5.15-stable patches

added patches:
	drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch
	drm-amdgpu-only-check-for-_pr3-on-dgpus.patch
	locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch

diff --git a/queue-5.15/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch b/queue-5.15/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch
new file mode 100644 (file)
index 0000000..f331d1a
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch
@@ -0,0 +1,81 @@
+From 901e2be20dc55079997ea1885ea77fc72e6826e7 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 24 Jan 2022 13:42:30 -0500
+Subject: drm/amdgpu: move PX checking into amdgpu_device_ip_early_init
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 901e2be20dc55079997ea1885ea77fc72e6826e7 upstream.
+
+We need to set the APU flag from IP discovery before
+we evaluate this code.
+
+Acked-by: Evan Quan <evan.quan@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c |   13 +++++++++++++
+ drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c    |   11 -----------
+ 2 files changed, 13 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -30,6 +30,7 @@
+ #include <linux/module.h>
+ #include <linux/console.h>
+ #include <linux/slab.h>
++#include <linux/pci.h>
+ 
+ #include <drm/drm_atomic_helper.h>
+ #include <drm/drm_probe_helper.h>
+@@ -2069,6 +2070,8 @@ out:
+  */
+ static int amdgpu_device_ip_early_init(struct amdgpu_device *adev)
+ {
++      struct drm_device *dev = adev_to_drm(adev);
++      struct pci_dev *parent;
+       int i, r;
+ 
+       amdgpu_device_enable_virtual_display(adev);
+@@ -2168,6 +2171,16 @@ static int amdgpu_device_ip_early_init(s
+               return -EINVAL;
+       }
+ 
++      if (amdgpu_has_atpx() &&
++          (amdgpu_is_atpx_hybrid() ||
++           amdgpu_has_atpx_dgpu_power_cntl()) &&
++          ((adev->flags & AMD_IS_APU) == 0) &&
++          !pci_is_thunderbolt_attached(to_pci_dev(dev->dev)))
++              adev->flags |= AMD_IS_PX;
++
++      parent = pci_upstream_bridge(adev->pdev);
++      adev->has_pr3 = parent ? pci_pr3_present(parent) : false;
++
+       amdgpu_amdkfd_device_probe(adev);
+ 
+       adev->pm.pp_feature = amdgpu_pp_feature_mask;
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+@@ -152,21 +152,10 @@ static void amdgpu_get_audio_func(struct
+ int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags)
+ {
+       struct drm_device *dev;
+-      struct pci_dev *parent;
+       int r, acpi_status;
+ 
+       dev = adev_to_drm(adev);
+ 
+-      if (amdgpu_has_atpx() &&
+-          (amdgpu_is_atpx_hybrid() ||
+-           amdgpu_has_atpx_dgpu_power_cntl()) &&
+-          ((flags & AMD_IS_APU) == 0) &&
+-          !pci_is_thunderbolt_attached(to_pci_dev(dev->dev)))
+-              flags |= AMD_IS_PX;
+-
+-      parent = pci_upstream_bridge(adev->pdev);
+-      adev->has_pr3 = parent ? pci_pr3_present(parent) : false;
+-
+       /* amdgpu_device_init should report only fatal error
+        * like memory allocation failure or iomapping failure,
+        * or memory manager initialization failure, it must

diff --git a/queue-5.15/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch b/queue-5.15/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch
new file mode 100644 (file)
index 0000000..b9f12c9
--- /dev/null
+++ b/queue-5.15/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch
@@ -0,0 +1,35 @@
+From 85ac2021fe3ace59cc0afd6edf005abad35625b0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 25 Jan 2022 15:04:54 -0500
+Subject: drm/amdgpu: only check for _PR3 on dGPUs
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 85ac2021fe3ace59cc0afd6edf005abad35625b0 upstream.
+
+We don't support runtime pm on APUs.  They support more
+dynamic power savings using clock and powergating.
+
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Tested-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c |    6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -2178,8 +2178,10 @@ static int amdgpu_device_ip_early_init(s
+           !pci_is_thunderbolt_attached(to_pci_dev(dev->dev)))
+               adev->flags |= AMD_IS_PX;
+ 
+-      parent = pci_upstream_bridge(adev->pdev);
+-      adev->has_pr3 = parent ? pci_pr3_present(parent) : false;
++      if (!(adev->flags & AMD_IS_APU)) {
++              parent = pci_upstream_bridge(adev->pdev);
++              adev->has_pr3 = parent ? pci_pr3_present(parent) : false;
++      }
+ 
+       amdgpu_amdkfd_device_probe(adev);
+ 

diff --git a/queue-5.15/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch b/queue-5.15/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch
new file mode 100644 (file)
index 0000000..b3be1a2
--- /dev/null
+++ b/queue-5.15/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch
@@ -0,0 +1,87 @@
+From 61cc4534b6550997c97a03759ab46b29d44c0017 Mon Sep 17 00:00:00 2001
+From: Waiman Long <longman@redhat.com>
+Date: Sun, 2 Jan 2022 21:35:58 -0500
+Subject: locking/lockdep: Avoid potential access of invalid memory in lock_class
+
+From: Waiman Long <longman@redhat.com>
+
+commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream.
+
+It was found that reading /proc/lockdep after a lockdep splat may
+potentially cause an access to freed memory if lockdep_unregister_key()
+is called after the splat but before access to /proc/lockdep [1]. This
+is due to the fact that graph_lock() call in lockdep_unregister_key()
+fails after the clearing of debug_locks by the splat process.
+
+After lockdep_unregister_key() is called, the lock_name may be freed
+but the corresponding lock_class structure still have a reference to
+it. That invalid memory pointer will then be accessed when /proc/lockdep
+is read by a user and a use-after-free (UAF) error will be reported if
+KASAN is enabled.
+
+To fix this problem, lockdep_unregister_key() is now modified to always
+search for a matching key irrespective of the debug_locks state and
+zap the corresponding lock class if a matching one is found.
+
+[1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/
+
+Fixes: 8b39adbee805 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again")
+Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Signed-off-by: Waiman Long <longman@redhat.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Reviewed-by: Bart Van Assche <bvanassche@acm.org>
+Cc: Cheng-Jui Wang <cheng-jui.wang@mediatek.com>
+Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/locking/lockdep.c |   24 +++++++++++++++---------
+ 1 file changed, 15 insertions(+), 9 deletions(-)
+
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -6276,7 +6276,13 @@ void lockdep_reset_lock(struct lockdep_m
+               lockdep_reset_lock_reg(lock);
+ }
+ 
+-/* Unregister a dynamically allocated key. */
++/*
++ * Unregister a dynamically allocated key.
++ *
++ * Unlike lockdep_register_key(), a search is always done to find a matching
++ * key irrespective of debug_locks to avoid potential invalid access to freed
++ * memory in lock_class entry.
++ */
+ void lockdep_unregister_key(struct lock_class_key *key)
+ {
+       struct hlist_head *hash_head = keyhashentry(key);
+@@ -6291,10 +6297,8 @@ void lockdep_unregister_key(struct lock_
+               return;
+ 
+       raw_local_irq_save(flags);
+-      if (!graph_lock())
+-              goto out_irq;
++      lockdep_lock();
+ 
+-      pf = get_pending_free();
+       hlist_for_each_entry_rcu(k, hash_head, hash_entry) {
+               if (k == key) {
+                       hlist_del_rcu(&k->hash_entry);
+@@ -6302,11 +6306,13 @@ void lockdep_unregister_key(struct lock_
+                       break;
+               }
+       }
+-      WARN_ON_ONCE(!found);
+-      __lockdep_free_key_range(pf, key, 1);
+-      call_rcu_zapped(pf);
+-      graph_unlock();
+-out_irq:
++      WARN_ON_ONCE(!found && debug_locks);
++      if (found) {
++              pf = get_pending_free();
++              __lockdep_free_key_range(pf, key, 1);
++              call_rcu_zapped(pf);
++      }
++      lockdep_unlock();
+       raw_local_irq_restore(flags);
+ 
+       /* Wait until is_dynamic_key() has finished accessing k->hash_entry. */

diff --git a/queue-5.15/series b/queue-5.15/series
index d5c49e345bddd5c9a45ef1158b2c14dbe216e040..bb14a2251dbe745088bfa9f415b302acae044c86 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -23,3 +23,6 @@ input-zinitix-do-not-report-shadow-fingers.patch
 af_key-add-__gfp_zero-flag-for-compose_sadb_supporte.patch
 net-dsa-microchip-add-spi_device_id-tables.patch
 selftests-vm-fix-clang-build-error-multiple-output-f.patch
+locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch
+drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch
+drm-amdgpu-only-check-for-_pr3-on-dgpus.patch