From: Greg Kroah-Hartman Date: Sat, 3 Feb 2024 01:30:24 +0000 (-0800) Subject: 6.1-stable patches X-Git-Tag: v6.1.77~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b6e306762f21742bc15587f427a1de9a49adb6da;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-msm-dsi-enable-runtime-pm.patch gve-fix-use-after-free-vulnerability.patch loongarch-smp-call-rcutree_report_cpu_starting-at-tlb_init.patch revert-drm-amd-display-disable-psr-su-on-parade-0803-tcon-again.patch --- diff --git a/queue-6.1/drm-msm-dsi-enable-runtime-pm.patch b/queue-6.1/drm-msm-dsi-enable-runtime-pm.patch new file mode 100644 index 00000000000..0f378ce68e0 --- /dev/null +++ b/queue-6.1/drm-msm-dsi-enable-runtime-pm.patch @@ -0,0 +1,36 @@ +From 6ab502bc1cf3147ea1d8540d04b83a7a4cb6d1f1 Mon Sep 17 00:00:00 2001 +From: Konrad Dybcio +Date: Tue, 20 Jun 2023 13:43:21 +0200 +Subject: drm/msm/dsi: Enable runtime PM + +From: Konrad Dybcio + +commit 6ab502bc1cf3147ea1d8540d04b83a7a4cb6d1f1 upstream. + +Some devices power the DSI PHY/PLL through a power rail that we model +as a GENPD. Enable runtime PM to make it suspendable. + +Signed-off-by: Konrad Dybcio +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/543352/ +Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-2-a11a751f34f0@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Amit Pundir +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c ++++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +@@ -673,6 +673,10 @@ static int dsi_phy_driver_probe(struct p + return dev_err_probe(dev, PTR_ERR(phy->ahb_clk), + "Unable to get ahb clk\n"); + ++ ret = devm_pm_runtime_enable(&pdev->dev); ++ if (ret) ++ return ret; ++ + /* PLL init will call into clk_register which requires + * register access, so we need to enable power and ahb clock. + */ diff --git a/queue-6.1/gve-fix-use-after-free-vulnerability.patch b/queue-6.1/gve-fix-use-after-free-vulnerability.patch new file mode 100644 index 00000000000..43498f4ef6b --- /dev/null +++ b/queue-6.1/gve-fix-use-after-free-vulnerability.patch @@ -0,0 +1,60 @@ +From pkaligineedi@google.com Fri Feb 2 17:28:54 2024 +From: Praveen Kaligineedi +Date: Tue, 30 Jan 2024 13:45:07 -0800 +Subject: [PATCH 5.15 6.1] gve: Fix use-after-free vulnerability +To: stable@vger.kernel.org +Cc: gregkh@linuxfoundation.org, Bailey Forrest , Praveen Kaligineedi , Eric Dumazet , Jeroen de Borst , Kevin DeCabooter +Message-ID: <20240130214507.3391252-1-pkaligineedi@google.com> + +From: Praveen Kaligineedi + +From: Bailey Forrest + +Call skb_shinfo() after gve_prep_tso() on DQO TX path. +gve_prep_tso() calls skb_cow_head(), which may reallocate +shinfo causing a use after free. + +This bug was unintentionally fixed by 'a6fb8d5a8b69 +("gve: Tx path for DQO-QPL")' while adding DQO-QPL format +support in 6.6. That patch is not appropriate for stable releases. + +Fixes: a57e5de476be ("gve: DQO: Add TX path") +Signed-off-by: Praveen Kaligineedi +Signed-off-by: Bailey Forrest +Reviewed-by: Eric Dumazet +Reviewed-by: Jeroen de Borst +Reviewed-by: Kevin DeCabooter +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/google/gve/gve_tx_dqo.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/google/gve/gve_tx_dqo.c ++++ b/drivers/net/ethernet/google/gve/gve_tx_dqo.c +@@ -350,6 +350,7 @@ static void gve_tx_fill_pkt_desc_dqo(str + /* Validates and prepares `skb` for TSO. + * + * Returns header length, or < 0 if invalid. ++ * Warning : Might change skb->head (and thus skb_shinfo). + */ + static int gve_prep_tso(struct sk_buff *skb) + { +@@ -451,8 +452,8 @@ gve_tx_fill_general_ctx_desc(struct gve_ + static int gve_tx_add_skb_no_copy_dqo(struct gve_tx_ring *tx, + struct sk_buff *skb) + { +- const struct skb_shared_info *shinfo = skb_shinfo(skb); + const bool is_gso = skb_is_gso(skb); ++ struct skb_shared_info *shinfo; + u32 desc_idx = tx->dqo_tx.tail; + + struct gve_tx_pending_packet_dqo *pkt; +@@ -477,6 +478,8 @@ static int gve_tx_add_skb_no_copy_dqo(st + desc_idx = (desc_idx + 1) & tx->mask; + } + ++ /* Must get after gve_prep_tso(), which can change shinfo. */ ++ shinfo = skb_shinfo(skb); + gve_tx_fill_general_ctx_desc(&tx->dqo.tx_ring[desc_idx].general_ctx, + &metadata); + desc_idx = (desc_idx + 1) & tx->mask; diff --git a/queue-6.1/loongarch-smp-call-rcutree_report_cpu_starting-at-tlb_init.patch b/queue-6.1/loongarch-smp-call-rcutree_report_cpu_starting-at-tlb_init.patch new file mode 100644 index 00000000000..7605b7680c2 --- /dev/null +++ b/queue-6.1/loongarch-smp-call-rcutree_report_cpu_starting-at-tlb_init.patch @@ -0,0 +1,73 @@ +From 5056c596c3d1848021a4eaa76ee42f4c05c50346 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Fri, 26 Jan 2024 16:22:07 +0800 +Subject: LoongArch/smp: Call rcutree_report_cpu_starting() at tlb_init() + +From: Huacai Chen + +commit 5056c596c3d1848021a4eaa76ee42f4c05c50346 upstream. + +Machines which have more than 8 nodes fail to boot SMP after commit +a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() +earlier"). Because such machines use tlb-based per-cpu base address +rather than dmw-based per-cpu base address, resulting per-cpu variables +can only be accessed after tlb_init(). But rcutree_report_cpu_starting() +is now called before tlb_init() and accesses per-cpu variables indeed. + +Since the original patch want to avoid the lockdep warning caused by +page allocation in tlb_init(), we can move rcutree_report_cpu_starting() +to tlb_init() where after tlb exception configuration but before page +allocation. + +Fixes: a2ccf46333d7b2cf96 ("LoongArch/smp: Call rcutree_report_cpu_starting() earlier") +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/smp.c | 1 - + arch/loongarch/mm/tlb.c | 16 ++++++++++------ + 2 files changed, 10 insertions(+), 7 deletions(-) + +--- a/arch/loongarch/kernel/smp.c ++++ b/arch/loongarch/kernel/smp.c +@@ -473,7 +473,6 @@ asmlinkage void start_secondary(void) + sync_counter(); + cpu = raw_smp_processor_id(); + set_my_cpu_offset(per_cpu_offset(cpu)); +- rcu_cpu_starting(cpu); + + cpu_probe(); + constant_clockevent_init(); +--- a/arch/loongarch/mm/tlb.c ++++ b/arch/loongarch/mm/tlb.c +@@ -271,12 +271,16 @@ void setup_tlb_handler(int cpu) + set_handler(EXCCODE_TLBNR * VECSIZE, handle_tlb_protect, VECSIZE); + set_handler(EXCCODE_TLBNX * VECSIZE, handle_tlb_protect, VECSIZE); + set_handler(EXCCODE_TLBPE * VECSIZE, handle_tlb_protect, VECSIZE); +- } ++ } else { ++ int vec_sz __maybe_unused; ++ void *addr __maybe_unused; ++ struct page *page __maybe_unused; ++ ++ /* Avoid lockdep warning */ ++ rcu_cpu_starting(cpu); ++ + #ifdef CONFIG_NUMA +- else { +- void *addr; +- struct page *page; +- const int vec_sz = sizeof(exception_handlers); ++ vec_sz = sizeof(exception_handlers); + + if (pcpu_handlers[cpu]) + return; +@@ -292,8 +296,8 @@ void setup_tlb_handler(int cpu) + csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_EENTRY); + csr_write64(pcpu_handlers[cpu], LOONGARCH_CSR_MERRENTRY); + csr_write64(pcpu_handlers[cpu] + 80*VECSIZE, LOONGARCH_CSR_TLBRENTRY); +- } + #endif ++ } + } + + void tlb_init(int cpu) diff --git a/queue-6.1/revert-drm-amd-display-disable-psr-su-on-parade-0803-tcon-again.patch b/queue-6.1/revert-drm-amd-display-disable-psr-su-on-parade-0803-tcon-again.patch new file mode 100644 index 00000000000..46aff04d230 --- /dev/null +++ b/queue-6.1/revert-drm-amd-display-disable-psr-su-on-parade-0803-tcon-again.patch @@ -0,0 +1,33 @@ +From stable+bounces-17641-greg=kroah.com@vger.kernel.org Thu Feb 1 18:05:06 2024 +From: Jonathan Gray +Date: Fri, 2 Feb 2024 13:04:47 +1100 +Subject: Revert "drm/amd/display: Disable PSR-SU on Parade 0803 TCON again" +To: gregkh@linuxfoundation.org +Cc: mario.limonciello@amd.com, stable@vger.kernel.org +Message-ID: <20240202020447.79371-1-jsg@jsg.id.au> + +From: Jonathan Gray + +This reverts commit 85d16c03ddd3f9b10212674e16ee8662b185bd14. + +duplicated a change made in 6.1.69 +20907717918f0487258424631b704c7248a72da2 + +Cc: stable@vger.kernel.org # 6.1 +Signed-off-by: Jonathan Gray +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/modules/power/power_helpers.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/modules/power/power_helpers.c ++++ b/drivers/gpu/drm/amd/display/modules/power/power_helpers.c +@@ -818,8 +818,6 @@ bool is_psr_su_specific_panel(struct dc_ + isPSRSUSupported = false; + else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) + isPSRSUSupported = false; +- else if (dpcd_caps->sink_dev_id_str[1] == 0x08 && dpcd_caps->sink_dev_id_str[0] == 0x03) +- isPSRSUSupported = false; + else if (dpcd_caps->psr_info.force_psrsu_cap == 0x1) + isPSRSUSupported = true; + } diff --git a/queue-6.1/series b/queue-6.1/series index c601ee5e9ec..6f24d3faaa8 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -213,3 +213,7 @@ selftests-team-add-missing-config-options.patch selftests-bonding-check-initial-state.patch arm64-irq-set-the-correct-node-for-shadow-call-stack.patch mm-kmsan-fix-infinite-recursion-due-to-rcu-critical-section.patch +revert-drm-amd-display-disable-psr-su-on-parade-0803-tcon-again.patch +drm-msm-dsi-enable-runtime-pm.patch +loongarch-smp-call-rcutree_report_cpu_starting-at-tlb_init.patch +gve-fix-use-after-free-vulnerability.patch