Commit 2765233a483f for kernel

commit 2765233a483febb1bf56f0abdcc5aa06d25633d7
Merge: f5e5d3509bff 7164d78559b0
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri May 29 19:08:20 2026 -0700

    Merge tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel

    Pull drm fixes from Dave Airlie:
     "Regular pull, doesn't seem too insane or AI owned, couple of UAF fixes
      and another repair for an earlier fix, mostly amdgpu and i915 display
      with xe/i915 accel, and misc core/driver fixes.

      It might be a bit bigger than usual at this stage, but I'm not seeing
      anything too scary here.

      dumb-buffer:
       - prevent overflows in dumb-buffer creation

      dma-buf:
       - fix UAF in dma_buf_fd() tracepoint

      gem:
       - fix for the fix for the fix for the change handle ioctl

      i915:
       - Fix potential UAF in TTM object purge
       - Use polling when irqs are unavailable
       - Fix HDR pre-CSC LUT programming loop
       - Block DC states on vblank enable when Panel Replay supported
       - Use DC_OFF wake reference to block DC6 on vblank enable

      xe:
       - Restore IDLEDLY regiter on engine reset

      amdgpu:
       - GEM_OP warning fix
       - GEM_OP locking fix
       - Userq fixes
       - DCN 2.1 refclk fix
       - SI fix
       - HMM fixes

      amdkfd:
       - svm_range_set_attr locking fix
       - CRIU restore fix
       - KFD debugger fix

      amdxdna:
       - require IOMMU on AIE2

      hyperv:
       - improve protocol validation

      ivpu:
       - test write offset in debugfs

      rocket:
       - fix UAF in bo creation"

    * tag 'drm-fixes-2026-05-30' of https://gitlab.freedesktop.org/drm/kernel: (33 commits)
      drm/gem: fix race between change_handle and handle_delete
      drm: prevent integer overflows in dumb buffer creation helpers
      dma-buf: fix UAF in dma_buf_fd() tracepoint
      drm/amdgpu: fix calling VM invalidation in amdgpu_hmm_invalidate_gfx
      drm/amdgpu: fix amdgpu_hmm_range_get_pages
      drm/amdgpu/userq: use array instead of list for userq_vas
      drm/amdgpu/userq: move mqd_destroy to later stage to keep core obj valid
      drm/amdkfd: fix a vulnerability of integer overflow in kfd debugger
      drm/amdgpu/userq: remove amdgpu_userq_create/destroy_object wrapper
      drm/amd/pm/si: Disregard vblank time when no displays are connected
      drm/amdkfd: Check for pdd drm file first in CRIU restore path
      drm/amdgpu: fix potential overflow in fs_info.debugfs_name
      drm/amdgpu/userq: make sure queue is valid in the hang_detect_work
      drm/amdgpu/userq: reserve root bo without interruption
      drm/amdgpu/userq: add amdgpu_bo_unpin when amdgpu_ttm_alloc_gart fails
      drm/amdgpu: simplify return value in amdgpu_userq_get_doorbell_index
      drm/amdkfd: fix NULL pointer bug in svm_range_set_attr
      drm/amd/display: Write REFCLK to 48MHz on DCN21
      drm/amdgpu/userq: Fix the mutex_init cleanup for fence_drv_lock
      drm/amdgpu/userq: Fix doorbell object cleanup of queue
      ...