[PULL] drm-misc-fixes

[Maarten Lankhorst <maarten.lankhorst@linux.intel.com>]

Hi Dave, Simona,

New pull-request for drm-misc-fixes, slightly late!

Kind regards,
~Maarten Lankhorst

drm-misc-fixes-2026-07-17:
drm-misc-fixes for v7.2-rc4:
- Fix UAF in host1x, amdxdna.
- Handle invalid firmware log in ivpu.
- Fix error handling in panthor.
- Handle NULL pages and backup handles in ttm_pool_backup() correctly.
- Reject more invalid amdxdna command submissions.
- Improve unmap and error handling on gpusvm.
- Fix virtio deadlock and invalid gem detach.
- Fix wrong read in ivpu.
- Always synchronize for CPU in begin_cpu_udmabuf.
The following changes since commit a13c140cc289c0b7b3770bce5b3ad42ab35074aa:

  Linux 7.2-rc3 (2026-07-12 14:16:39 -0700)

are available in the Git repository at:

  https://gitlab.freedesktop.org/drm/misc/kernel.git tags/drm-misc-fixes-2026-07-17

for you to fetch changes up to faebb7ba1ac65fa5810b640df02ce04e509fdc11:

  accel/amdxdna: Fix use-after-free of mm_struct in job scheduler (2026-07-16 20:05:28 -0700)

----------------------------------------------------------------
drm-misc-fixes for v7.2-rc4:
- Fix UAF in host1x, amdxdna.
- Handle invalid firmware log in ivpu.
- Fix error handling in panthor.
- Handle NULL pages and backup handles in ttm_pool_backup() correctly.
- Reject more invalid amdxdna command submissions.
- Improve unmap and error handling on gpusvm.
- Fix virtio deadlock and invalid gem detach.
- Fix wrong read in ivpu.
- Always synchronize for CPU in begin_cpu_udmabuf.

----------------------------------------------------------------
Doruk Tan Ozturk (2):
      accel/amdxdna: reject user command submission without a command BO
      accel/amdxdna: reject command submission on devices without a submit op

Honglei Huang (3):
      drm/gpusvm: free the whole IOVA reservation on unmap
      drm/gpusvm: do not route system pages to device_unmap() on IOVA unmap
      drm/gpusvm: publish dpagemap early to avoid device mapping leak on error

Jason Macnak (1):
      drm/virtio: Don't detach GEM from a non-created context

Jhonraushan (1):
      accel/ivpu: Reject firmware log with size smaller than header

Karol Wachowski (1):
      accel/ivpu: Fix wrong register read in LNL failure diagnostics

Linmao Li (1):
      drm/panthor: Check debugfs GEM lock initialization

Lizhi Hou (1):
      accel/amdxdna: Fix use-after-free of mm_struct in job scheduler

Maarten Lankhorst (1):
      Merge v7.2-rc3 into drm-misc-fixes

Matthew Brost (1):
      drm/ttm: Account for NULL and handle pages in ttm_pool_backup

Mikko Perttunen (1):
      gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings

Osama Abdelkader (1):
      drm/panthor: return error on truncated firmware

Robert Mader (1):
      udmabuf: Ensure to perform cache synchronisation in begin_cpu_udmabuf()

Ryosuke Yasuoka (1):
      drm/virtio: fix deadlock in display_info_cb by removing hotplug from dequeue worker

 drivers/accel/amdxdna/amdxdna_ctx.c      | 18 +++++++++++
 drivers/accel/ivpu/ivpu_fw_log.c         |  4 +++
 drivers/accel/ivpu/ivpu_hw_btrs.c        |  2 +-
 drivers/dma-buf/udmabuf.c                |  9 +++---
 drivers/gpu/drm/drm_gpusvm.c             | 53 ++++++++++++++++++++++----------
 drivers/gpu/drm/panthor/panthor_device.c |  5 ++-
 drivers/gpu/drm/panthor/panthor_fw.c     |  1 +
 drivers/gpu/drm/ttm/ttm_pool.c           | 34 +++++++++++++++++---
 drivers/gpu/drm/virtio/virtgpu_gem.c     | 14 +++++----
 drivers/gpu/drm/virtio/virtgpu_kms.c     |  5 ++-
 drivers/gpu/drm/virtio/virtgpu_vq.c      |  3 --
 drivers/gpu/host1x/bus.c                 |  4 +--
 12 files changed, 114 insertions(+), 38 deletions(-)