From: Greg Kroah-Hartman Date: Mon, 5 Jan 2026 13:32:19 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v6.12.64~20 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=268d82849e981146291f7b092d93666cb63aed17;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch --- diff --git a/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch b/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch new file mode 100644 index 0000000000..859e1bc5e4 --- /dev/null +++ b/queue-5.10/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch @@ -0,0 +1,35 @@ +From 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 Mon Sep 17 00:00:00 2001 +From: Akhil P Oommen +Date: Tue, 18 Nov 2025 14:20:28 +0530 +Subject: drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers + +From: Akhil P Oommen + +commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 upstream. + +REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register +range. So, use gmu_write() routines to write to this register. + +Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") +Cc: stable@vger.kernel.org +Signed-off-by: Akhil P Oommen +Reviewed-by: Konrad Dybcio +Patchwork: https://patchwork.freedesktop.org/patch/688993/ +Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com> +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -794,7 +794,7 @@ static void a6xx_get_gmu_registers(struc + return; + + /* Set the fence to ALLOW mode so we can access the registers */ +- gpu_write(gpu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0); ++ gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0); + + _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[2], + &a6xx_state->gmu_registers[2], false); diff --git a/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch b/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch new file mode 100644 index 0000000000..42b6afcecc --- /dev/null +++ b/queue-5.10/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch @@ -0,0 +1,63 @@ +From 560271e10b2c86e95ea35afa9e79822e4847f07a Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Thu, 11 Dec 2025 14:02:54 -0500 +Subject: drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb + +From: Lyude Paul + +commit 560271e10b2c86e95ea35afa9e79822e4847f07a upstream. + +Since we recently started warning about uses of this function after the +atomic check phase completes, we've started getting warnings about this in +nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been +hiding in our .prepare_fb callback for a while. + +So, fix this by adding a new nv50_head_atom_get_new() function and use that +in our .prepare_fb callback instead. + +Signed-off-by: Lyude Paul +Reviewed-by: Dave Airlie +Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") +Cc: # v4.18+ +Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 +++++++++++++ + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- + 2 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h ++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h +@@ -152,8 +152,21 @@ static inline struct nv50_head_atom * + nv50_head_atom_get(struct drm_atomic_state *state, struct drm_crtc *crtc) + { + struct drm_crtc_state *statec = drm_atomic_get_crtc_state(state, crtc); ++ + if (IS_ERR(statec)) + return (void *)statec; ++ ++ return nv50_head_atom(statec); ++} ++ ++static inline struct nv50_head_atom * ++nv50_head_atom_get_new(struct drm_atomic_state *state, struct drm_crtc *crtc) ++{ ++ struct drm_crtc_state *statec = drm_atomic_get_new_crtc_state(state, crtc); ++ ++ if (!statec) ++ return NULL; ++ + return nv50_head_atom(statec); + } + +--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c +@@ -561,7 +561,7 @@ nv50_wndw_prepare_fb(struct drm_plane *p + asyw->image.offset[0] = nvbo->offset; + + if (wndw->func->prepare) { +- asyh = nv50_head_atom_get(asyw->state.state, asyw->state.crtc); ++ asyh = nv50_head_atom_get_new(asyw->state.state, asyw->state.crtc); + if (IS_ERR(asyh)) + return PTR_ERR(asyh); + diff --git a/queue-5.10/series b/queue-5.10/series index 164472b1ff..f2e7a83739 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -334,3 +334,5 @@ nfsd-drop-the-client-reference-in-client_states_open.patch net-usb-sr9700-fix-incorrect-command-used-to-write-single-register.patch net-nfc-fix-deadlock-between-nfc_unregister_device-and-rfkill_fop_write.patch net-macb-relocate-mog_init_rings-callback-from-macb_mac_link_up-to-macb_open.patch +drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch +drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch