5.10-stable patches

added patches:
	drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch

diff --git a/queue-5.10/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch b/queue-5.10/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch
new file mode 100644 (file)
index 0000000..e704628
--- /dev/null
+++ b/queue-5.10/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch
@@ -0,0 +1,53 @@
+From 439cf34c8e0a8a33d8c15a31be1b7423426bc765 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 9 Feb 2022 11:19:27 +0200
+Subject: drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 439cf34c8e0a8a33d8c15a31be1b7423426bc765 upstream.
+
+Make sure we don't assign an error pointer to crtc_state->mode_blob
+as that will break all kinds of places that assume either NULL or a
+valid pointer (eg. drm_property_blob_put()).
+
+Cc: stable@vger.kernel.org
+Reported-by: fuyufan <fuyufan@huawei.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220209091928.14766-1-ville.syrjala@linux.intel.com
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -75,15 +75,17 @@ int drm_atomic_set_mode_for_crtc(struct
+       state->mode_blob = NULL;
+ 
+       if (mode) {
++              struct drm_property_blob *blob;
++
+               drm_mode_convert_to_umode(&umode, mode);
+-              state->mode_blob =
+-                      drm_property_create_blob(state->crtc->dev,
+-                                               sizeof(umode),
+-                                               &umode);
+-              if (IS_ERR(state->mode_blob))
+-                      return PTR_ERR(state->mode_blob);
++              blob = drm_property_create_blob(crtc->dev,
++                                              sizeof(umode), &umode);
++              if (IS_ERR(blob))
++                      return PTR_ERR(blob);
+ 
+               drm_mode_copy(&state->mode, mode);
++
++              state->mode_blob = blob;
+               state->enable = true;
+               DRM_DEBUG_ATOMIC("Set [MODE:%s] for [CRTC:%d:%s] state %p\n",
+                                mode->name, crtc->base.id, crtc->name, state);

diff --git a/queue-5.10/series b/queue-5.10/series
index f9783eb9923c86a8eb4c0991a36eada48ac8341b..2cba263ff50202c541ea0abb51c6cf0fdf0bcc79 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -62,3 +62,4 @@ ext4-only-check-dquot_initialize_needed-when-debugging.patch
 tcp-fix-tcp_min_tso_segs-sysctl.patch
 xfs-verify-buffer-contents-when-we-skip-log-replay.patch
 mips-locking-atomic-fix-atomic-_64-_sub_if_positive.patch
+drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch