--- /dev/null
+From 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 Mon Sep 17 00:00:00 2001
+From: Umio Yasuno <coelacanth_dream@protonmail.com>
+Date: Thu, 14 Nov 2024 16:15:27 +0900
+Subject: drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
+
+From: Umio Yasuno <coelacanth_dream@protonmail.com>
+
+commit 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 upstream.
+
+These were missed before.
+
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3751
+Signed-off-by: Umio Yasuno <coelacanth_dream@protonmail.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+@@ -1725,6 +1725,8 @@ static ssize_t smu_v13_0_7_get_gpu_metri
+ gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency;
+
+ gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK];
++ gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK];
++ gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK];
+ gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0];
+ gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0];
+ gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1];
--- /dev/null
+From b61badd20b443eabe132314669bb51a263982e5c Mon Sep 17 00:00:00 2001
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Date: Mon, 11 Nov 2024 17:24:08 -0500
+Subject: drm/amdgpu: fix usage slab after free
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vitaly Prosyak <vitaly.prosyak@amd.com>
+
+commit b61badd20b443eabe132314669bb51a263982e5c upstream.
+
+[ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
+[ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147
+
+[ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1
+[ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020
+[ +0.000016] Call Trace:
+[ +0.000008] <TASK>
+[ +0.000009] dump_stack_lvl+0x76/0xa0
+[ +0.000017] print_report+0xce/0x5f0
+[ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
+[ +0.000019] ? srso_return_thunk+0x5/0x5f
+[ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200
+[ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
+[ +0.000019] kasan_report+0xbe/0x110
+[ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
+[ +0.000023] __asan_report_load8_noabort+0x14/0x30
+[ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
+[ +0.000020] ? srso_return_thunk+0x5/0x5f
+[ +0.000013] ? __kasan_check_write+0x14/0x30
+[ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]
+[ +0.000020] ? srso_return_thunk+0x5/0x5f
+[ +0.000013] ? __kasan_check_write+0x14/0x30
+[ +0.000013] ? srso_return_thunk+0x5/0x5f
+[ +0.000013] ? enable_work+0x124/0x220
+[ +0.000015] ? __pfx_enable_work+0x10/0x10
+[ +0.000013] ? srso_return_thunk+0x5/0x5f
+[ +0.000014] ? free_large_kmalloc+0x85/0xf0
+[ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched]
+[ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu]
+[ +0.000735] ? __kasan_check_read+0x11/0x20
+[ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu]
+[ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu]
+[ +0.000679] ? mutex_unlock+0x80/0xe0
+[ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu]
+[ +0.000662] ? srso_return_thunk+0x5/0x5f
+[ +0.000014] ? __kasan_check_write+0x14/0x30
+[ +0.000013] ? srso_return_thunk+0x5/0x5f
+[ +0.000013] ? mutex_unlock+0x80/0xe0
+[ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu]
+[ +0.000663] drm_minor_release+0xc9/0x140 [drm]
+[ +0.000081] drm_release+0x1fd/0x390 [drm]
+[ +0.000082] __fput+0x36c/0xad0
+[ +0.000018] __fput_sync+0x3c/0x50
+[ +0.000014] __x64_sys_close+0x7d/0xe0
+[ +0.000014] x64_sys_call+0x1bc6/0x2680
+[ +0.000014] do_syscall_64+0x70/0x130
+[ +0.000014] ? srso_return_thunk+0x5/0x5f
+[ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190
+[ +0.000015] ? srso_return_thunk+0x5/0x5f
+[ +0.000014] ? irqentry_exit+0x43/0x50
+[ +0.000012] ? srso_return_thunk+0x5/0x5f
+[ +0.000013] ? exc_page_fault+0x7c/0x110
+[ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+[ +0.000014] RIP: 0033:0x7ffff7b14f67
+[ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff
+[ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
+[ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67
+[ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003
+[ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000
+[ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8
+[ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040
+[ +0.000020] </TASK>
+
+[ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s:
+[ +0.000014] kasan_save_stack+0x28/0x60
+[ +0.000008] kasan_save_track+0x18/0x70
+[ +0.000007] kasan_save_alloc_info+0x38/0x60
+[ +0.000007] __kasan_kmalloc+0xc1/0xd0
+[ +0.000007] kmalloc_trace_noprof+0x180/0x380
+[ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched]
+[ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu]
+[ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu]
+[ +0.000662] amdgpu_pci_probe+0x361/0xf30 [amdgpu]
+[ +0.000651] local_pci_probe+0xe7/0x1b0
+[ +0.000009] pci_device_probe+0x248/0x890
+[ +0.000008] really_probe+0x1fd/0x950
+[ +0.000008] __driver_probe_device+0x307/0x410
+[ +0.000007] driver_probe_device+0x4e/0x150
+[ +0.000007] __driver_attach+0x223/0x510
+[ +0.000006] bus_for_each_dev+0x102/0x1a0
+[ +0.000007] driver_attach+0x3d/0x60
+[ +0.000006] bus_add_driver+0x2ac/0x5f0
+[ +0.000006] driver_register+0x13d/0x490
+[ +0.000008] __pci_register_driver+0x1ee/0x2b0
+[ +0.000007] llc_sap_close+0xb0/0x160 [llc]
+[ +0.000009] do_one_initcall+0x9c/0x3e0
+[ +0.000008] do_init_module+0x241/0x760
+[ +0.000008] load_module+0x51ac/0x6c30
+[ +0.000006] __do_sys_init_module+0x234/0x270
+[ +0.000007] __x64_sys_init_module+0x73/0xc0
+[ +0.000006] x64_sys_call+0xe3/0x2680
+[ +0.000006] do_syscall_64+0x70/0x130
+[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+[ +0.000015] Freed by task 2147 on cpu 6 at 160.507651s:
+[ +0.000013] kasan_save_stack+0x28/0x60
+[ +0.000007] kasan_save_track+0x18/0x70
+[ +0.000007] kasan_save_free_info+0x3b/0x60
+[ +0.000007] poison_slab_object+0x115/0x1c0
+[ +0.000007] __kasan_slab_free+0x34/0x60
+[ +0.000007] kfree+0xfa/0x2f0
+[ +0.000007] drm_sched_fini+0x19d/0x410 [gpu_sched]
+[ +0.000012] amdgpu_fence_driver_sw_fini+0xc4/0x2f0 [amdgpu]
+[ +0.000662] amdgpu_device_fini_sw+0x77/0xfc0 [amdgpu]
+[ +0.000653] amdgpu_driver_release_kms+0x16/0x80 [amdgpu]
+[ +0.000655] drm_minor_release+0xc9/0x140 [drm]
+[ +0.000071] drm_release+0x1fd/0x390 [drm]
+[ +0.000071] __fput+0x36c/0xad0
+[ +0.000008] __fput_sync+0x3c/0x50
+[ +0.000007] __x64_sys_close+0x7d/0xe0
+[ +0.000007] x64_sys_call+0x1bc6/0x2680
+[ +0.000007] do_syscall_64+0x70/0x130
+[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+[ +0.000014] The buggy address belongs to the object at ffff8881b8605f80
+ which belongs to the cache kmalloc-64 of size 64
+[ +0.000020] The buggy address is located 8 bytes inside of
+ freed 64-byte region [ffff8881b8605f80, ffff8881b8605fc0)
+
+[ +0.000028] The buggy address belongs to the physical page:
+[ +0.000011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b8605
+[ +0.000008] anon flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
+[ +0.000007] page_type: 0xffffefff(slab)
+[ +0.000009] raw: 0017ffffc0000000 ffff8881000428c0 0000000000000000 dead000000000001
+[ +0.000006] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000
+[ +0.000006] page dumped because: kasan: bad access detected
+
+[ +0.000012] Memory state around the buggy address:
+[ +0.000011] ffff8881b8605e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ +0.000015] ffff8881b8605f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
+[ +0.000015] >ffff8881b8605f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
+[ +0.000013] ^
+[ +0.000011] ffff8881b8606000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
+[ +0.000014] ffff8881b8606080: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
+[ +0.000013] ==================================================================
+
+The issue reproduced on VG20 during the IGT pci_unplug test.
+The root cause of the issue is that the function drm_sched_fini is called before drm_sched_entity_kill.
+In drm_sched_fini, the drm_sched_rq structure is freed, but this structure is later accessed by
+each entity within the run queue, leading to invalid memory access.
+To resolve this, the order of cleanup calls is updated:
+
+ Before:
+ amdgpu_fence_driver_sw_fini
+ amdgpu_device_ip_fini
+
+ After:
+ amdgpu_device_ip_fini
+ amdgpu_fence_driver_sw_fini
+
+This updated order ensures that all entities in the IPs are cleaned up first, followed by proper
+cleanup of the schedulers.
+
+Additional Investigation:
+
+During debugging, another issue was identified in the amdgpu_vce_sw_fini function. The vce.vcpu_bo
+buffer must be freed only as the final step in the cleanup process to prevent any premature
+access during earlier cleanup stages.
+
+v2: Using Christian suggestion call drm_sched_entity_destroy before drm_sched_fini.
