--- /dev/null
+From bf43e4521ff3223a613f3a496991a22a4d78e04b Mon Sep 17 00:00:00 2001
+From: Thomas Zimmermann <tzimmermann@suse.de>
+Date: Fri, 17 Jun 2022 14:10:27 +0200
+Subject: drm/aperture: Run fbdev removal before internal helpers
+
+From: Thomas Zimmermann <tzimmermann@suse.de>
+
+commit bf43e4521ff3223a613f3a496991a22a4d78e04b upstream.
+
+Always run fbdev removal first to remove simpledrm via
+sysfb_disable(). This clears the internal state. The later call
+to drm_aperture_detach_drivers() then does nothing. Otherwise,
+with drm_aperture_detach_drivers() running first, the call to
+sysfb_disable() uses inconsistent state.
+
+Example backtrace show below:
+
+[ 11.663422] ==================================================================
+[ 11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0
+[ 11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311
+[ 11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G E 5
+ .19.0-rc2-1-default+ #1689
+[ 11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011
+[ 11.663447] Call Trace:
+[ 11.663449] <TASK>
+[ 11.663451] ? device_del+0x79/0x5f0
+[ 11.663456] dump_stack_lvl+0x5b/0x73
+[ 11.663462] print_address_description.constprop.0+0x1f/0x1b0
+[ 11.663468] ? device_del+0x79/0x5f0
+[ 11.663471] ? device_del+0x79/0x5f0
+[ 11.663475] print_report.cold+0x3c/0x21c
+[ 11.663481] ? lock_acquired+0x87/0x1e0
+[ 11.663484] ? lock_acquired+0x87/0x1e0
+[ 11.663489] ? device_del+0x79/0x5f0
+[ 11.663492] kasan_report+0xbf/0xf0
+[ 11.663498] ? device_del+0x79/0x5f0
+[ 11.663503] device_del+0x79/0x5f0
+[ 11.663509] ? device_remove_attrs+0x170/0x170
+[ 11.663514] ? lock_is_held_type+0xe8/0x140
+[ 11.663523] platform_device_del.part.0+0x19/0xe0
+[ 11.663530] platform_device_unregister+0x1c/0x30
+[ 11.663535] sysfb_disable+0x2d/0x70
+[ 11.663540] remove_conflicting_framebuffers+0x1c/0xf0
+[ 11.663546] remove_conflicting_pci_framebuffers+0x130/0x1a0
+[ 11.663554] drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0
+[ 11.663561] ? mgag200_pci_remove+0x30/0x30 [mgag200]
+[ 11.663578] mgag200_pci_probe+0x2d/0x140 [mgag200]
+
+Reported-by: Zack Rusin <zackr@vmware.com>
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
+Reviewed-by: Zack Rusin <zackr@vmware.com>
+Fixes: ee7a69aa38d8 ("fbdev: Disable sysfb device registration when removing conflicting FBs")
+Cc: Javier Martinez Canillas <javierm@redhat.com>
+Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Sam Ravnborg <sam@ravnborg.org>
+Cc: Helge Deller <deller@gmx.de>
+Cc: Thomas Zimmermann <tzimmermann@suse.de>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: Zhen Lei <thunder.leizhen@huawei.com>
+Cc: Changcheng Deng <deng.changcheng@zte.com.cn>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de
+(cherry picked from commit fb84efa28a48e30b87fa1122e8aab8016c7347cd)
+Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/drm_aperture.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/drm_aperture.c
++++ b/drivers/gpu/drm/drm_aperture.c
+@@ -329,7 +329,20 @@ int drm_aperture_remove_conflicting_pci_
+ const struct drm_driver *req_driver)
+ {
+ resource_size_t base, size;
+- int bar, ret = 0;
++ int bar, ret;
++
++ /*
++ * WARNING: Apparently we must kick fbdev drivers before vgacon,
++ * otherwise the vga fbdev driver falls over.
++ */
++#if IS_REACHABLE(CONFIG_FB)
++ ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name);
++ if (ret)
++ return ret;
++#endif
++ ret = vga_remove_vgacon(pdev);
++ if (ret)
++ return ret;
+
+ for (bar = 0; bar < PCI_STD_NUM_BARS; ++bar) {
+ if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM))
+@@ -339,15 +352,6 @@ int drm_aperture_remove_conflicting_pci_
+ drm_aperture_detach_drivers(base, size);
+ }
+
+- /*
+- * WARNING: Apparently we must kick fbdev drivers before vgacon,
+- * otherwise the vga fbdev driver falls over.
+- */
+-#if IS_REACHABLE(CONFIG_FB)
+- ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name);
+-#endif
+- if (ret == 0)
+- ret = vga_remove_vgacon(pdev);
+- return ret;
++ return 0;
+ }
+ EXPORT_SYMBOL(drm_aperture_remove_conflicting_pci_framebuffers);
--- /dev/null
+From ced7866db39fc5c59ee05e154d4abc0977a17f6b Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Tue, 12 Jul 2022 18:40:50 +0100
+Subject: drm/i915/ttm: fix 32b build
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit ced7866db39fc5c59ee05e154d4abc0977a17f6b upstream.
+
+Since segment_pages is no longer a compile time constant, it looks the
+DIV_ROUND_UP(node->size, segment_pages) breaks the 32b build. Simplest
+is just to use the ULL variant, but really we should need not need more
+than u32 for the page alignment (also we are limited by that due to the
+sg->length type), so also make it all u32.
