From: Greg Kroah-Hartman Date: Mon, 5 Jan 2026 13:34:32 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v6.12.64~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d2fc14b46247c4d9e6249b82313fcbb71e4d721d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch --- diff --git a/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch b/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch new file mode 100644 index 0000000000..859e1bc5e4 --- /dev/null +++ b/queue-5.15/drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch @@ -0,0 +1,35 @@ +From 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 Mon Sep 17 00:00:00 2001 +From: Akhil P Oommen +Date: Tue, 18 Nov 2025 14:20:28 +0530 +Subject: drm/msm/a6xx: Fix out of bound IO access in a6xx_get_gmu_registers + +From: Akhil P Oommen + +commit 779b68a5bf2764c8ed3aa800e41ba0d5d007e1e7 upstream. + +REG_A6XX_GMU_AO_AHB_FENCE_CTRL register falls under GMU's register +range. So, use gmu_write() routines to write to this register. + +Fixes: 1707add81551 ("drm/msm/a6xx: Add a6xx gpu state") +Cc: stable@vger.kernel.org +Signed-off-by: Akhil P Oommen +Reviewed-by: Konrad Dybcio +Patchwork: https://patchwork.freedesktop.org/patch/688993/ +Message-ID: <20251118-kaana-gpu-support-v4-1-86eeb8e93fb6@oss.qualcomm.com> +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -794,7 +794,7 @@ static void a6xx_get_gmu_registers(struc + return; + + /* Set the fence to ALLOW mode so we can access the registers */ +- gpu_write(gpu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0); ++ gmu_write(&a6xx_gpu->gmu, REG_A6XX_GMU_AO_AHB_FENCE_CTRL, 0); + + _a6xx_get_gmu_registers(gpu, a6xx_state, &a6xx_gmu_reglist[2], + &a6xx_state->gmu_registers[2], false); diff --git a/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch b/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch new file mode 100644 index 0000000000..3388b17d70 --- /dev/null +++ b/queue-5.15/drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch @@ -0,0 +1,63 @@ +From 560271e10b2c86e95ea35afa9e79822e4847f07a Mon Sep 17 00:00:00 2001 +From: Lyude Paul +Date: Thu, 11 Dec 2025 14:02:54 -0500 +Subject: drm/nouveau/dispnv50: Don't call drm_atomic_get_crtc_state() in prepare_fb + +From: Lyude Paul + +commit 560271e10b2c86e95ea35afa9e79822e4847f07a upstream. + +Since we recently started warning about uses of this function after the +atomic check phase completes, we've started getting warnings about this in +nouveau. It appears a misplaced drm_atomic_get_crtc_state() call has been +hiding in our .prepare_fb callback for a while. + +So, fix this by adding a new nv50_head_atom_get_new() function and use that +in our .prepare_fb callback instead. + +Signed-off-by: Lyude Paul +Reviewed-by: Dave Airlie +Fixes: 1590700d94ac ("drm/nouveau/kms/nv50-: split each resource type into their own source files") +Cc: # v4.18+ +Link: https://patch.msgid.link/20251211190256.396742-1-lyude@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/dispnv50/atom.h | 13 +++++++++++++ + drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +- + 2 files changed, 14 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/nouveau/dispnv50/atom.h ++++ b/drivers/gpu/drm/nouveau/dispnv50/atom.h +@@ -152,8 +152,21 @@ static inline struct nv50_head_atom * + nv50_head_atom_get(struct drm_atomic_state *state, struct drm_crtc *crtc) + { + struct drm_crtc_state *statec = drm_atomic_get_crtc_state(state, crtc); ++ + if (IS_ERR(statec)) + return (void *)statec; ++ ++ return nv50_head_atom(statec); ++} ++ ++static inline struct nv50_head_atom * ++nv50_head_atom_get_new(struct drm_atomic_state *state, struct drm_crtc *crtc) ++{ ++ struct drm_crtc_state *statec = drm_atomic_get_new_crtc_state(state, crtc); ++ ++ if (!statec) ++ return NULL; ++ + return nv50_head_atom(statec); + } + +--- a/drivers/gpu/drm/nouveau/dispnv50/wndw.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/wndw.c +@@ -565,7 +565,7 @@ nv50_wndw_prepare_fb(struct drm_plane *p + asyw->image.offset[0] = nvbo->offset; + + if (wndw->func->prepare) { +- asyh = nv50_head_atom_get(asyw->state.state, asyw->state.crtc); ++ asyh = nv50_head_atom_get_new(asyw->state.state, asyw->state.crtc); + if (IS_ERR(asyh)) + return PTR_ERR(asyh); + diff --git a/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch b/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch new file mode 100644 index 0000000000..c58c7eeb76 --- /dev/null +++ b/queue-5.15/drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch @@ -0,0 +1,56 @@ +From 491adc6a0f9903c32b05f284df1148de39e8e644 Mon Sep 17 00:00:00 2001 +From: Simon Richter +Date: Tue, 14 Oct 2025 01:11:33 +0900 +Subject: drm/ttm: Avoid NULL pointer deref for evicted BOs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Simon Richter + +commit 491adc6a0f9903c32b05f284df1148de39e8e644 upstream. + +It is possible for a BO to exist that is not currently associated with a +resource, e.g. because it has been evicted. + +When devcoredump tries to read the contents of all BOs for dumping, we need +to expect this as well -- in this case, ENODATA is recorded instead of the +buffer contents. + +Fixes: 7d08df5d0bd3 ("drm/ttm: Add ttm_bo_access") +Fixes: 09ac4fcb3f25 ("drm/ttm: Implement vm_operations_struct.access v2") +Cc: stable +Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6271 +Signed-off-by: Simon Richter +Reviewed-by: Matthew Brost +Reviewed-by: Shuicheng Lin +Reviewed-by: Christian König +Signed-off-by: Matthew Brost +Link: https://patch.msgid.link/20251013161241.709916-1-Simon.Richter@hogyros.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_bo_vm.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -427,6 +427,11 @@ int ttm_bo_vm_access(struct vm_area_stru + if (ret) + return ret; + ++ if (!bo->resource) { ++ ret = -ENODATA; ++ goto unlock; ++ } ++ + switch (bo->resource->mem_type) { + case TTM_PL_SYSTEM: + fallthrough; +@@ -441,6 +446,7 @@ int ttm_bo_vm_access(struct vm_area_stru + ret = -EIO; + } + ++unlock: + ttm_bo_unreserve(bo); + + return ret; diff --git a/queue-5.15/series b/queue-5.15/series index 0fa961aa43..77a738d849 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -407,3 +407,6 @@ nfsd-drop-the-client-reference-in-client_states_open.patch net-usb-sr9700-fix-incorrect-command-used-to-write-single-register.patch net-nfc-fix-deadlock-between-nfc_unregister_device-and-rfkill_fop_write.patch net-macb-relocate-mog_init_rings-callback-from-macb_mac_link_up-to-macb_open.patch +drm-msm-a6xx-fix-out-of-bound-io-access-in-a6xx_get_gmu_registers.patch +drm-ttm-avoid-null-pointer-deref-for-evicted-bos.patch +drm-nouveau-dispnv50-don-t-call-drm_atomic_get_crtc_state-in-prepare_fb.patch