6.6-stable patches

added patches:
	drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch

diff --git a/queue-6.6/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch b/queue-6.6/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
new file mode 100644 (file)
index 0000000..dcba5dd
--- /dev/null
+++ b/queue-6.6/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
@@ -0,0 +1,66 @@
+From 6f71507415841d1a6d38118e5fa0eaf0caab9c17 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 21 Jan 2025 06:52:03 -0800
+Subject: drm/i915/backlight: Return immediately when scale() finds invalid parameters
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 6f71507415841d1a6d38118e5fa0eaf0caab9c17 upstream.
+
+The scale() functions detects invalid parameters, but continues
+its calculations anyway. This causes bad results if negative values
+are used for unsigned operations. Worst case, a division by 0 error
+will be seen if source_min == source_max.
+
+On top of that, after v6.13, the sequence of WARN_ON() followed by clamp()
+may result in a build error with gcc 13.x.
+
+drivers/gpu/drm/i915/display/intel_backlight.c: In function 'scale':
+include/linux/compiler_types.h:542:45: error:
+       call to '__compiletime_assert_415' declared with attribute error:
+       clamp() low limit source_min greater than high limit source_max
+
+This happens if the compiler decides to rearrange the code as follows.
+
+        if (source_min > source_max) {
+                WARN(..);
+                /* Do the clamp() knowing that source_min > source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        } else {
+                /* Do the clamp knowing that source_min <= source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        }
+
+Fix the problem by evaluating the return values from WARN_ON and returning
+immediately after a warning. While at it, fix divide by zero error seen
+if source_min == source_max.
+
+Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: David Laight <david.laight.linux@gmail.com>
+Cc: David Laight <david.laight.linux@gmail.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250121145203.2851237-1-linux@roeck-us.net
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_backlight.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_backlight.c
++++ b/drivers/gpu/drm/i915/display/intel_backlight.c
+@@ -40,8 +40,9 @@ static u32 scale(u32 source_val,
+ {
+       u64 target_val;
+ 
+-      WARN_ON(source_min > source_max);
+-      WARN_ON(target_min > target_max);
++      if (WARN_ON(source_min >= source_max) ||
++          WARN_ON(target_min > target_max))
++              return target_min;
+ 
+       /* defensive */
+       source_val = clamp(source_val, source_min, source_max);

diff --git a/queue-6.6/series b/queue-6.6/series
index 275f341a6e3bb0bcea1c6a5738dcd9a75b92457f..5d18af94a0cb439226bf389ee026491508b89eec 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -85,3 +85,4 @@ minmax.h-use-build_bug_on_msg-for-the-lo-hi-test-in-clamp.patch
 minmax.h-move-all-the-clamp-definitions-after-the-min-max-ones.patch
 minmax.h-simplify-the-variants-of-clamp.patch
 minmax.h-remove-some-defines-that-are-only-expanded-once.patch
+drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch