From 3f26bb732cc136ab20176697c92f32c9c84cb125 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Sun, 7 Jun 2026 09:03:03 +0000 Subject: [PATCH 1/9] drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait() dma_fence_unwrap_for_each() internally calls dma_fence_unwrap_first() which does cursor->chain = dma_fence_get(head), taking an extra reference. On normal loop completion, dma_fence_unwrap_next() releases this via dma_fence_chain_walk() -> dma_fence_put(). When virtio_gpu_do_fence_wait() fails and the function returns early from inside the loop, the cursor->chain reference is never released. This is the only caller in the entire kernel that does an early return inside dma_fence_unwrap_for_each. Add dma_fence_put(itr.chain) before the early return. Cc: stable@vger.kernel.org Fixes: eba57fb5498f ("drm/virtio: Wait for each dma-fence of in-fence array individually") Signed-off-by: Wentao Liang Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://patch.msgid.link/20260607090303.92423-1-vulab@iscas.ac.cn --- drivers/gpu/drm/virtio/virtgpu_submit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_submit.c b/drivers/gpu/drm/virtio/virtgpu_submit.c index dae761fa5788..32cb1e4aa425 100644 --- a/drivers/gpu/drm/virtio/virtgpu_submit.c +++ b/drivers/gpu/drm/virtio/virtgpu_submit.c @@ -65,8 +65,10 @@ static int virtio_gpu_dma_fence_wait(struct virtio_gpu_submit *submit, dma_fence_unwrap_for_each(f, &itr, fence) { err = virtio_gpu_do_fence_wait(submit, f); - if (err) + if (err) { + dma_fence_put(itr.chain); return err; + } } return 0; From d9faef564438d1e4579c692c046603e7ada7bdf4 Mon Sep 17 00:00:00 2001 From: Andrzej Kacprowski Date: Mon, 1 Jun 2026 18:16:43 +0200 Subject: [PATCH 2/9] accel/ivpu: Fix signed integer truncation in IPC receive Fix potential buffer overflow where firmware-supplied data_size is cast to signed int before being used in min_t(). Large unsigned values (>= 0x80000000) become negative, causing unsigned wraparound and oversized memcpy operations that can overflow the stack buffer. Change min_t(int, ...) to min() as both values are unsigned and can be handled by min() without explicit cast. Fixes: 3b434a3445ff ("accel/ivpu: Use threaded IRQ to handle JOB done messages") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Andrzej Kacprowski Reviewed-by: Karol Wachowski Signed-off-by: Karol Wachowski Link: https://patch.msgid.link/20260601161643.229342-1-andrzej.kacprowski@linux.intel.com --- drivers/accel/ivpu/ivpu_ipc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/accel/ivpu/ivpu_ipc.c b/drivers/accel/ivpu/ivpu_ipc.c index f47df092bb0d..9347f05a2b79 100644 --- a/drivers/accel/ivpu/ivpu_ipc.c +++ b/drivers/accel/ivpu/ivpu_ipc.c @@ -276,7 +276,7 @@ int ivpu_ipc_receive(struct ivpu_device *vdev, struct ivpu_ipc_consumer *cons, if (ipc_buf) memcpy(ipc_buf, rx_msg->ipc_hdr, sizeof(*ipc_buf)); if (rx_msg->jsm_msg) { - u32 size = min_t(int, rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); + u32 size = min(rx_msg->ipc_hdr->data_size, sizeof(*jsm_msg)); if (rx_msg->jsm_msg->result != VPU_JSM_STATUS_SUCCESS) { ivpu_err(vdev, "IPC resp result error: %d\n", rx_msg->jsm_msg->result); From f329e8325e054bd6d84d10904f8dd51137281b92 Mon Sep 17 00:00:00 2001 From: Dmitry Osipenko Date: Thu, 4 Jun 2026 15:27:43 +0300 Subject: [PATCH 3/9] drm/virtio: Fix driver removal with disabled KMS DRM atomic and modesetting aren't initialized if virtio-gpu driver built with disabled KMS, leading to access of uninitialized data on driver removal/unbinding and crashing kernel. Fix it by skipping shutting down atomic core with unavailable KMS. Fixes: 72122c69d717 ("drm/virtio: Add option to disable KMS support") Signed-off-by: Dmitry Osipenko Tested-by: Ryosuke Yasuoka Reviewed-by: Ryosuke Yasuoka Link: https://patch.msgid.link/20260604122743.13383-1-dmitry.osipenko@collabora.com --- drivers/gpu/drm/virtio/virtgpu_drv.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c index a5ce96fb8a1d..9af740bda835 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -124,7 +124,10 @@ static void virtio_gpu_remove(struct virtio_device *vdev) struct drm_device *dev = vdev->priv; drm_dev_unplug(dev); - drm_atomic_helper_shutdown(dev); + + if (drm_core_check_feature(dev, DRIVER_ATOMIC)) + drm_atomic_helper_shutdown(dev); + virtio_gpu_deinit(dev); drm_dev_put(dev); } From 5d563a5da8717629ae72f9eadf1e0e340bd1658b Mon Sep 17 00:00:00 2001 From: "Alexander A. Klimov" Date: Sat, 6 Jun 2026 14:38:10 +0200 Subject: [PATCH 4/9] drm/vc4: fix krealloc() memory leak MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Don't just overwrite the original pointer passed to krealloc() with its return value without checking latter: MEM = krealloc(MEM, SZ, GFP); If krealloc() returns NULL, that erases the pointer to the still allocated memory, hence leaks this memory. Instead, use a temporary variable, check it's not NULL and only then assign it to the original pointer: TMP = krealloc(MEM, SZ, GFP); if (!TMP) return; MEM = TMP; While on it, use krealloc_array(). Fixes: 6d45c81d229d ("drm/vc4: Add support for branching in shader validation.") Signed-off-by: Alexander A. Klimov Signed-off-by: Maíra Canal Link: https://patch.msgid.link/20260606123817.37222-1-grandmaster@al2klimov.de --- drivers/gpu/drm/vc4/vc4_validate_shaders.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c index d48cf76983c0..66502a6a4a8e 100644 --- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c +++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c @@ -290,15 +290,16 @@ static bool require_uniform_address_uniform(struct vc4_validated_shader_info *va { uint32_t o = validated_shader->num_uniform_addr_offsets; uint32_t num_uniforms = validated_shader->uniforms_size / 4; + u32 *offsets; - validated_shader->uniform_addr_offsets = - krealloc(validated_shader->uniform_addr_offsets, - (o + 1) * - sizeof(*validated_shader->uniform_addr_offsets), - GFP_KERNEL); - if (!validated_shader->uniform_addr_offsets) + offsets = krealloc_array(validated_shader->uniform_addr_offsets, + o + 1, + sizeof(*validated_shader->uniform_addr_offsets), + GFP_KERNEL); + if (!offsets) return false; + validated_shader->uniform_addr_offsets = offsets; validated_shader->uniform_addr_offsets[o] = num_uniforms; validated_shader->num_uniform_addr_offsets++; From e480228cf65583040c894bb9cc02e1d5b328cee0 Mon Sep 17 00:00:00 2001 From: Alex Hung Date: Tue, 9 Jun 2026 12:20:18 +0200 Subject: [PATCH 5/9] drm/colorop: Remove read-only comments from interpolation fields The lut1d_interpolation and lut3d_interpolation fields and their associated properties were marked as read-only, but userspace can set them via drm_atomic_colorop_set_property(). Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Signed-off-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-2-mwen@igalia.com --- include/drm/drm_colorop.h | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h index bd082854ca74..61cc8206b4c4 100644 --- a/include/drm/drm_colorop.h +++ b/include/drm/drm_colorop.h @@ -309,7 +309,6 @@ struct drm_colorop { /** * @lut1d_interpolation: * - * Read-only * Interpolation for DRM_COLOROP_1D_LUT */ enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; @@ -317,7 +316,6 @@ struct drm_colorop { /** * @lut3d_interpolation: * - * Read-only * Interpolation for DRM_COLOROP_3D_LUT */ enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; @@ -325,7 +323,7 @@ struct drm_colorop { /** * @lut1d_interpolation_property: * - * Read-only property for DRM_COLOROP_1D_LUT interpolation + * Property for DRM_COLOROP_1D_LUT interpolation */ struct drm_property *lut1d_interpolation_property; @@ -353,7 +351,7 @@ struct drm_colorop { /** * @lut3d_interpolation_property: * - * Read-only property for DRM_COLOROP_3D_LUT interpolation + * Property for DRM_COLOROP_3D_LUT interpolation */ struct drm_property *lut3d_interpolation_property; From 94ff735296d371045fce163451a3d65e44ac4729 Mon Sep 17 00:00:00 2001 From: Melissa Wen Date: Tue, 9 Jun 2026 12:20:19 +0200 Subject: [PATCH 6/9] drm/colorop: make lut(1/3)d_interpolation props correctly behave as mutable As interpolation props are actually mutable props, any changes should be handled by drm_colorop_state. Move their enum and make it correctly behaves as mutable. Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-3-mwen@igalia.com --- drivers/gpu/drm/drm_atomic.c | 4 ++-- drivers/gpu/drm/drm_atomic_uapi.c | 8 ++++---- drivers/gpu/drm/drm_colorop.c | 16 ++++++++++++++-- include/drm/drm_colorop.h | 28 ++++++++++++++-------------- 4 files changed, 34 insertions(+), 22 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c index 41c57063f3b4..0eb52d1d5af2 100644 --- a/drivers/gpu/drm/drm_atomic.c +++ b/drivers/gpu/drm/drm_atomic.c @@ -830,7 +830,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p, case DRM_COLOROP_1D_LUT: drm_printf(p, "\tsize=%d\n", colorop->size); drm_printf(p, "\tinterpolation=%s\n", - drm_get_colorop_lut1d_interpolation_name(colorop->lut1d_interpolation)); + drm_get_colorop_lut1d_interpolation_name(state->lut1d_interpolation)); drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0); break; case DRM_COLOROP_CTM_3X4: @@ -842,7 +842,7 @@ static void drm_atomic_colorop_print_state(struct drm_printer *p, case DRM_COLOROP_3D_LUT: drm_printf(p, "\tsize=%d\n", colorop->size); drm_printf(p, "\tinterpolation=%s\n", - drm_get_colorop_lut3d_interpolation_name(colorop->lut3d_interpolation)); + drm_get_colorop_lut3d_interpolation_name(state->lut3d_interpolation)); drm_printf(p, "\tdata blob id=%d\n", state->data ? state->data->base.id : 0); break; default: diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c index 5bd5bf6661df..b81dbba4d8c3 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -751,13 +751,13 @@ static int drm_atomic_colorop_set_property(struct drm_colorop *colorop, if (property == colorop->bypass_property) { state->bypass = val; } else if (property == colorop->lut1d_interpolation_property) { - colorop->lut1d_interpolation = val; + state->lut1d_interpolation = val; } else if (property == colorop->curve_1d_type_property) { state->curve_1d_type = val; } else if (property == colorop->multiplier_property) { state->multiplier = val; } else if (property == colorop->lut3d_interpolation_property) { - colorop->lut3d_interpolation = val; + state->lut3d_interpolation = val; } else if (property == colorop->data_property) { return drm_atomic_color_set_data_property(colorop, state, property, val); @@ -782,7 +782,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop, else if (property == colorop->bypass_property) *val = state->bypass; else if (property == colorop->lut1d_interpolation_property) - *val = colorop->lut1d_interpolation; + *val = state->lut1d_interpolation; else if (property == colorop->curve_1d_type_property) *val = state->curve_1d_type; else if (property == colorop->multiplier_property) @@ -790,7 +790,7 @@ drm_atomic_colorop_get_property(struct drm_colorop *colorop, else if (property == colorop->size_property) *val = colorop->size; else if (property == colorop->lut3d_interpolation_property) - *val = colorop->lut3d_interpolation; + *val = state->lut3d_interpolation; else if (property == colorop->data_property) *val = (state->data) ? state->data->base.id : 0; else diff --git a/drivers/gpu/drm/drm_colorop.c b/drivers/gpu/drm/drm_colorop.c index 566816e3c6f0..509678e5371f 100644 --- a/drivers/gpu/drm/drm_colorop.c +++ b/drivers/gpu/drm/drm_colorop.c @@ -342,7 +342,6 @@ int drm_plane_colorop_curve_1d_lut_init(struct