From 6942be5d83c23d7c5739ab4185b2e1d07341c735 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 2 Oct 2025 09:21:30 +0200 Subject: [PATCH] 6.12-stable patches added patches: drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch --- ...-when-scale-finds-invalid-parameters.patch | 66 +++++++++++++++++++ queue-6.12/series | 1 + 2 files changed, 67 insertions(+) create mode 100644 queue-6.12/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch diff --git a/queue-6.12/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch b/queue-6.12/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch new file mode 100644 index 0000000000..dcba5ddd42 --- /dev/null +++ b/queue-6.12/drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch @@ -0,0 +1,66 @@ +From 6f71507415841d1a6d38118e5fa0eaf0caab9c17 Mon Sep 17 00:00:00 2001 +From: Guenter Roeck +Date: Tue, 21 Jan 2025 06:52:03 -0800 +Subject: drm/i915/backlight: Return immediately when scale() finds invalid parameters + +From: Guenter Roeck + +commit 6f71507415841d1a6d38118e5fa0eaf0caab9c17 upstream. + +The scale() functions detects invalid parameters, but continues +its calculations anyway. This causes bad results if negative values +are used for unsigned operations. Worst case, a division by 0 error +will be seen if source_min == source_max. + +On top of that, after v6.13, the sequence of WARN_ON() followed by clamp() +may result in a build error with gcc 13.x. + +drivers/gpu/drm/i915/display/intel_backlight.c: In function 'scale': +include/linux/compiler_types.h:542:45: error: + call to '__compiletime_assert_415' declared with attribute error: + clamp() low limit source_min greater than high limit source_max + +This happens if the compiler decides to rearrange the code as follows. + + if (source_min > source_max) { + WARN(..); + /* Do the clamp() knowing that source_min > source_max */ + source_val = clamp(source_val, source_min, source_max); + } else { + /* Do the clamp knowing that source_min <= source_max */ + source_val = clamp(source_val, source_min, source_max); + } + +Fix the problem by evaluating the return values from WARN_ON and returning +immediately after a warning. While at it, fix divide by zero error seen +if source_min == source_max. + +Analyzed-by: Linus Torvalds +Suggested-by: Linus Torvalds +Suggested-by: David Laight +Cc: David Laight +Cc: Jani Nikula +Cc: Andy Shevchenko +Signed-off-by: Guenter Roeck +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20250121145203.2851237-1-linux@roeck-us.net +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_backlight.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_backlight.c ++++ b/drivers/gpu/drm/i915/display/intel_backlight.c +@@ -40,8 +40,9 @@ static u32 scale(u32 source_val, + { + u64 target_val; + +- WARN_ON(source_min > source_max); +- WARN_ON(target_min > target_max); ++ if (WARN_ON(source_min >= source_max) || ++ WARN_ON(target_min > target_max)) ++ return target_min; + + /* defensive */ + source_val = clamp(source_val, source_min, source_max); diff --git a/queue-6.12/series b/queue-6.12/series index 41afbc6bfa..8e0660afa5 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -83,3 +83,4 @@ fbcon-fix-integer-overflow-in-fbcon_do_set_font.patch fbcon-fix-oob-access-in-font-allocation.patch iommufd-fix-race-during-abort-for-file-descriptors.patch revert-usb-xhci-remove-option-to-change-a-default-ring-s-trb-cycle-bit.patch +drm-i915-backlight-return-immediately-when-scale-finds-invalid-parameters.patch -- 2.47.3