From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 12 Jun 2023 09:25:01 +0000 (+0200)
Subject: 5.4-stable patches
X-Git-Tag: v4.14.318~17
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d603ab9fd43a16aae4b5852274f8d27de9a0449;p=thirdparty%2Fkernel%2Fstable-queue.git

5.4-stable patches

added patches:
	drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch
---

diff --git a/queue-5.4/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch b/queue-5.4/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch
new file mode 100644
index 00000000000..e70462846cd
--- /dev/null
+++ b/queue-5.4/drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch
@@ -0,0 +1,53 @@
+From 439cf34c8e0a8a33d8c15a31be1b7423426bc765 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala@linux.intel.com>
+Date: Wed, 9 Feb 2022 11:19:27 +0200
+Subject: drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ville Syrjälä <ville.syrjala@linux.intel.com>
+
+commit 439cf34c8e0a8a33d8c15a31be1b7423426bc765 upstream.
+
+Make sure we don't assign an error pointer to crtc_state->mode_blob
+as that will break all kinds of places that assume either NULL or a
+valid pointer (eg. drm_property_blob_put()).
+
+Cc: stable@vger.kernel.org
+Reported-by: fuyufan <fuyufan@huawei.com>
+Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220209091928.14766-1-ville.syrjala@linux.intel.com
+Acked-by: Maxime Ripard <maxime@cerno.tech>
+Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_atomic_uapi.c |   14 ++++++++------
+ 1 file changed, 8 insertions(+), 6 deletions(-)
+
+--- a/drivers/gpu/drm/drm_atomic_uapi.c
++++ b/drivers/gpu/drm/drm_atomic_uapi.c
+@@ -75,15 +75,17 @@ int drm_atomic_set_mode_for_crtc(struct
+ 	state->mode_blob = NULL;
+ 
+ 	if (mode) {
++		struct drm_property_blob *blob;
++
+ 		drm_mode_convert_to_umode(&umode, mode);
+-		state->mode_blob =
+-			drm_property_create_blob(state->crtc->dev,
+-		                                 sizeof(umode),
+-		                                 &umode);
+-		if (IS_ERR(state->mode_blob))
+-			return PTR_ERR(state->mode_blob);
++		blob = drm_property_create_blob(crtc->dev,
++						sizeof(umode), &umode);
++		if (IS_ERR(blob))
++			return PTR_ERR(blob);
+ 
+ 		drm_mode_copy(&state->mode, mode);
++
++		state->mode_blob = blob;
+ 		state->enable = true;
+ 		DRM_DEBUG_ATOMIC("Set [MODE:%s] for [CRTC:%d:%s] state %p\n",
+ 				 mode->name, crtc->base.id, crtc->name, state);
diff --git a/queue-5.4/series b/queue-5.4/series
index 2e2f575e32a..dc93dda8b0d 100644
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -37,3 +37,4 @@ eeprom-at24-also-select-regmap.patch
 ext4-only-check-dquot_initialize_needed-when-debugging.patch
 cifs-get-rid-of-unused-parameter-in-reconn_setup_dfs_targets.patch
 cifs-handle-empty-list-of-targets-in-cifs_reconnect.patch
+drm-atomic-don-t-pollute-crtc_state-mode_blob-with-error-pointers.patch