drm_device *dev, struct drm_color colorop->lut1d_interpolation_property = prop; drm_object_attach_property(&colorop->base, prop, interpolation); - colorop->lut1d_interpolation = interpolation; /* data */ ret = drm_colorop_create_data_prop(dev, colorop); @@ -442,7 +441,6 @@ int drm_plane_colorop_3dlut_init(struct drm_device *dev, struct drm_colorop *col colorop->lut3d_interpolation_property = prop; drm_object_attach_property(&colorop->base, prop, interpolation); - colorop->lut3d_interpolation = interpolation; /* data */ ret = drm_colorop_create_data_prop(dev, colorop); @@ -521,6 +519,20 @@ static void __drm_colorop_state_reset(struct drm_colorop_state *colorop_state, &val); colorop_state->curve_1d_type = val; } + + if (colorop->lut1d_interpolation_property) { + if (!drm_object_property_get_default_value(&colorop->base, + colorop->lut1d_interpolation_property, + &val)) + colorop_state->lut1d_interpolation = val; + } + + if (colorop->lut3d_interpolation_property) { + if (!drm_object_property_get_default_value(&colorop->base, + colorop->lut3d_interpolation_property, + &val)) + colorop_state->lut3d_interpolation = val; + } } /** diff --git a/include/drm/drm_colorop.h b/include/drm/drm_colorop.h index 61cc8206b4c4..d5b45339333f 100644 --- a/include/drm/drm_colorop.h +++ b/include/drm/drm_colorop.h @@ -183,6 +183,20 @@ struct drm_colorop_state { */ struct drm_property_blob *data; + /** + * @lut1d_interpolation: + * + * Interpolation for DRM_COLOROP_1D_LUT + */ + enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; + + /** + * @lut3d_interpolation: + * + * Interpolation for DRM_COLOROP_3D_LUT + */ + enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; + /** @state: backpointer to global drm_atomic_state */ struct drm_atomic_state *state; }; @@ -306,20 +320,6 @@ struct drm_colorop { */ uint32_t size; - /** - * @lut1d_interpolation: - * - * Interpolation for DRM_COLOROP_1D_LUT - */ - enum drm_colorop_lut1d_interpolation_type lut1d_interpolation; - - /** - * @lut3d_interpolation: - * - * Interpolation for DRM_COLOROP_3D_LUT - */ - enum drm_colorop_lut3d_interpolation_type lut3d_interpolation; - /** * @lut1d_interpolation_property: * From 2e235e2a2784b12b735321e5b42240ca51c49b0f Mon Sep 17 00:00:00 2001 From: Melissa Wen Date: Tue, 9 Jun 2026 12:20:20 +0200 Subject: [PATCH 7/9] drm/atomic: track individual colorop updates As we do for CRTC color mgmt properties, use color_mgmt_changed flag to track any value changes in the color pipeline of a given plane, so that drivers can update color blocks as soon as plane color pipeline or individual colorop values change. Since we're here, only announce and track changes to plane COLOR_PIPELINE prop if its value is actually changing. Fixes: 8c5ea1745f4c ("drm/colorop: Add BYPASS property") Fixes: 7fa3ee8c0a79 ("drm/colorop: Define LUT_1D interpolation") Fixes: 41651f9d42eb ("drm/colorop: Add 1D Curve subtype") Fixes: 3410108037d5 ("drm/colorop: Add multiplier type") Fixes: db971856bbe0 ("drm/colorop: Add 3D LUT support to color pipeline") Fixes: e5719e7f1900 ("drm/colorop: Add 3x4 CTM type") Fixes: 99a4e4f08abe ("drm/colorop: Add 1D Curve Custom LUT type") Fixes: 2afc3184f3b3 ("drm/plane: Add COLOR PIPELINE property") Reviewed-by: Harry Wentland #v1 Reviewed-by: Chaitanya Kumar Borah Reviewed-by: Alex Hung Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-4-mwen@igalia.com --- drivers/gpu/drm/drm_atomic_uapi.c | 64 ++++++++++++++++++++++++------- include/drm/drm_atomic_uapi.h | 4 +- 2 files changed, 54 insertions(+), 14 deletions(-) diff --git a/drivers/gpu/drm/drm_atomic_uapi.c b/drivers/gpu/drm/drm_atomic_uapi.c index b81dbba4d8c3..5eaf0e8a494b 100644 --- a/drivers/gpu/drm/drm_atomic_uapi.c +++ b/drivers/gpu/drm/drm_atomic_uapi.c @@ -265,13 +265,19 @@ EXPORT_SYMBOL(drm_atomic_set_fb_for_plane); * * Helper function to select the color pipeline on a plane by setting * it to the first drm_colorop element of the pipeline. + * + * Return: true if plane color pipeline value changed, false otherwise. */ -void +bool drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, struct drm_colorop *colorop) { struct drm_plane *plane = plane_state->plane; + /* Color pipeline didn't change */ + if (plane_state->color_pipeline == colorop) + return false; + if (colorop) drm_dbg_atomic(plane->dev, "Set [COLOROP:%d] for [PLANE:%d:%s] state %p\n", @@ -283,6 +289,8 @@ drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, plane->base.id, plane->name, plane_state); plane_state->color_pipeline = colorop; + + return true; } EXPORT_SYMBOL(drm_atomic_set_colorop_for_plane); @@ -604,7 +612,7 @@ static int drm_atomic_plane_set_property(struct drm_plane *plane, if (val && !colorop) return -EACCES; - drm_atomic_set_colorop_for_plane(state, colorop); + state->color_mgmt_changed |= drm_atomic_set_colorop_for_plane(state, colorop); } else if (property == config->prop_fb_damage_clips) { ret = drm_property_replace_blob_from_id(dev, &state->fb_damage_clips, @@ -713,11 +721,11 @@ drm_atomic_plane_get_property(struct drm_plane *plane, static int drm_atomic_color_set_data_property(struct drm_colorop *colorop, struct drm_colorop_state *state, struct drm_property *property, - uint64_t val) + uint64_t val, + bool *replaced) { ssize_t elem_size = -1; ssize_t size = -1; - bool replaced = false; switch (colorop->type) { case DRM_COLOROP_1D_LUT: @@ -739,28 +747,45 @@ static int drm_atomic_color_set_data_property(struct drm_colorop *colorop, &state->data, val, -1, size, elem_size, - &replaced); + replaced); } static int drm_atomic_colorop_set_property(struct drm_colorop *colorop, struct drm_colorop_state *state, struct drm_file *file_priv, struct drm_property *property, - uint64_t val) + uint64_t val, + bool *replaced) { if (property == colorop->bypass_property) { - state->bypass = val; + if (state->bypass != val) { + state->bypass = val; + *replaced = true; + } } else if (property == colorop->lut1d_interpolation_property) { - state->lut1d_interpolation = val; + if (state->lut1d_interpolation != val) { + state->lut1d_interpolation = val; + *replaced = true; + } } else if (property == colorop->curve_1d_type_property) { - state->curve_1d_type = val; + if (state->curve_1d_type != val) { + state->curve_1d_type = val; + *replaced = true; + } } else if (property == colorop->multiplier_property) { - state->multiplier = val; + if (state->multiplier != val) { + state->multiplier = val; + *replaced = true; + } } else if (property == colorop->lut3d_interpolation_property) { - state->lut3d_interpolation = val; + if (state->lut3d_interpolation != val) { + state->lut3d_interpolation = val; + *replaced = true; + } } else if (property == colorop->data_property) { return drm_atomic_color_set_data_property(colorop, state, - property, val); + property, val, + replaced); } else { drm_dbg_atomic(colorop->dev, "[COLOROP:%d:%d] unknown property [PROP:%d:%s]\n", @@ -1275,8 +1300,10 @@ int drm_atomic_set_property(struct drm_atomic_state *state, break; } case DRM_MODE_OBJECT_COLOROP: { + struct drm_plane_state *plane_state; struct drm_colorop *colorop = obj_to_colorop(obj); struct drm_colorop_state *colorop_state; + bool replaced = false; colorop_state = drm_atomic_get_colorop_state(state, colorop); if (IS_ERR(colorop_state)) { @@ -1285,7 +1312,18 @@ int drm_atomic_set_property(struct drm_atomic_state *state, } ret = drm_atomic_colorop_set_property(colorop, colorop_state, - file_priv, prop, prop_value); + file_priv, prop, prop_value, + &replaced); + if (ret || !replaced) + break; + + plane_state = drm_atomic_get_plane_state(state, colorop->plane); + if (IS_ERR(plane_state)) { + ret = PTR_ERR(plane_state); + break; + } + plane_state->color_mgmt_changed |= replaced; + break; } default: diff --git a/include/drm/drm_atomic_uapi.h b/include/drm/drm_atomic_uapi.h index 436315523326..4e7e78f711e2 100644 --- a/include/drm/drm_atomic_uapi.h +++ b/include/drm/drm_atomic_uapi.h @@ -29,6 +29,8 @@ #ifndef DRM_ATOMIC_UAPI_H_ #define DRM_ATOMIC_UAPI_H_ +#include + struct drm_crtc_state; struct drm_display_mode; struct drm_property_blob; @@ -50,7 +52,7 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state, struct drm_crtc *crtc); void drm_atomic_set_fb_for_plane(struct drm_plane_state *plane_state, struct drm_framebuffer *fb); -void drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, +bool drm_atomic_set_colorop_for_plane(struct drm_plane_state *plane_state, struct drm_colorop *colorop); int __must_check drm_atomic_set_crtc_for_connector(struct drm_connector_state *conn_state, From d79716401a954677a93c4dd51fec65beccb38296 Mon Sep 17 00:00:00 2001 From: Melissa Wen Date: Tue, 9 Jun 2026 12:20:21 +0200 Subject: [PATCH 8/9] drm/amd/display: use plane color_mgmt_changed to track colorop changes Ensure the driver tracks changes in any colorop property of a plane color pipeline by using the same mechanism of CRTC color management and update plane color blocks when any colorop property changes. It fixes an issue observed on gamescope settings for night mode which is done via shaper/3D-LUT updates. Fixes: 9ba25915efba ("drm/amd/display: Add support for sRGB EOTF in DEGAM block") Reviewed-by: Harry Wentland Reviewed-by: Alex Hung Signed-off-by: Melissa Wen Signed-off-by: Melissa Wen Link: https://patch.msgid.link/20260609110420.1298352-5-mwen@igalia.com --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index e96a12ff2d31..d3237f61246c 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -10067,7 +10067,7 @@ static void amdgpu_dm_commit_planes(struct drm_atomic_state *state, continue; bundle->surface_updates[planes_count].surface = dc_plane; - if (new_pcrtc_state->color_mgmt_changed) { + if (new_pcrtc_state->color_mgmt_changed || new_plane_state->color_mgmt_changed) { bundle->surface_updates[planes_count].gamma = &dc_plane->gamma_correction; bundle->surface_updates[planes_count].in_transfer_func = &dc_plane->in_transfer_func; bundle->surface_updates[planes_count].gamut_remap_matrix = &dc_plane->gamut_remap_matrix; @@ -11808,6 +11808,10 @@ static bool should_reset_plane(struct drm_atomic_state *state, if (new_crtc_state->color_mgmt_changed) return true; + /* Plane color pipeline or its colorop changes. */ + if (new_plane_state->color_mgmt_changed) + return true; + /* * On zpos change, planes need to be reordered by removing and re-adding * them one by one to the dc state, in order of descending zpos. From 2f41af638c92bac6f1f9275ea2d1901baef578f3 Mon Sep 17 00:00:00 2001 From: Lizhi Hou Date: Wed, 10 Jun 2026 08:11:27 -0700 Subject: [PATCH 9/9] accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range() aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add the missing mmput() before jumping to again. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Lizhi Hou Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com --- drivers/accel/amdxdna/aie2_ctx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/accel/amdxdna/aie2_ctx.c b/drivers/accel/amdxdna/aie2_ctx.c index 286379d9511d..eed3d0ec5413 100644 --- a/drivers/accel/amdxdna/aie2_ctx.c +++ b/drivers/accel/amdxdna/aie2_ctx.c @@ -999,6 +999,7 @@ again: if (ret == -EBUSY) { amdxdna_umap_put(mapp); + mmput(mm); goto again; } @@ -1009,11 +1010,13 @@ again: if (mmu_interval_read_retry(&mapp->notifier, mapp->range.notifier_seq)) { up_write(&xdna->notifier_lock); amdxdna_umap_put(mapp); + mmput(mm); goto again; } mapp->invalid = false; up_write(&xdna->notifier_lock); amdxdna_umap_put(mapp); + mmput(mm); goto again; put_mm: