From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 14:45:37 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.16.3~73 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=52fd352b9333ba0972da3c8ae6a1bc7f033b1624;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amd-restore-cached-power-limit-during-resume.patch media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch --- diff --git a/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch b/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch new file mode 100644 index 0000000000..d7b58af858 --- /dev/null +++ b/queue-5.10/drm-amd-restore-cached-power-limit-during-resume.patch @@ -0,0 +1,40 @@ +From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 24 Jul 2025 22:12:21 -0500 +Subject: drm/amd: Restore cached power limit during resume + +From: Mario Limonciello + +commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream. + +The power limit will be cached in smu->current_power_limit but +if the ASIC goes into S3 this value won't be restored. + +Restore the value during SMU resume. + +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1332,6 +1332,12 @@ static int smu_resume(void *handle) + + adev->pm.dpm_enabled = true; + ++ if (smu->current_power_limit) { ++ ret = smu_set_power_limit(smu, smu->current_power_limit); ++ if (ret && ret != -EOPNOTSUPP) ++ return ret; ++ } ++ + dev_info(adev->dev, "SMU is resumed successfully!\n"); + + return 0; diff --git a/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch b/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch new file mode 100644 index 0000000000..4a3ab917c8 --- /dev/null +++ b/queue-5.10/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch @@ -0,0 +1,47 @@ +From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001 +From: Vedang Nagar +Date: Mon, 19 May 2025 12:42:21 +0530 +Subject: media: venus: Add a check for packet size after reading from shared memory + +From: Vedang Nagar + +commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream. + +Add a check to ensure that the packet size does not exceed the number of +available words after reading the packet header from shared memory. This +ensures that the size provided by the firmware is safe to process and +prevent potential out-of-bounds memory access. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Vedang Nagar +Co-developed-by: Dikshita Agarwal +Signed-off-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -240,6 +240,7 @@ static int venus_write_queue(struct venu + static int venus_read_queue(struct venus_hfi_device *hdev, + struct iface_queue *queue, void *pkt, u32 *tx_req) + { ++ struct hfi_pkt_hdr *pkt_hdr = NULL; + struct hfi_queue_header *qhdr; + u32 dwords, new_rd_idx; + u32 rd_idx, wr_idx, type, qsize; +@@ -305,6 +306,9 @@ static int venus_read_queue(struct venus + memcpy(pkt, rd_ptr, len); + memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2); + } ++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt); ++ if ((pkt_hdr->size >> 2) != dwords) ++ return -EINVAL; + } else { + /* bad packet received, dropping */ + new_rd_idx = qhdr->write_idx; diff --git a/queue-5.10/series b/queue-5.10/series index 014bf36776..1ce0df64af 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -382,3 +382,5 @@ media-imx-fix-a-potential-memory-leak-in-imx_media_csc_scaler_device_init.patch media-usbtv-lock-resolution-while-streaming.patch media-rainshadow-cec-fix-toctou-race-condition-in-rain_interrupt.patch media-ov2659-fix-memory-leaks-in-ov2659_probe.patch +media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch +drm-amd-restore-cached-power-limit-during-resume.patch