5.15-stable patches

added patches:
	drm-aperture-run-fbdev-removal-before-internal-helpers.patch

diff --git a/queue-5.15/drm-aperture-run-fbdev-removal-before-internal-helpers.patch b/queue-5.15/drm-aperture-run-fbdev-removal-before-internal-helpers.patch
new file mode 100644 (file)
index 0000000..1a4a52f
--- /dev/null
+++ b/queue-5.15/drm-aperture-run-fbdev-removal-before-internal-helpers.patch
@@ -0,0 +1,111 @@
+From bf43e4521ff3223a613f3a496991a22a4d78e04b Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Fri, 17 Jun 2022 14:10:27 +0200
+Subject: drm/aperture: Run fbdev removal before internal helpers
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit bf43e4521ff3223a613f3a496991a22a4d78e04b upstream.
+
+Always run fbdev removal first to remove simpledrm via
+sysfb_disable(). This clears the internal state. The later call
+to drm_aperture_detach_drivers() then does nothing. Otherwise,
+with drm_aperture_detach_drivers() running first, the call to
+sysfb_disable() uses inconsistent state.
+
+Example backtrace show below:
+
+[   11.663422] ==================================================================
+[   11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0
+[   11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
+[   11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G            E     5
+       .19.0-rc2-1-default+ #1689
+[   11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
+[   11.663447] Call Trace:
+[   11.663449]  <TASK>
+[   11.663451]  ? device_del+0x79/0x5f0
+[   11.663456]  dump_stack_lvl+0x5b/0x73
+[   11.663462]  print_address_description.constprop.0+0x1f/0x1b0
+[   11.663468]  ? device_del+0x79/0x5f0
+[   11.663471]  ? device_del+0x79/0x5f0
+[   11.663475]  print_report.cold+0x3c/0x21c
+[   11.663481]  ? lock_acquired+0x87/0x1e0
+[   11.663484]  ? lock_acquired+0x87/0x1e0
+[   11.663489]  ? device_del+0x79/0x5f0
+[   11.663492]  kasan_report+0xbf/0xf0
+[   11.663498]  ? device_del+0x79/0x5f0
+[   11.663503]  device_del+0x79/0x5f0
+[   11.663509]  ? device_remove_attrs+0x170/0x170
+[   11.663514]  ? lock_is_held_type+0xe8/0x140
+[   11.663523]  platform_device_del.part.0+0x19/0xe0
+[   11.663530]  platform_device_unregister+0x1c/0x30
+[   11.663535]  sysfb_disable+0x2d/0x70
+[   11.663540]  remove_conflicting_framebuffers+0x1c/0xf0
+[   11.663546]  remove_conflicting_pci_framebuffers+0x130/0x1a0
+[   11.663554]  drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
+[   11.663561]  ? mgag200_pci_remove+0x30/0x30 [mgag200]
+[   11.663578]  mgag200_pci_probe+0x2d/0x140 [mgag200]
+
+Reported-by: Zack Rusin <zackr@vmware.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Zack Rusin <zackr@vmware.com>
+Fixes: ee7a69aa38d8 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Zhen Lei <thunder.leizhen@huawei.com>
+Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de
+(cherry picked from commit fb84efa28a48e30b87fa1122e8aab8016c7347cd)
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_aperture.c |   26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/drm_aperture.c
++++ b/drivers/gpu/drm/drm_aperture.c
+@@ -329,7 +329,20 @@ int drm_aperture_remove_conflicting_pci_
+                                                    const struct drm_driver *req_driver)
+ {
+       resource_size_t base, size;
+-      int bar, ret = 0;
++      int bar, ret;
++
++      /*
++       * WARNING: Apparently we must kick fbdev drivers before vgacon,
++       * otherwise the vga fbdev driver falls over.
++       */
++#if IS_REACHABLE(CONFIG_FB)
++      ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name);
++      if (ret)
++              return ret;
++#endif
++      ret = vga_remove_vgacon(pdev);
++      if (ret)
++              return ret;
+ 
+       for (bar = 0; bar < PCI_STD_NUM_BARS; ++bar) {
+               if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM))
+@@ -339,15 +352,6 @@ int drm_aperture_remove_conflicting_pci_
+               drm_aperture_detach_drivers(base, size);
+       }
+ 
+-      /*
+-       * WARNING: Apparently we must kick fbdev drivers before vgacon,
+-       * otherwise the vga fbdev driver falls over.
+-       */
+-#if IS_REACHABLE(CONFIG_FB)
+-      ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name);
+-#endif
+-      if (ret == 0)
+-              ret = vga_remove_vgacon(pdev);
+-      return ret;
++      return 0;
+ }
+ EXPORT_SYMBOL(drm_aperture_remove_conflicting_pci_framebuffers);

diff --git a/queue-5.15/series b/queue-5.15/series
index 7e9e00845cf6de1359188a6efac3859c27bf8a5a..064082b9a4dbee7947bfa34eb995b14a92b7c60d 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -165,3 +165,4 @@ serial-stm32-clear-prev-values-before-setting-rts-delays.patch
 serial-pl011-upstat_autorts-requires-.throttle-unthrottle.patch
 serial-8250-fix-pm-usage_count-for-console-handover.patch
 x86-pat-fix-x86_has_pat_wp.patch
+drm-aperture-run-fbdev-removal-before-internal-helpers.patch