]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 6.8
authorSasha Levin <sashal@kernel.org>
Sat, 11 May 2024 13:02:55 +0000 (09:02 -0400)
committerSasha Levin <sashal@kernel.org>
Sat, 11 May 2024 13:02:55 +0000 (09:02 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-6.8/dm-amd-pm-fix-problems-with-reboot-shutdown-for-some.patch [new file with mode: 0644]
queue-6.8/drm-connector-add-n-to-message-about-demoting-connec.patch [new file with mode: 0644]
queue-6.8/drm-meson-dw-hdmi-add-bandgap-setting-for-g12.patch [new file with mode: 0644]
queue-6.8/drm-meson-dw-hdmi-power-up-phy-on-device-init.patch [new file with mode: 0644]
queue-6.8/gpiolib-cdev-fix-uninitialised-kfifo.patch [new file with mode: 0644]
queue-6.8/gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_.patch [new file with mode: 0644]
queue-6.8/series

diff --git a/queue-6.8/dm-amd-pm-fix-problems-with-reboot-shutdown-for-some.patch b/queue-6.8/dm-amd-pm-fix-problems-with-reboot-shutdown-for-some.patch
new file mode 100644 (file)
index 0000000..f73302b
--- /dev/null
@@ -0,0 +1,40 @@
+From 3a0c066960e1e06f904306e0e8176685c9dba488 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 13:32:17 -0500
+Subject: dm/amd/pm: Fix problems with reboot/shutdown for some SMU
+ 13.0.4/13.0.11 users
+
+From: Mario Limonciello <mario.limonciello@amd.com>
+
+[ Upstream commit cd94d1b182d2986378550c9087571991bfee01d4 ]
+
+Limit the workaround introduced by commit 31729e8c21ec ("drm/amd/pm: fixes
+a random hang in S4 for SMU v13.0.4/11") to only run in the s4 path.
+
+Cc: Tim Huang <Tim.Huang@amd.com>
+Fixes: 31729e8c21ec ("drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11")
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3351
+Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+index 949131bd1ecb2..4abfcd32747d3 100644
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+@@ -226,7 +226,7 @@ static int smu_v13_0_4_system_features_control(struct smu_context *smu, bool en)
+       struct amdgpu_device *adev = smu->adev;
+       int ret = 0;
+-      if (!en && !adev->in_s0ix) {
++      if (!en && adev->in_s4) {
+               /* Adds a GFX reset as workaround just before sending the
+                * MP1_UNLOAD message to prevent GC/RLC/PMFW from entering
+                * an invalid state.
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-connector-add-n-to-message-about-demoting-connec.patch b/queue-6.8/drm-connector-add-n-to-message-about-demoting-connec.patch
new file mode 100644 (file)
index 0000000..772fe9b
--- /dev/null
@@ -0,0 +1,39 @@
+From e87170dc343074443dcaea3407eee0a0f26ca69a Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 2 May 2024 15:32:35 -0700
+Subject: drm/connector: Add \n to message about demoting connector
+ force-probes
+
+From: Douglas Anderson <dianders@chromium.org>
+
+[ Upstream commit 6897204ea3df808d342c8e4613135728bc538bcd ]
+
+The debug print clearly lacks a \n at the end. Add it.
+
+Fixes: 8f86c82aba8b ("drm/connector: demote connector force-probes for non-master clients")
+Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
+Reviewed-by: Simon Ser <contact@emersion.fr>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
+Signed-off-by: Douglas Anderson <dianders@chromium.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240502153234.1.I2052f01c8d209d9ae9c300b87c6e4f60bd3cc99e@changeid
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/drm_connector.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
+index b0516505f7ae9..4d2df7f64dc51 100644
+--- a/drivers/gpu/drm/drm_connector.c
++++ b/drivers/gpu/drm/drm_connector.c
+@@ -2940,7 +2940,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
+                                                    dev->mode_config.max_width,
+                                                    dev->mode_config.max_height);
+               else
+-                      drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe",
++                      drm_dbg_kms(dev, "User-space requested a forced probe on [CONNECTOR:%d:%s] but is not the DRM master, demoting to read-only probe\n",
+                                   connector->base.id, connector->name);
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-meson-dw-hdmi-add-bandgap-setting-for-g12.patch b/queue-6.8/drm-meson-dw-hdmi-add-bandgap-setting-for-g12.patch
new file mode 100644 (file)
index 0000000..19f9777
--- /dev/null
@@ -0,0 +1,135 @@
+From c18d1c81d62fc9892fda48961f0a0427aa9871e6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 18:02:54 +0200
+Subject: drm/meson: dw-hdmi: add bandgap setting for g12
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 08001033121dd92b8297a5b7333636b466c30f13 ]
+
+When no mode is set, the utility pin appears to be grounded. No signal
+is getting through.
+
+This is problematic because ARC and eARC use this line and may do so even
+if no display mode is set.
+
+This change enable the bandgap setting on g12 chip, which fix the problem
+with the utility pin. This is done by restoring init values on PHY init and
+disable.
+
+Fixes: 3b7c1237a72a ("drm/meson: Add G12A support for the DW-HDMI Glue")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20240426160256.3089978-3-jbrunet@baylibre.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240426160256.3089978-3-jbrunet@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 43 ++++++++++++++++-----------
+ 1 file changed, 26 insertions(+), 17 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index a83d93078537d..5565f7777529f 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -106,6 +106,8 @@
+ #define HHI_HDMI_CLK_CNTL     0x1cc /* 0x73 */
+ #define HHI_HDMI_PHY_CNTL0    0x3a0 /* 0xe8 */
+ #define HHI_HDMI_PHY_CNTL1    0x3a4 /* 0xe9 */
++#define  PHY_CNTL1_INIT               0x03900000
++#define  PHY_INVERT           BIT(17)
+ #define HHI_HDMI_PHY_CNTL2    0x3a8 /* 0xea */
+ #define HHI_HDMI_PHY_CNTL3    0x3ac /* 0xeb */
+ #define HHI_HDMI_PHY_CNTL4    0x3b0 /* 0xec */
+@@ -130,6 +132,8 @@ struct meson_dw_hdmi_data {
+                                   unsigned int addr);
+       void            (*dwc_write)(struct meson_dw_hdmi *dw_hdmi,
+                                    unsigned int addr, unsigned int data);
++      u32 cntl0_init;
++      u32 cntl1_init;
+ };
+ struct meson_dw_hdmi {
+@@ -458,7 +462,9 @@ static void dw_hdmi_phy_disable(struct dw_hdmi *hdmi,
+       DRM_DEBUG_DRIVER("\n");
+-      regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, 0);
++      /* Fallback to init mode */
++      regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL1, dw_hdmi->data->cntl1_init);
++      regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, dw_hdmi->data->cntl0_init);
+ }
+ static enum drm_connector_status dw_hdmi_read_hpd(struct dw_hdmi *hdmi,
+@@ -576,11 +582,22 @@ static const struct regmap_config meson_dw_hdmi_regmap_config = {
+       .fast_io = true,
+ };
+-static const struct meson_dw_hdmi_data meson_dw_hdmi_gx_data = {
++static const struct meson_dw_hdmi_data meson_dw_hdmi_gxbb_data = {
+       .top_read = dw_hdmi_top_read,
+       .top_write = dw_hdmi_top_write,
+       .dwc_read = dw_hdmi_dwc_read,
+       .dwc_write = dw_hdmi_dwc_write,
++      .cntl0_init = 0x0,
++      .cntl1_init = PHY_CNTL1_INIT | PHY_INVERT,
++};
++
++static const struct meson_dw_hdmi_data meson_dw_hdmi_gxl_data = {
++      .top_read = dw_hdmi_top_read,
++      .top_write = dw_hdmi_top_write,
++      .dwc_read = dw_hdmi_dwc_read,
++      .dwc_write = dw_hdmi_dwc_write,
++      .cntl0_init = 0x0,
++      .cntl1_init = PHY_CNTL1_INIT,
+ };
+ static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = {
+@@ -588,6 +605,8 @@ static const struct meson_dw_hdmi_data meson_dw_hdmi_g12a_data = {
+       .top_write = dw_hdmi_g12a_top_write,
+       .dwc_read = dw_hdmi_g12a_dwc_read,
+       .dwc_write = dw_hdmi_g12a_dwc_write,
++      .cntl0_init = 0x000b4242, /* Bandgap */
++      .cntl1_init = PHY_CNTL1_INIT,
+ };
+ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
+@@ -626,18 +645,8 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
+       meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
+       /* Setup PHY */
+-      regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                         0xffff << 16, 0x0390 << 16);
+-
+-      /* BIT_INVERT */
+-      if (dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-gxl-dw-hdmi") ||
+-          dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-gxm-dw-hdmi") ||
+-          dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-g12a-dw-hdmi"))
+-              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                                 BIT(17), 0);
+-      else
+-              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                                 BIT(17), BIT(17));
++      regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL1, meson_dw_hdmi->data->cntl1_init);
++      regmap_write(priv->hhi, HHI_HDMI_PHY_CNTL0, meson_dw_hdmi->data->cntl0_init);
+       /* Enable HDMI-TX Interrupt */
+       meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_INTR_STAT_CLR,
+@@ -848,11 +857,11 @@ static const struct dev_pm_ops meson_dw_hdmi_pm_ops = {
+ static const struct of_device_id meson_dw_hdmi_of_table[] = {
+       { .compatible = "amlogic,meson-gxbb-dw-hdmi",
+-        .data = &meson_dw_hdmi_gx_data },
++        .data = &meson_dw_hdmi_gxbb_data },
+       { .compatible = "amlogic,meson-gxl-dw-hdmi",
+-        .data = &meson_dw_hdmi_gx_data },
++        .data = &meson_dw_hdmi_gxl_data },
+       { .compatible = "amlogic,meson-gxm-dw-hdmi",
+-        .data = &meson_dw_hdmi_gx_data },
++        .data = &meson_dw_hdmi_gxl_data },
+       { .compatible = "amlogic,meson-g12a-dw-hdmi",
+         .data = &meson_dw_hdmi_g12a_data },
+       { }
+-- 
+2.43.0
+
diff --git a/queue-6.8/drm-meson-dw-hdmi-power-up-phy-on-device-init.patch b/queue-6.8/drm-meson-dw-hdmi-power-up-phy-on-device-init.patch
new file mode 100644 (file)
index 0000000..cb0273a
--- /dev/null
@@ -0,0 +1,109 @@
+From 8a3122d1fbe133946551ddadbb920d72cb508c5b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 26 Apr 2024 18:02:53 +0200
+Subject: drm/meson: dw-hdmi: power up phy on device init
+
+From: Jerome Brunet <jbrunet@baylibre.com>
+
+[ Upstream commit 04703bfd7f99c016a823c74712b97f8b5590ce87 ]
+
+The phy is not in a useful state right after init. It will become useful,
+including for auxiliary function such as CEC or ARC, after the first mode
+is set. This is a problem on systems where the display is using another
+interface like DSI or CVBS.
+
+This change refactor the init and mode change callback to power up the PHY
+on init and leave only what is necessary for mode changes in the related
+function. This is enough to fix CEC operation when HDMI display is not
+enabled.
+
+Fixes: 3f68be7d8e96 ("drm/meson: Add support for HDMI encoder and DW-HDMI bridge + PHY")
+Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
+Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://lore.kernel.org/r/20240426160256.3089978-2-jbrunet@baylibre.com
+Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240426160256.3089978-2-jbrunet@baylibre.com
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpu/drm/meson/meson_dw_hdmi.c | 51 +++++++++------------------
+ 1 file changed, 17 insertions(+), 34 deletions(-)
+
+diff --git a/drivers/gpu/drm/meson/meson_dw_hdmi.c b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+index 5a9538bc0e26f..a83d93078537d 100644
+--- a/drivers/gpu/drm/meson/meson_dw_hdmi.c
++++ b/drivers/gpu/drm/meson/meson_dw_hdmi.c
+@@ -384,26 +384,6 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,
+           dw_hdmi_bus_fmt_is_420(hdmi))
+               mode_is_420 = true;
+-      /* Enable clocks */
+-      regmap_update_bits(priv->hhi, HHI_HDMI_CLK_CNTL, 0xffff, 0x100);
+-
+-      /* Bring HDMITX MEM output of power down */
+-      regmap_update_bits(priv->hhi, HHI_MEM_PD_REG0, 0xff << 8, 0);
+-
+-      /* Bring out of reset */
+-      dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_SW_RESET,  0);
+-
+-      /* Enable internal pixclk, tmds_clk, spdif_clk, i2s_clk, cecclk */
+-      dw_hdmi_top_write_bits(dw_hdmi, HDMITX_TOP_CLK_CNTL,
+-                             0x3, 0x3);
+-
+-      /* Enable cec_clk and hdcp22_tmdsclk_en */
+-      dw_hdmi_top_write_bits(dw_hdmi, HDMITX_TOP_CLK_CNTL,
+-                             0x3 << 4, 0x3 << 4);
+-
+-      /* Enable normal output to PHY */
+-      dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
+-
+       /* TMDS pattern setup */
+       if (mode->clock > 340000 && !mode_is_420) {
+               dw_hdmi->data->top_write(dw_hdmi, HDMITX_TOP_TMDS_CLK_PTTN_01,
+@@ -425,20 +405,6 @@ static int dw_hdmi_phy_init(struct dw_hdmi *hdmi, void *data,
+       /* Setup PHY parameters */
+       meson_hdmi_phy_setup_mode(dw_hdmi, mode, mode_is_420);
+-      /* Setup PHY */
+-      regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                         0xffff << 16, 0x0390 << 16);
+-
+-      /* BIT_INVERT */
+-      if (dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxl-dw-hdmi") ||
+-          dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-gxm-dw-hdmi") ||
+-          dw_hdmi_is_compatible(dw_hdmi, "amlogic,meson-g12a-dw-hdmi"))
+-              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                                 BIT(17), 0);
+-      else
+-              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
+-                                 BIT(17), BIT(17));
+-
+       /* Disable clock, fifo, fifo_wr */
+       regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1, 0xf, 0);
+@@ -656,6 +622,23 @@ static void meson_dw_hdmi_init(struct meson_dw_hdmi *meson_dw_hdmi)
+       meson_dw_hdmi->data->top_write(meson_dw_hdmi,
+                                      HDMITX_TOP_CLK_CNTL, 0xff);
++      /* Enable normal output to PHY */
++      meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_BIST_CNTL, BIT(12));
++
++      /* Setup PHY */
++      regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
++                         0xffff << 16, 0x0390 << 16);
++
++      /* BIT_INVERT */
++      if (dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-gxl-dw-hdmi") ||
++          dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-gxm-dw-hdmi") ||
++          dw_hdmi_is_compatible(meson_dw_hdmi, "amlogic,meson-g12a-dw-hdmi"))
++              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
++                                 BIT(17), 0);
++      else
++              regmap_update_bits(priv->hhi, HHI_HDMI_PHY_CNTL1,
++                                 BIT(17), BIT(17));
++
+       /* Enable HDMI-TX Interrupt */
+       meson_dw_hdmi->data->top_write(meson_dw_hdmi, HDMITX_TOP_INTR_STAT_CLR,
+                                      HDMITX_TOP_INTR_CORE);
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpiolib-cdev-fix-uninitialised-kfifo.patch b/queue-6.8/gpiolib-cdev-fix-uninitialised-kfifo.patch
new file mode 100644 (file)
index 0000000..2b776f2
--- /dev/null
@@ -0,0 +1,62 @@
+From 8040c53a25d56ad46b01be1885010ec7d9c85134 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 10 May 2024 14:53:42 +0800
+Subject: gpiolib: cdev: fix uninitialised kfifo
+
+From: Kent Gibson <warthog618@gmail.com>
+
+[ Upstream commit ee0166b637a5e376118e9659e5b4148080f1d27e ]
+
+If a line is requested with debounce, and that results in debouncing
+in software, and the line is subsequently reconfigured to enable edge
+detection then the allocation of the kfifo to contain edge events is
+overlooked.  This results in events being written to and read from an
+uninitialised kfifo.  Read events are returned to userspace.
+
+Initialise the kfifo in the case where the software debounce is
+already active.
+
+Fixes: 65cff7046406 ("gpiolib: cdev: support setting debounce")
+Signed-off-by: Kent Gibson <warthog618@gmail.com>
+Link: https://lore.kernel.org/r/20240510065342.36191-1-warthog618@gmail.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index 0b94c398c0649..5cca9e8803495 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -1199,6 +1199,8 @@ static int edge_detector_update(struct line *line,
+                               struct gpio_v2_line_config *lc,
+                               unsigned int line_idx, u64 edflags)
+ {
++      u64 eflags;
++      int ret;
+       u64 active_edflags = READ_ONCE(line->edflags);
+       unsigned int debounce_period_us =
+                       gpio_v2_line_config_debounce_period(lc, line_idx);
+@@ -1210,6 +1212,18 @@ static int edge_detector_update(struct line *line,
+       /* sw debounced and still will be...*/
+       if (debounce_period_us && READ_ONCE(line->sw_debounced)) {
+               line_set_debounce_period(line, debounce_period_us);
++              /*
++               * ensure event fifo is initialised if edge detection
++               * is now enabled.
++               */
++              eflags = edflags & GPIO_V2_LINE_EDGE_FLAGS;
++              if (eflags && !kfifo_initialized(&line->req->events)) {
++                      ret = kfifo_alloc(&line->req->events,
++                                        line->req->event_buffer_size,
++                                        GFP_KERNEL);
++                      if (ret)
++                              return ret;
++              }
+               return 0;
+       }
+-- 
+2.43.0
+
diff --git a/queue-6.8/gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_.patch b/queue-6.8/gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_.patch
new file mode 100644 (file)
index 0000000..61ce145
--- /dev/null
@@ -0,0 +1,77 @@
+From ac0f8ca2cfbbfff01e4bc699e5d31a7fe1194a14 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sun, 5 May 2024 22:11:56 +0800
+Subject: gpiolib: cdev: Fix use after free in lineinfo_changed_notify
+
+From: Zhongqiu Han <quic_zhonhan@quicinc.com>
+
+[ Upstream commit 02f6b0e1ec7e0e7d059dddc893645816552039da ]
+
+The use-after-free issue occurs as follows: when the GPIO chip device file
+is being closed by invoking gpio_chrdev_release(), watched_lines is freed
+by bitmap_free(), but the unregistration of lineinfo_changed_nb notifier
+chain failed due to waiting write rwsem. Additionally, one of the GPIO
+chip's lines is also in the release process and holds the notifier chain's
+read rwsem. Consequently, a race condition leads to the use-after-free of
+watched_lines.
+
+Here is the typical stack when issue happened:
+
+[free]
+gpio_chrdev_release()
+  --> bitmap_free(cdev->watched_lines)                  <-- freed
+  --> blocking_notifier_chain_unregister()
+    --> down_write(&nh->rwsem)                          <-- waiting rwsem
+          --> __down_write_common()
+            --> rwsem_down_write_slowpath()
+                  --> schedule_preempt_disabled()
+                    --> schedule()
+
+[use]
+st54spi_gpio_dev_release()
+  --> gpio_free()
+    --> gpiod_free()
+      --> gpiod_free_commit()
+        --> gpiod_line_state_notify()
+          --> blocking_notifier_call_chain()
+            --> down_read(&nh->rwsem);                  <-- held rwsem
+            --> notifier_call_chain()
+              --> lineinfo_changed_notify()
+                --> test_bit(xxxx, cdev->watched_lines) <-- use after free
+
+The side effect of the use-after-free issue is that a GPIO line event is
+being generated for userspace where it shouldn't. However, since the chrdev
+is being closed, userspace won't have the chance to read that event anyway.
+
+To fix the issue, call the bitmap_free() function after the unregistration
+of lineinfo_changed_nb notifier chain.
+
+Fixes: 51c1064e82e7 ("gpiolib: add new ioctl() for monitoring changes in line info")
+Signed-off-by: Zhongqiu Han <quic_zhonhan@quicinc.com>
+Link: https://lore.kernel.org/r/20240505141156.2944912-1-quic_zhonhan@quicinc.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/gpio/gpiolib-cdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
+index 1438fdca0b748..0b94c398c0649 100644
+--- a/drivers/gpio/gpiolib-cdev.c
++++ b/drivers/gpio/gpiolib-cdev.c
+@@ -2800,11 +2800,11 @@ static int gpio_chrdev_release(struct inode *inode, struct file *file)
+       struct gpio_chardev_data *cdev = file->private_data;
+       struct gpio_device *gdev = cdev->gdev;
+-      bitmap_free(cdev->watched_lines);
+       blocking_notifier_chain_unregister(&gdev->device_notifier,
+                                          &cdev->device_unregistered_nb);
+       blocking_notifier_chain_unregister(&gdev->line_state_notifier,
+                                          &cdev->lineinfo_changed_nb);
++      bitmap_free(cdev->watched_lines);
+       gpio_device_put(gdev);
+       kfree(cdev);
+-- 
+2.43.0
+
index 55f83e78d0d3ed01965f3ed2934086ed2d61b68c..a63e58fc295cff21eb3f5a2b1a344014bec41931 100644 (file)
@@ -232,3 +232,9 @@ net-hns3-use-appropriate-barrier-function-after-sett.patch
 net-hns3-fix-port-vlan-filter-not-disabled-issue.patch
 net-hns3-fix-kernel-crash-when-devlink-reload-during.patch
 net-dsa-mv88e6xxx-add-phylink_get_caps-for-the-mv88e.patch
+drm-meson-dw-hdmi-power-up-phy-on-device-init.patch
+drm-meson-dw-hdmi-add-bandgap-setting-for-g12.patch
+drm-connector-add-n-to-message-about-demoting-connec.patch
+dm-amd-pm-fix-problems-with-reboot-shutdown-for-some.patch
+gpiolib-cdev-fix-use-after-free-in-lineinfo_changed_.patch
+gpiolib-cdev-fix-uninitialised-kfifo.patch