+
+Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Fixes: aff1e0b09b54 ("drm/i915/ttm: fix sg_table construction")
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@linux.intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220712174050.592550-1-matthew.auld@intel.com
+(cherry picked from commit 9306b2b2dfce6931241ef804783692cee526599c)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gem/i915_gem_region.c | 2 ++
+ drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +-
+ drivers/gpu/drm/i915/i915_scatterlist.c | 16 ++++++++--------
+ drivers/gpu/drm/i915/i915_scatterlist.h | 4 ++--
+ drivers/gpu/drm/i915/intel_region_ttm.c | 2 +-
+ drivers/gpu/drm/i915/intel_region_ttm.h | 2 +-
+ 6 files changed, 15 insertions(+), 13 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_region.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_region.c
+@@ -57,6 +57,8 @@ i915_gem_object_create_region(struct int
+ if (page_size)
+ default_page_size = page_size;
+
++ /* We should be able to fit a page within an sg entry */
++ GEM_BUG_ON(overflows_type(default_page_size, u32));
+ GEM_BUG_ON(!is_power_of_2_u64(default_page_size));
+ GEM_BUG_ON(default_page_size < PAGE_SIZE);
+
+--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
++++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c
+@@ -583,7 +583,7 @@ i915_ttm_resource_get_st(struct drm_i915
+ struct ttm_resource *res)
+ {
+ struct ttm_buffer_object *bo = i915_gem_to_ttm(obj);
+- u64 page_alignment;
++ u32 page_alignment;
+
+ if (!i915_ttm_gtt_binds_lmem(res))
+ return i915_ttm_tt_get_st(bo->ttm);
+--- a/drivers/gpu/drm/i915/i915_scatterlist.c
++++ b/drivers/gpu/drm/i915/i915_scatterlist.c
+@@ -79,10 +79,10 @@ void i915_refct_sgt_init(struct i915_ref
+ */
+ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node,
+ u64 region_start,
+- u64 page_alignment)
++ u32 page_alignment)
+ {
+- const u64 max_segment = round_down(UINT_MAX, page_alignment);
+- u64 segment_pages = max_segment >> PAGE_SHIFT;
++ const u32 max_segment = round_down(UINT_MAX, page_alignment);
++ const u32 segment_pages = max_segment >> PAGE_SHIFT;
+ u64 block_size, offset, prev_end;
+ struct i915_refct_sgt *rsgt;
+ struct sg_table *st;
+@@ -96,7 +96,7 @@ struct i915_refct_sgt *i915_rsgt_from_mm
+
+ i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT);
+ st = &rsgt->table;
+- if (sg_alloc_table(st, DIV_ROUND_UP(node->size, segment_pages),
++ if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages),
+ GFP_KERNEL)) {
+ i915_refct_sgt_put(rsgt);
+ return ERR_PTR(-ENOMEM);
+@@ -123,7 +123,7 @@ struct i915_refct_sgt *i915_rsgt_from_mm
+ st->nents++;
+ }
+
+- len = min(block_size, max_segment - sg->length);
++ len = min_t(u64, block_size, max_segment - sg->length);
+ sg->length += len;
+ sg_dma_len(sg) += len;
+
+@@ -155,11 +155,11 @@ struct i915_refct_sgt *i915_rsgt_from_mm
+ */
+ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res,
+ u64 region_start,
+- u64 page_alignment)
++ u32 page_alignment)
+ {
+ struct i915_ttm_buddy_resource *bman_res = to_ttm_buddy_resource(res);
+ const u64 size = res->num_pages << PAGE_SHIFT;
+- const u64 max_segment = round_down(UINT_MAX, page_alignment);
++ const u32 max_segment = round_down(UINT_MAX, page_alignment);
+ struct drm_buddy *mm = bman_res->mm;
+ struct list_head *blocks = &bman_res->blocks;
+ struct drm_buddy_block *block;
+@@ -207,7 +207,7 @@ struct i915_refct_sgt *i915_rsgt_from_bu
+ st->nents++;
+ }
+
+- len = min(block_size, max_segment - sg->length);
++ len = min_t(u64, block_size, max_segment - sg->length);
+ sg->length += len;
+ sg_dma_len(sg) += len;
+
+--- a/drivers/gpu/drm/i915/i915_scatterlist.h
++++ b/drivers/gpu/drm/i915/i915_scatterlist.h
+@@ -214,10 +214,10 @@ void i915_refct_sgt_init(struct i915_ref
+
+ struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node,
+ u64 region_start,
+- u64 page_alignment);
++ u32 page_alignment);
+
+ struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res,
+ u64 region_start,
+- u64 page_alignment);
++ u32 page_alignment);
+
+ #endif
+--- a/drivers/gpu/drm/i915/intel_region_ttm.c
++++ b/drivers/gpu/drm/i915/intel_region_ttm.c
+@@ -162,7 +162,7 @@ int intel_region_ttm_fini(struct intel_m
+ struct i915_refct_sgt *
+ intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem,
+ struct ttm_resource *res,
+- u64 page_alignment)
++ u32 page_alignment)
+ {
+ if (mem->is_range_manager) {
+ struct ttm_range_mgr_node *range_node =
+--- a/drivers/gpu/drm/i915/intel_region_ttm.h
++++ b/drivers/gpu/drm/i915/intel_region_ttm.h
+@@ -25,7 +25,7 @@ int intel_region_ttm_fini(struct intel_m
+ struct i915_refct_sgt *
+ intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem,
+ struct ttm_resource *res,
+- u64 page_alignment);
++ u32 page_alignment);
+
+ void intel_region_ttm_resource_free(struct intel_memory_region *mem,
+ struct ttm_resource *res);
projects / thirdparty / kernel / stable-queue.git / commitdiff
