From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 2 Oct 2025 07:21:04 +0000 (+0200)
Subject: 5.15-stable patches
X-Git-Tag: v5.4.300~4
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8f479894d26993d93924b99eaa3e797999a31b91;p=thirdparty%2Fkernel%2Fstable-queue.git

5.15-stable patches

added patches:
	drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
---

diff --git a/queue-5.15/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch b/queue-5.15/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
new file mode 100644
index 0000000000..70f55eb065
--- /dev/null
+++ b/queue-5.15/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch
@@ -0,0 +1,66 @@
+From 6f71507415841d1a6d38118e5fa0eaf0caab9c17 Mon Sep 17 00:00:00 2001
+From: Guenter Roeck <linux@roeck-us.net>
+Date: Tue, 21 Jan 2025 06:52:03 -0800
+Subject: drm/i915/backlight: Return immediately when scale() finds invalid parameters
+
+From: Guenter Roeck <linux@roeck-us.net>
+
+commit 6f71507415841d1a6d38118e5fa0eaf0caab9c17 upstream.
+
+The scale() functions detects invalid parameters, but continues
+its calculations anyway. This causes bad results if negative values
+are used for unsigned operations. Worst case, a division by 0 error
+will be seen if source_min == source_max.
+
+On top of that, after v6.13, the sequence of WARN_ON() followed by clamp()
+may result in a build error with gcc 13.x.
+
+drivers/gpu/drm/i915/display/intel_backlight.c: In function 'scale':
+include/linux/compiler_types.h:542:45: error:
+	call to '__compiletime_assert_415' declared with attribute error:
+	clamp() low limit source_min greater than high limit source_max
+
+This happens if the compiler decides to rearrange the code as follows.
+
+        if (source_min > source_max) {
+                WARN(..);
+                /* Do the clamp() knowing that source_min > source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        } else {
+                /* Do the clamp knowing that source_min <= source_max */
+                source_val = clamp(source_val, source_min, source_max);
+        }
+
+Fix the problem by evaluating the return values from WARN_ON and returning
+immediately after a warning. While at it, fix divide by zero error seen
+if source_min == source_max.
+
+Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: David Laight <david.laight.linux@gmail.com>
+Cc: David Laight <david.laight.linux@gmail.com>
+Cc: Jani Nikula <jani.nikula@linux.intel.com>
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250121145203.2851237-1-linux@roeck-us.net
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_backlight.c |    5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_backlight.c
++++ b/drivers/gpu/drm/i915/display/intel_backlight.c
+@@ -31,8 +31,9 @@ static u32 scale(u32 source_val,
+ {
+ 	u64 target_val;
+ 
+-	WARN_ON(source_min > source_max);
+-	WARN_ON(target_min > target_max);
++	if (WARN_ON(source_min >= source_max) ||
++	    WARN_ON(target_min > target_max))
++		return target_min;
+ 
+ 	/* defensive */
+ 	source_val = clamp(source_val, source_min, source_max);
diff --git a/queue-5.15/series b/queue-5.15/series
index a9cd3ab0d5..73d882ef58 100644
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -149,3 +149,4 @@ i40e-fix-validation-of-vf-state-in-get-resources.patch
 i40e-fix-idx-validation-in-config-queues-msg.patch
 i40e-increase-max-descriptors-for-xl710.patch
 i40e-add-validation-for-ring_len-param.patch
+drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch