drm-misc-fixes
Hi Dave, Sima,
Here's this week drm-misc-fixes PR
Maxime
drm-misc-fixes-2026-09-03:
A whole bunch of fixes for various drivers
- Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used,
- amd: plane blend mode fixes
- amdxdna: out-of-bounds access fix, reject commands chains with no commands, handle chained mapping BO failures, refuse to flush an imported BO
- atomic-state-helpers: set pixel_blend_mode to prop default on reset
- dma-buf: Publish the dma-buf only after copy_to_user succeeds, fix some kernel-doc warnings
- ethosu: handle mmio mapping failures, handle storage modes only on hardware that supports it, fix job completion fence cleanup
- fastrpc: Publish the dma-buf only after copy_to_user succeeds
- gud: Improve TV modes and rotation handling
- nouveau: use-after-free fixes, add scanline position support, HDMI and DP fixes, null pointer dereference fix, dmem accounting fixes for large folios, use write-combined maps for coherent
- pagemap: Prevent double migration of device pages, Reset migration page count on eviction retry, dma-unmap pages before handling migration errors, use after free fixes
- prime: fix prime exports tracing
- qaic: out-of-bounds access fix
- sysfb: Fix integer overflow, fix constant comparison bug
- tegra: Add blend mode properties
- virtio: exit path and error handling fixes
The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:
Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)
are available in the Git repository at:
https://gitlab.freedesktop.org/drm/misc/kernel.git tags/drm-misc-fixes-2026-09-03
for you to fetch changes up to d3609b540838945ab2ca5b65f32a2eb67bb284c8:
MAINTAINERS, mailmap: use Aditya Garg's linux.dev account (2026-09-03 09:44:40 +0200)
----------------------------------------------------------------
A whole bunch of fixes for various drivers
- Fix drm_crtc_commit leak when PAGE_FLIP_EVENT is used,
- amd: plane blend mode fixes
- amdxdna: out-of-bounds access fix, reject commands chains with no commands, handle chained mapping BO failures, refuse to flush an imported BO
- atomic-state-helpers: set pixel_blend_mode to prop default on reset
- dma-buf: Publish the dma-buf only after copy_to_user succeeds, fix some kernel-doc warnings
- ethosu: handle mmio mapping failures, handle storage modes only on hardware that supports it, fix job completion fence cleanup
- fastrpc: Publish the dma-buf only after copy_to_user succeeds
- gud: Improve TV modes and rotation handling
- nouveau: use-after-free fixes, add scanline position support, HDMI and DP fixes, null pointer dereference fix, dmem accounting fixes for large folios, use write-combined maps for coherent
- pagemap: Prevent double migration of device pages, Reset migration page count on eviction retry, dma-unmap pages before handling migration errors, use after free fixes
- prime: fix prime exports tracing
- qaic: out-of-bounds access fix
- sysfb: Fix integer overflow, fix constant comparison bug
- tegra: Add blend mode properties
- virtio: exit path and error handling fixes
----------------------------------------------------------------
Aditya Garg (1):
MAINTAINERS, mailmap: use Aditya Garg's linux.dev account
Anuj Bolewar (1):
drm/virtio: reclaim pending vbufs before tearing down vqs
Arvind Yadav (2):
drm/pagemap: Prevent double migration of device pages drm/pagemap: Reset migration page count on eviction retry
Baineng Shou (4):
dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds
misc: fastrpc: don't publish fd before copy_to_user() succeeds drm/prime: use dma_buf_fd_install() to preserve export tracing
selftests: dmabuf-heaps: add fd-leak-on-EFAULT regression test
Benjamin Leggett (1):
drm/virtio: use the DMA API for resource backing on Xen
Dan Carpenter (1):
drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()
Dave Airlie (1):
nouveau/instmem: handle iomapping already existing
Deepanshu Kartikey (1):
drm/gud: NUL-terminate TV mode names read from the device
Faith Ekstrand (1):
drm/nouveau: Use write-combined maps for coherent
GuoHan Zhao (2):
accel/ethosu: check MMIO mapping errors in probe accel/ethosu: fix job completion fence cleanup
Lizhi Hou (1):
accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain
Lyude Paul (1):
drm/nouveau/disp/r535: Add scanline position support + head state support
Marek Czernohous (1):
drm/nouveau: unsubscribe the channel-kill event before the fence context
Matthew Brost (2):
drm/pagemap: dma-unmap pages before handling migration errors drm/pagemap: Fix folio allocation fallback and use-after-put
Maxime Ripard (1):
Merge drm/drm-fixes into drm-misc-fixes
Melissa Wen (4):
drm/atomic-state-helper: set pixel_blend_mode to prop default on reset drm/amd/display: fix missing blend-mode-prop warning for DCN drm/amd/display: advertise PIXEL_NONE and PREMULTI blend mode for DCE drm/amd/display: use plane color_mgmt_changed to track colorop changes
