From 73b0153d82feb1cc6edaf5dcacf868bd122fbd7a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 28 Dec 2022 14:42:21 +0100 Subject: [PATCH] 6.0-stable patches added patches: drm-amd-display-revert-disable-drr-actions-during-state-commit.patch io_uring-remove-iopoll-spinlock.patch media-dvbdev-fix-build-warning-due-to-comments.patch media-dvbdev-fix-refcnt-bug.patch net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch --- ...able-drr-actions-during-state-commit.patch | 35 +++++++++++ .../io_uring-remove-iopoll-spinlock.patch | 46 ++++++++++++++ ...ev-fix-build-warning-due-to-comments.patch | 41 ++++++++++++ queue-6.0/media-dvbdev-fix-refcnt-bug.patch | 63 +++++++++++++++++++ ...-create_singlethread_workqueue-fails.patch | 33 ++++++++++ queue-6.0/series | 5 ++ 6 files changed, 223 insertions(+) create mode 100644 queue-6.0/drm-amd-display-revert-disable-drr-actions-during-state-commit.patch create mode 100644 queue-6.0/io_uring-remove-iopoll-spinlock.patch create mode 100644 queue-6.0/media-dvbdev-fix-build-warning-due-to-comments.patch create mode 100644 queue-6.0/media-dvbdev-fix-refcnt-bug.patch create mode 100644 queue-6.0/net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch diff --git a/queue-6.0/drm-amd-display-revert-disable-drr-actions-during-state-commit.patch b/queue-6.0/drm-amd-display-revert-disable-drr-actions-during-state-commit.patch new file mode 100644 index 00000000000..c0a9ffab069 --- /dev/null +++ b/queue-6.0/drm-amd-display-revert-disable-drr-actions-during-state-commit.patch @@ -0,0 +1,35 @@ +From 6f8816261db9251f2635533572f95ab8e530266c Mon Sep 17 00:00:00 2001 +From: Martin Leung +Date: Thu, 3 Nov 2022 11:35:44 -0400 +Subject: drm/amd/display: revert Disable DRR actions during state commit + +From: Martin Leung + +commit 6f8816261db9251f2635533572f95ab8e530266c upstream. + +why and how: +causes unstable on certain surface format/mpo transitions + +This reverts commit de020e5fa9ebc6fc32e82ae6ccb0282451ed937c + +Reviewed-by: Wesley Chalmers +Acked-by: Tom Chung +Signed-off-by: Martin Leung +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +@@ -973,5 +973,8 @@ void dcn30_prepare_bandwidth(struct dc * + dc->clk_mgr->funcs->set_max_memclk(dc->clk_mgr, dc->clk_mgr->bw_params->clk_table.entries[dc->clk_mgr->bw_params->clk_table.num_entries - 1].memclk_mhz); + + dcn20_prepare_bandwidth(dc, context); ++ ++ dc_dmub_srv_p_state_delegate(dc, ++ context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching, context); + } + diff --git a/queue-6.0/io_uring-remove-iopoll-spinlock.patch b/queue-6.0/io_uring-remove-iopoll-spinlock.patch new file mode 100644 index 00000000000..ad99f479e05 --- /dev/null +++ b/queue-6.0/io_uring-remove-iopoll-spinlock.patch @@ -0,0 +1,46 @@ +From 2dac1a159216b39ced8d78dba590c5d2f4249586 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Wed, 23 Nov 2022 11:33:42 +0000 +Subject: io_uring: remove iopoll spinlock + +From: Pavel Begunkov + +commit 2dac1a159216b39ced8d78dba590c5d2f4249586 upstream. + +This reverts commit 2ccc92f4effcfa1c51c4fcf1e34d769099d3cad4 + +io_req_complete_post() should now behave well even in case of IOPOLL, we +can remove completion_lock locking. + +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/7e171c8b530656b14a671c59100ca260e46e7f2a.1669203009.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + io_uring/rw.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -1063,7 +1063,6 @@ int io_do_iopoll(struct io_ring_ctx *ctx + else if (!pos) + return 0; + +- spin_lock(&ctx->completion_lock); + prev = start; + wq_list_for_each_resume(pos, prev) { + struct io_kiocb *req = container_of(pos, struct io_kiocb, comp_list); +@@ -1078,11 +1077,11 @@ int io_do_iopoll(struct io_ring_ctx *ctx + req->cqe.flags = io_put_kbuf(req, 0); + __io_fill_cqe_req(req->ctx, req); + } +- io_commit_cqring(ctx); +- spin_unlock(&ctx->completion_lock); ++ + if (unlikely(!nr_events)) + return 0; + ++ io_commit_cqring(ctx); + io_cqring_ev_posted_iopoll(ctx); + pos = start ? start->next : ctx->iopoll_list.first; + wq_list_cut(&ctx->iopoll_list, prev, start); diff --git a/queue-6.0/media-dvbdev-fix-build-warning-due-to-comments.patch b/queue-6.0/media-dvbdev-fix-build-warning-due-to-comments.patch new file mode 100644 index 00000000000..7e6a8ea597d --- /dev/null +++ b/queue-6.0/media-dvbdev-fix-build-warning-due-to-comments.patch @@ -0,0 +1,41 @@ +From 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Mon, 28 Nov 2022 08:39:03 +0000 +Subject: media: dvbdev: fix build warning due to comments + +From: Lin Ma + +commit 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 upstream. + +Previous commit that introduces reference counter does not add proper +comments, which will lead to warning when building htmldocs. Fix them. + +Reported-by: "Stephen Rothwell" +Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") +Signed-off-by: Lin Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + include/media/dvbdev.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/include/media/dvbdev.h ++++ b/include/media/dvbdev.h +@@ -126,6 +126,7 @@ struct dvb_adapter { + * struct dvb_device - represents a DVB device node + * + * @list_head: List head with all DVB devices ++ * @ref: reference counter + * @fops: pointer to struct file_operations + * @adapter: pointer to the adapter that holds this device node + * @type: type of the device, as defined by &enum dvb_device_type. +@@ -196,7 +197,7 @@ struct dvb_device { + struct dvb_device *dvb_device_get(struct dvb_device *dvbdev); + + /** +- * dvb_device_get - Decrease dvb_device reference ++ * dvb_device_put - Decrease dvb_device reference + * + * @dvbdev: pointer to struct dvb_device + */ diff --git a/queue-6.0/media-dvbdev-fix-refcnt-bug.patch b/queue-6.0/media-dvbdev-fix-refcnt-bug.patch new file mode 100644 index 00000000000..9ab611d0565 --- /dev/null +++ b/queue-6.0/media-dvbdev-fix-refcnt-bug.patch @@ -0,0 +1,63 @@ +From 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 Mon Sep 17 00:00:00 2001 +From: Lin Ma +Date: Mon, 28 Nov 2022 16:21:59 +0000 +Subject: media: dvbdev: fix refcnt bug + +From: Lin Ma + +commit 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 upstream. + +Previous commit initialize the dvbdev->ref before the template copy, +which will overwrite the reference and cause refcnt bug. + +refcount_t: addition on 0; use-after-free. +WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 +Modules linked in: +CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0 +... +RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25 +RSP: 0000:ffffc900000678d0 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c +RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000 +R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 +FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __refcount_add include/linux/refcount.h:199 [inline] + __refcount_inc include/linux/refcount.h:250 [inline] + refcount_inc include/linux/refcount.h:267 [inline] + kref_get include/linux/kref.h:45 [inline] + dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline] + dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517 +... + +Just place the kref_init at correct position. + +Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com +Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF") +Signed-off-by: Lin Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/dvb-core/dvbdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -480,8 +480,8 @@ int dvb_register_device(struct dvb_adapt + return -ENOMEM; + } + +- kref_init(&dvbdev->ref); + memcpy(dvbdev, template, sizeof(struct dvb_device)); ++ kref_init(&dvbdev->ref); + dvbdev->type = type; + dvbdev->id = id; + dvbdev->adapter = adap; diff --git a/queue-6.0/net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch b/queue-6.0/net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch new file mode 100644 index 00000000000..999bd39b1a1 --- /dev/null +++ b/queue-6.0/net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch @@ -0,0 +1,33 @@ +From 2cb815cfc78b137ee38bcd65e7c955d6cc2cc250 Mon Sep 17 00:00:00 2001 +From: Gaosheng Cui +Date: Wed, 14 Dec 2022 16:01:17 +0800 +Subject: net: stmmac: fix errno when create_singlethread_workqueue() fails + +From: Gaosheng Cui + +commit 2cb815cfc78b137ee38bcd65e7c955d6cc2cc250 upstream. + +We should set the return value to -ENOMEM explicitly when +create_singlethread_workqueue() fails in stmmac_dvr_probe(), +otherwise we'll lose the error value. + +Fixes: a137f3f27f92 ("net: stmmac: fix possible memory leak in stmmac_dvr_probe()") +Signed-off-by: Gaosheng Cui +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20221214080117.3514615-1-cuigaosheng1@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -7115,6 +7115,7 @@ int stmmac_dvr_probe(struct device *devi + priv->wq = create_singlethread_workqueue("stmmac_wq"); + if (!priv->wq) { + dev_err(priv->device, "failed to create workqueue\n"); ++ ret = -ENOMEM; + goto error_wq_init; + } + diff --git a/queue-6.0/series b/queue-6.0/series index 88d5d65a32b..10a48b132b5 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -1060,3 +1060,8 @@ io_uring-add-completion-locking-for-iopoll.patch io_uring-improve-io_double_lock_ctx-fail-handling.patch io_uring-net-fix-cleanup-after-recycle.patch io_uring-protect-cq_timeouts-with-timeout_lock.patch +io_uring-remove-iopoll-spinlock.patch +net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch +media-dvbdev-fix-build-warning-due-to-comments.patch +media-dvbdev-fix-refcnt-bug.patch +drm-amd-display-revert-disable-drr-actions-during-state-commit.patch -- 2.47.3