Merge tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "rc2 fixes for the week, mostly xe, with amdgpu as usual. Then a
  smattering of small fixes across the core/tests/panel and amdxdna.

  I expect things will be quiet for rc3/4 as teams take a break, and I'm
  travelling but will keep an eye on things.

  core:
   - fix gem handle leak on DRM_IOCTL_GEM_CHANGE_HANDLE

  tests:
   - add EDEADLK handling

  amdgpu:
   - Fix no_console_suspend handling
   - DCN 3.5.x seamless boot fixes
   - DP audio fix
   - Fix race in GPU recovery
   - SMU 14 OD fix

  amdkfd:
   - Event fix

  xe:
   - Limit num_syncs to prevent oversized kernel allocations
   - Disallow 0 OA property values
   - Disallow 0 EU stall property values
   - Fix kobject leak
   - Workaround
   - Loop variable reference fix
   - Fix a CONFIG corner-case incorrect number of argument
   - Skip reason prefix while emitting array
   - VF migration fix
   - Fix context in mei interrupt top half
   - Don't include the CCS metadata in the dma-buf sg-table
   - VF queueing recovery work fix
   - Increase TDF timeout
   - GT reset registers vs scheduler ordering fix
   - Adjust long-running workload timeslices
   - Always set OA_OAGLBCTXCTRL_COUNTER_RESUME
   - Fix a return value
   - Drop preempt-fences when destroying imported dma-bufs
   - Use usleep_range for accurate long-running workload timeslicing

  amdxdna:
   - don't load virtualized

  panel:
   - fix visionox-rm69299 Kconfig dependency
   - sony-td4353-jdi probing fix"

* tag 'drm-fixes-2025-12-20' of https://gitlab.freedesktop.org/drm/kernel: (34 commits)
  drm/xe: Use usleep_range for accurate long-running workload timeslicing
  drm/xe: Drop preempt-fences when destroying imported dma-bufs.
  drm/xe/eustall: Disallow 0 EU stall property values
  drm/xe/oa: Disallow 0 OA property values
  drm/xe/xe_sriov_vfio: Fix return value in xe_sriov_vfio_migration_supported()
  drm/xe/oa: Always set OAG_OAGLBCTXCTRL_COUNTER_RESUME
  drm/xe: Adjust long-running workload timeslices to reasonable values
  drm/xe/oa: Limit num_syncs to prevent oversized allocations
  drm/xe: Limit num_syncs to prevent oversized allocations
  drm/amdkfd: Fix improper NULL termination of queue restore SMI event string
  drm/amd/pm: restore SCLK settings after S0ix resume
  drm/amdgpu: fix a job->pasid access race in gpu recovery
  drm/amd/display: Fix DP no audio issue
  drm/amd/display: Fix scratch registers offsets for DCN351
  drm/amd/display: Fix scratch registers offsets for DCN35
  drm/amd: Resume the device in thaw() callback when console suspend is disabled
  drm/panel: visionox-rm69299: Depend on BACKLIGHT_CLASS_DEVICE
  accel/amdxdna: Block running under a hypervisor
  drm/panel: sony-td4353-jdi: Enable prepare_prev_first
  drm/xe: Restore engine registers before restarting schedulers after GT reset
  ...

1 files changed, 2 insertions, 1 deletions

diff --git a/drivers/gpu/drm/xe/xe_exec.c b/drivers/gpu/drm/xe/xe_exec.c
index 4d81210e41f5..fd9480031750 100644
--- a/drivers/gpu/drm/xe/xe_exec.c
+++ b/drivers/gpu/drm/xe/xe_exec.c
@@ -132,7 +132,8 @@ int xe_exec_ioctl(struct drm_device *dev, void *data, struct drm_file *file)
 
 	if (XE_IOCTL_DBG(xe, args->extensions) ||
 	    XE_IOCTL_DBG(xe, args->pad[0] || args->pad[1] || args->pad[2]) ||
-	    XE_IOCTL_DBG(xe, args->reserved[0] || args->reserved[1]))
+	    XE_IOCTL_DBG(xe, args->reserved[0] || args->reserved[1]) ||
+	    XE_IOCTL_DBG(xe, args->num_syncs > DRM_XE_MAX_SYNCS))
 		return -EINVAL;
 
 	q = xe_exec_queue_lookup(xef, args->exec_queue_id);