+
+Cc: Christian König <christian.koenig@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
+ drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +++---
+ 2 files changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+@@ -4020,8 +4020,8 @@ void amdgpu_device_fini_sw(struct amdgpu
+ int idx;
+ bool px;
+
+- amdgpu_fence_driver_sw_fini(adev);
+ amdgpu_device_ip_fini(adev);
++ amdgpu_fence_driver_sw_fini(adev);
+ amdgpu_ucode_release(&adev->firmware.gpu_info_fw);
+ adev->accel_working = false;
+ dma_fence_put(rcu_dereference_protected(adev->gang_submit, true));
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+@@ -214,15 +214,15 @@ int amdgpu_vce_sw_fini(struct amdgpu_dev
+
+ drm_sched_entity_destroy(&adev->vce.entity);
+
+- amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
+- (void **)&adev->vce.cpu_addr);
+-
+ for (i = 0; i < adev->vce.num_rings; i++)
+ amdgpu_ring_fini(&adev->vce.ring[i]);
+
+ amdgpu_ucode_release(&adev->vce.fw);
+ mutex_destroy(&adev->vce.idle_mutex);
+
++ amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
++ (void **)&adev->vce.cpu_addr);
++
+ return 0;
+ }
+
--- /dev/null
+From cdc6705f98ea3f854a60ba8c9b19228e197ae384 Mon Sep 17 00:00:00 2001
+From: Lijo Lazar <lijo.lazar@amd.com>
+Date: Mon, 11 Nov 2024 20:11:38 +0530
+Subject: drm/amdkfd: Use the correct wptr size
+
+From: Lijo Lazar <lijo.lazar@amd.com>
+
+commit cdc6705f98ea3f854a60ba8c9b19228e197ae384 upstream.
+
+Write pointer could be 32-bit or 64-bit. Use the correct size during
+initialization.
+
+Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
+Acked-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+@@ -123,7 +123,7 @@ static bool kq_initialize(struct kernel_
+
+ memset(kq->pq_kernel_addr, 0, queue_size);
+ memset(kq->rptr_kernel, 0, sizeof(*kq->rptr_kernel));
+- memset(kq->wptr_kernel, 0, sizeof(*kq->wptr_kernel));
++ memset(kq->wptr_kernel, 0, dev->kfd->device_info.doorbell_size);
+
+ prop.queue_size = queue_size;
+ prop.is_interop = false;
--- /dev/null
+From 4f8dbadef085ab447a01a8d4806a3f629fea05ed Mon Sep 17 00:00:00 2001
+From: Lucas Stach <l.stach@pengutronix.de>
+Date: Fri, 25 Oct 2024 17:14:46 +0200
+Subject: drm/etnaviv: flush shader L1 cache after user commandstream
+
+From: Lucas Stach <l.stach@pengutronix.de>
+
+commit 4f8dbadef085ab447a01a8d4806a3f629fea05ed upstream.
+
+The shader L1 cache is a writeback cache for shader loads/stores
+and thus must be flushed before any BOs backing the shader buffers
+are potentially freed.
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
+Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
++++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+@@ -482,7 +482,8 @@ void etnaviv_buffer_queue(struct etnaviv
+ } else {
+ CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
+ VIVS_GL_FLUSH_CACHE_DEPTH |
+- VIVS_GL_FLUSH_CACHE_COLOR);
++ VIVS_GL_FLUSH_CACHE_COLOR |
++ VIVS_GL_FLUSH_CACHE_SHADER_L1);
+ if (has_blt) {
+ CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1);
+ CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1);
--- /dev/null
+From f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 Mon Sep 17 00:00:00 2001
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Date: Fri, 11 Oct 2024 21:21:51 +0200
+Subject: drm/mediatek: Fix child node refcount handling in early exit
+
+From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+
+commit f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 upstream.
+
+Early exits (goto, break, return) from for_each_child_of_node() required
+an explicit call to of_node_put(), which was not introduced with the
+break if cnt == MAX_CRTC.
+
+Add the missing of_node_put() before the break.
+
+Cc: stable@vger.kernel.org
+Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")
+
+Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
+Reviewed-by: CK Hu <ck.hu@mediatek.com>
+Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://patchwork.kernel.org/project/dri-devel/patch/20241011-mtk_drm_drv_memleak-v1-1-2b40c74c8d75@gmail.com/
+Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+@@ -378,8 +378,10 @@ static bool mtk_drm_get_all_drm_priv(str
+ if (all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound)
+ cnt++;
+
+- if (cnt == MAX_CRTC)
++ if (cnt == MAX_CRTC) {
++ of_node_put(node);
+ break;
++ }
+ }
+
+ if (drm_priv->data->mmsys_dev_num == cnt) {
--- /dev/null
+From e965e771b069421c233d674c3c8cd8c7f7245f42 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Mon, 9 Sep 2024 14:33:59 +0800
+Subject: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream.
+
+The return value of drm_atomic_get_crtc_state() needs to be
+checked. To avoid use of error pointer 'crtc_state' in case
+of the failure.
+
+Cc: stable@vger.kernel.org
+Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Acked-by: Alain Volmat <alain.volmat@foss.st.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make24@iscas.ac.cn
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sti/sti_gdp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/sti/sti_gdp.c
++++ b/drivers/gpu/drm/sti/sti_gdp.c
+@@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct d
+
+ mixer = to_sti_mixer(crtc);
+ crtc_state = drm_atomic_get_crtc_state(state, crtc);
++ if (IS_ERR(crtc_state))
++ return PTR_ERR(crtc_state);
++
+ mode = &crtc_state->mode;
+ dst_x = new_plane_state->crtc_x;
+ dst_y = new_plane_state->crtc_y;
--- /dev/null
+From c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 13 Sep 2024 17:09:26 +0800
+Subject: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 upstream.
+
+The return value of drm_atomic_get_crtc_state() needs to be
+checked. To avoid use of error pointer 'crtc_state' in case
+of the failure.
+
+Cc: stable@vger.kernel.org
+Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240913090926.2023716-1-make24@iscas.ac.cn
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sti/sti_hqvdp.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/sti/sti_hqvdp.c
++++ b/drivers/gpu/drm/sti/sti_hqvdp.c
+@@ -1037,6 +1037,9 @@ static int sti_hqvdp_atomic_check(struct
+ return 0;
+
+ crtc_state = drm_atomic_get_crtc_state(state, crtc);
++ if (IS_ERR(crtc_state))
++ return PTR_ERR(crtc_state);
++
+ mode = &crtc_state->mode;
+ dst_x = new_plane_state->crtc_x;
+ dst_y = new_plane_state->crtc_y;
--- /dev/null
+From 831214f77037de02afc287eae93ce97f218d8c04 Mon Sep 17 00:00:00 2001
+From: Ma Ke <make24@iscas.ac.cn>
+Date: Fri, 13 Sep 2024 17:04:12 +0800
+Subject: drm/sti: avoid potential dereference of error pointers
+
+From: Ma Ke <make24@iscas.ac.cn>
+
+commit 831214f77037de02afc287eae93ce97f218d8c04 upstream.
+
+The return value of drm_atomic_get_crtc_state() needs to be
+checked. To avoid use of error pointer 'crtc_state' in case
+of the failure.
+
+Cc: stable@vger.kernel.org
+Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
+Signed-off-by: Ma Ke <make24@iscas.ac.cn>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make24@iscas.ac.cn
+Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/sti/sti_cursor.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/sti/sti_cursor.c
++++ b/drivers/gpu/drm/sti/sti_cursor.c
+@@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struc
+ return 0;
+
+ crtc_state = drm_atomic_get_crtc_state(state, crtc);
++ if (IS_ERR(crtc_state))
++ return PTR_ERR(crtc_state);
++
+ mode = &crtc_state->mode;
+ dst_x = new_plane_state->crtc_x;
+ dst_y = new_plane_state->crtc_y;
--- /dev/null
+From 71ba1c9b1c717831920c3d432404ee5a707e04b4 Mon Sep 17 00:00:00 2001
+From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Date: Mon, 28 Oct 2024 14:42:17 +0100
+Subject: drm: xlnx: zynqmp_dpsub: fix hotplug detection
+
+From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+
+commit 71ba1c9b1c717831920c3d432404ee5a707e04b4 upstream.
+
+drm_kms_helper_poll_init needs to be called after zynqmp_dpsub_kms_init.
+zynqmp_dpsub_kms_init creates the connector and without it we don't
+enable hotplug detection.
+
+Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge")
+Cc: stable@vger.kernel.org
+Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
+Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20241028134218.54727-1-lists@steffen.cc
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/xlnx/zynqmp_kms.c
++++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c
+@@ -506,12 +506,12 @@ int zynqmp_dpsub_drm_init(struct zynqmp_
+ if (ret)
+ return ret;
+
+- drm_kms_helper_poll_init(drm);
+-
+ ret = zynqmp_dpsub_kms_init(dpsub);
+ if (ret < 0)
+ goto err_poll_fini;
+
++ drm_kms_helper_poll_init(drm);
++
+ /* Reset all components and register the DRM device. */
+ drm_mode_config_reset(drm);
+
btrfs-don-t-bug_on-on-enomem-from-btrfs_lookup_extent_info-in-walk_down_proc.patch
tpm-lock-tpm-chip-in-tpm_pm_suspend-first.patch
udmabuf-use-vmf_insert_pfn-and-vm_pfnmap-for-handling-mmap.patch
+drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch
+drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch
+drm-sti-avoid-potential-dereference-of-error-pointers.patch
+drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch
+drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch
+drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch
+drm-amdkfd-use-the-correct-wptr-size.patch
+drm-amdgpu-fix-usage-slab-after-free.patch
+drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
