+++ /dev/null
-From 54478c2e4a510eb6dbc12c0449c47a8a777dcceb Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 23 Oct 2023 12:56:37 +0000
-Subject: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is
- NULL
-
-From: Qu Huang <qu.huang@linux.dev>
-
-[ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ]
-
-In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresponding exception log:
-
-1. Navigate to the directory: /sys/kernel/debug/dri/0
-2. Execute command: cat amdgpu_regs_smc
-3. Exception Log::
-[4005007.702554] BUG: kernel NULL pointer dereference, address: 0000000000000000
-[4005007.702562] #PF: supervisor instruction fetch in kernel mode
-[4005007.702567] #PF: error_code(0x0010) - not-present page
-[4005007.702570] PGD 0 P4D 0
-[4005007.702576] Oops: 0010 [#1] SMP NOPTI
-[4005007.702581] CPU: 4 PID: 62563 Comm: cat Tainted: G OE 5.15.0-43-generic #46-Ubunt u
-[4005007.702590] RIP: 0010:0x0
-[4005007.702598] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
-[4005007.702600] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
-[4005007.702605] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
-[4005007.702609] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
-[4005007.702612] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
-[4005007.702615] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
-[4005007.702618] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
-[4005007.702622] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
-[4005007.702626] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[4005007.702629] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
-[4005007.702633] Call Trace:
-[4005007.702636] <TASK>
-[4005007.702640] amdgpu_debugfs_regs_smc_read+0xb0/0x120 [amdgpu]
-[4005007.703002] full_proxy_read+0x5c/0x80
-[4005007.703011] vfs_read+0x9f/0x1a0
-[4005007.703019] ksys_read+0x67/0xe0
-[4005007.703023] __x64_sys_read+0x19/0x20
-[4005007.703028] do_syscall_64+0x5c/0xc0
-[4005007.703034] ? do_user_addr_fault+0x1e3/0x670
-[4005007.703040] ? exit_to_user_mode_prepare+0x37/0xb0
-[4005007.703047] ? irqentry_exit_to_user_mode+0x9/0x20
-[4005007.703052] ? irqentry_exit+0x19/0x30
-[4005007.703057] ? exc_page_fault+0x89/0x160
-[4005007.703062] ? asm_exc_page_fault+0x8/0x30
-[4005007.703068] entry_SYSCALL_64_after_hwframe+0x44/0xae
-[4005007.703075] RIP: 0033:0x7f5e07672992
-[4005007.703079] Code: c0 e9 b2 fe ff ff 50 48 8d 3d fa b2 0c 00 e8 c5 1d 02 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 e c 28 48 89 54 24
-[4005007.703083] RSP: 002b:00007ffe03097898 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
-[4005007.703088] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5e07672992
-[4005007.703091] RDX: 0000000000020000 RSI: 00007f5e06753000 RDI: 0000000000000003
-[4005007.703094] RBP: 00007f5e06753000 R08: 00007f5e06752010 R09: 00007f5e06752010
-[4005007.703096] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000022000
-[4005007.703099] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
-[4005007.703105] </TASK>
-[4005007.703107] Modules linked in: nf_tables libcrc32c nfnetlink algif_hash af_alg binfmt_misc nls_ iso8859_1 ipmi_ssif ast intel_rapl_msr intel_rapl_common drm_vram_helper drm_ttm_helper amd64_edac t tm edac_mce_amd kvm_amd ccp mac_hid k10temp kvm acpi_ipmi ipmi_si rapl sch_fq_codel ipmi_devintf ipm i_msghandler msr parport_pc ppdev lp parport mtd pstore_blk efi_pstore ramoops pstore_zone reed_solo mon ip_tables x_tables autofs4 ib_uverbs ib_core amdgpu(OE) amddrm_ttm_helper(OE) amdttm(OE) iommu_v 2 amd_sched(OE) amdkcl(OE) drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec rc_core drm igb ahci xhci_pci libahci i2c_piix4 i2c_algo_bit xhci_pci_renesas dca
-[4005007.703184] CR2: 0000000000000000
-[4005007.703188] ---[ end trace ac65a538d240da39 ]---
-[4005007.800865] RIP: 0010:0x0
-[4005007.800871] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
-[4005007.800874] RSP: 0018:ffffa82b46d27da0 EFLAGS: 00010206
-[4005007.800878] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffa82b46d27e68
-[4005007.800881] RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff9940656e0000
-[4005007.800883] RBP: ffffa82b46d27dd8 R08: 0000000000000000 R09: ffff994060c07980
-[4005007.800886] R10: 0000000000020000 R11: 0000000000000000 R12: 00007f5e06753000
-[4005007.800888] R13: ffff9940656e0000 R14: ffffa82b46d27e68 R15: 00007f5e06753000
-[4005007.800891] FS: 00007f5e0755b740(0000) GS:ffff99479d300000(0000) knlGS:0000000000000000
-[4005007.800895] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
-[4005007.800898] CR2: ffffffffffffffd6 CR3: 00000003253fc000 CR4: 00000000003506e0
-
-Signed-off-by: Qu Huang <qu.huang@linux.dev>
-Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
-index 48df32dd352ed..d7d3cf4da9e05 100644
---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
-+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
-@@ -456,6 +456,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,
- ssize_t result = 0;
- int r;
-
-+ if (!adev->smc_wreg)
-+ return -EPERM;
-+
- if (size & 0x3 || *pos & 0x3)
- return -EINVAL;
-
-@@ -515,6 +518,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
- ssize_t result = 0;
- int r;
-
-+ if (!adev->smc_rreg)
-+ return -EPERM;
-+
- if (size & 0x3 || *pos & 0x3)
- return -EINVAL;
-
---
-2.42.0
-
+++ /dev/null
-From dab54a8c0116b011bf722a739768e1bfdb430298 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Wed, 13 Apr 2016 08:54:30 +0800
-Subject: i2c: sun6i-p2wi: Prevent potential division by zero
-
-From: Axel Lin <axel.lin@ingics.com>
-
-[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ]
-
-Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The
-variable set here is later used as a divisor.
-
-Signed-off-by: Axel Lin <axel.lin@ingics.com>
-Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
-Signed-off-by: Wolfram Sang <wsa@kernel.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c
-index 4f7a4f5a1150a..389ca6fddc1db 100644
---- a/drivers/i2c/busses/i2c-sun6i-p2wi.c
-+++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c
-@@ -206,6 +206,11 @@ static int p2wi_probe(struct platform_device *pdev)
- return -EINVAL;
- }
-
-+ if (clk_freq == 0) {
-+ dev_err(dev, "clock-frequency is set to 0 in DT\n");
-+ return -EINVAL;
-+ }
-+
- if (of_get_child_count(np) > 1) {
- dev_err(dev, "P2WI only supports one slave device\n");
- return -EINVAL;
---
-2.42.0
-
+++ /dev/null
-From 0f37496a7f43d64678c633935964e014fcd677da Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Fri, 22 Sep 2023 14:38:07 +0200
-Subject: media: imon: fix access to invalid resource for the second interface
-
-From: Takashi Iwai <tiwai@suse.de>
-
-[ Upstream commit a1766a4fd83befa0b34d932d532e7ebb7fab1fa7 ]
-
-imon driver probes two USB interfaces, and at the probe of the second
-interface, the driver assumes blindly that the first interface got
-bound with the same imon driver. It's usually true, but it's still
-possible that the first interface is bound with another driver via a
-malformed descriptor. Then it may lead to a memory corruption, as
-spotted by syzkaller; imon driver accesses the data from drvdata as
-struct imon_context object although it's a completely different one
-that was assigned by another driver.
-
-This patch adds a sanity check -- whether the first interface is
-really bound with the imon driver or not -- for avoiding the problem
-above at the probe time.
-
-Reported-by: syzbot+59875ffef5cb9c9b29e9@syzkaller.appspotmail.com
-Closes: https://lore.kernel.org/all/000000000000a838aa0603cc74d6@google.com/
-Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
-Link: https://lore.kernel.org/r/20230922005152.163640-1-ricardo@marliere.net
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
-Signed-off-by: Sean Young <sean@mess.org>
-Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/media/rc/imon.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
-diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
-index 253a1d1a840a0..c6d9a6de8e4ed 100644
---- a/drivers/media/rc/imon.c
-+++ b/drivers/media/rc/imon.c
-@@ -2436,6 +2436,12 @@ static int imon_probe(struct usb_interface *interface,
- goto fail;
- }
-
-+ if (first_if->dev.driver != interface->dev.driver) {
-+ dev_err(&interface->dev, "inconsistent driver matching\n");
-+ ret = -EINVAL;
-+ goto fail;
-+ }
-+
- if (ifnum == 0) {
- ictx = imon_init_intf0(interface, id);
- if (!ictx) {
---
-2.42.0
-
+++ /dev/null
-From c171a3f38a2b79ee7150594aabcbfd6e31919851 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Mon, 30 Oct 2023 16:50:14 -0400
-Subject: net: r8169: Disable multicast filter for RTL8168H and RTL8107E
-
-From: Patrick Thompson <ptf@google.com>
-
-[ Upstream commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df ]
-
-RTL8168H and RTL8107E ethernet adapters erroneously filter unicast
-eapol packets unless allmulti is enabled. These devices correspond to
-RTL_GIGA_MAC_VER_46 and VER_48. Add an exception for VER_46 and VER_48
-in the same way that VER_35 has an exception.
-
-Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E")
-Signed-off-by: Patrick Thompson <ptf@google.com>
-Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
-Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
-Link: https://lore.kernel.org/r/20231030205031.177855-1-ptf@google.com
-Signed-off-by: Paolo Abeni <pabeni@redhat.com>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/realtek/r8169_main.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
-index ab6af1f1ad5bb..6e0fe77d1019c 100644
---- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -2581,7 +2581,9 @@ static void rtl_set_rx_mode(struct net_device *dev)
- rx_mode &= ~AcceptMulticast;
- } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
- dev->flags & IFF_ALLMULTI ||
-- tp->mac_version == RTL_GIGA_MAC_VER_35) {
-+ tp->mac_version == RTL_GIGA_MAC_VER_35 ||
-+ tp->mac_version == RTL_GIGA_MAC_VER_46 ||
-+ tp->mac_version == RTL_GIGA_MAC_VER_48) {
- /* accept all multicasts */
- } else if (netdev_mc_empty(dev)) {
- rx_mode &= ~AcceptMulticast;
---
-2.42.0
-
+++ /dev/null
-From b289a8a0fd5948ef3c1fc965876ec1bff952d270 Mon Sep 17 00:00:00 2001
-From: Sasha Levin <sashal@kernel.org>
-Date: Tue, 21 Nov 2023 09:09:33 +0100
-Subject: Revert "net: r8169: Disable multicast filter for RTL8168H and
- RTL8107E"
-
-From: Heiner Kallweit <hkallweit1@gmail.com>
-
-commit 6a26310273c323380da21eb23fcfd50e31140913 upstream.
-
-This reverts commit efa5f1311c4998e9e6317c52bc5ee93b3a0f36df.
-
-I couldn't reproduce the reported issue. What I did, based on a pcap
-packet log provided by the reporter:
-- Used same chip version (RTL8168h)
-- Set MAC address to the one used on the reporters system
-- Replayed the EAPOL unicast packet that, according to the reporter,
- was filtered out by the mc filter.
-The packet was properly received.
-
-Therefore the root cause of the reported issue seems to be somewhere
-else. Disabling mc filtering completely for the most common chip
-version is a quite big hammer. Therefore revert the change and wait
-for further analysis results from the reporter.
-
-Cc: stable@vger.kernel.org
-Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-Signed-off-by: Sasha Levin <sashal@kernel.org>
----
- drivers/net/ethernet/realtek/r8169_main.c | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
-index 6e0fe77d1019c..ab6af1f1ad5bb 100644
---- a/drivers/net/ethernet/realtek/r8169_main.c
-+++ b/drivers/net/ethernet/realtek/r8169_main.c
-@@ -2581,9 +2581,7 @@ static void rtl_set_rx_mode(struct net_device *dev)
- rx_mode &= ~AcceptMulticast;
- } else if (netdev_mc_count(dev) > MC_FILTER_LIMIT ||
- dev->flags & IFF_ALLMULTI ||
-- tp->mac_version == RTL_GIGA_MAC_VER_35 ||
-- tp->mac_version == RTL_GIGA_MAC_VER_46 ||
-- tp->mac_version == RTL_GIGA_MAC_VER_48) {
-+ tp->mac_version == RTL_GIGA_MAC_VER_35) {
- /* accept all multicasts */
- } else if (netdev_mc_empty(dev)) {
- rx_mode &= ~AcceptMulticast;
---
-2.42.0
-
rdma-irdma-prevent-zero-length-stag-registration.patch
pci-keystone-drop-__init-from-ks_pcie_add_pcie_-ep-port.patch
-net-r8169-disable-multicast-filter-for-rtl8168h-and-.patch
-drm-amdgpu-fix-a-null-pointer-access-when-the-smc_rr.patch
-i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch
-media-imon-fix-access-to-invalid-resource-for-the-se.patch
-revert-net-r8169-disable-multicast-filter-for-rtl816.patch
afs-fix-afs_server_list-to-be-cleaned-up-with-rcu.patch
afs-make-error-on-cell-lookup-failure-consistent-wit.patch
drm-panel-boe-tv101wum-nl6-fine-tune-the-panel-power.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
