5.10-stable patches

added patches:
	drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch

diff --git a/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch b/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch
new file mode 100644 (file)
index 0000000..9d170c4
--- /dev/null
+++ b/queue-5.10/drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch
@@ -0,0 +1,105 @@
+From 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 Mon Sep 17 00:00:00 2001
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Date: Wed, 27 Oct 2021 16:27:30 +0200
+Subject: drm/amdgpu: Fix even more out of bound writes from debugfs
+
+From: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+
+commit 3f4e54bd312d3dafb59daf2b97ffa08abebe60f5 upstream.
+
+CVE-2021-42327 was fixed by:
+
+commit f23750b5b3d98653b31d4469592935ef6364ad67
+Author: Thelford Williams <tdwilliamsiv@gmail.com>
+Date:   Wed Oct 13 16:04:13 2021 -0400
+
+    drm/amdgpu: fix out of bounds write
+
+but amdgpu_dm_debugfs.c contains more of the same issue so fix the
+remaining ones.
+
+v2:
+       * Add missing fix in dp_max_bpc_write (Harry Wentland)
+
+Fixes: 918698d5c2b5 ("drm/amd/display: Return the number of bytes parsed than allocated")
+Signed-off-by: Patrik Jakobsson <pjakobsson@suse.de>
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+[ Cherry-pick the fix and drop the following functions which were introduced
+  since 5.13 or later: dp_max_bpc_write() was introduced in commit cca912e0a6b4
+  ("drm/amd/display: Add max bpc debugfs") dp_dsc_passthrough_set() was
+  introduced in commit fcd1e484c8ae ("drm/amd/display: Add debugfs entry for
+  dsc passthrough"). ]
+Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c |   14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -424,7 +424,7 @@ static ssize_t dp_phy_settings_write(str
+       if (!wr_buf)
+               return -ENOSPC;
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                          (long *)param, buf,
+                                          max_param_num,
+                                          &param_nums)) {
+@@ -576,7 +576,7 @@ static ssize_t dp_phy_test_pattern_debug
+       if (!wr_buf)
+               return -ENOSPC;
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                          (long *)param, buf,
+                                          max_param_num,
+                                          &param_nums)) {
+@@ -1091,7 +1091,7 @@ static ssize_t dp_trigger_hotplug(struct
+               return -ENOSPC;
+       }
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                               (long *)param, buf,
+                                               max_param_num,
+                                               &param_nums)) {
+@@ -1272,7 +1272,7 @@ static ssize_t dp_dsc_clock_en_write(str
+               return -ENOSPC;
+       }
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                           (long *)param, buf,
+                                           max_param_num,
+                                           &param_nums)) {
+@@ -1426,7 +1426,7 @@ static ssize_t dp_dsc_slice_width_write(
+               return -ENOSPC;
+       }
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                           (long *)param, buf,
+                                           max_param_num,
+                                           &param_nums)) {
+@@ -1580,7 +1580,7 @@ static ssize_t dp_dsc_slice_height_write
+               return -ENOSPC;
+       }
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                           (long *)param, buf,
+                                           max_param_num,
+                                           &param_nums)) {
+@@ -1727,7 +1727,7 @@ static ssize_t dp_dsc_bits_per_pixel_wri
+               return -ENOSPC;
+       }
+ 
+-      if (parse_write_buffer_into_params(wr_buf, size,
++      if (parse_write_buffer_into_params(wr_buf, wr_buf_size,
+                                           (long *)param, buf,
+                                           max_param_num,
+                                           &param_nums)) {

diff --git a/queue-5.10/series b/queue-5.10/series
index a827d617e058d1aa0374825dac384bcc15e2c3b3..625e360022eeb547bbd04fb13b8b5ebef50e0635 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -86,6 +86,7 @@ arm64-dts-rockchip-add-missing-pcie-supplies-to-rockpro64-board-dtsi.patch
 mmc-atmel-mci-add-missing-clk_disable_unprepare.patch
 proc-fix-uaf-in-proc_get_inode.patch
 arm-shmobile-smp-enforce-shmobile_smp_-alignment.patch
+drm-amdgpu-fix-even-more-out-of-bound-writes-from-debugfs.patch
 batman-adv-ignore-own-maximum-aggregation-size-during-rx.patch
 soc-qcom-pdr-fix-the-potential-deadlock.patch
 drm-radeon-fix-uninitialized-size-issue-in-radeon_vce_cs_parse.patch