From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 14:42:16 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.16.3~78 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe4f591855801890032fda020409537b857c7dec;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch drm-amd-restore-cached-power-limit-during-resume.patch media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch media-venus-hfi-explicitly-release-irq-during-teardown.patch media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch --- diff --git a/queue-5.15/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch b/queue-5.15/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch new file mode 100644 index 0000000000..78a1471e9d --- /dev/null +++ b/queue-5.15/drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch @@ -0,0 +1,38 @@ +From 4db9cd554883e051df1840d4d58d636043101034 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Tue, 22 Jul 2025 17:58:29 +0200 +Subject: drm/amd/display: Don't overwrite dce60_clk_mgr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 4db9cd554883e051df1840d4d58d636043101034 upstream. + +dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr +with the dce_clk_mgr, causing incorrect behaviour on DCE6. +Fix it by removing the extra dce_clk_mgr_construct. + +Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs") +Reviewed-by: Rodrigo Siqueira +Reviewed-by: Alex Deucher +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/clk_mgr.c +@@ -146,7 +146,6 @@ struct clk_mgr *dc_clk_mgr_create(struct + return NULL; + } + dce60_clk_mgr_construct(ctx, clk_mgr); +- dce_clk_mgr_construct(ctx, clk_mgr); + return &clk_mgr->base; + } + #endif diff --git a/queue-5.15/drm-amd-restore-cached-power-limit-during-resume.patch b/queue-5.15/drm-amd-restore-cached-power-limit-during-resume.patch new file mode 100644 index 0000000000..729421c8fe --- /dev/null +++ b/queue-5.15/drm-amd-restore-cached-power-limit-during-resume.patch @@ -0,0 +1,40 @@ +From ed4efe426a49729952b3dc05d20e33b94409bdd1 Mon Sep 17 00:00:00 2001 +From: Mario Limonciello +Date: Thu, 24 Jul 2025 22:12:21 -0500 +Subject: drm/amd: Restore cached power limit during resume + +From: Mario Limonciello + +commit ed4efe426a49729952b3dc05d20e33b94409bdd1 upstream. + +The power limit will be cached in smu->current_power_limit but +if the ASIC goes into S3 this value won't be restored. + +Restore the value during SMU resume. + +Acked-by: Alex Deucher +Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org +Signed-off-by: Mario Limonciello +Signed-off-by: Alex Deucher +(cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1573,6 +1573,12 @@ static int smu_resume(void *handle) + + adev->pm.dpm_enabled = true; + ++ if (smu->current_power_limit) { ++ ret = smu_set_power_limit(smu, smu->current_power_limit); ++ if (ret && ret != -EOPNOTSUPP) ++ return ret; ++ } ++ + dev_info(adev->dev, "SMU is resumed successfully!\n"); + + return 0; diff --git a/queue-5.15/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch b/queue-5.15/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch new file mode 100644 index 0000000000..d2f10a5dcf --- /dev/null +++ b/queue-5.15/media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch @@ -0,0 +1,47 @@ +From 49befc830daa743e051a65468c05c2ff9e8580e6 Mon Sep 17 00:00:00 2001 +From: Vedang Nagar +Date: Mon, 19 May 2025 12:42:21 +0530 +Subject: media: venus: Add a check for packet size after reading from shared memory + +From: Vedang Nagar + +commit 49befc830daa743e051a65468c05c2ff9e8580e6 upstream. + +Add a check to ensure that the packet size does not exceed the number of +available words after reading the packet header from shared memory. This +ensures that the size provided by the firmware is safe to process and +prevent potential out-of-bounds memory access. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Vedang Nagar +Co-developed-by: Dikshita Agarwal +Signed-off-by: Dikshita Agarwal +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -239,6 +239,7 @@ static int venus_write_queue(struct venu + static int venus_read_queue(struct venus_hfi_device *hdev, + struct iface_queue *queue, void *pkt, u32 *tx_req) + { ++ struct hfi_pkt_hdr *pkt_hdr = NULL; + struct hfi_queue_header *qhdr; + u32 dwords, new_rd_idx; + u32 rd_idx, wr_idx, type, qsize; +@@ -304,6 +305,9 @@ static int venus_read_queue(struct venus + memcpy(pkt, rd_ptr, len); + memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2); + } ++ pkt_hdr = (struct hfi_pkt_hdr *)(pkt); ++ if ((pkt_hdr->size >> 2) != dwords) ++ return -EINVAL; + } else { + /* bad packet received, dropping */ + new_rd_idx = qhdr->write_idx; diff --git a/queue-5.15/media-venus-hfi-explicitly-release-irq-during-teardown.patch b/queue-5.15/media-venus-hfi-explicitly-release-irq-during-teardown.patch new file mode 100644 index 0000000000..d2c4260f6e --- /dev/null +++ b/queue-5.15/media-venus-hfi-explicitly-release-irq-during-teardown.patch @@ -0,0 +1,38 @@ +From 640803003cd903cea73dc6a86bf6963e238e2b3f Mon Sep 17 00:00:00 2001 +From: Jorge Ramirez-Ortiz +Date: Thu, 19 Jun 2025 09:48:30 +0200 +Subject: media: venus: hfi: explicitly release IRQ during teardown + +From: Jorge Ramirez-Ortiz + +commit 640803003cd903cea73dc6a86bf6963e238e2b3f upstream. + +Ensure the IRQ is disabled - and all pending handlers completed - before +dismantling the interrupt routing and clearing related pointers. + +This prevents any possibility of the interrupt triggering after the +handler context has been invalidated. + +Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") +Cc: stable@vger.kernel.org +Signed-off-by: Jorge Ramirez-Ortiz +Reviewed-by: Dikshita Agarwal +Tested-by: Dikshita Agarwal # RB5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/hfi_venus.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/media/platform/qcom/venus/hfi_venus.c ++++ b/drivers/media/platform/qcom/venus/hfi_venus.c +@@ -1679,6 +1679,7 @@ void venus_hfi_destroy(struct venus_core + venus_interface_queues_release(hdev); + mutex_destroy(&hdev->lock); + kfree(hdev); ++ disable_irq(core->irq); + core->ops = NULL; + } + diff --git a/queue-5.15/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-5.15/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..8c4523cd23 --- /dev/null +++ b/queue-5.15/media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,59 @@ +From 377dc500d253f0b26732b2cb062e89668aef890a Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:14 +0000 +Subject: media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. + +From: Ricardo Ribalda + +commit 377dc500d253f0b26732b2cb062e89668aef890a upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the value if the user provides a param that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") +Cc: stable@vger.kernel.org +Tested-by: Bryan O'Donoghue # qrb5615-rb5 +Reviewed-by: Bryan O'Donoghue +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/core.h | 2 ++ + drivers/media/platform/qcom/venus/vdec.c | 5 ++--- + 2 files changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/core.h ++++ b/drivers/media/platform/qcom/venus/core.h +@@ -26,6 +26,8 @@ + #define VIDC_PMDOMAINS_NUM_MAX 3 + #define VIDC_RESETS_NUM_MAX 2 + ++#define VENUS_MAX_FPS 240 ++ + extern int venus_fw_debug; + + struct freq_tbl { +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -430,11 +430,10 @@ static int vdec_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->fps = fps; + inst->timeperframe = *timeperframe; diff --git a/queue-5.15/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch b/queue-5.15/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch new file mode 100644 index 0000000000..77413bbd7a --- /dev/null +++ b/queue-5.15/media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch @@ -0,0 +1,45 @@ +From 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Mon, 16 Jun 2025 15:29:15 +0000 +Subject: media: venus: venc: Clamp param smaller than 1fps and bigger than 240 + +From: Ricardo Ribalda + +commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 upstream. + +The driver uses "whole" fps in all its calculations (e.g. in +load_per_instance()). Those calculation expect an fps bigger than 1, and +not big enough to overflow. + +Clamp the param if the user provides a value that will result in an invalid +fps. + +Reported-by: Hans Verkuil +Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 +Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") +Cc: stable@vger.kernel.org +Signed-off-by: Ricardo Ribalda +[bod: Change "parm" to "param"] +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Hans Verkuil +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/platform/qcom/venus/venc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/drivers/media/platform/qcom/venus/venc.c ++++ b/drivers/media/platform/qcom/venus/venc.c +@@ -408,11 +408,10 @@ static int venc_s_parm(struct file *file + us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC; + do_div(us_per_frame, timeperframe->denominator); + +- if (!us_per_frame) +- return -EINVAL; +- ++ us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC); + fps = (u64)USEC_PER_SEC; + do_div(fps, us_per_frame); ++ fps = min(VENUS_MAX_FPS, fps); + + inst->timeperframe = *timeperframe; + inst->fps = fps; diff --git a/queue-5.15/series b/queue-5.15/series index 9b492a746a..893072113e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -491,3 +491,9 @@ media-v4l2-ctrls-don-t-reset-handler-s-error-in-v4l2_ctrl_handler_free.patch media-usbtv-lock-resolution-while-streaming.patch media-rainshadow-cec-fix-toctou-race-condition-in-rain_interrupt.patch media-ov2659-fix-memory-leaks-in-ov2659_probe.patch +media-venus-add-a-check-for-packet-size-after-reading-from-shared-memory.patch +media-venus-hfi-explicitly-release-irq-during-teardown.patch +media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +media-venus-venc-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +drm-amd-restore-cached-power-limit-during-resume.patch +drm-amd-display-don-t-overwrite-dce60_clk_mgr.patch