Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
- fs/efivarfs/super.c | 4 ++++
+ fs/efivarfs/super.c | 4 ++++
1 file changed, 4 insertions(+)
-diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
-index d12a21b2dd9d0..0f3d3d96599b8 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
-@@ -46,6 +46,10 @@ static int efivarfs_d_compare(const struct dentry *dentry,
+@@ -46,6 +46,10 @@ static int efivarfs_d_compare(const stru
{
int guid = len - EFI_VARIABLE_GUID_LEN;
if (name->len != len)
return 1;
---
-2.50.1
-
--- /dev/null
+From d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 Mon Sep 17 00:00:00 2001
+From: Qasim Ijaz <qasdev00@gmail.com>
+Date: Sun, 10 Aug 2025 19:10:41 +0100
+Subject: HID: asus: fix UAF via HID_CLAIMED_INPUT validation
+
+From: Qasim Ijaz <qasdev00@gmail.com>
+
+commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 upstream.
+
+After hid_hw_start() is called hidinput_connect() will eventually be
+called to set up the device with the input layer since the
+HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect()
+all input and output reports are processed and corresponding hid_inputs
+are allocated and configured via hidinput_configure_usages(). This
+process involves slot tagging report fields and configuring usages
+by setting relevant bits in the capability bitmaps. However it is possible
+that the capability bitmaps are not set at all leading to the subsequent
+hidinput_has_been_populated() check to fail leading to the freeing of the
+hid_input and the underlying input device.
+
+This becomes problematic because a malicious HID device like a
+ASUS ROG N-Key keyboard can trigger the above scenario via a
+specially crafted descriptor which then leads to a user-after-free
+when the name of the freed input device is written to later on after
+hid_hw_start(). Below, report 93 intentionally utilises the
+HID_UP_UNDEFINED Usage Page which is skipped during usage
+configuration, leading to the frees.
+
+0x05, 0x0D, // Usage Page (Digitizer)
+0x09, 0x05, // Usage (Touch Pad)
+0xA1, 0x01, // Collection (Application)
+0x85, 0x0D, // Report ID (13)
+0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00)
+0x09, 0xC5, // Usage (0xC5)
+0x15, 0x00, // Logical Minimum (0)
+0x26, 0xFF, 0x00, // Logical Maximum (255)
+0x75, 0x08, // Report Size (8)
+0x95, 0x04, // Report Count (4)
+0xB1, 0x02, // Feature (Data,Var,Abs)
+0x85, 0x5D, // Report ID (93)
+0x06, 0x00, 0x00, // Usage Page (Undefined)
+0x09, 0x01, // Usage (0x01)
+0x15, 0x00, // Logical Minimum (0)
+0x26, 0xFF, 0x00, // Logical Maximum (255)
+0x75, 0x08, // Report Size (8)
+0x95, 0x1B, // Report Count (27)
+0x81, 0x02, // Input (Data,Var,Abs)
+0xC0, // End Collection
+
+Below is the KASAN splat after triggering the UAF:
+
+[ 21.672709] ==================================================================
+[ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80
+[ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54
+[ 21.673700]
+[ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary)
+[ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
+[ 21.673700] Call Trace:
+[ 21.673700] <TASK>
+[ 21.673700] dump_stack_lvl+0x5f/0x80
+[ 21.673700] print_report+0xd1/0x660
+[ 21.673700] kasan_report+0xe5/0x120
+[ 21.673700] __asan_report_store8_noabort+0x1b/0x30
+[ 21.673700] asus_probe+0xeeb/0xf80
+[ 21.673700] hid_device_probe+0x2ee/0x700
+[ 21.673700] really_probe+0x1c6/0x6b0
+[ 21.673700] __driver_probe_device+0x24f/0x310
+[ 21.673700] driver_probe_device+0x4e/0x220
+[...]
+[ 21.673700]
+[ 21.673700] Allocated by task 54:
+[ 21.673700] kasan_save_stack+0x3d/0x60
+[ 21.673700] kasan_save_track+0x18/0x40
+[ 21.673700] kasan_save_alloc_info+0x3b/0x50
+[ 21.673700] __kasan_kmalloc+0x9c/0xa0
+[ 21.673700] __kmalloc_cache_noprof+0x139/0x340
+[ 21.673700] input_allocate_device+0x44/0x370
+[ 21.673700] hidinput_connect+0xcb6/0x2630
+[ 21.673700] hid_connect+0xf74/0x1d60
+[ 21.673700] hid_hw_start+0x8c/0x110
+[ 21.673700] asus_probe+0x5a3/0xf80
+[ 21.673700] hid_device_probe+0x2ee/0x700
+[ 21.673700] really_probe+0x1c6/0x6b0
+[ 21.673700] __driver_probe_device+0x24f/0x310
+[ 21.673700] driver_probe_device+0x4e/0x220
+[...]
+[ 21.673700]
+[ 21.673700] Freed by task 54:
+[ 21.673700] kasan_save_stack+0x3d/0x60
+[ 21.673700] kasan_save_track+0x18/0x40
+[ 21.673700] kasan_save_free_info+0x3f/0x60
+[ 21.673700] __kasan_slab_free+0x3c/0x50
+[ 21.673700] kfree+0xcf/0x350
+[ 21.673700] input_dev_release+0xab/0xd0
+[ 21.673700] device_release+0x9f/0x220
+[ 21.673700] kobject_put+0x12b/0x220
+[ 21.673700] put_device+0x12/0x20
+[ 21.673700] input_free_device+0x4c/0xb0
+[ 21.673700] hidinput_connect+0x1862/0x2630
+[ 21.673700] hid_connect+0xf74/0x1d60
+[ 21.673700] hid_hw_start+0x8c/0x110
+[ 21.673700] asus_probe+0x5a3/0xf80
+[ 21.673700] hid_device_probe+0x2ee/0x700
+[ 21.673700] really_probe+0x1c6/0x6b0
+[ 21.673700] __driver_probe_device+0x24f/0x310
+[ 21.673700] driver_probe_device+0x4e/0x220
+[...]
+
+Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Qasim Ijaz <qasdev00@gmail.com>
+Link: https://patch.msgid.link/20250810181041.44874-1-qasdev00@gmail.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-asus.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-asus.c
++++ b/drivers/hid/hid-asus.c
+@@ -1035,7 +1035,13 @@ static int asus_probe(struct hid_device
+ return ret;
+ }
+
+- if (!drvdata->input) {
++ /*
++ * Check that input registration succeeded. Checking that
++ * HID_CLAIMED_INPUT is set prevents a UAF when all input devices
++ * were freed during registration due to no usages being mapped,
++ * leaving drvdata->input pointing to freed memory.
++ */
++ if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) {
+ hid_err(hdev, "Asus input not registered\n");
+ ret = -ENOMEM;
+ goto err_stop_hw;
--- /dev/null
+From 185c926283da67a72df20a63a5046b3b4631b7d9 Mon Sep 17 00:00:00 2001
+From: Minjong Kim <minbell.kim@samsung.com>
+Date: Wed, 13 Aug 2025 19:30:22 +0900
+Subject: HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()
+
+From: Minjong Kim <minbell.kim@samsung.com>
+
+commit 185c926283da67a72df20a63a5046b3b4631b7d9 upstream.
+
+in ntrig_report_version(), hdev parameter passed from hid_probe().
+sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null
+if hdev->dev.parent->parent is null, usb_dev has
+invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned
+when usb_rcvctrlpipe() use usb_dev,it trigger
+page fault error for address(0xffffffffffffff58)
+
+add null check logic to ntrig_report_version()
+before calling hid_to_usb_dev()
+
+Signed-off-by: Minjong Kim <minbell.kim@samsung.com>
+Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com
+Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/hid-ntrig.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -144,6 +144,9 @@ static void ntrig_report_version(struct
+ struct usb_device *usb_dev = hid_to_usb_dev(hdev);
+ unsigned char *data = kmalloc(8, GFP_KERNEL);
+
++ if (!hid_is_usb(hdev))
++ return;
++
+ if (!data)
+ goto err_free;
+
--- /dev/null
+From 9fc51941d9e7793da969b2c66e6f8213c5b1237f Mon Sep 17 00:00:00 2001
+From: Ping Cheng <pinglinux@gmail.com>
+Date: Sun, 10 Aug 2025 22:40:30 -0700
+Subject: HID: wacom: Add a new Art Pen 2
+
+From: Ping Cheng <pinglinux@gmail.com>
+
+commit 9fc51941d9e7793da969b2c66e6f8213c5b1237f upstream.
+
+Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/hid/wacom_wac.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -684,6 +684,7 @@ static bool wacom_is_art_pen(int tool_id
+ case 0x885: /* Intuos3 Marker Pen */
+ case 0x804: /* Intuos4/5 13HD/24HD Marker Pen */
+ case 0x10804: /* Intuos4/5 13HD/24HD Art Pen */
++ case 0x204: /* Art Pen 2 */
+ is_art_pen = true;
+ break;
+ }
--- /dev/null
+From c87bd4dd43a624109c3cc42d843138378a7f4548 Mon Sep 17 00:00:00 2001
+From: Thijs Raymakers <thijs@raymakers.nl>
+Date: Mon, 4 Aug 2025 08:44:05 +0200
+Subject: KVM: x86: use array_index_nospec with indices that come from guest
+
+From: Thijs Raymakers <thijs@raymakers.nl>
+
+commit c87bd4dd43a624109c3cc42d843138378a7f4548 upstream.
+
+min and dest_id are guest-controlled indices. Using array_index_nospec()
+after the bounds checks clamps these values to mitigate speculative execution
+side-channels.
+
+Signed-off-by: Thijs Raymakers <thijs@raymakers.nl>
+Cc: stable@vger.kernel.org
+Cc: Sean Christopherson <seanjc@google.com>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Fixes: 715062970f37 ("KVM: X86: Implement PV sched yield hypercall")
+Fixes: bdf7ffc89922 ("KVM: LAPIC: Fix pv ipis out-of-bounds access")
+Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall")
+Link: https://lore.kernel.org/r/20250804064405.4802-1-thijs@raymakers.nl
+Signed-off-by: Sean Christopherson <seanjc@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/kvm/lapic.c | 3 +++
+ arch/x86/kvm/x86.c | 7 +++++--
+ 2 files changed, 8 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -589,6 +589,9 @@ int kvm_pv_send_ipi(struct kvm *kvm, uns
+
+ if (min > map->max_apic_id)
+ goto out;
++
++ min = array_index_nospec(min, map->max_apic_id + 1);
++
+ /* Bits above cluster_size are masked in the caller. */
+ for_each_set_bit(i, &ipi_bitmap_low,
+ min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -7506,8 +7506,11 @@ static void kvm_sched_yield(struct kvm *
+ rcu_read_lock();
+ map = rcu_dereference(kvm->arch.apic_map);
+
+- if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id])
+- target = map->phys_map[dest_id]->vcpu;
++ if (likely(map) && dest_id <= map->max_apic_id) {
++ dest_id = array_index_nospec(dest_id, map->max_apic_id + 1);
++ if (map->phys_map[dest_id])
++ target = map->phys_map[dest_id]->vcpu;
++ }
+
+ rcu_read_unlock();
+
--- /dev/null
+From e81a7f65288c7e2cfb7e7890f648e099fd885ab3 Mon Sep 17 00:00:00 2001
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+Date: Fri, 22 Aug 2025 11:13:24 +0200
+Subject: net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions
+
+From: Fabio Porcedda <fabio.porcedda@gmail.com>
+
+commit e81a7f65288c7e2cfb7e7890f648e099fd885ab3 upstream.
+
+Add the following Telit Cinterion LE910C4-WWX new compositions:
+
+0x1034: tty (AT) + tty (AT) + rmnet
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1034 Rev=00.00
+S: Manufacturer=Telit
+S: Product=LE910C4-WWX
+S: SerialNumber=93f617e7
+C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1037 Rev=00.00
+S: Manufacturer=Telit
+S: Product=LE910C4-WWX
+S: SerialNumber=93f617e7
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet
+T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=1bc7 ProdID=1038 Rev=00.00
+S: Manufacturer=Telit
+S: Product=LE910C4-WWX
+S: SerialNumber=93f617e7
+C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
+E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
+E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
+Link: https://patch.msgid.link/20250822091324.39558-1-Fabio.Porcedda@telit.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1319,6 +1319,9 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
+ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1034, 2)}, /* Telit LE910C4-WWX */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1037, 4)}, /* Telit LE910C4-WWX */
++ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1038, 3)}, /* Telit LE910C4-WWX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
--- /dev/null
+From ac4ed2da4c1305a1a002415058aa7deaf49ffe3e Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 25 Aug 2025 13:40:22 -0400
+Subject: Revert "drm/amdgpu: fix incorrect vm flags to map bo"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit ac4ed2da4c1305a1a002415058aa7deaf49ffe3e upstream.
+
+This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f.
+
+Revert this to align with 6.17 because the fixes tag
+was wrong on this commit.
+
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit be33e8a239aac204d7e9e673c4220ef244eb1ba3)
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c
+@@ -94,8 +94,8 @@ int amdgpu_map_static_csa(struct amdgpu_
+ }
+
+ r = amdgpu_vm_bo_map(adev, *bo_va, csa_addr, 0, size,
+- AMDGPU_VM_PAGE_READABLE | AMDGPU_VM_PAGE_WRITEABLE |
+- AMDGPU_VM_PAGE_EXECUTABLE);
++ AMDGPU_PTE_READABLE | AMDGPU_PTE_WRITEABLE |
++ AMDGPU_PTE_EXECUTABLE);
+
+ if (r) {
+ DRM_ERROR("failed to do bo_map on static CSA, err=%d\n", r);
net-stmmac-xgmac-do-not-enable-rx-fifo-overflow-inte.patch
sctp-initialize-more-fields-in-sctp_v6_from_sk.patch
efivarfs-fix-slab-out-of-bounds-in-efivarfs_d_compar.patch
+kvm-x86-use-array_index_nospec-with-indices-that-come-from-guest.patch
+hid-asus-fix-uaf-via-hid_claimed_input-validation.patch
+hid-wacom-add-a-new-art-pen-2.patch
+hid-hid-ntrig-fix-unable-to-handle-page-fault-in-ntrig_report_version.patch
+revert-drm-amdgpu-fix-incorrect-vm-flags-to-map-bo.patch
+net-usb-qmi_wwan-add-telit-cinterion-le910c4-wwx-new-compositions.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
