5.10-stable patches

added patches:
	drm-amd-restore-cached-power-limit-during-resume.patch
	media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch

diff --git a/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch b/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch
new file mode 100644 (file)
index 0000000..d7b58af
--- /dev/null
+++ b/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch
@@ -0,0 +1,40 @@
+From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001
+From: Mario Limonciello <mario.limonciello@amd.com>
+Date: Thu, 24 Jul 2025 22:12:21 -0500
+Subject: drm/amd: Restore cached power limit during resume
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream.
+
+The power limit will be cached in smu->current_power_limit but
+if the ASIC goes into S3 this value won't be restored.
+
+Restore the value during SMU resume.
+
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -1332,6 +1332,12 @@ static int smu_resume(void *handle)
+ 
+       adev->pm.dpm_enabled = true;
+ 
++      if (smu->current_power_limit) {
++              ret = smu_set_power_limit(smu, smu->current_power_limit);
++              if (ret && ret != -EOPNOTSUPP)
++                      return ret;
++      }
++
+       dev_info(adev->dev, "SMU is resumed successfully!\n");
+ 
+       return 0;

diff --git a/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch b/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
new file mode 100644 (file)
index 0000000..4a3ab91
--- /dev/null
+++ b/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
@@ -0,0 +1,47 @@
+From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+Date: Mon, 19 May 2025 12:42:21 +0530
+Subject: media: venus: Add a check for packet size after reading from shared memory
+
+From: Vedang Nagar <quic_vnagar@quicinc.com>
+
+commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream.
+
+Add a check to ensure that the packet size does not exceed the number of
+available words after reading the packet header from shared memory. This
+ensures that the size provided by the firmware is safe to process and
+prevent potential out-of-bounds memory access.
+
+Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
+Cc: stable@vger.kernel.org
+Signed-off-by: Vedang Nagar <quic_vnagar@quicinc.com>
+Co-developed-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Signed-off-by: Dikshita Agarwal <quic_dikshita@quicinc.com>
+Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
+Signed-off-by: Bryan O'Donoghue <bod@kernel.org>
+Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/platform/qcom/venus/hfi_venus.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/media/platform/qcom/venus/hfi_venus.c
++++ b/drivers/media/platform/qcom/venus/hfi_venus.c
+@@ -240,6 +240,7 @@ static int venus_write_queue(struct venu
+ static int venus_read_queue(struct venus_hfi_device *hdev,
+                           struct iface_queue *queue, void *pkt, u32 *tx_req)
+ {
++      struct hfi_pkt_hdr *pkt_hdr = NULL;
+       struct hfi_queue_header *qhdr;
+       u32 dwords, new_rd_idx;
+       u32 rd_idx, wr_idx, type, qsize;
+@@ -305,6 +306,9 @@ static int venus_read_queue(struct venus
+                       memcpy(pkt, rd_ptr, len);
+                       memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2);
+               }
++              pkt_hdr = (struct hfi_pkt_hdr *)(pkt);
++              if ((pkt_hdr->size >> 2) != dwords)
++                      return -EINVAL;
+       } else {
+               /* bad packet received, dropping */
+               new_rd_idx = qhdr->write_idx;

diff --git a/queue-5.10/series b/queue-5.10/series
index 014bf3677672c3e3d49f9f25c5d84d940ed80daa..1ce0df64af40b94b781c38df3e417f4b541854a7 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -382,3 +382,5 @@ media-imx-fix-a-potential-memory-leak-in-imx_media_csc_scaler_device_init.patch
 media-usbtv-lock-resolution-while-streaming.patch
 media-rainshadow-cec-fix-toctou-race-condition-in-rain_interrupt.patch
 media-ov2659-fix-memory-leaks-in-ov2659_probe.patch
+media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch
+drm-amd-restore-cached-power-limit-during-resume.patch