<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-stable.git/drivers/gpu, branch v7.2-rc6</title>
<subtitle>Linux kernel stable tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/'/>
<entry>
<title>Merge tag 'drm-intel-fixes-2026-07-30' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes</title>
<updated>2026-07-31T04:44:15+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:44:11+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=256325820a46b2d69e04b4911f0d95c0bd50fb32'/>
<id>256325820a46b2d69e04b4911f0d95c0bd50fb32</id>
<content type='text'>
One DP DSC fix and one HDMI 2.0 fix.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Link: https://patch.msgid.link/amvIvqJehP7uaUgx@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
One DP DSC fix and one HDMI 2.0 fix.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Link: https://patch.msgid.link/amvIvqJehP7uaUgx@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'amd-drm-fixes-7.2-2026-07-30' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes</title>
<updated>2026-07-31T04:43:38+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:43:32+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=cbad2668c26b830ce67307530a959f0f6764d585'/>
<id>cbad2668c26b830ce67307530a959f0f6764d585</id>
<content type='text'>
amd-drm-fixes-7.2-2026-07-30:

amdgpu:
- PM sysfs fix for APUs
- Follow on pageflip timeout fix

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260730150018.801791-1-alexander.deucher@amd.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
amd-drm-fixes-7.2-2026-07-30:

amdgpu:
- PM sysfs fix for APUs
- Follow on pageflip timeout fix

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260730150018.801791-1-alexander.deucher@amd.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-xe-fixes-2026-07-30' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes</title>
<updated>2026-07-31T04:43:13+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:43:02+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=efbac20ac44894d1238b37a3e1dadb0f3f73a8fe'/>
<id>efbac20ac44894d1238b37a3e1dadb0f3f73a8fe</id>
<content type='text'>
- Check no-DMA huge-pte cases before DMA segment test (Himal)

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Link: https://patch.msgid.link/amtk7ZddR12dgg-A@intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
- Check no-DMA huge-pte cases before DMA segment test (Himal)

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
Link: https://patch.msgid.link/amtk7ZddR12dgg-A@intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'drm-misc-fixes-2026-07-30' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes</title>
<updated>2026-07-31T04:34:20+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:33:49+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=e28b7fa7d8474615fec357568955a9d02ac3fd2f'/>
<id>e28b7fa7d8474615fec357568955a9d02ac3fd2f</id>
<content type='text'>
drm-misc-fies for v7.2-rc6:
- vmwgfx:
  - Improve various size checks and limit checks.
  - Fix oops when submitting  invalid execbuf ioctl.
  - Correctly lock in vmfwgx fence signaling path.
  - More validation of execbuf ioctl.
  - Fix oops in vmwgfx vkms init failure path.
  - Overflow handling in shader path.
- Improve firmware validation in panthor.
- Fix small leak in bridge/display-connector
- Improve imagination trace points.
- Fix QAIC transaction length check.
- Restrict some DP bandwidth calculations to HDMI DFP.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Link: https://patch.msgid.link/178a513f-2d7f-4e3a-811b-cd0d9dc309eb@linux.intel.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
drm-misc-fies for v7.2-rc6:
- vmwgfx:
  - Improve various size checks and limit checks.
  - Fix oops when submitting  invalid execbuf ioctl.
  - Correctly lock in vmfwgx fence signaling path.
  - More validation of execbuf ioctl.
  - Fix oops in vmwgfx vkms init failure path.
  - Overflow handling in shader path.
- Improve firmware validation in panthor.
- Fix small leak in bridge/display-connector
- Improve imagination trace points.
- Fix QAIC transaction length check.
- Restrict some DP bandwidth calculations to HDMI DFP.

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Maarten Lankhorst &lt;maarten.lankhorst@linux.intel.com&gt;
Link: https://patch.msgid.link/178a513f-2d7f-4e3a-811b-cd0d9dc309eb@linux.intel.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'amd-drm-fixes-7.2-2026-07-29' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes</title>
<updated>2026-07-31T04:20:54+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:20:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=963144556021e478b8cc889ba93a5972796bd744'/>
<id>963144556021e478b8cc889ba93a5972796bd744</id>
<content type='text'>
amd-drm-fixes-7.2-2026-07-29:

amdgpu:
- VCN 5.3 fix
- UserQ fixes
- GEM close optimization
- HDMI AV mute fix
- UML build fixes
- GFXOFF residency metrics fixes
- SMU 15 fixes
- debug_vm fix
- PSP 15 fixes
- NBIO 7.11.5 fix
- pptable use after free fix
- gpu metrics fetch fix
- DC viewport fix
- DML2.1 fix
- i2c retimer spam fix
- UMD profile pstate fix
- Power metrics format cleanup
- GTT size fix on APUs
- DC context logging fix

amdkfd:
- Various bounds checking fixes
- Mutex locking fix

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260729182209.4072227-1-alexander.deucher@amd.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
amd-drm-fixes-7.2-2026-07-29:

amdgpu:
- VCN 5.3 fix
- UserQ fixes
- GEM close optimization
- HDMI AV mute fix
- UML build fixes
- GFXOFF residency metrics fixes
- SMU 15 fixes
- debug_vm fix
- PSP 15 fixes
- NBIO 7.11.5 fix
- pptable use after free fix
- gpu metrics fetch fix
- DC viewport fix
- DML2.1 fix
- i2c retimer spam fix
- UMD profile pstate fix
- Power metrics format cleanup
- GTT size fix on APUs
- DC context logging fix

amdkfd:
- Various bounds checking fixes
- Mutex locking fix

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Alex Deucher &lt;alexander.deucher@amd.com&gt;
Link: https://patch.msgid.link/20260729182209.4072227-1-alexander.deucher@amd.com
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'mediatek-drm-fixes-20260729' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes</title>
<updated>2026-07-31T04:09:35+00:00</updated>
<author>
<name>Dave Airlie</name>
<email>airlied@redhat.com</email>
</author>
<published>2026-07-31T04:09:29+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1fb50e57e506053293c42b694e2038be7d24bd96'/>
<id>1fb50e57e506053293c42b694e2038be7d24bd96</id>
<content type='text'>
Mediatek DRM Fixes - 20260729

1. Check CRTC state before freeing
2. mtk_hdmi: Fix DDC adapter double put in v2
3. mtk_hdmi_common: take i2c adapter module reference
4. mtk_dsi: Enable HS clock only at pre-enable
5. ovl_adaptor: balance component registrations

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Chun-Kuang Hu &lt;chunkuang.hu@kernel.org&gt;
Link: https://patch.msgid.link/20260729131701.4158-1-chunkuang.hu@kernel.org
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Mediatek DRM Fixes - 20260729

1. Check CRTC state before freeing
2. mtk_hdmi: Fix DDC adapter double put in v2
3. mtk_hdmi_common: take i2c adapter module reference
4. mtk_dsi: Enable HS clock only at pre-enable
5. ovl_adaptor: balance component registrations

Signed-off-by: Dave Airlie &lt;airlied@redhat.com&gt;

From: Chun-Kuang Hu &lt;chunkuang.hu@kernel.org&gt;
Link: https://patch.msgid.link/20260729131701.4158-1-chunkuang.hu@kernel.org
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/i915/hdmi: Poll for 200 msec for TMDS_Scrambler_Status</title>
<updated>2026-07-30T20:10:01+00:00</updated>
<author>
<name>Jerome Tollet</name>
<email>jerome.tollet@gmail.com</email>
</author>
<published>2026-05-20T02:25:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=1afb8eaeec44fd011f2b93ccd9fd426d753d963b'/>
<id>1afb8eaeec44fd011f2b93ccd9fd426d753d963b</id>
<content type='text'>
HDMI 2.0 section 6.1.3.1 specifies that after enabling
Scrambling_Enable and starting scrambled video transmission, the source
should poll Scrambling_Status until it reads 1 or until a timeout of
200 ms expires.

Add a polling step after enabling the HDMI port to check the scrambling
status when HDMI scrambling is enabled.

On some HDMI 2.0 sinks, omitting this check can result in 4K@60Hz
(594 MHz) failing to come up correctly because the sink has not yet
finished its scrambling setup. In practice, waiting for the scrambling
status here fixes such sinks.

While this synchronous polling is not itself explicitly required for
correct modeset sequencing, HDMI 2.0 section 6.1.3.1 does recommend it
as the way for the source to verify that the TMDS link is functioning
correctly with scrambling enabled.

v3:
 - Add explicit HDMI 2.0 section reference in code comment
 - Clarify commit message around the observed sink fix

v2:
 - Poll TMDS_Scrambler_Status for up to 200 ms instead of using a fixed
   delay

Reported-by: Jerome Tollet &lt;jtollet@cisco.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6868
Link: https://lore.kernel.org/dri-devel/20251230091037.5603-1-jerome.tollet@gmail.com/
Signed-off-by: Jerome Tollet &lt;jerome.tollet@gmail.com&gt;
Signed-off-by: Ankit Nautiyal &lt;ankit.k.nautiyal@intel.com&gt;
Reviewed-by: Arun R Murthy &lt;arun.r.murthy@intel.com&gt;
Link: https://patch.msgid.link/20260520022544.3097252-1-ankit.k.nautiyal@intel.com
(cherry picked from commit b7d51d65e4f12a48392d260613108ec262bc7774)
Fixes: 15953637886d ("drm/i915: enable scrambling")
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
HDMI 2.0 section 6.1.3.1 specifies that after enabling
Scrambling_Enable and starting scrambled video transmission, the source
should poll Scrambling_Status until it reads 1 or until a timeout of
200 ms expires.