Mohamed Ahmed (8):
drm/nouveau/disp: move GSP head-timing ISR and vblank helpers to tu102.c drm/nouveau/disp: move the GSP HDMI GCP AVMute write to engine/disp drm/nouveau/disp: route GSP-RM display MMIO through nvkm_disp_func hooks drm/nouveau/disp: fix HDMI vendor infoframes on GB20x drm/nouveau/disp: fix HDMI GCP AVMute register offsets on GB20x drm/nouveau/gsp: use per-version DP_CONFIG_STREAM params on r570 firmware drm/nouveau/disp: fix head state readback on GB20x drm/nouveau/gsp: fix vblank interrupts on GB20x
Randy Dunlap (1):
dma-buf: fix some kernel-doc warnings
Sajal Gupta (1):
drm/gud: validate GUD_ROTATION_0 is present in supported rotations
Shixiong Ou (2):
drm/sysfb: ofdrm: Fix integer overflow in fb_size calculation drm/sysfb: ofdrm: Fix is_avivo() constant comparison bug
Slawomir Stepien (1):
drm/cirrus-qemu: Validate BAR0 size during probe
Taimuraz Kaitmazov (4):
accel/amdxdna: return early from a zero-length flush accel/amdxdna: reject a command chain that carries no commands accel/amdxdna: put the chained BO when its mapping fails accel/amdxdna: refuse to flush an imported BO
Tao Yu (1):
drm/gud: validate TV mode names before creating enum property
Thadeu Lima de Souza Cascardo (2):
drm/atomic: remove bogus check for file_priv
drm: Fix drm_crtc_commit leak if signaled when PAGE_FLIP_EVENT is used
Thierry Reding (1):
drm/tegra: Add blend mode properties
Thomas Zimmermann (1):
Merge drm/drm-fixes into drm-misc-fixes
Tomeu Vizoso (1):
accel: ethosu: Don't read the U65 rounding mode as a storage mode
Youssef Samir (1):
accel/qaic: Address potential out-of-bounds read in resp_worker()
Zhenhao Wan (5):
drm/nouveau/uvmm: fix NULL deref unwinding an OP_MAP_SPARSE op drm/nouveau/uvmm: fix premature region free on failed OP_UNMAP_SPARSE drm/nouveau/uvmm: clear the dirty flag when unwinding an OP_UNMAP_SPARSE drm/nouveau/dmem: fix mismatched DMA unmap size for large folios drm/nouveau/dmem: fix callocated underflow on large folio split
shechenglong (1):
drm/virtio: check return value of vgdev_output_init()
.mailmap | 3 +- MAINTAINERS | 2 +- drivers/accel/amdxdna/aie2_message.c | 2 +- drivers/accel/amdxdna/amdxdna_ctx.c | 4 +- drivers/accel/amdxdna/amdxdna_ctx.h | 2 +- drivers/accel/amdxdna/amdxdna_gem.c | 10 +- drivers/accel/ethosu/ethosu_drv.c | 2 + drivers/accel/ethosu/ethosu_gem.c | 2 +- drivers/accel/ethosu/ethosu_job.c | 10 +- drivers/accel/qaic/qaic_control.c | 46 ++-- drivers/dma-buf/dma-buf.c | 20 ++ drivers/dma-buf/dma-heap.c | 80 +++--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_plane.c | 31 ++- drivers/gpu/drm/drm_atomic_state_helper.c | 7 + drivers/gpu/drm/drm_atomic_uapi.c | 5 +- drivers/gpu/drm/drm_pagemap.c | 270 ++++++++++++++++++--- drivers/gpu/drm/drm_prime.c | 2 +- drivers/gpu/drm/gud/gud_connector.c | 12 +- drivers/gpu/drm/gud/gud_drv.c | 2 + drivers/gpu/drm/nouveau/include/nvkm/engine/disp.h | 1 + drivers/gpu/drm/nouveau/nouveau_chan.c | 9 +- drivers/gpu/drm/nouveau/nouveau_dmem.c | 18 +- drivers/gpu/drm/nouveau/nouveau_sgdma.c | 4 +- drivers/gpu/drm/nouveau/nouveau_uvmm.c | 6 +- drivers/gpu/drm/nouveau/nvkm/engine/device/base.c | 10 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/Kbuild | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ga102.c | 13 +- drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c | 191 +++++++++++++++ drivers/gpu/drm/nouveau/nvkm/engine/disp/head.h | 2 + drivers/gpu/drm/nouveau/nvkm/engine/disp/ior.h | 1 + drivers/gpu/drm/nouveau/nvkm/engine/disp/priv.h | 17 ++ drivers/gpu/drm/nouveau/nvkm/engine/disp/tu102.c | 86 ++++++- .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/disp.c | 125 ++++------ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/disp.c | 64 +++++ .../gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/gsp.c | 9 + .../nouveau/nvkm/subdev/gsp/rm/r570/nvrm/disp.h | 2 + drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/rm.h | 5 + drivers/gpu/drm/nouveau/nvkm/subdev/instmem/nv50.c | 3 + drivers/gpu/drm/sysfb/ofdrm.c | 8 +- drivers/gpu/drm/tegra/dc.c | 6 + drivers/gpu/drm/tegra/hub.c | 2 + drivers/gpu/drm/tiny/cirrus-qemu.c | 3 + drivers/gpu/drm/virtio/virtgpu_display.c | 9 +- drivers/gpu/drm/virtio/virtgpu_drv.h | 21 ++ drivers/gpu/drm/virtio/virtgpu_kms.c | 1 + drivers/gpu/drm/virtio/virtgpu_object.c | 2 +- drivers/gpu/drm/virtio/virtgpu_vq.c | 21 +- drivers/misc/fastrpc.c | 16 +- include/drm/drm_pagemap.h | 8 +- include/linux/dma-buf.h | 1 + include/linux/dma-fence-array.h | 1 - include/linux/dma-fence-chain.h | 9 +- tools/testing/selftests/dmabuf-heaps/dmabuf-heap.c | 113 ++++++++- 54 files changed, 1072 insertions(+), 234 deletions(-) create mode 100644 drivers/gpu/drm/nouveau/nvkm/engine/disp/gb202.c