[PULL] drm-misc-fixes

[Maarten Lankhorst <maarten.lankhorst@linux.intel.com>]

Hi Dave, Sima, 

drm-misc-fixes for v7.2-rc3!

Kind regards,
~Maarten Lankhorst

drm-misc-fixes-2026-07-09:
drm-misc-fixes for v7.2-rc3:
- Fix uaf in amdxdna mmap failure path.
- A lot of deadlocks, access races and return value fixes in amdxdna.
- Fix analogix_dp bitshifts during link training.
- Use direct label in drm_exec.
- Fix absent indirect bo handling in v3d.
- Sync on first active crtc in fb_dirty, rather than first crtc.
- Rework try_harder in the buddy allocator.
- Make imagination function static to solve compiler warning.
- Fix imagination error checking.
The following changes since commit 8dc8f3f4c2382fb7d1b1986ba8f33a2466cd3d7a:

  drm/imagination: Fix user array stride in pvr_set_uobj_array() (2026-07-02 11:16:18 +0100)

are available in the Git repository at:

  https://gitlab.freedesktop.org/drm/misc/kernel.git tags/drm-misc-fixes-2026-07-09

for you to fetch changes up to cf385cf6e713eba0720651174dac0b2d2f5bb8f8:

  drm/imagination: fix error checking of pvr_vm_context_lookup() (2026-07-09 15:07:32 +0100)

----------------------------------------------------------------
drm-misc-fixes for v7.2-rc3:
- Fix uaf in amdxdna mmap failure path.
- A lot of deadlocks, access races and return value fixes in amdxdna.
- Fix analogix_dp bitshifts during link training.
- Use direct label in drm_exec.
- Fix absent indirect bo handling in v3d.
- Sync on first active crtc in fb_dirty, rather than first crtc.
- Rework try_harder in the buddy allocator.
- Make imagination function static to solve compiler warning.
- Fix imagination error checking.

----------------------------------------------------------------
Arunpravin Paneer Selvam (1):
      gpu/buddy: bail out of try_harder when alignment cannot be honoured

Ben Dooks (1):
      drm/imagination: make pvr_fw_trace_init_mask_ops static

Christian König (1):
      drm/drm_exec: avoid indirect goto

Damon Ding (1):
      drm/bridge: analogix_dp: Fix PE/VS value shift mismatch during link training

Lizhi Hou (10):
      accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()
      accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()
      accel/amdxdna: Fix VMA access race
      accel/amdxdna: Fix potential amdxdna_umap lifetime race
      accel/amdxdna: fix open_ref leak and stale client pointer on dma map failure
      accel/amdxdna: Fix deadlock on debug BO command timeout
      accel/amdxdna: Fix hardware context race in amdxdna_update_heap()
      accel/amdxdna: Check drmm_mutex_init() return value
      accel/amdxdna: Check init_srcu_struct() return value
      accel/amdxdna: Fix potential NULL pointer dereference of abo->client

Luigi Santivetti (1):
      drm/imagination: fix error checking of pvr_vm_context_lookup()

Maíra Canal (1):
      drm/v3d: Reject invalid indirect BO handle in indirect CSD setup

Robert Mader (1):
      drm: Guard DRM_CLIENT_CAP_PLANE_COLOR_PIPELINE

Thomas Zimmermann (1):
      drm/fb-helper: Only consider active CRTCs for vblank sync

Wentao Liang (1):
      accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()

 drivers/accel/amdxdna/aie2_ctx.c                   | 19 ++---
 drivers/accel/amdxdna/aie2_message.c               |  4 +-
 drivers/accel/amdxdna/amdxdna_ctx.c                | 56 ++++++++++---
 drivers/accel/amdxdna/amdxdna_gem.c                | 50 ++++++++----
 drivers/accel/amdxdna/amdxdna_gem.h                | 12 ++-
 drivers/accel/amdxdna/amdxdna_pci_drv.c            | 21 ++++-
 drivers/gpu/buddy.c                                | 67 +++++++++++-----
 drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c             |  2 +
 drivers/gpu/drm/bridge/analogix/analogix_dp_core.c |  4 +
 drivers/gpu/drm/drm_fb_helper.c                    | 92 +++++++++++++++++++++-
 drivers/gpu/drm/drm_ioctl.c                        | 14 +++-
 drivers/gpu/drm/imagination/pvr_context.c          |  4 +-
 drivers/gpu/drm/imagination/pvr_fw_trace.c         |  2 +-
 drivers/gpu/drm/tests/drm_exec_test.c              | 28 ++++---
 drivers/gpu/drm/v3d/v3d_submit.c                   |  2 +
 include/drm/drm_exec.h                             | 34 ++++----
 16 files changed, 311 insertions(+), 100 deletions(-)