From: Greg Kroah-Hartman Date: Thu, 21 Jul 2022 18:26:01 +0000 (+0200) Subject: 5.18-stable patches X-Git-Tag: v4.9.324~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=45ca8de0fdfd9ae0829f2d84768711f618780446;p=thirdparty%2Fkernel%2Fstable-queue.git 5.18-stable patches added patches: drm-aperture-run-fbdev-removal-before-internal-helpers.patch drm-i915-ttm-fix-32b-build.patch --- diff --git a/queue-5.18/drm-aperture-run-fbdev-removal-before-internal-helpers.patch b/queue-5.18/drm-aperture-run-fbdev-removal-before-internal-helpers.patch new file mode 100644 index 00000000000..1a4a52f4f73 --- /dev/null +++ b/queue-5.18/drm-aperture-run-fbdev-removal-before-internal-helpers.patch @@ -0,0 +1,111 @@ +From bf43e4521ff3223a613f3a496991a22a4d78e04b Mon Sep 17 00:00:00 2001 +From: Thomas Zimmermann +Date: Fri, 17 Jun 2022 14:10:27 +0200 +Subject: drm/aperture: Run fbdev removal before internal helpers + +From: Thomas Zimmermann + +commit bf43e4521ff3223a613f3a496991a22a4d78e04b upstream. + +Always run fbdev removal first to remove simpledrm via +sysfb_disable(). This clears the internal state. The later call +to drm_aperture_detach_drivers() then does nothing. Otherwise, +with drm_aperture_detach_drivers() running first, the call to +sysfb_disable() uses inconsistent state. + +Example backtrace show below: + +[ 11.663422] ================================================================== +[ 11.663426] BUG: KASAN: use-after-free in device_del+0x79/0x5f0 +[ 11.663435] Read of size 8 at addr ffff888108185050 by task systemd-udevd/311 +[ 11.663440] CPU: 0 PID: 311 Comm: systemd-udevd Tainted: G E 5 + .19.0-rc2-1-default+ #1689 +[ 11.663445] Hardware name: HP ProLiant DL120 G7, BIOS J01 04/21/2011 +[ 11.663447] Call Trace: +[ 11.663449] +[ 11.663451] ? device_del+0x79/0x5f0 +[ 11.663456] dump_stack_lvl+0x5b/0x73 +[ 11.663462] print_address_description.constprop.0+0x1f/0x1b0 +[ 11.663468] ? device_del+0x79/0x5f0 +[ 11.663471] ? device_del+0x79/0x5f0 +[ 11.663475] print_report.cold+0x3c/0x21c +[ 11.663481] ? lock_acquired+0x87/0x1e0 +[ 11.663484] ? lock_acquired+0x87/0x1e0 +[ 11.663489] ? device_del+0x79/0x5f0 +[ 11.663492] kasan_report+0xbf/0xf0 +[ 11.663498] ? device_del+0x79/0x5f0 +[ 11.663503] device_del+0x79/0x5f0 +[ 11.663509] ? device_remove_attrs+0x170/0x170 +[ 11.663514] ? lock_is_held_type+0xe8/0x140 +[ 11.663523] platform_device_del.part.0+0x19/0xe0 +[ 11.663530] platform_device_unregister+0x1c/0x30 +[ 11.663535] sysfb_disable+0x2d/0x70 +[ 11.663540] remove_conflicting_framebuffers+0x1c/0xf0 +[ 11.663546] remove_conflicting_pci_framebuffers+0x130/0x1a0 +[ 11.663554] drm_aperture_remove_conflicting_pci_framebuffers+0x86/0xb0 +[ 11.663561] ? mgag200_pci_remove+0x30/0x30 [mgag200] +[ 11.663578] mgag200_pci_probe+0x2d/0x140 [mgag200] + +Reported-by: Zack Rusin +Signed-off-by: Thomas Zimmermann +Reviewed-by: Javier Martinez Canillas +Reviewed-by: Zack Rusin +Fixes: ee7a69aa38d8 ("fbdev: Disable sysfb device registration when removing conflicting FBs") +Cc: Javier Martinez Canillas +Cc: Daniel Vetter +Cc: Daniel Vetter +Cc: Sam Ravnborg +Cc: Helge Deller +Cc: Thomas Zimmermann +Cc: Alex Deucher +Cc: Zhen Lei +Cc: Changcheng Deng +Link: https://patchwork.freedesktop.org/patch/msgid/20220617121027.30273-1-tzimmermann@suse.de +(cherry picked from commit fb84efa28a48e30b87fa1122e8aab8016c7347cd) +Signed-off-by: Thomas Zimmermann +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_aperture.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/drm_aperture.c ++++ b/drivers/gpu/drm/drm_aperture.c +@@ -329,7 +329,20 @@ int drm_aperture_remove_conflicting_pci_ + const struct drm_driver *req_driver) + { + resource_size_t base, size; +- int bar, ret = 0; ++ int bar, ret; ++ ++ /* ++ * WARNING: Apparently we must kick fbdev drivers before vgacon, ++ * otherwise the vga fbdev driver falls over. ++ */ ++#if IS_REACHABLE(CONFIG_FB) ++ ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name); ++ if (ret) ++ return ret; ++#endif ++ ret = vga_remove_vgacon(pdev); ++ if (ret) ++ return ret; + + for (bar = 0; bar < PCI_STD_NUM_BARS; ++bar) { + if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) +@@ -339,15 +352,6 @@ int drm_aperture_remove_conflicting_pci_ + drm_aperture_detach_drivers(base, size); + } + +- /* +- * WARNING: Apparently we must kick fbdev drivers before vgacon, +- * otherwise the vga fbdev driver falls over. +- */ +-#if IS_REACHABLE(CONFIG_FB) +- ret = remove_conflicting_pci_framebuffers(pdev, req_driver->name); +-#endif +- if (ret == 0) +- ret = vga_remove_vgacon(pdev); +- return ret; ++ return 0; + } + EXPORT_SYMBOL(drm_aperture_remove_conflicting_pci_framebuffers); diff --git a/queue-5.18/drm-i915-ttm-fix-32b-build.patch b/queue-5.18/drm-i915-ttm-fix-32b-build.patch new file mode 100644 index 00000000000..cd0f72fd925 --- /dev/null +++ b/queue-5.18/drm-i915-ttm-fix-32b-build.patch @@ -0,0 +1,152 @@ +From ced7866db39fc5c59ee05e154d4abc0977a17f6b Mon Sep 17 00:00:00 2001 +From: Matthew Auld +Date: Tue, 12 Jul 2022 18:40:50 +0100 +Subject: drm/i915/ttm: fix 32b build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Matthew Auld + +commit ced7866db39fc5c59ee05e154d4abc0977a17f6b upstream. + +Since segment_pages is no longer a compile time constant, it looks the +DIV_ROUND_UP(node->size, segment_pages) breaks the 32b build. Simplest +is just to use the ULL variant, but really we should need not need more +than u32 for the page alignment (also we are limited by that due to the +sg->length type), so also make it all u32. + +Reported-by: Ville Syrjälä +Fixes: aff1e0b09b54 ("drm/i915/ttm: fix sg_table construction") +Signed-off-by: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20220712174050.592550-1-matthew.auld@intel.com +(cherry picked from commit 9306b2b2dfce6931241ef804783692cee526599c) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_region.c | 2 ++ + drivers/gpu/drm/i915/gem/i915_gem_ttm.c | 2 +- + drivers/gpu/drm/i915/i915_scatterlist.c | 16 ++++++++-------- + drivers/gpu/drm/i915/i915_scatterlist.h | 4 ++-- + drivers/gpu/drm/i915/intel_region_ttm.c | 2 +- + drivers/gpu/drm/i915/intel_region_ttm.h | 2 +- + 6 files changed, 15 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_region.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_region.c +@@ -57,6 +57,8 @@ i915_gem_object_create_region(struct int + if (page_size) + default_page_size = page_size; + ++ /* We should be able to fit a page within an sg entry */ ++ GEM_BUG_ON(overflows_type(default_page_size, u32)); + GEM_BUG_ON(!is_power_of_2_u64(default_page_size)); + GEM_BUG_ON(default_page_size < PAGE_SIZE); + +--- a/drivers/gpu/drm/i915/gem/i915_gem_ttm.