From: Greg Kroah-Hartman Date: Fri, 6 Dec 2024 13:24:44 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.6.64~4 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fab3bb4e6a9f49d07ba2a4b9f1353558fd017132;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch drm-amdgpu-fix-usage-slab-after-free.patch drm-amdkfd-use-the-correct-wptr-size.patch drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch drm-sti-avoid-potential-dereference-of-error-pointers.patch drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch --- diff --git a/queue-6.6/drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch b/queue-6.6/drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch new file mode 100644 index 00000000000..726364131fb --- /dev/null +++ b/queue-6.6/drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch @@ -0,0 +1,31 @@ +From 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 Mon Sep 17 00:00:00 2001 +From: Umio Yasuno +Date: Thu, 14 Nov 2024 16:15:27 +0900 +Subject: drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 + +From: Umio Yasuno + +commit 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 upstream. + +These were missed before. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3751 +Signed-off-by: Umio Yasuno +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c +@@ -1725,6 +1725,8 @@ static ssize_t smu_v13_0_7_get_gpu_metri + gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency; + + gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK]; ++ gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK]; ++ gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK]; + gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0]; + gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0]; + gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1]; diff --git a/queue-6.6/drm-amdgpu-fix-usage-slab-after-free.patch b/queue-6.6/drm-amdgpu-fix-usage-slab-after-free.patch new file mode 100644 index 00000000000..57a16db03fa --- /dev/null +++ b/queue-6.6/drm-amdgpu-fix-usage-slab-after-free.patch @@ -0,0 +1,218 @@ +From b61badd20b443eabe132314669bb51a263982e5c Mon Sep 17 00:00:00 2001 +From: Vitaly Prosyak +Date: Mon, 11 Nov 2024 17:24:08 -0500 +Subject: drm/amdgpu: fix usage slab after free +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vitaly Prosyak + +commit b61badd20b443eabe132314669bb51a263982e5c upstream. + +[ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] +[ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147 + +[ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1 +[ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 +[ +0.000016] Call Trace: +[ +0.000008] +[ +0.000009] dump_stack_lvl+0x76/0xa0 +[ +0.000017] print_report+0xce/0x5f0 +[ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] +[ +0.000019] ? srso_return_thunk+0x5/0x5f +[ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200 +[ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] +[ +0.000019] kasan_report+0xbe/0x110 +[ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] +[ +0.000023] __asan_report_load8_noabort+0x14/0x30 +[ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] +[ +0.000020] ? srso_return_thunk+0x5/0x5f +[ +0.000013] ? __kasan_check_write+0x14/0x30 +[ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched] +[ +0.000020] ? srso_return_thunk+0x5/0x5f +[ +0.000013] ? __kasan_check_write+0x14/0x30 +[ +0.000013] ? srso_return_thunk+0x5/0x5f +[ +0.000013] ? enable_work+0x124/0x220 +[ +0.000015] ? __pfx_enable_work+0x10/0x10 +[ +0.000013] ? srso_return_thunk+0x5/0x5f +[ +0.000014] ? free_large_kmalloc+0x85/0xf0 +[ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched] +[ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu] +[ +0.000735] ? __kasan_check_read+0x11/0x20 +[ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu] +[ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu] +[ +0.000679] ? mutex_unlock+0x80/0xe0 +[ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu] +[ +0.000662] ? srso_return_thunk+0x5/0x5f +[ +0.000014] ? __kasan_check_write+0x14/0x30 +[ +0.000013] ? srso_return_thunk+0x5/0x5f +[ +0.000013] ? mutex_unlock+0x80/0xe0 +[ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] +[ +0.000663] drm_minor_release+0xc9/0x140 [drm] +[ +0.000081] drm_release+0x1fd/0x390 [drm] +[ +0.000082] __fput+0x36c/0xad0 +[ +0.000018] __fput_sync+0x3c/0x50 +[ +0.000014] __x64_sys_close+0x7d/0xe0 +[ +0.000014] x64_sys_call+0x1bc6/0x2680 +[ +0.000014] do_syscall_64+0x70/0x130 +[ +0.000014] ? srso_return_thunk+0x5/0x5f +[ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190 +[ +0.000015] ? srso_return_thunk+0x5/0x5f +[ +0.000014] ? irqentry_exit+0x43/0x50 +[ +0.000012] ? srso_return_thunk+0x5/0x5f +[ +0.000013] ? exc_page_fault+0x7c/0x110 +[ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e +[ +0.000014] RIP: 0033:0x7ffff7b14f67 +[ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff +[ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 +[ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 +[ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003 +[ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000 +[ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 +[ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 +[ +0.000020] + +[ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s: +[ +0.000014] kasan_save_stack+0x28/0x60 +[ +0.000008] kasan_save_track+0x18/0x70 +[ +0.000007] kasan_save_alloc_info+0x38/0x60 +[ +0.000007] __kasan_kmalloc+0xc1/0xd0 +[ +0.000007] kmalloc_trace_noprof+0x180/0x380 +[ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched] +[ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu] +[ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu] +[ +0.000662] amdgpu_pci_probe+0x361/0xf30 [amdgpu] +[ +0.000651] local_pci_probe+0xe7/0x1b0 +[ +0.000009] pci_device_probe+0x248/0x890 +[ +0.000008] really_probe+0x1fd/0x950 +[ +0.000008] __driver_probe_device+0x307/0x410 +[ +0.000007] driver_probe_device+0x4e/0x150 +[ +0.000007] __driver_attach+0x223/0x510 +[ +0.000006] bus_for_each_dev+0x102/0x1a0 +[ +0.000007] driver_attach+0x3d/0x60 +[ +0.000006] bus_add_driver+0x2ac/0x5f0 +[ +0.000006] driver_register+0x13d/0x490 +[ +0.000008] __pci_register_driver+0x1ee/0x2b0 +[ +0.000007] llc_sap_close+0xb0/0x160 [llc] +[ +0.000009] do_one_initcall+0x9c/0x3e0 +[ +0.000008] do_init_module+0x241/0x760 +[ +0.000008] load_module+0x51ac/0x6c30 +[ +0.000006] __do_sys_init_module+0x234/0x270 +[ +0.000007] __x64_sys_init_module+0x73/0xc0 +[ +0.000006] x64_sys_call+0xe3/0x2680 +[ +0.000006] do_syscall_64+0x70/0x130 +[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +[ +0.000015] Freed by task 2147 on cpu 6 at 160.507651s: +[ +0.000013] kasan_save_stack+0x28/0x60 +[ +0.000007] kasan_save_track+0x18/0x70 +[ +0.000007] kasan_save_free_info+0x3b/0x60 +[ +0.000007] poison_slab_object+0x115/0x1c0 +[ +0.000007] __kasan_slab_free+0x34/0x60 +[ +0.000007] kfree+0xfa/0x2f0 +[ +0.000007] drm_sched_fini+0x19d/0x410 [gpu_sched] +[ +0.000012] amdgpu_fence_driver_sw_fini+0xc4/0x2f0 [amdgpu] +[ +0.000662] amdgpu_device_fini_sw+0x77/0xfc0 [amdgpu] +[ +0.000653] amdgpu_driver_release_kms+0x16/0x80 [amdgpu] +[ +0.000655] drm_minor_release+0xc9/0x140 [drm] +[ +0.000071] drm_release+0x1fd/0x390 [drm] +[ +0.000071] __fput+0x36c/0xad0 +[ +0.000008] __fput_sync+0x3c/0x50 +[ +0.000007] __x64_sys_close+0x7d/0xe0 +[ +0.000007] x64_sys_call+0x1bc6/0x2680 +[ +0.000007] do_syscall_64+0x70/0x130 +[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e + +[ +0.000014] The buggy address belongs to the object at ffff8881b8605f80 + which belongs to the cache kmalloc-64 of size 64 +[ +0.000020] The buggy address is located 8 bytes inside of + freed 64-byte region [ffff8881b8605f80, ffff8881b8605fc0) + +[ +0.000028] The buggy address belongs to the physical page: +[ +0.000011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b8605 +[ +0.000008] anon flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff) +[ +0.000007] page_type: 0xffffefff(slab) +[ +0.000009] raw: 0017ffffc0000000 ffff8881000428c0 0000000000000000 dead000000000001 +[ +0.000006] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000 +[ +0.000006] page dumped because: kasan: bad access detected + +[ +0.000012] Memory state around the buggy address: +[ +0.000011] ffff8881b8605e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ +0.000015] ffff8881b8605f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc +[ +0.000015] >ffff8881b8605f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ +0.000013] ^ +[ +0.000011] ffff8881b8606000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc +[ +0.000014] ffff8881b8606080: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb +[ +0.000013] ================================================================== + +The issue reproduced on VG20 during the IGT pci_unplug test. +The root cause of the issue is that the function drm_sched_fini is called before drm_sched_entity_kill. +In drm_sched_fini, the drm_sched_rq structure is freed, but this structure is later accessed by +each entity within the run queue, leading to invalid memory access. +To resolve this, the order of cleanup calls is updated: + + Before: + amdgpu_fence_driver_sw_fini + amdgpu_device_ip_fini + + After: + amdgpu_device_ip_fini + amdgpu_fence_driver_sw_fini + +This updated order ensures that all entities in the IPs are cleaned up first, followed by proper +cleanup of the schedulers. + +Additional Investigation: + +During debugging, another issue was identified in the amdgpu_vce_sw_fini function. The vce.vcpu_bo +buffer must be freed only as the final step in the cleanup process to prevent any premature +access during earlier cleanup stages. + +v2: Using Christian suggestion call drm_sched_entity_destroy before drm_sched_fini. + +Cc: Christian König +Cc: Alex Deucher +Signed-off-by: Vitaly Prosyak +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +- + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +++--- + 2 files changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -4020,8 +4020,8 @@ void amdgpu_device_fini_sw(struct amdgpu + int idx; + bool px; + +- amdgpu_fence_driver_sw_fini(adev); + amdgpu_device_ip_fini(adev); ++ amdgpu_fence_driver_sw_fini(adev); + amdgpu_ucode_release(&adev->firmware.gpu_info_fw); + adev->accel_working = false; + dma_fence_put(rcu_dereference_protected(adev->gang_submit, true)); +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +@@ -214,15 +214,15 @@ int amdgpu_vce_sw_fini(struct amdgpu_dev + + drm_sched_entity_destroy(&adev->vce.entity); + +- amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr, +- (void **)&adev->vce.cpu_addr); +- + for (i = 0; i < adev->vce.num_rings; i++) + amdgpu_ring_fini(&adev->vce.ring[i]); + + amdgpu_ucode_release(&adev->vce.fw); + mutex_destroy(&adev->vce.idle_mutex); + ++ amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr, ++ (void **)&adev->vce.cpu_addr); ++ + return 0; + } + diff --git a/queue-6.6/drm-amdkfd-use-the-correct-wptr-size.patch b/queue-6.6/drm-amdkfd-use-the-correct-wptr-size.patch new file mode 100644 index 00000000000..3177d6e081b --- /dev/null +++ b/queue-6.6/drm-amdkfd-use-the-correct-wptr-size.patch @@ -0,0 +1,32 @@ +From cdc6705f98ea3f854a60ba8c9b19228e197ae384 Mon Sep 17 00:00:00 2001 +From: Lijo Lazar +Date: Mon, 11 Nov 2024 20:11:38 +0530 +Subject: drm/amdkfd: Use the correct wptr size + +From: Lijo Lazar + +commit cdc6705f98ea3f854a60ba8c9b19228e197ae384 upstream. + +Write pointer could be 32-bit or 64-bit. Use the correct size during +initialization. + +Signed-off-by: Lijo Lazar +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c +@@ -123,7 +123,7 @@ static bool kq_initialize(struct kernel_ + + memset(kq->pq_kernel_addr, 0, queue_size); + memset(kq->rptr_kernel, 0, sizeof(*kq->rptr_kernel)); +- memset(kq->wptr_kernel, 0, sizeof(*kq->wptr_kernel)); ++ memset(kq->wptr_kernel, 0, dev->kfd->device_info.doorbell_size); + + prop.queue_size = queue_size; + prop.is_interop = false; diff --git a/queue-6.6/drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch b/queue-6.6/drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch new file mode 100644 index 00000000000..1fe96350a87 --- /dev/null +++ b/queue-6.6/drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch @@ -0,0 +1,33 @@ +From 4f8dbadef085ab447a01a8d4806a3f629fea05ed Mon Sep 17 00:00:00 2001 +From: Lucas Stach +Date: Fri, 25 Oct 2024 17:14:46 +0200 +Subject: drm/etnaviv: flush shader L1 cache after user commandstream + +From: Lucas Stach + +commit 4f8dbadef085ab447a01a8d4806a3f629fea05ed upstream. + +The shader L1 cache is a writeback cache for shader loads/stores +and thus must be flushed before any BOs backing the shader buffers +are potentially freed. + +Cc: stable@vger.kernel.org +Reviewed-by: Christian Gmeiner +Signed-off-by: Lucas Stach +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c +@@ -482,7 +482,8 @@ void etnaviv_buffer_queue(struct etnaviv + } else { + CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE, + VIVS_GL_FLUSH_CACHE_DEPTH | +- VIVS_GL_FLUSH_CACHE_COLOR); ++ VIVS_GL_FLUSH_CACHE_COLOR | ++ VIVS_GL_FLUSH_CACHE_SHADER_L1); + if (has_blt) { + CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1); + CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1); diff --git a/queue-6.6/drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch b/queue-6.6/drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch new file mode 100644 index 00000000000..246a12f9451 --- /dev/null +++ b/queue-6.6/drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch @@ -0,0 +1,43 @@ +From f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 Mon Sep 17 00:00:00 2001 +From: Javier Carrasco +Date: Fri, 11 Oct 2024 21:21:51 +0200 +Subject: drm/mediatek: Fix child node refcount handling in early exit + +From: Javier Carrasco + +commit f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 upstream. + +Early exits (goto, break, return) from for_each_child_of_node() required +an explicit call to of_node_put(), which was not introduced with the +break if cnt == MAX_CRTC. + +Add the missing of_node_put() before the break. + +Cc: stable@vger.kernel.org +Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue") + +Signed-off-by: Javier Carrasco +Reviewed-by: CK Hu +Reviewed-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://patchwork.kernel.org/project/dri-devel/patch/20241011-mtk_drm_drv_memleak-v1-1-2b40c74c8d75@gmail.com/ +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -378,8 +378,10 @@ static bool mtk_drm_get_all_drm_priv(str + if (all_drm_priv[cnt] && all_drm_priv[cnt]->mtk_drm_bound) + cnt++; + +- if (cnt == MAX_CRTC) ++ if (cnt == MAX_CRTC) { ++ of_node_put(node); + break; ++ } + } + + if (drm_priv->data->mmsys_dev_num == cnt) { diff --git a/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch new file mode 100644 index 00000000000..8242d994b89 --- /dev/null +++ b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch @@ -0,0 +1,36 @@ +From e965e771b069421c233d674c3c8cd8c7f7245f42 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Mon, 9 Sep 2024 14:33:59 +0800 +Subject: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check + +From: Ma Ke + +commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream. + +The return value of drm_atomic_get_crtc_state() needs to be +checked. To avoid use of error pointer 'crtc_state' in case +of the failure. + +Cc: stable@vger.kernel.org +Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") +Signed-off-by: Ma Ke +Acked-by: Alain Volmat +Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make24@iscas.ac.cn +Signed-off-by: Alain Volmat +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sti/sti_gdp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/sti/sti_gdp.c ++++ b/drivers/gpu/drm/sti/sti_gdp.c +@@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct d + + mixer = to_sti_mixer(crtc); + crtc_state = drm_atomic_get_crtc_state(state, crtc); ++ if (IS_ERR(crtc_state)) ++ return PTR_ERR(crtc_state); ++ + mode = &crtc_state->mode; + dst_x = new_plane_state->crtc_x; + dst_y = new_plane_state->crtc_y; diff --git a/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch new file mode 100644 index 00000000000..17748f128af --- /dev/null +++ b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch @@ -0,0 +1,35 @@ +From c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 13 Sep 2024 17:09:26 +0800 +Subject: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check + +From: Ma Ke + +commit c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 upstream. + +The return value of drm_atomic_get_crtc_state() needs to be +checked. To avoid use of error pointer 'crtc_state' in case +of the failure. + +Cc: stable@vger.kernel.org +Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") +Signed-off-by: Ma Ke +Link: https://patchwork.freedesktop.org/patch/msgid/20240913090926.2023716-1-make24@iscas.ac.cn +Signed-off-by: Alain Volmat +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sti/sti_hqvdp.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/sti/sti_hqvdp.c ++++ b/drivers/gpu/drm/sti/sti_hqvdp.c +@@ -1037,6 +1037,9 @@ static int sti_hqvdp_atomic_check(struct + return 0; + + crtc_state = drm_atomic_get_crtc_state(state, crtc); ++ if (IS_ERR(crtc_state)) ++ return PTR_ERR(crtc_state); ++ + mode = &crtc_state->mode; + dst_x = new_plane_state->crtc_x; + dst_y = new_plane_state->crtc_y; diff --git a/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers.patch b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers.patch new file mode 100644 index 00000000000..ab3840c6d8d --- /dev/null +++ b/queue-6.6/drm-sti-avoid-potential-dereference-of-error-pointers.patch @@ -0,0 +1,35 @@ +From 831214f77037de02afc287eae93ce97f218d8c04 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Fri, 13 Sep 2024 17:04:12 +0800 +Subject: drm/sti: avoid potential dereference of error pointers + +From: Ma Ke + +commit 831214f77037de02afc287eae93ce97f218d8c04 upstream. + +The return value of drm_atomic_get_crtc_state() needs to be +checked. To avoid use of error pointer 'crtc_state' in case +of the failure. + +Cc: stable@vger.kernel.org +Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes") +Signed-off-by: Ma Ke +Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make24@iscas.ac.cn +Signed-off-by: Alain Volmat +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/sti/sti_cursor.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/sti/sti_cursor.c ++++ b/drivers/gpu/drm/sti/sti_cursor.c +@@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struc + return 0; + + crtc_state = drm_atomic_get_crtc_state(state, crtc); ++ if (IS_ERR(crtc_state)) ++ return PTR_ERR(crtc_state); ++ + mode = &crtc_state->mode; + dst_x = new_plane_state->crtc_x; + dst_y = new_plane_state->crtc_y; diff --git a/queue-6.6/drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch b/queue-6.6/drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch new file mode 100644 index 00000000000..7c89fd2629a --- /dev/null +++ b/queue-6.6/drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch @@ -0,0 +1,40 @@ +From 71ba1c9b1c717831920c3d432404ee5a707e04b4 Mon Sep 17 00:00:00 2001 +From: Steffen Dirkwinkel +Date: Mon, 28 Oct 2024 14:42:17 +0100 +Subject: drm: xlnx: zynqmp_dpsub: fix hotplug detection + +From: Steffen Dirkwinkel + +commit 71ba1c9b1c717831920c3d432404ee5a707e04b4 upstream. + +drm_kms_helper_poll_init needs to be called after zynqmp_dpsub_kms_init. +zynqmp_dpsub_kms_init creates the connector and without it we don't +enable hotplug detection. + +Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge") +Cc: stable@vger.kernel.org +Signed-off-by: Steffen Dirkwinkel +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20241028134218.54727-1-lists@steffen.cc +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/xlnx/zynqmp_kms.c ++++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c +@@ -506,12 +506,12 @@ int zynqmp_dpsub_drm_init(struct zynqmp_ + if (ret) + return ret; + +- drm_kms_helper_poll_init(drm); +- + ret = zynqmp_dpsub_kms_init(dpsub); + if (ret < 0) + goto err_poll_fini; + ++ drm_kms_helper_poll_init(drm); ++ + /* Reset all components and register the DRM device. */ + drm_mode_config_reset(drm); + diff --git a/queue-6.6/series b/queue-6.6/series index b26fca80760..050163a3ada 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -664,3 +664,12 @@ powerpc-adjust-adding-stack-protector-flags-to-kbuild_clags-for-clang.patch btrfs-don-t-bug_on-on-enomem-from-btrfs_lookup_extent_info-in-walk_down_proc.patch tpm-lock-tpm-chip-in-tpm_pm_suspend-first.patch udmabuf-use-vmf_insert_pfn-and-vm_pfnmap-for-handling-mmap.patch +drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_hqvdp_atomic_check.patch +drm-sti-avoid-potential-dereference-of-error-pointers-in-sti_gdp_atomic_check.patch +drm-sti-avoid-potential-dereference-of-error-pointers.patch +drm-mediatek-fix-child-node-refcount-handling-in-early-exit.patch +drm-etnaviv-flush-shader-l1-cache-after-user-commandstream.patch +drm-xlnx-zynqmp_dpsub-fix-hotplug-detection.patch +drm-amdkfd-use-the-correct-wptr-size.patch +drm-amdgpu-fix-usage-slab-after-free.patch +drm-amd-pm-update-current_socclk-and-current_uclk-in-gpu_metrics-on-smu-v13.0.7.patch