From a4b95dd7376a3a855a592c4398ca0b3c87fddd6d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 17 Mar 2025 20:58:39 -0400 Subject: [PATCH] Fixes for 5.15 Signed-off-by: Sasha Levin --- ...check-for-invalid-input-params-when-.patch | 52 ++++++++++++++++++ ...fix-null-check-for-pipe_ctx-plane_st.patch | 44 +++++++++++++++ ...an-error-handling-path-in-ali1535_pr.patch | 55 +++++++++++++++++++ ...an-error-handling-path-in-ali15x3_pr.patch | 55 +++++++++++++++++++ ...n-error-handling-path-in-sis630_prob.patch | 55 +++++++++++++++++++ queue-5.15/series | 5 ++ 6 files changed, 266 insertions(+) create mode 100644 queue-5.15/drm-amd-display-check-for-invalid-input-params-when-.patch create mode 100644 queue-5.15/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch create mode 100644 queue-5.15/i2c-ali1535-fix-an-error-handling-path-in-ali1535_pr.patch create mode 100644 queue-5.15/i2c-ali15x3-fix-an-error-handling-path-in-ali15x3_pr.patch create mode 100644 queue-5.15/i2c-sis630-fix-an-error-handling-path-in-sis630_prob.patch diff --git a/queue-5.15/drm-amd-display-check-for-invalid-input-params-when-.patch b/queue-5.15/drm-amd-display-check-for-invalid-input-params-when-.patch new file mode 100644 index 0000000000..189161857d --- /dev/null +++ b/queue-5.15/drm-amd-display-check-for-invalid-input-params-when-.patch @@ -0,0 +1,52 @@ +From 872df62f11533f945e4b86a13246ee00eaadcfea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Mar 2022 16:06:25 -0400 +Subject: drm/amd/display: Check for invalid input params when building scaling + params + +From: Michael Strauss + +[ Upstream commit 73b1da69f5314d96e1f963468863eaa884ee1030 ] + +[WHY] +Function to calculate scaling ratios can be called with invalid plane +src/dest, causing a divide by zero. + +[HOW] +Fail building scaling params if plane state src/dest rects are +unpopulated + +Tested-by: Daniel Wheeler +Reviewed-by: Charlene Liu +Acked-by: Tom Chung +Signed-off-by: Michael Strauss +Signed-off-by: Alex Deucher +Stable-dep-of: 374c9faac5a7 ("drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params") +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index f29299fb25c4d..de5192ee2b022 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1025,6 +1025,15 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) + bool res = false; + DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger); + ++ /* Invalid input */ ++ if (!plane_state->dst_rect.width || ++ !plane_state->dst_rect.height || ++ !plane_state->src_rect.width || ++ !plane_state->src_rect.height) { ++ ASSERT(0); ++ return false; ++ } ++ + pipe_ctx->plane_res.scl_data.format = convert_pixel_format_to_dalsurface( + pipe_ctx->plane_state->format); + +-- +2.39.5 + diff --git a/queue-5.15/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch b/queue-5.15/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch new file mode 100644 index 0000000000..cf1064d4ed --- /dev/null +++ b/queue-5.15/drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch @@ -0,0 +1,44 @@ +From 7f4f68fd13c678c139a19c6b168d55fda3fdb2af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Feb 2025 16:37:31 +0800 +Subject: drm/amd/display: Fix null check for pipe_ctx->plane_state in + resource_build_scaling_params + +From: Ma Ke + +[ Upstream commit 374c9faac5a763a05bc3f68ad9f73dab3c6aec90 ] + +Null pointer dereference issue could occur when pipe_ctx->plane_state +is null. The fix adds a check to ensure 'pipe_ctx->plane_state' is not +null before accessing. This prevents a null pointer dereference. + +Found by code review. + +Fixes: 3be5262e353b ("drm/amd/display: Rename more dc_surface stuff to plane_state") +Reviewed-by: Alex Hung +Signed-off-by: Ma Ke +Signed-off-by: Alex Deucher +(cherry picked from commit 63e6a77ccf239337baa9b1e7787cde9fa0462092) +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +index de5192ee2b022..a84280b65821b 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +@@ -1026,7 +1026,8 @@ bool resource_build_scaling_params(struct pipe_ctx *pipe_ctx) + DC_LOGGER_INIT(pipe_ctx->stream->ctx->logger); + + /* Invalid input */ +- if (!plane_state->dst_rect.width || ++ if (!plane_state || ++ !plane_state->dst_rect.width || + !plane_state->dst_rect.height || + !plane_state->src_rect.width || + !plane_state->src_rect.height) { +-- +2.39.5 + diff --git a/queue-5.15/i2c-ali1535-fix-an-error-handling-path-in-ali1535_pr.patch b/queue-5.15/i2c-ali1535-fix-an-error-handling-path-in-ali1535_pr.patch new file mode 100644 index 0000000000..9090914167 --- /dev/null +++ b/queue-5.15/i2c-ali1535-fix-an-error-handling-path-in-ali1535_pr.patch @@ -0,0 +1,55 @@ +From f595e1f275d50fc498f2700e581d8379740c9a3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 20:53:08 +0100 +Subject: i2c: ali1535: Fix an error handling path in ali1535_probe() + +From: Christophe JAILLET + +[ Upstream commit 9b5463f349d019a261f1e80803447efca3126151 ] + +If i2c_add_adapter() fails, the request_region() call in ali1535_setup() +must be undone by a corresponding release_region() call, as done in the +remove function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/0daf63d7a2ce74c02e2664ba805bbfadab7d25e5.1741031571.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-ali1535.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c +index ee83c4581bce0..cd2c8afebe798 100644 +--- a/drivers/i2c/busses/i2c-ali1535.c ++++ b/drivers/i2c/busses/i2c-ali1535.c +@@ -490,6 +490,8 @@ MODULE_DEVICE_TABLE(pci, ali1535_ids); + + static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id) + { ++ int ret; ++ + if (ali1535_setup(dev)) { + dev_warn(&dev->dev, + "ALI1535 not detected, module not inserted.\n"); +@@ -501,7 +503,15 @@ static int ali1535_probe(struct pci_dev *dev, const struct pci_device_id *id) + + snprintf(ali1535_adapter.name, sizeof(ali1535_adapter.name), + "SMBus ALI1535 adapter at %04x", ali1535_offset); +- return i2c_add_adapter(&ali1535_adapter); ++ ret = i2c_add_adapter(&ali1535_adapter); ++ if (ret) ++ goto release_region; ++ ++ return 0; ++ ++release_region: ++ release_region(ali1535_smba, ALI1535_SMB_IOSIZE); ++ return ret; + } + + static void ali1535_remove(struct pci_dev *dev) +-- +2.39.5 + diff --git a/queue-5.15/i2c-ali15x3-fix-an-error-handling-path-in-ali15x3_pr.patch b/queue-5.15/i2c-ali15x3-fix-an-error-handling-path-in-ali15x3_pr.patch new file mode 100644 index 0000000000..f5d68366d3 --- /dev/null +++ b/queue-5.15/i2c-ali15x3-fix-an-error-handling-path-in-ali15x3_pr.patch @@ -0,0 +1,55 @@ +From 71964f96f4d95c3e0180131cdbb0ace82d2ba514 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 20:58:06 +0100 +Subject: i2c: ali15x3: Fix an error handling path in ali15x3_probe() + +From: Christophe JAILLET + +[ Upstream commit 6e55caaf30c88209d097e575a169b1dface1ab69 ] + +If i2c_add_adapter() fails, the request_region() call in ali15x3_setup() +must be undone by a corresponding release_region() call, as done in the +remove function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Signed-off-by: Andi Shyti +Link: https://lore.kernel.org/r/9b2090cbcc02659f425188ea05f2e02745c4e67b.1741031878.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-ali15x3.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c +index cc58feacd0821..28a57cb6efb99 100644 +--- a/drivers/i2c/busses/i2c-ali15x3.c ++++ b/drivers/i2c/busses/i2c-ali15x3.c +@@ -473,6 +473,8 @@ MODULE_DEVICE_TABLE (pci, ali15x3_ids); + + static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id) + { ++ int ret; ++ + if (ali15x3_setup(dev)) { + dev_err(&dev->dev, + "ALI15X3 not detected, module not inserted.\n"); +@@ -484,7 +486,15 @@ static int ali15x3_probe(struct pci_dev *dev, const struct pci_device_id *id) + + snprintf(ali15x3_adapter.name, sizeof(ali15x3_adapter.name), + "SMBus ALI15X3 adapter at %04x", ali15x3_smba); +- return i2c_add_adapter(&ali15x3_adapter); ++ ret = i2c_add_adapter(&ali15x3_adapter); ++ if (ret) ++ goto release_region; ++ ++ return 0; ++ ++release_region: ++ release_region(ali15x3_smba, ALI15X3_SMB_IOSIZE); ++ return ret; + } + + static void ali15x3_remove(struct pci_dev *dev) +-- +2.39.5 + diff --git a/queue-5.15/i2c-sis630-fix-an-error-handling-path-in-sis630_prob.patch b/queue-5.15/i2c-sis630-fix-an-error-handling-path-in-sis630_prob.patch new file mode 100644 index 0000000000..364d8fa21c --- /dev/null +++ b/queue-5.15/i2c-sis630-fix-an-error-handling-path-in-sis630_prob.patch @@ -0,0 +1,55 @@ +From 8dca02c88a0207f730b87d6ebefabcd9c5090966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 21:26:54 +0100 +Subject: i2c: sis630: Fix an error handling path in sis630_probe() + +From: Christophe JAILLET + +[ Upstream commit 2b22459792fcb4def9f0936d64575ac11a95a58d ] + +If i2c_add_adapter() fails, the request_region() call in sis630_setup() +must be undone by a corresponding release_region() call, as done in the +remove function. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/3d607601f2c38e896b10207963c6ab499ca5c307.1741033587.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Andi Shyti +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sis630.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c +index cfb8e04a2a831..6befa6ff83f26 100644 +--- a/drivers/i2c/busses/i2c-sis630.c ++++ b/drivers/i2c/busses/i2c-sis630.c +@@ -509,6 +509,8 @@ MODULE_DEVICE_TABLE(pci, sis630_ids); + + static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id) + { ++ int ret; ++ + if (sis630_setup(dev)) { + dev_err(&dev->dev, + "SIS630 compatible bus not detected, " +@@ -522,7 +524,15 @@ static int sis630_probe(struct pci_dev *dev, const struct pci_device_id *id) + snprintf(sis630_adapter.name, sizeof(sis630_adapter.name), + "SMBus SIS630 adapter at %04x", smbus_base + SMB_STS); + +- return i2c_add_adapter(&sis630_adapter); ++ ret = i2c_add_adapter(&sis630_adapter); ++ if (ret) ++ goto release_region; ++ ++ return 0; ++ ++release_region: ++ release_region(smbus_base + SMB_STS, SIS630_SMB_IOREGION); ++ return ret; + } + + static void sis630_remove(struct pci_dev *dev) +-- +2.39.5 + diff --git a/queue-5.15/series b/queue-5.15/series index a01a39c4b7..242906e647 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -69,3 +69,8 @@ cifs-fix-integer-overflow-while-processing-acregmax-.patch cifs-fix-integer-overflow-while-processing-acdirmax-.patch cifs-fix-integer-overflow-while-processing-actimeo-m.patch cifs-fix-integer-overflow-while-processing-closetime.patch +i2c-ali1535-fix-an-error-handling-path-in-ali1535_pr.patch +i2c-ali15x3-fix-an-error-handling-path-in-ali15x3_pr.patch +i2c-sis630-fix-an-error-handling-path-in-sis630_prob.patch +drm-amd-display-check-for-invalid-input-params-when-.patch +drm-amd-display-fix-null-check-for-pipe_ctx-plane_st.patch -- 2.47.3