From: Sasha Levin Date: Sun, 21 Apr 2024 17:10:14 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.15.157~53 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=57d2d8b91e32f78ae58aeb870e397ebf0b4c69aa;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/drm-nv04-fix-out-of-bounds-access.patch b/queue-5.4/drm-nv04-fix-out-of-bounds-access.patch new file mode 100644 index 00000000000..8e2af7965da --- /dev/null +++ b/queue-5.4/drm-nv04-fix-out-of-bounds-access.patch @@ -0,0 +1,86 @@ +From b647680da2fcc57258b47a090e260712951ea07a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Apr 2024 14:08:52 +0300 +Subject: drm: nv04: Fix out of bounds access + +From: Mikhail Kobuk + +[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] + +When Output Resource (dcb->or) value is assigned in +fabricate_dcb_output(), there may be out of bounds access to +dac_users array in case dcb->or is zero because ffs(dcb->or) is +used as index there. +The 'or' argument of fabricate_dcb_output() must be interpreted as a +number of bit to set, not value. + +Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") +Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") +Signed-off-by: Mikhail Kobuk +Signed-off-by: Danilo Krummrich +Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobuk@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c +index d204ea8a5618e..5cdf0d8d4bc18 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bios.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c +@@ -23,6 +23,7 @@ + */ + + #include "nouveau_drv.h" ++#include "nouveau_bios.h" + #include "nouveau_reg.h" + #include "dispnv04/hw.h" + #include "nouveau_encoder.h" +@@ -1672,7 +1673,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) + */ + if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { + if (*conn == 0xf2005014 && *conf == 0xffffffff) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); + return false; + } + } +@@ -1758,26 +1759,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) + #ifdef __powerpc__ + /* Apple iMac G4 NV17 */ + if (of_machine_is_compatible("PowerMac4,5")) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); +- fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); + return; + } + #endif + + /* Make up some sane defaults */ + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, +- bios->legacy.i2c_indices.crt, 1, 1); ++ bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); + + if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) + fabricate_dcb_output(dcb, DCB_OUTPUT_TV, + bios->legacy.i2c_indices.tv, +- all_heads, 0); ++ all_heads, DCB_OUTPUT_A); + + else if (bios->tmds.output0_script_ptr || + bios->tmds.output1_script_ptr) + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, + bios->legacy.i2c_indices.panel, +- all_heads, 1); ++ all_heads, DCB_OUTPUT_B); + } + + static int +-- +2.43.0 + diff --git a/queue-5.4/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch b/queue-5.4/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch new file mode 100644 index 00000000000..87b13849f64 --- /dev/null +++ b/queue-5.4/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch @@ -0,0 +1,41 @@ +From 0d262a990d3439dad8f25799c3d8a5e36d352275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Apr 2024 12:03:46 +0300 +Subject: RDMA/mlx5: Fix port number for counter query in multi-port + configuration + +From: Michael Guralnik + +[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ] + +Set the correct port when querying PPCNT in multi-port configuration. +Distinguish between cases where switchdev mode was enabled to multi-port +configuration and don't overwrite the queried port to 1 in multi-port +case. + +Fixes: 74b30b3ad5ce ("RDMA/mlx5: Set local port to one when accessing counters") +Signed-off-by: Michael Guralnik +Link: https://lore.kernel.org/r/9bfcc8ade958b760a51408c3ad654a01b11f7d76.1712134988.git.leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c +index 3897a3ce02ad0..84d72b3b6df84 100644 +--- a/drivers/infiniband/hw/mlx5/mad.c ++++ b/drivers/infiniband/hw/mlx5/mad.c +@@ -219,7 +219,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num, + mdev = dev->mdev; + mdev_port_num = 1; + } +- if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) { ++ if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1 && ++ !mlx5_core_mp_enabled(mdev)) { + /* set local port to one for Function-Per-Port HCA. */ + mdev = dev->mdev; + mdev_port_num = 1; +-- +2.43.0 + diff --git a/queue-5.4/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch b/queue-5.4/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch new file mode 100644 index 00000000000..6e46c1876bb --- /dev/null +++ b/queue-5.4/rdma-rxe-fix-the-problem-mutex_destroy-missing.patch @@ -0,0 +1,38 @@ +From d745d76f07843daffbc542b892efeb8bee6116ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Mar 2024 07:51:40 +0100 +Subject: RDMA/rxe: Fix the problem "mutex_destroy missing" + +From: Yanjun.Zhu + +[ Upstream commit 481047d7e8391d3842ae59025806531cdad710d9 ] + +When a mutex lock is not used any more, the function mutex_destroy +should be called to mark the mutex lock uninitialized. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Signed-off-by: Yanjun.Zhu +Link: https://lore.kernel.org/r/20240314065140.27468-1-yanjun.zhu@linux.dev +Reviewed-by: Daisuke Matsuda +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe.c b/drivers/infiniband/sw/rxe/rxe.c +index de5f3efe9fcb4..76e103ef5be31 100644 +--- a/drivers/infiniband/sw/rxe/rxe.c ++++ b/drivers/infiniband/sw/rxe/rxe.c +@@ -72,6 +72,8 @@ void rxe_dealloc(struct ib_device *ib_dev) + + if (rxe->tfm) + crypto_free_shash(rxe->tfm); ++ ++ mutex_destroy(&rxe->usdev_lock); + } + + /* initialize rxe device parameters */ +-- +2.43.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 6f1cc464c2f..7221a38dbd6 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -23,3 +23,6 @@ kprobes-fix-possible-use-after-free-issue-on-kprobe-registration.patch revert-tracing-trigger-fix-to-return-error-if-failed-to-alloc-snapshot.patch netfilter-nf_tables-fix-potential-data-race-in-__nft.patch tun-limit-printing-rate-when-illegal-packet-received.patch +rdma-rxe-fix-the-problem-mutex_destroy-missing.patch +rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch +drm-nv04-fix-out-of-bounds-access.patch