From: Greg Kroah-Hartman Date: Tue, 1 Oct 2024 08:36:47 +0000 (+0200) Subject: 6.11-stable patches X-Git-Tag: v6.6.54~104 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0d1c9d39ad560637fc758d5f79f5052966304d34;p=thirdparty%2Fkernel%2Fstable-queue.git 6.11-stable patches added patches: drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch drm-xe-fix-engine_class-bounds-check-again.patch io_uring-sqpoll-do-not-put-cpumask-on-stack.patch selftests-bpf-correctly-move-log-upon-successful-match.patch --- diff --git a/queue-6.11/drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch b/queue-6.11/drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch new file mode 100644 index 00000000000..9503f54b082 --- /dev/null +++ b/queue-6.11/drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch @@ -0,0 +1,40 @@ +From d925c04d974c657d10471c0c2dba3bc9c7d994ee Mon Sep 17 00:00:00 2001 +From: Alex Hung +Date: Thu, 27 Jun 2024 16:45:39 -0600 +Subject: drm/amd/display: Check link_res->hpo_dp_link_enc before using it + +From: Alex Hung + +commit d925c04d974c657d10471c0c2dba3bc9c7d994ee upstream. + +[WHAT & HOW] +Functions dp_enable_link_phy and dp_disable_link_phy can pass link_res +without initializing hpo_dp_link_enc and it is necessary to check for +null before dereferencing. + +This fixes 1 FORWARD_NULL issue reported by Coverity. + +Fixes: 0beca868cde8 ("drm/amd/display: Check link_res->hpo_dp_link_enc before using it") +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Hung +Signed-off-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/link/hwss/link_hwss_hpo_dp.c +@@ -110,6 +110,11 @@ void enable_hpo_dp_link_output(struct dc + enum clock_source_id clock_source, + const struct dc_link_settings *link_settings) + { ++ if (!link_res->hpo_dp_link_enc) { ++ DC_LOG_ERROR("%s: invalid hpo_dp_link_enc\n", __func__); ++ return; ++ } ++ + if (link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating) + link->dc->res_pool->dccg->funcs->set_symclk32_le_root_clock_gating( + link->dc->res_pool->dccg, diff --git a/queue-6.11/drm-xe-fix-engine_class-bounds-check-again.patch b/queue-6.11/drm-xe-fix-engine_class-bounds-check-again.patch new file mode 100644 index 00000000000..85ce6b00e17 --- /dev/null +++ b/queue-6.11/drm-xe-fix-engine_class-bounds-check-again.patch @@ -0,0 +1,39 @@ +From 23ab1cb6591dba7c97b65eb407cd71147bd878b8 Mon Sep 17 00:00:00 2001 +From: Matthew Auld +Date: Mon, 12 Aug 2024 15:13:32 +0100 +Subject: drm/xe: fix engine_class bounds check again + +From: Matthew Auld + +commit 23ab1cb6591dba7c97b65eb407cd71147bd878b8 upstream. + +This was fixed in commit b7dce525c4fc ("drm/xe/queue: fix engine_class +bounds check"), but then re-introduced in commit 6f20fc09936e ("drm/xe: +Move and export xe_hw_engine lookup.") which should only be simple code +movement of the existing function. + +Fixes: 6f20fc09936e ("drm/xe: Move and export xe_hw_engine lookup.") +Signed-off-by: Matthew Auld +Cc: Dominik Grzegorzek +Cc: Mika Kuoppala +Cc: Matthew Brost +Reviewed-by: Jonathan Cavitt +Reviewed-by: Lucas De Marchi +Link: https://patchwork.freedesktop.org/patch/msgid/20240812141331.729843-2-matthew.auld@intel.com +Signed-off-by: Lucas De Marchi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_hw_engine.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/xe/xe_hw_engine.c ++++ b/drivers/gpu/drm/xe/xe_hw_engine.c +@@ -1153,7 +1153,7 @@ xe_hw_engine_lookup(struct xe_device *xe + { + unsigned int idx; + +- if (eci.engine_class > ARRAY_SIZE(user_to_xe_engine_class)) ++ if (eci.engine_class >= ARRAY_SIZE(user_to_xe_engine_class)) + return NULL; + + if (eci.gt_id >= xe->info.gt_count) diff --git a/queue-6.11/io_uring-sqpoll-do-not-put-cpumask-on-stack.patch b/queue-6.11/io_uring-sqpoll-do-not-put-cpumask-on-stack.patch new file mode 100644 index 00000000000..1a81dbd04d0 --- /dev/null +++ b/queue-6.11/io_uring-sqpoll-do-not-put-cpumask-on-stack.patch @@ -0,0 +1,50 @@ +From 7f44beadcc11adb98220556d2ddbe9c97aa6d42d Mon Sep 17 00:00:00 2001 +From: Felix Moessbauer +Date: Mon, 16 Sep 2024 13:11:50 +0200 +Subject: io_uring/sqpoll: do not put cpumask on stack + +From: Felix Moessbauer + +commit 7f44beadcc11adb98220556d2ddbe9c97aa6d42d upstream. + +Putting the cpumask on the stack is deprecated for a long time (since +2d3854a37e8), as these can be big. Given that, change the on-stack +allocation of allowed_mask to be dynamically allocated. + +Fixes: f011c9cf04c0 ("io_uring/sqpoll: do not allow pinning outside of cpuset") +Signed-off-by: Felix Moessbauer +Link: https://lore.kernel.org/r/20240916111150.1266191-1-felix.moessbauer@siemens.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/sqpoll.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +--- a/io_uring/sqpoll.c ++++ b/io_uring/sqpoll.c +@@ -461,15 +461,22 @@ __cold int io_sq_offload_create(struct i + return 0; + + if (p->flags & IORING_SETUP_SQ_AFF) { +- struct cpumask allowed_mask; ++ cpumask_var_t allowed_mask; + int cpu = p->sq_thread_cpu; + + ret = -EINVAL; + if (cpu >= nr_cpu_ids || !cpu_online(cpu)) + goto err_sqpoll; +- cpuset_cpus_allowed(current, &allowed_mask); +- if (!cpumask_test_cpu(cpu, &allowed_mask)) ++ ret = -ENOMEM; ++ if (!alloc_cpumask_var(&allowed_mask, GFP_KERNEL)) + goto err_sqpoll; ++ ret = -EINVAL; ++ cpuset_cpus_allowed(current, allowed_mask); ++ if (!cpumask_test_cpu(cpu, allowed_mask)) { ++ free_cpumask_var(allowed_mask); ++ goto err_sqpoll; ++ } ++ free_cpumask_var(allowed_mask); + sqd->sq_cpu = cpu; + } else { + sqd->sq_cpu = -1; diff --git a/queue-6.11/selftests-bpf-correctly-move-log-upon-successful-match.patch b/queue-6.11/selftests-bpf-correctly-move-log-upon-successful-match.patch new file mode 100644 index 00000000000..007921fd7ee --- /dev/null +++ b/queue-6.11/selftests-bpf-correctly-move-log-upon-successful-match.patch @@ -0,0 +1,35 @@ +From d0a29cdb6ef95d8a175e09ab2d1334271f047e60 Mon Sep 17 00:00:00 2001 +From: Eduard Zingerman +Date: Tue, 20 Aug 2024 03:23:50 -0700 +Subject: selftests/bpf: correctly move 'log' upon successful match + +From: Eduard Zingerman + +commit d0a29cdb6ef95d8a175e09ab2d1334271f047e60 upstream. + +Suppose log="foo bar buz" and msg->substr="bar". +In such case current match processing logic would update 'log' as +follows: log += strlen(msg->substr); -> log += 3 -> log=" bar". +However, the intent behind the 'log' update is to make it point after +the successful match, e.g. to make log=" buz" in the example above. + +Fixes: 4ef5d6af4935 ("selftests/bpf: no need to track next_match_pos in struct test_loader") +Signed-off-by: Eduard Zingerman +Link: https://lore.kernel.org/r/20240820102357.3372779-3-eddyz87@gmail.com +Signed-off-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/test_loader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/testing/selftests/bpf/test_loader.c ++++ b/tools/testing/selftests/bpf/test_loader.c +@@ -545,7 +545,7 @@ static void validate_msgs(char *log_buf, + if (msg->substr) { + match = strstr(log, msg->substr); + if (match) +- log += strlen(msg->substr); ++ log = match + strlen(msg->substr); + } else { + err = regexec(&msg->regex, log, 1, reg_match, 0); + if (err == 0) { diff --git a/queue-6.11/series b/queue-6.11/series index 795959cfdc7..9ca86ac8f3b 100644 --- a/queue-6.11/series +++ b/queue-6.11/series @@ -517,3 +517,7 @@ drm-amdgpu-display-fix-a-mistake-in-revert-commit.patch xen-move-checks-for-e820-conflicts-further-up.patch xen-allow-mapping-acpi-data-using-a-different-physical-address.patch io_uring-sqpoll-retain-test-for-whether-the-cpu-is-valid.patch +drm-amd-display-check-link_res-hpo_dp_link_enc-before-using-it.patch +drm-xe-fix-engine_class-bounds-check-again.patch +io_uring-sqpoll-do-not-put-cpumask-on-stack.patch +selftests-bpf-correctly-move-log-upon-successful-match.patch