Add a polling step after enabling the HDMI port to check the scrambling
status when HDMI scrambling is enabled.

On some HDMI 2.0 sinks, omitting this check can result in 4K@60Hz
(594 MHz) failing to come up correctly because the sink has not yet
finished its scrambling setup. In practice, waiting for the scrambling
status here fixes such sinks.

While this synchronous polling is not itself explicitly required for
correct modeset sequencing, HDMI 2.0 section 6.1.3.1 does recommend it
as the way for the source to verify that the TMDS link is functioning
correctly with scrambling enabled.

v3:
 - Add explicit HDMI 2.0 section reference in code comment
 - Clarify commit message around the observed sink fix

v2:
 - Poll TMDS_Scrambler_Status for up to 200 ms instead of using a fixed
   delay

Reported-by: Jerome Tollet &lt;jtollet@cisco.com&gt;
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6868
Link: https://lore.kernel.org/dri-devel/20251230091037.5603-1-jerome.tollet@gmail.com/
Signed-off-by: Jerome Tollet &lt;jerome.tollet@gmail.com&gt;
Signed-off-by: Ankit Nautiyal &lt;ankit.k.nautiyal@intel.com&gt;
Reviewed-by: Arun R Murthy &lt;arun.r.murthy@intel.com&gt;
Link: https://patch.msgid.link/20260520022544.3097252-1-ankit.k.nautiyal@intel.com
(cherry picked from commit b7d51d65e4f12a48392d260613108ec262bc7774)
Fixes: 15953637886d ("drm/i915: enable scrambling")
Signed-off-by: Rodrigo Vivi &lt;rodrigo.vivi@intel.com&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/display: Exit idle optimizations before programming</title>
<updated>2026-07-29T22:21:24+00:00</updated>
<author>
<name>Leo Li</name>
<email>sunpeng.li@amd.com</email>
</author>
<published>2026-07-28T17:02:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=8419331e64d92a8de5fc4feef0e305f201fb8b33'/>
<id>8419331e64d92a8de5fc4feef0e305f201fb8b33</id>
<content type='text'>
[Why]

We need to exit PSR/IPS before programming. Before calling DC for
programming in amdgpu_dm_commit_planes(), there's a
vblank_control_workqueue flush. This waits for IPS and PSR exit. (See
drm_vblank_on/off() &gt; amdgpu_dm_crtc_set_vblank() --queue_work()-&gt;
amdgpu_dm_crtc_vblank_control_worker())

Prior to the tagged "Fixes:" change, drm_vblank_get() was called before
the workqueue flush. This ordering ensures that PSR exit occurred before
programming. After the "Fixes:" change, drm_vblank_get() is called after
the workqueue flush, leading to programming while idle optimizations are
still active. This can lead to incorrect flip_pending detection used by
vblank event delivery.

[How]

Split the vblank_get() component of `dm_arm_vblank_event()` into
`dm_arm_vblank_event_pre_programming()`, which is called before
programming. Call it before the vblank_control_workqueue flush.

Includes a drive-by cleanup of prepare_flip_isr(): the only caller is
dm_arm_vblank_event() and it's simple enough to roll-in.

v2: Fix checkpatch formatting warning on
    drm_arm_vblank_event_pre_programming() arg alignment.

Fixes: 48ab86360af1 ("drm/amd/display: check GRPH_FLIP status before sending event")
Cc: stable@vger.kernel.org
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141#note_3583205
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5527
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Claude:opus-5
Suggested-by: David Weber &lt;weber.aulendorf@gmail.com&gt;
Signed-off-by: Leo Li &lt;sunpeng.li@amd.com&gt;
Reviewed-by: Mario Limonciello (AMD) &lt;superm1@kernel.org&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 05984e29520a28c27f5a2388742c957a6a87ee7a)
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[Why]

We need to exit PSR/IPS before programming. Before calling DC for
programming in amdgpu_dm_commit_planes(), there's a
vblank_control_workqueue flush. This waits for IPS and PSR exit. (See
drm_vblank_on/off() &gt; amdgpu_dm_crtc_set_vblank() --queue_work()-&gt;
amdgpu_dm_crtc_vblank_control_worker())

Prior to the tagged "Fixes:" change, drm_vblank_get() was called before
the workqueue flush. This ordering ensures that PSR exit occurred before
programming. After the "Fixes:" change, drm_vblank_get() is called after
the workqueue flush, leading to programming while idle optimizations are
still active. This can lead to incorrect flip_pending detection used by
vblank event delivery.

[How]

Split the vblank_get() component of `dm_arm_vblank_event()` into
`dm_arm_vblank_event_pre_programming()`, which is called before
programming. Call it before the vblank_control_workqueue flush.

Includes a drive-by cleanup of prepare_flip_isr(): the only caller is
dm_arm_vblank_event() and it's simple enough to roll-in.

v2: Fix checkpatch formatting warning on
    drm_arm_vblank_event_pre_programming() arg alignment.

Fixes: 48ab86360af1 ("drm/amd/display: check GRPH_FLIP status before sending event")
Cc: stable@vger.kernel.org
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/4141#note_3583205
Link: https://gitlab.freedesktop.org/drm/amd/-/work_items/5527
Assisted-by: Codex:gpt-5.6-sol
Assisted-by: Claude:opus-5
Suggested-by: David Weber &lt;weber.aulendorf@gmail.com&gt;
Signed-off-by: Leo Li &lt;sunpeng.li@amd.com&gt;
Reviewed-by: Mario Limonciello (AMD) &lt;superm1@kernel.org&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 05984e29520a28c27f5a2388742c957a6a87ee7a)
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/amd/pm: hide pp_table sysfs on APUs</title>
<updated>2026-07-29T22:20:29+00:00</updated>
<author>
<name>Yang Wang</name>
<email>kevinyang.wang@amd.com</email>
</author>
<published>2026-07-29T07:56:46+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=a65f5179d3f0c93da31b450aeb416eaa22f1912b'/>
<id>a65f5179d3f0c93da31b450aeb416eaa22f1912b</id>
<content type='text'>
APUs use firmware-owned DPM tables and do not support replacement through
pp_table. Generic callbacks can nevertheless expose the sysfs file and
accept an upload before resetting the power management stack.

Treat pp_table as unsupported on APUs. Use the same platform check in the
get and set paths to hide the file and reject uploads.

Fixes: 289921b03fe5 ("drm/amd/powerplay: implement sysfs of pp_table for smu11 (v2)")
Signed-off-by: Yang Wang &lt;kevinyang.wang@amd.com&gt;
Reviewed-by: Kenneth Feng &lt;kenneth.feng@amd.com&gt;
Reviewed-by: Asad Kamal &lt;asad.kamal@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 74f28db2db69777cd2f059d50fe34e365ddd5add)
Cc: stable@vger.kernel.org
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
APUs use firmware-owned DPM tables and do not support replacement through
pp_table. Generic callbacks can nevertheless expose the sysfs file and
accept an upload before resetting the power management stack.

Treat pp_table as unsupported on APUs. Use the same platform check in the
get and set paths to hide the file and reject uploads.

Fixes: 289921b03fe5 ("drm/amd/powerplay: implement sysfs of pp_table for smu11 (v2)")
Signed-off-by: Yang Wang &lt;kevinyang.wang@amd.com&gt;
Reviewed-by: Kenneth Feng &lt;kenneth.feng@amd.com&gt;
Reviewed-by: Asad Kamal &lt;asad.kamal@amd.com&gt;
Signed-off-by: Alex Deucher &lt;alexander.deucher@amd.com&gt;
(cherry picked from commit 74f28db2db69777cd2f059d50fe34e365ddd5add)
Cc: stable@vger.kernel.org
</pre>
</div>
</content>
</entry>
<entry>
<title>drm/panthor: validate firmware interface structure sizes</title>
<updated>2026-07-29T15:15:47+00:00</updated>
<author>
<name>Osama Abdelkader</name>
<email>osama.abdelkader@gmail.com</email>
</author>
<published>2026-07-20T11:49:17+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux-stable.git/commit/?id=b921b8613790a3f9e78ab64017fa7149ef0b750c'/>
<id>b921b8613790a3f9e78ab64017fa7149ef0b750c</id>
<content type='text'>
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual
address points inside the shared section. The returned pointer is later
used as a full firmware interface structure, so accepting an address near
the end of the shared section can still lead to out-of-bounds accesses.

Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges
that do not fit entirely in the shared section.

Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader &lt;osama.abdelkader@gmail.com&gt;
Reviewed-by: Steven Price &lt;steven.price@arm.com&gt;
Signed-off-by: Steven Price &lt;steven.price@arm.com&gt;
Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
iface_fw_to_cpu_addr() only checks that the firmware-provided MCU virtual
address points inside the shared section. The returned pointer is later
used as a full firmware interface structure, so accepting an address near
the end of the shared section can still lead to out-of-bounds accesses.

Pass the expected object size to iface_fw_to_cpu_addr() and reject ranges
that do not fit entirely in the shared section.

Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@vger.kernel.org
Signed-off-by: Osama Abdelkader &lt;osama.abdelkader@gmail.com&gt;
Reviewed-by: Steven Price &lt;steven.price@arm.com&gt;
Signed-off-by: Steven Price &lt;steven.price@arm.com&gt;
Link: https://patch.msgid.link/20260720114918.15973-1-osama.abdelkader@gmail.com
</pre>
</div>
</content>
</entry>
</feed>
