From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 24 Jan 2022 10:03:47 +0000 (+0100)
Subject: 4.14-stable patches
X-Git-Tag: v4.4.300~87
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8a4dd71d565e4fa77ca9552f61aaa77f99852618;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
---

diff --git a/queue-4.14/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch b/queue-4.14/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
new file mode 100644
index 00000000000..397a446c848
--- /dev/null
+++ b/queue-4.14/drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch
@@ -0,0 +1,89 @@
+From 4722f463896cc0ef1a6f1c3cb2e171e949831249 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Christian=20K=C3=B6nig?= <christian.koenig@amd.com>
+Date: Mon, 17 Jan 2022 10:31:26 +0100
+Subject: drm/radeon: fix error handling in radeon_driver_open_kms
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Christian König <christian.koenig@amd.com>
+
+commit 4722f463896cc0ef1a6f1c3cb2e171e949831249 upstream.
+
+The return value was never initialized so the cleanup code executed when
+it isn't even necessary.
+
+Just add proper error handling.
+
+Fixes: ab50cb9df889 ("drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms()")
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Tested-by: Jan Stancek <jstancek@redhat.com>
+Tested-by: Borislav Petkov <bp@suse.de>
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/radeon/radeon_kms.c |   22 ++++++++++++----------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -673,18 +673,18 @@ int radeon_driver_open_kms(struct drm_de
+ 		fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
+ 		if (unlikely(!fpriv)) {
+ 			r = -ENOMEM;
+-			goto out_suspend;
++			goto err_suspend;
+ 		}
+ 
+ 		if (rdev->accel_working) {
+ 			vm = &fpriv->vm;
+ 			r = radeon_vm_init(rdev, vm);
+ 			if (r)
+-				goto out_fpriv;
++				goto err_fpriv;
+ 
+ 			r = radeon_bo_reserve(rdev->ring_tmp_bo.bo, false);
+ 			if (r)
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 
+ 			/* map the ib pool buffer read only into
+ 			 * virtual address space */
+@@ -692,7 +692,7 @@ int radeon_driver_open_kms(struct drm_de
+ 							rdev->ring_tmp_bo.bo);
+ 			if (!vm->ib_bo_va) {
+ 				r = -ENOMEM;
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 			}
+ 
+ 			r = radeon_vm_bo_set_addr(rdev, vm->ib_bo_va,
+@@ -700,19 +700,21 @@ int radeon_driver_open_kms(struct drm_de
+ 						  RADEON_VM_PAGE_READABLE |
+ 						  RADEON_VM_PAGE_SNOOPED);
+ 			if (r)
+-				goto out_vm_fini;
++				goto err_vm_fini;
+ 		}
+ 		file_priv->driver_priv = fpriv;
+ 	}
+ 
+-	if (!r)
+-		goto out_suspend;
++	pm_runtime_mark_last_busy(dev->dev);
++	pm_runtime_put_autosuspend(dev->dev);
++	return 0;
+ 
+-out_vm_fini:
++err_vm_fini:
+ 	radeon_vm_fini(rdev, vm);
+-out_fpriv:
++err_fpriv:
+ 	kfree(fpriv);
+-out_suspend:
++
++err_suspend:
+ 	pm_runtime_mark_last_busy(dev->dev);
+ 	pm_runtime_put_autosuspend(dev->dev);
+ 	return r;
diff --git a/queue-4.14/series b/queue-4.14/series
index e35e9ad6ecc..e4a1152ea95 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -157,3 +157,4 @@ ext4-don-t-use-the-orphan-list-when-migrating-an-inode.patch
 crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch
 fuse-fix-bad-inode.patch
 fuse-fix-live-lock-in-fuse_iget.patch
+drm-radeon-fix-error-handling-in-radeon_driver_open_kms.patch