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_ttm.c +@@ -583,7 +583,7 @@ i915_ttm_resource_get_st(struct drm_i915 + struct ttm_resource *res) + { + struct ttm_buffer_object *bo = i915_gem_to_ttm(obj); +- u64 page_alignment; ++ u32 page_alignment; + + if (!i915_ttm_gtt_binds_lmem(res)) + return i915_ttm_tt_get_st(bo->ttm); +--- a/drivers/gpu/drm/i915/i915_scatterlist.c ++++ b/drivers/gpu/drm/i915/i915_scatterlist.c +@@ -79,10 +79,10 @@ void i915_refct_sgt_init(struct i915_ref + */ + struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, + u64 region_start, +- u64 page_alignment) ++ u32 page_alignment) + { +- const u64 max_segment = round_down(UINT_MAX, page_alignment); +- u64 segment_pages = max_segment >> PAGE_SHIFT; ++ const u32 max_segment = round_down(UINT_MAX, page_alignment); ++ const u32 segment_pages = max_segment >> PAGE_SHIFT; + u64 block_size, offset, prev_end; + struct i915_refct_sgt *rsgt; + struct sg_table *st; +@@ -96,7 +96,7 @@ struct i915_refct_sgt *i915_rsgt_from_mm + + i915_refct_sgt_init(rsgt, node->size << PAGE_SHIFT); + st = &rsgt->table; +- if (sg_alloc_table(st, DIV_ROUND_UP(node->size, segment_pages), ++ if (sg_alloc_table(st, DIV_ROUND_UP_ULL(node->size, segment_pages), + GFP_KERNEL)) { + i915_refct_sgt_put(rsgt); + return ERR_PTR(-ENOMEM); +@@ -123,7 +123,7 @@ struct i915_refct_sgt *i915_rsgt_from_mm + st->nents++; + } + +- len = min(block_size, max_segment - sg->length); ++ len = min_t(u64, block_size, max_segment - sg->length); + sg->length += len; + sg_dma_len(sg) += len; + +@@ -155,11 +155,11 @@ struct i915_refct_sgt *i915_rsgt_from_mm + */ + struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, + u64 region_start, +- u64 page_alignment) ++ u32 page_alignment) + { + struct i915_ttm_buddy_resource *bman_res = to_ttm_buddy_resource(res); + const u64 size = res->num_pages << PAGE_SHIFT; +- const u64 max_segment = round_down(UINT_MAX, page_alignment); ++ const u32 max_segment = round_down(UINT_MAX, page_alignment); + struct drm_buddy *mm = bman_res->mm; + struct list_head *blocks = &bman_res->blocks; + struct drm_buddy_block *block; +@@ -207,7 +207,7 @@ struct i915_refct_sgt *i915_rsgt_from_bu + st->nents++; + } + +- len = min(block_size, max_segment - sg->length); ++ len = min_t(u64, block_size, max_segment - sg->length); + sg->length += len; + sg_dma_len(sg) += len; + +--- a/drivers/gpu/drm/i915/i915_scatterlist.h ++++ b/drivers/gpu/drm/i915/i915_scatterlist.h +@@ -214,10 +214,10 @@ void i915_refct_sgt_init(struct i915_ref + + struct i915_refct_sgt *i915_rsgt_from_mm_node(const struct drm_mm_node *node, + u64 region_start, +- u64 page_alignment); ++ u32 page_alignment); + + struct i915_refct_sgt *i915_rsgt_from_buddy_resource(struct ttm_resource *res, + u64 region_start, +- u64 page_alignment); ++ u32 page_alignment); + + #endif +--- a/drivers/gpu/drm/i915/intel_region_ttm.c ++++ b/drivers/gpu/drm/i915/intel_region_ttm.c +@@ -162,7 +162,7 @@ int intel_region_ttm_fini(struct intel_m + struct i915_refct_sgt * + intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem, + struct ttm_resource *res, +- u64 page_alignment) ++ u32 page_alignment) + { + if (mem->is_range_manager) { + struct ttm_range_mgr_node *range_node = +--- a/drivers/gpu/drm/i915/intel_region_ttm.h ++++ b/drivers/gpu/drm/i915/intel_region_ttm.h +@@ -25,7 +25,7 @@ int intel_region_ttm_fini(struct intel_m + struct i915_refct_sgt * + intel_region_ttm_resource_to_rsgt(struct intel_memory_region *mem, + struct ttm_resource *res, +- u64 page_alignment); ++ u32 page_alignment); + + void intel_region_ttm_resource_free(struct intel_memory_region *mem, + struct ttm_resource *res); diff --git a/queue-5.18/series b/queue-5.18/series index c823d6367b4..81b002d81f8 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -223,3 +223,5 @@ serial-pl011-upstat_autorts-requires-.throttle-unthrottle.patch serial-8250-fix-pm-usage_count-for-console-handover.patch serial-mvebu-uart-correctly-report-configured-baudrate-value.patch x86-pat-fix-x86_has_pat_wp.patch +drm-i915-ttm-fix-32b-build.patch +drm-aperture-run-fbdev-removal-before-internal-helpers.patch