--- /dev/null
+From d925c04d974c657d10471c0c2dba3bc9c7d994ee Mon Sep 17 00:00:00 2001
+From: Alex Hung <alex.hung@amd.com>
+Date: Thu, 27 Jun 2024 16:45:39 -0600
+Subject: drm/amd/display: Check link_res->hpo_dp_link_enc before using it
+
+From: Alex Hung <alex.hung@amd.com>
+
+commit d925c04d974c657d10471c0c2dba3bc9c7d994ee upstream.
+
+[WHAT & HOW]
+Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res
+without initializing hpo_dp_link_enc and it is necessary to check for
+null before dereferencing.
+
+This fixes 1 FORWARD_NULL issue reported by Coverity.
+
+Fixes: 0beca868cde8 ("drm/amd/display: Check link_res->hpo_dp_link_enc before using it")
+Reviewed-by: Rodrigo Siqueira <rodrigo.siqueira@amd.com>
+Signed-off-by: Alex Hung <alex.hung@amd.com>
+Signed-off-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c
++++ b/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c
+@@ -110,6 +110,11 @@ void enable_hpo_dp_link_output(struct dc
+ enum clock_source_id clock_source,
+ const struct dc_link_settings *link_settings)
+ {
++ if (!link_res->hpo_dp_link_enc) {
++ DC_LOG_ERROR("%s: invalid hpo_dp_link_enc\n", __func__);
++ return;
++ }
++
+ if (link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating)
+ link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating(
+ link->dc->res_pool->dccg,
--- /dev/null
+From 23ab1cb6591dba7c97b65eb407cd71147bd878b8 Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Mon, 12 Aug 2024 15:13:32 +0100
+Subject: drm/xe: fix engine_class bounds check again
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit 23ab1cb6591dba7c97b65eb407cd71147bd878b8 upstream.
+
+This was fixed in commit b7dce525c4fc ("drm/xe/queue: fix engine_class
+bounds check"), but then re-introduced in commit 6f20fc09936e ("drm/xe:
+Move and export xe_hw_engine lookup.") which should only be simple code
+movement of the existing function.
+
+Fixes: 6f20fc09936e ("drm/xe: Move and export xe_hw_engine lookup.")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Dominik Grzegorzek <dominik.grzegorzek@intel.com>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: Matthew Brost <matthew.brost@intel.com>
+Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
+Reviewed-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240812141331.729843-2-matthew.auld@intel.com
+Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_hw_engine.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/xe/xe_hw_engine.c
++++ b/drivers/gpu/drm/xe/xe_hw_engine.c
+@@ -1153,7 +1153,7 @@ xe_hw_engine_lookup(struct xe_device *xe
+ {
+ unsigned int idx;
+
+- if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class))
++ if (eci.engine_class >= ARRAY_SIZE(user_to_xe_engine_class))
+ return NULL;
+
+ if (eci.gt_id >= xe->info.gt_count)
--- /dev/null
+From 7f44beadcc11adb98220556d2ddbe9c97aa6d42d Mon Sep 17 00:00:00 2001
+From: Felix Moessbauer <felix.moessbauer@siemens.com>
+Date: Mon, 16 Sep 2024 13:11:50 +0200
+Subject: io_uring/sqpoll: do not put cpumask on stack
+
+From: Felix Moessbauer <felix.moessbauer@siemens.com>
+
+commit 7f44beadcc11adb98220556d2ddbe9c97aa6d42d upstream.
+
+Putting the cpumask on the stack is deprecated for a long time (since
+2d3854a37e8), as these can be big. Given that, change the on-stack
+allocation of allowed_mask to be dynamically allocated.
+
+Fixes: f011c9cf04c0 ("io_uring/sqpoll: do not allow pinning outside of cpuset")
+Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
+Link: https://lore.kernel.org/r/20240916111150.1266191-1-felix.moessbauer@siemens.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/sqpoll.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+--- a/io_uring/sqpoll.c
++++ b/io_uring/sqpoll.c
+@@ -461,15 +461,22 @@ __cold int io_sq_offload_create(struct i
+ return 0;
+
+ if (p->flags & IORING_SETUP_SQ_AFF) {
+- struct cpumask allowed_mask;
++ cpumask_var_t allowed_mask;
+ int cpu = p->sq_thread_cpu;
+
+ ret = -EINVAL;
+ if (cpu >= nr_cpu_ids || !cpu_online(cpu))
+ goto err_sqpoll;
+- cpuset_cpus_allowed(current, &allowed_mask);
+- if (!cpumask_test_cpu(cpu, &allowed_mask))
++ ret = -ENOMEM;
++ if (!alloc_cpumask_var(&allowed_mask, GFP_KERNEL))
+ goto err_sqpoll;
++ ret = -EINVAL;
++ cpuset_cpus_allowed(current, allowed_mask);
++ if (!cpumask_test_cpu(cpu, allowed_mask)) {
++ free_cpumask_var(allowed_mask);
++ goto err_sqpoll;
++ }
++ free_cpumask_var(allowed_mask);
+ sqd->sq_cpu = cpu;
+ } else {
+ sqd->sq_cpu = -1;
--- /dev/null
+From d0a29cdb6ef95d8a175e09ab2d1334271f047e60 Mon Sep 17 00:00:00 2001
+From: Eduard Zingerman <eddyz87@gmail.com>
+Date: Tue, 20 Aug 2024 03:23:50 -0700
+Subject: selftests/bpf: correctly move 'log' upon successful match
+
+From: Eduard Zingerman <eddyz87@gmail.com>
+
+commit d0a29cdb6ef95d8a175e09ab2d1334271f047e60 upstream.
+
+Suppose log="foo bar buz" and msg->substr="bar".
+In such case current match processing logic would update 'log' as
+follows: log += strlen(msg->substr); -> log += 3 -> log=" bar".
+However, the intent behind the 'log' update is to make it point after
+the successful match, e.g. to make log=" buz" in the example above.
+
+Fixes: 4ef5d6af4935 ("selftests/bpf: no need to track next_match_pos in struct test_loader")
+Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
+Link: https://lore.kernel.org/r/20240820102357.3372779-3-eddyz87@gmail.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/test_loader.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/bpf/test_loader.c
++++ b/tools/testing/selftests/bpf/test_loader.c
+@@ -545,7 +545,7 @@ static void validate_msgs(char *log_buf,
+ if (msg->substr) {
+ match = strstr(log, msg->substr);
+ if (match)
+- log += strlen(msg->substr);
++ log = match + strlen(msg->substr);
+ } else {
+ err = regexec(&msg->regex, log, 1, reg_match, 0);
+ if (err == 0) {
xen-move-checks-for-e820-conflicts-further-up.patch
xen-allow-mapping-acpi-data-using-a-different-physical-address.patch
io_uring-sqpoll-retain-test-for-whether-the-cpu-is-valid.patch
+drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch
+drm-xe-fix-engine_class-bounds-check-again.patch
+io_uring-sqpoll-do-not-put-cpumask-on-stack.patch
+selftests-bpf-correctly-move-log-upon-successful-match.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
