From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 24 Jan 2022 10:04:07 +0000 (+0100)
Subject: 4.19-stable patches
X-Git-Tag: v4.4.300~86
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=21783b83bb80b5afb22f1400d015434d837669ba;p=thirdparty%2Fkernel%2Fstable-queue.git

4.19-stable patches

added patches:
	drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
---

diff --git a/queue-4.19/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch b/queue-4.19/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
new file mode 100644
index 00000000000..a9a647343ac
--- /dev/null
+++ b/queue-4.19/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
@@ -0,0 +1,89 @@
+From 4722f463896cc0ef1a6f1c3cb2e171e949831249 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Mon, 17 Jan 2022 10:31:26 +0100
+Subject: drm/radeon: fix error handling in radeon_driver_open_kms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 4722f463896cc0ef1a6f1c3cb2e171e949831249 upstream.
+
+The return value was never initialized so the cleanup code executed when
+it isn't even necessary.
+
+Just add proper error handling.
+
+Fixes: ab50cb9df889 ("drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()")
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Tested-by: Jan Stancek <jstancek@redhat.com>
+Tested-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_kms.c |   22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -641,18 +641,18 @@ int radeon_driver_open_kms(struct drm_de
+ 		fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
+ 		if (unlikely(!fpriv)) {
+ 			r = -ENOMEM;
+-			goto out_suspend;
++			goto err_suspend;
+ 		}
+ 
+ 		if (rdev->accel_working) {
+ 			vm = &fpriv->vm;
+ 			r = radeon_vm_init(rdev, vm);
+ 			if (r)
+-				goto out_fpriv;
++				goto err_fpriv;
+ 
+ 			r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+ 			if (r)
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 
+ 			/* map the ib pool buffer read only into
+ 			 * virtual address space */
+@@ -660,7 +660,7 @@ int radeon_driver_open_kms(struct drm_de
+ 							rdev->ring_tmp_bo.bo);
+ 			if (!vm->ib_bo_va) {
+ 				r = -ENOMEM;
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 			}
+ 
+ 			r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va,
+@@ -668,19 +668,21 @@ int radeon_driver_open_kms(struct drm_de
+ 						  RADEON_VM_PAGE_READABLE |
+ 						  RADEON_VM_PAGE_SNOOPED);
+ 			if (r)
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 		}
+ 		file_priv->driver_priv = fpriv;
+ 	}
+ 
+-	if (!r)
+-		goto out_suspend;
++	pm_runtime_mark_last_busy(dev->dev);
++	pm_runtime_put_autosuspend(dev->dev);
++	return 0;
+ 
+-out_vm_fini:
++err_vm_fini:
+ 	radeon_vm_fini(rdev, vm);
+-out_fpriv:
++err_fpriv:
+ 	kfree(fpriv);
+-out_suspend:
++
++err_suspend:
+ 	pm_runtime_mark_last_busy(dev->dev);
+ 	pm_runtime_put_autosuspend(dev->dev);
+ 	return r;
diff --git a/queue-4.19/series b/queue-4.19/series
index 9e67aba428c..bfea4b87a1e 100644
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -209,3 +209,4 @@ asoc-dpcm-prevent-snd_soc_dpcm-use-after-free.patch
 regulator-core-let-boot-on-regulators-be-powered-off.patch
 fuse-fix-bad-inode.patch
 fuse-fix-live-lock-in-fuse_iget.patch
+drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch