--- /dev/null
+fbdev-color-map-copying-bounds-checking.patch
+tile-ptrace-preserve-previous-registers-for-short-regset-write.patch
+drm-fix-broken-vt-switch-with-video-1366x768-option.patch
--- /dev/null
+From fdf35a6b22247746a7053fc764d04218a9306f82 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Mon, 9 Jan 2017 15:56:14 +0100
+Subject: drm: Fix broken VT switch with video=1366x768 option
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit fdf35a6b22247746a7053fc764d04218a9306f82 upstream.
+
+I noticed that the VT switch doesn't work any longer with a Dell
+laptop with 1366x768 eDP when the machine is connected with a DP
+monitor. It behaves as if VT were switched, but the graphics remain
+frozen. Actually the keyboard works, so I could switch back to VT7
+again.
+
+I tried to track down the problem, and encountered a long story until
+we reach to this error:
+
+- The machine is booted with video=1366x768 option (the distro
+ installer seems to add it as default).
+- Recently, drm_helper_probe_single_connector_modes() deals with
+ cmdline modes, and it tries to create a new mode when no
+ matching mode is found.
+- The drm_mode_create_from_cmdline_mode() creates a mode based on
+ either CVT of GFT according to the given cmdline mode; in our case,
+ it's 1366x768.
+- Since both CVT and GFT can't express the width 1366 due to
+ alignment, the resultant mode becomes 1368x768, slightly larger than
+ the given size.
+- Later on, the atomic commit is performed, and in
+ drm_atomic_check_only(), the size of each plane is checked.
+- The size check of 1366x768 fails due to the above, and eventually
+ the whole VT switch fails.
+
+Back in the history, we've had a manual fix-up of 1368x768 in various
+places via c09dedb7a50e ("drm/edid: Add a workaround for 1366x768 HD
+panel"), but they have been all in drm_edid.c at probing the modes
+from EDID. For addressing the problem above, we need a similar hack
+to the mode newly created from cmdline, manually adjusting the width
+when the expected size is 1366 while we get 1368 instead.
+
+Fixes: eaf99c749d43 ("drm: Perform cmdline mode parsing during...")
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170109145614.29454-1-tiwai@suse.de
+Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_modes.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/drm_modes.c
++++ b/drivers/gpu/drm/drm_modes.c
+@@ -1462,6 +1462,13 @@ drm_mode_create_from_cmdline_mode(struct
+ return NULL;
+
+ mode->type |= DRM_MODE_TYPE_USERDEF;
++ /* fix up 1368x768: GFT/CVT can't express 1366 width due to alignment */
++ if (cmd->xres == 1366 && mode->hdisplay == 1368) {
++ mode->hdisplay = 1366;
++ mode->hsync_start--;
++ mode->hsync_end--;
++ drm_mode_set_name(mode);
++ }
+ drm_mode_set_crtcinfo(mode, CRTC_INTERLACE_HALVE_V);
+ return mode;
+ }
--- /dev/null
+From 3bfdfdcbce2796ce75bf2d85fd8471858d702e5d Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Mon, 7 Nov 2016 22:20:54 +0200
+Subject: drm/i915: Ignore bogus plane coordinates on SKL when the plane is not visible
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 3bfdfdcbce2796ce75bf2d85fd8471858d702e5d upstream.
+
+When the plane is invisible we may have all sorts of bogus stuff
+in the coordinates, which we must ignore or else we might fail the
+plane update. This started to happen on SKL when I moved the plane
+offset computation to happen in the check phase. Previously we
+happily ignored it all since we never called the update_plane hook
+with an invisible plane.
+
+Cc: Sivakumar Thulasimani <sivakumar.thulasimani@intel.com>
+Cc: drm-intel-fixes@lists.freedesktop.org
+Fixes: b63a16f6cd89 ("drm/i915: Compute display surface offset in the plane check hook for SKL+")
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=98258
+Testcase: igt/pm_rpm/legacy-planes
+Testcase: igt/pm_rpm/universal-planes
+Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
+Signed-off-by: Matt Roper <matthew.d.roper@intel.com>
+Link: http://patchwork.freedesktop.org/patch/msgid/1478550057-24864-3-git-send-email-ville.syrjala@linux.intel.com
+(cherry picked from commit a5e4c7d0aa6784d8abe95c3ceef0da9656d17468)
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -2975,6 +2975,9 @@ int skl_check_plane_surface(struct intel
+ unsigned int rotation = plane_state->base.rotation;
+ int ret;
+
++ if (!plane_state->base.visible)
++ return 0;
++
+ /* Rotate src coordinates to match rotated GTT view */
+ if (intel_rotation_90_or_270(rotation))
+ drm_rect_rotate(&plane_state->base.src,
--- /dev/null
+From 68f458eec7069d618a6c884ca007426e0cea411b Mon Sep 17 00:00:00 2001
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+Date: Mon, 9 Jan 2017 16:31:58 +0200
+Subject: drm: Schedule the output_poll_work with 1s delay if we have delayed event
+
+From: Peter Ujfalusi <peter.ujfalusi@ti.com>
+
+commit 68f458eec7069d618a6c884ca007426e0cea411b upstream.
+
+Instead of scheduling the work to handle the initial delayed event, use 1s
+delay.
+
+This delay should not be needed, but Optimus/nouveau will fail in a
+mysterious way if the delayed event is handled as soon as possible like it
+is done in drm_helper_probe_single_connector_modes() in case the poll
+was enabled before.
+
+Reverting 339fd36238dd would give back the 10 sec (!) delay to handle the
+delayed event. Adding 1sec delay to the poll_work is enough to work around
+the issue in Optimus setups and gives shorter response on handling the
+initial delayed event.
+
+Fixes: 339fd36238dd ("drm: drm_probe_helper: Fix output_poll_work scheduling")
+Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
+[danvet: Add FIXME to the comment to make it stick out more.]
+Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
+Link: http://patchwork.freedesktop.org/patch/msgid/20170109143158.21917-1-peter.ujfalusi@ti.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_probe_helper.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/drm_probe_helper.c
++++ b/drivers/gpu/drm/drm_probe_helper.c
+@@ -143,8 +143,18 @@ void drm_kms_helper_poll_enable_locked(s
+ }
+
+ if (dev->mode_config.delayed_event) {
++ /*
++ * FIXME:
++ *
++ * Use short (1s) delay to handle the initial delayed event.
++ * This delay should not be needed, but Optimus/nouveau will
++ * fail in a mysterious way if the delayed event is handled as
++ * soon as possible like it is done in
++ * drm_helper_probe_single_connector_modes() in case the poll
++ * was enabled before.
++ */
+ poll = true;
+- delay = 0;
++ delay = HZ;
+ }
+
+ if (poll)
--- /dev/null
+From 2dc705a9930b4806250fbf5a76e55266e59389f2 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Tue, 24 Jan 2017 15:18:24 -0800
+Subject: fbdev: color map copying bounds checking
+
+From: Kees Cook <keescook@chromium.org>
+
+commit 2dc705a9930b4806250fbf5a76e55266e59389f2 upstream.
+
+Copying color maps to userspace doesn't check the value of to->start,
+which will cause kernel heap buffer OOB read due to signedness wraps.
+
+CVE-2016-8405
+
+Link: http://lkml.kernel.org/r/20170105224249.GA50925@beast
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Reported-by: Peter Pi (@heisecode) of Trend Micro
+Cc: Min Chong <mchong@google.com>
+Cc: Dan Carpenter <dan.carpenter@oracle.com>
+Cc: Tomi Valkeinen <tomi.valkeinen@ti.com>
+Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/video/fbdev/core/fbcmap.c | 26 ++++++++++++++------------
+ 1 file changed, 14 insertions(+), 12 deletions(-)
+
+--- a/drivers/video/fbdev/core/fbcmap.c
++++ b/drivers/video/fbdev/core/fbcmap.c
+@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cma
+
+ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to)
+ {
+- int tooff = 0, fromoff = 0;
+- int size;
++ unsigned int tooff = 0, fromoff = 0;
++ size_t size;
+
+ if (to->start > from->start)
+ fromoff = to->start - from->start;
+ else
+ tooff = from->start - to->start;
+- size = to->len - tooff;
+- if (size > (int) (from->len - fromoff))
+- size = from->len - fromoff;
+- if (size <= 0)
++ if (fromoff >= from->len || tooff >= to->len)
++ return -EINVAL;
++
++ size = min_t(size_t, to->len - tooff, from->len - fromoff);
++ if (size == 0)
+ return -EINVAL;
+ size *= sizeof(u16);
+
+@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *f
+
+ int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to)
+ {
+- int tooff = 0, fromoff = 0;
+- int size;
++ unsigned int tooff = 0, fromoff = 0;
++ size_t size;
+
+ if (to->start > from->start)
+ fromoff = to->start - from->start;
+ else
+ tooff = from->start - to->start;
+- size = to->len - tooff;
+- if (size > (int) (from->len - fromoff))
+- size = from->len - fromoff;
+- if (size <= 0)
++ if (fromoff >= from->len || tooff >= to->len)
++ return -EINVAL;
++
++ size = min_t(size_t, to->len - tooff, from->len - fromoff);
++ if (size == 0)
+ return -EINVAL;
+ size *= sizeof(u16);
+
--- /dev/null
+fbdev-color-map-copying-bounds-checking.patch
+tile-ptrace-preserve-previous-registers-for-short-regset-write.patch
+drm-schedule-the-output_poll_work-with-1s-delay-if-we-have-delayed-event.patch
+drm-fix-broken-vt-switch-with-video-1366x768-option.patch
+drm-i915-ignore-bogus-plane-coordinates-on-skl-when-the-plane-is-not-visible.patch
--- /dev/null
+From fd7c99142d77dc4a851879a66715abf12a3193fb Mon Sep 17 00:00:00 2001
+From: Dave Martin <Dave.Martin@arm.com>
+Date: Fri, 6 Jan 2017 17:54:51 +0000
+Subject: tile/ptrace: Preserve previous registers for short regset write
+
+From: Dave Martin <Dave.Martin@arm.com>
+
+commit fd7c99142d77dc4a851879a66715abf12a3193fb upstream.
+
+Ensure that if userspace supplies insufficient data to
+PTRACE_SETREGSET to fill all the registers, the thread's old
+registers are preserved.
+
+Signed-off-by: Dave Martin <Dave.Martin@arm.com>
+Signed-off-by: Chris Metcalf <cmetcalf@mellanox.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/tile/kernel/ptrace.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/tile/kernel/ptrace.c
++++ b/arch/tile/kernel/ptrace.c
+@@ -111,7 +111,7 @@ static int tile_gpr_set(struct task_stru
+ const void *kbuf, const void __user *ubuf)
+ {
+ int ret;
+- struct pt_regs regs;
++ struct pt_regs regs = *task_pt_regs(target);
+
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ®s, 0,
+ sizeof(regs));
projects / thirdparty / kernel / stable-queue.git / commitdiff
