6.1-stable patches

added patches:
	drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch

diff --git a/queue-6.1/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch b/queue-6.1/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
new file mode 100644 (file)
index 0000000..53004c8
--- /dev/null
+++ b/queue-6.1/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
@@ -0,0 +1,66 @@
+From 6f71507415841d1a6d38118e5fa0eaf0caab9c17 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 21 Jan 2025 06:52:03 -0800
+Subject: drm/i915/backlight: Return immediately when scale() finds invalid parameters
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 6f71507415841d1a6d38118e5fa0eaf0caab9c17 upstream.
+
+The scale() functions detects invalid parameters, but continues
+its calculations anyway. This causes bad results if negative values
+are used for unsigned operations. Worst case, a division by 0 error
+will be seen if source_min == source_max.
+
+On top of that, after v6.13, the sequence of WARN_ON() followed by clamp()
+may result in a build error with gcc 13.x.
+
+drivers/gpu/drm/i915/display/intel_backlight.c: In function 'scale':
+include/linux/compiler_types.h:542:45: error:
+       call to '__compiletime_assert_415' declared with attribute error:
+       clamp() low limit source_min greater than high limit source_max
+
+This happens if the compiler decides to rearrange the code as follows.
+
+        if (source_min > source_max) {
+                WARN(..);
+                /* Do the clamp() knowing that source_min > source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        } else {
+                /* Do the clamp knowing that source_min <= source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        }
+
+Fix the problem by evaluating the return values from WARN_ON and returning
+immediately after a warning. While at it, fix divide by zero error seen
+if source_min == source_max.
+
+Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: David Laight <david.laight.linux@gmail.com>
+Cc: David Laight <david.laight.linux@gmail.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250121145203.2851237-1-linux@roeck-us.net
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_backlight.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_backlight.c
++++ b/drivers/gpu/drm/i915/display/intel_backlight.c
+@@ -39,8 +39,9 @@ static u32 scale(u32 source_val,
+ {
+       u64 target_val;
+ 
+-      WARN_ON(source_min > source_max);
+-      WARN_ON(target_min > target_max);
++      if (WARN_ON(source_min >= source_max) ||
++          WARN_ON(target_min > target_max))
++              return target_min;
+ 
+       /* defensive */
+       source_val = clamp(source_val, source_min, source_max);

diff --git a/queue-6.1/series b/queue-6.1/series
index b79dc24204081271d93dfe79759fb4ed000ce104..2f57172e00ea1948767abc934cf8324d162fe526 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -67,3 +67,4 @@ kmsan-fix-out-of-bounds-access-to-shadow-memory.patch
 minmax-make-generic-min-and-max-macros-available-everywhere.patch
 minmax-add-a-few-more-min_t-max_t-users.patch
 minmax-simplify-and-clarify-min_t-max_t-implementation.patch
+drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch