connector. Get a reference to each of the taken bridges and put it on cleanup. Achieve this by adding a drmm cleanup callback whic puts all the non-NULL bridges. Using drmm ensures the cleanup happens on drm_device teardown, whichever is the return value of this function. Four of these pointers (edid, hpd, detect and modes) can be written multiple times (up to once per loop iterations), in order to eventually store the last matching bridge. So when one of those pointers is overwritten, we need to put the reference that we got during the previous assignment. Add a drm_bridge_put() before writing them to handle this. Reviewed-by: Louis Chauvet Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # db410c Tested-by: Geert Uytterhoeven Tested-by: Nicolas Frattaroli Tested-by: Tommaso Merciai Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20251017-drm-bridge-alloc-getput-bridge-connector-fix-hdmi_cec-v2-2-667abf6d47c0@bootlin.com Signed-off-by: Luca Ceresoli

Revert "drm/display: bridge_connector: get/put the stored bridges"

2025-11-03T11:17:54+00:00

This reverts commit 2be300f9a0b6f6b0ae2a90be97e558ec0535be54. The commit being reverted moved all the bridge_connector->bridge_* assignments to just before the final successful return in order to handle the bridge refcounting in a clean way. This introduced a bug, because a bit before the successful return drmm_connector_hdmi_cec_register() is called, which calls funcs->init() which is drm_bridge_connector_hdmi_cec_init() which needs bridge_connector->bridge_hdmi_cec to be set. The reported bug may be fixed in a relatively simple way, but other similar patterns are potentially present, so just revert the offending commit. A different approach will be implemented. Fixes: 2be300f9a0b6 ("drm/display: bridge_connector: get/put the stored bridges") Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/336fbfdd-c424-490e-b5d1-8ee84043dc80@samsung.com/ Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/r/CA+G9fYuKHp3QgPKjgFY3TfkDdh5Vf=Ae5pCW+eU41Bu=D7th2g@mail.gmail.com Reviewed-by: Louis Chauvet Reviewed-by: Dmitry Baryshkov Tested-by: Dmitry Baryshkov # db410c Tested-by: Geert Uytterhoeven Tested-by: Nicolas Frattaroli Tested-by: Tommaso Merciai Tested-by: Marek Szyprowski Link: https://patch.msgid.link/20251017-drm-bridge-alloc-getput-bridge-connector-fix-hdmi_cec-v2-1-667abf6d47c0@bootlin.com Signed-off-by: Luca Ceresoli

Merge drm/drm-next into drm-intel-next

2025-10-14T07:37:11+00:00

Sync to v6.18-rc1. Signed-off-by: Jani Nikula

Merge drm/drm-next into drm-misc-next

2025-10-13T07:19:19+00:00

Updating drm-misc-next to the state of v6.18-rc1. Signed-off-by: Thomas Zimmermann

drm/display: bridge_connector: get/put the stored bridges

2025-10-03T06:48:43+00:00

drm_bridge_connector_init() takes eight pointers to various bridges, some of which can be identical, and stores them in pointers inside struct drm_bridge_connector. Get a reference to each of the taken bridges and put it on cleanup. This is tricky because the pointers are currently stored directly in the drm_bridge_connector in the loop, but there is no nice and clean way to put those pointers on error return paths. To overcome this, store all pointers in temporary local variables with a cleanup action, and only on success copy them into struct drm_bridge_connector (getting another ref while copying). Additionally four of these pointers (edid, hpd, detect and modes) can be written in multiple loop iterations, in order to eventually store the last matching bridge. However, when one of those pointers is overwritten, we need to put the reference that we got during the previous assignment. Add a drm_bridge_put() before writing them to handle this. Finally, there is also a function-local panel_bridge pointer taken inside the loop and used after the loop. Use a cleanup action as well to ensure it is put on return. Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250926-drm-bridge-alloc-getput-bridge-connector-v2-1-138b4bb70576@bootlin.com Signed-off-by: Luca Ceresoli

Merge tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media

2025-10-02T20:13:26+00:00

Pull media updates from Mauro Carvalho Chehab: - Added a new V4L2 clock helper - New camera sensor drivers - iris: Enable H.264/H.265 encoder support and fixes in iris driver common code - camss: add support for new SoC flavors - venus: add new SoC support - tc358743: support more infoframe types - Various fixes, driver improvements and cleanups * tag 'media/v6.18-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (439 commits) media: venus: pm_helpers: add fallback for the opp-table media: qcom: camss: vfe: Fix BPL alignment for QCM2290 media: tuner: xc5000: Fix use-after-free in xc5000_release media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove media: vsp1: Export missing vsp1_isp_free_buffer symbol media: renesas: vsp1: Convert to SYSTEM_SLEEP/RUNTIME_PM_OPS() media: renesas: ceu: Convert to RUNTIME_PM_OPS() media: renesas: fdp1: Convert to RUNTIME_PM_OPS() media: renesas: rcar-vin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: renesas: rcar_drif: Convert to DEFINE_SIMPLE_DEV_PM_OPS() media: uvcvideo: Mark invalid entities with id UVC_INVALID_ENTITY_ID media: uvcvideo: Support UVC_CROSXU_CONTROL_IQ_PROFILE media: uvcvideo: Run uvc_ctrl_init_ctrl for all controls media: uvcvideo: Shorten the transfer size non compliance message media: uvcvideo: Do not re-reference dev->udev media: uvcvideo: Use intf instead of udev for printks media: uvcvideo: Move video_device under video_queue media: uvcvideo: Drop stream->mutex media: uvcvideo: Move MSXU_CONTROL_METADATA definition to header ...