[PULL] drm-misc-fixes

Hey Dave, Sima,

drm-misc-fixes for the next -rc!
As both Thomas and Maxime are out, I'll send -next as well.

Kind regards,
~Maarten Lankhorst

drm-misc-fixes-2026-07-30:
drm-misc-fixes for v7.2-rc6:
- vmwgfx:
  - Improve various size checks and limit checks.
  - Fix oops when submitting  invalid execbuf ioctl.
  - Correctly lock in vmfwgx fence signaling path.
  - More validation of execbuf ioctl.
  - Fix oops in vmwgfx vkms init failure path.
  - Overflow handling in shader path.
- Improve firmware validation in panthor.
- Fix small leak in bridge/display-connector
- Improve imagination trace points.
- Fix QAIC transaction length check.
- Restrict some DP bandwidth calculations to HDMI DFP.
The following changes since commit f5098b6bae761e346ebcd9da7f95622c04733cff:

  Linux 7.2-rc5 (2026-07-26 14:45:48 -0700)

are available in the Git repository at:

  https://gitlab.freedesktop.org/drm/misc/kernel.git tags/drm-misc-fixes-2026-07-30

for you to fetch changes up to d6c075f797a672a6e3bd2fd44aee713801698ec2:

  accel/qaic: use sizeof(*trans_hdr) for transaction length check (2026-07-29 14:57:37 -0600)

----------------------------------------------------------------
drm-misc-fies for v7.2-rc6:
- vmwgfx:
  - Improve various size checks and limit checks.
  - Fix oops when submitting  invalid execbuf ioctl.
  - Correctly lock in vmfwgx fence signaling path.
  - More validation of execbuf ioctl.
  - Fix oops in vmwgfx vkms init failure path.
  - Overflow handling in shader path.
- Improve firmware validation in panthor.
- Fix small leak in bridge/display-connector
- Improve imagination trace points.
- Fix QAIC transaction length check.
- Restrict some DP bandwidth calculations to HDMI DFP.

----------------------------------------------------------------
Alessio Belle (1):
      drm/imagination: Fix value of HWRT address in pvr_job_create tracepoint

Alexander Kaplan (1):
      drm/dp: Read the PCON max FRL bandwidth only for HDMI DFPs

Brajesh Gupta (1):
      drm/imagination: Update the trace point pvr_job_submit_fw()

Jose Maria Casanova Crespo (1):
      drm/vc4: Supply the overflow slot size in BPOS, not the whole bin BO size

Laurent Pinchart (1):
      drm/bridge: display-connector: Fix I2C adapter resource leak

Maarten Lankhorst (1):
      Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

Maíra Canal (1):
      drm/vc4: Zero the tile state data array before each BIN job

Muhammad Bilal (1):
      accel/qaic: use sizeof(*trans_hdr) for transaction length check

Osama Abdelkader (2):
      drm/panthor: reject firmware sections with oversized data
      drm/panthor: validate firmware interface structure sizes

Zack Rusin (12):
      drm/vmwgfx: fix guest_memory_dirty bitfield clobbered as size
      drm/vmwgfx: reject DX_BIND_QUERY without a DX context
      drm/vmwgfx: clamp dirty-page range with min, not max
      drm/vmwgfx: take fman->lock around fence list mutation in fifo_down
      drm/vmwgfx: drop dma_buf reference on foreign-fd prime import
      drm/vmwgfx: validate DRAW_PRIMITIVES header size before division
      drm/vmwgfx: bound DMA command body size against suffix pointer
      drm/vmwgfx: avoid destroy_workqueue(NULL) on vkms init failure
      drm/vmwgfx: enforce cursor size limits for MOB cursors
      drm/vmwgfx: skip hash_del_rcu when validation context has no hash table
      drm/vmwgfx: use check_add_overflow for shader size+offset bound
      drm/vmwgfx: validate external BO copy bounds for both stride paths

 drivers/accel/qaic/qaic_control.c            |  2 +-
 drivers/gpu/drm/bridge/display-connector.c   | 11 +++++--
 drivers/gpu/drm/display/drm_dp_helper.c      | 12 +++++++
 drivers/gpu/drm/imagination/pvr_queue.c      |  7 ++--
 drivers/gpu/drm/imagination/pvr_trace.h      | 16 +++++++--
 drivers/gpu/drm/panthor/panthor_fw.c         | 47 ++++++++++++++++++--------
 drivers/gpu/drm/vc4/vc4_irq.c                |  2 +-
 drivers/gpu/drm/vc4/vc4_validate.c           | 29 ++++++++++++----
 drivers/gpu/drm/vmwgfx/ttm_object.c          |  7 ++--
 drivers/gpu/drm/vmwgfx/vmwgfx_blit.c         | 39 +++++++++++++++++-----
 drivers/gpu/drm/vmwgfx/vmwgfx_cursor_plane.c | 49 +++++++++++++++++++++++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c      | 20 ++++++++++--
 drivers/gpu/drm/vmwgfx/vmwgfx_fence.c        | 13 +++++++-
 drivers/gpu/drm/vmwgfx/vmwgfx_page_dirty.c   |  4 +--
 drivers/gpu/drm/vmwgfx/vmwgfx_resource.c     |  4 +--
 drivers/gpu/drm/vmwgfx/vmwgfx_shader.c       | 13 +++++---
 drivers/gpu/drm/vmwgfx/vmwgfx_validation.c   |  3 +-
 drivers/gpu/drm/vmwgfx/vmwgfx_vkms.c         | 17 +++++-----
 18 files changed, 230 insertions(+), 65 deletions(-)