--- /dev/null
+From 6f8816261db9251f2635533572f95ab8e530266c Mon Sep 17 00:00:00 2001
+From: Martin Leung <Martin.Leung@amd.com>
+Date: Thu, 3 Nov 2022 11:35:44 -0400
+Subject: drm/amd/display: revert Disable DRR actions during state commit
+
+From: Martin Leung <Martin.Leung@amd.com>
+
+commit 6f8816261db9251f2635533572f95ab8e530266c upstream.
+
+why and how:
+causes unstable on certain surface format/mpo transitions
+
+This reverts commit de020e5fa9ebc6fc32e82ae6ccb0282451ed937c
+
+Reviewed-by: Wesley Chalmers <Wesley.Chalmers@amd.com>
+Acked-by: Tom Chung <chiahsuan.chung@amd.com>
+Signed-off-by: Martin Leung <Martin.Leung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c
+@@ -973,5 +973,8 @@ void dcn30_prepare_bandwidth(struct dc *
+ dc->clk_mgr->funcs->set_max_memclk(dc->clk_mgr, dc->clk_mgr->bw_params->clk_table.entries[dc->clk_mgr->bw_params->clk_table.num_entries - 1].memclk_mhz);
+
+ dcn20_prepare_bandwidth(dc, context);
++
++ dc_dmub_srv_p_state_delegate(dc,
++ context->bw_ctx.bw.dcn.clk.fw_based_mclk_switching, context);
+ }
+
--- /dev/null
+From 2dac1a159216b39ced8d78dba590c5d2f4249586 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Wed, 23 Nov 2022 11:33:42 +0000
+Subject: io_uring: remove iopoll spinlock
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 2dac1a159216b39ced8d78dba590c5d2f4249586 upstream.
+
+This reverts commit 2ccc92f4effcfa1c51c4fcf1e34d769099d3cad4
+
+io_req_complete_post() should now behave well even in case of IOPOLL, we
+can remove completion_lock locking.
+
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://lore.kernel.org/r/7e171c8b530656b14a671c59100ca260e46e7f2a.1669203009.git.asml.silence@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/rw.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- a/io_uring/rw.c
++++ b/io_uring/rw.c
+@@ -1063,7 +1063,6 @@ int io_do_iopoll(struct io_ring_ctx *ctx
+ else if (!pos)
+ return 0;
+
+- spin_lock(&ctx->completion_lock);
+ prev = start;
+ wq_list_for_each_resume(pos, prev) {
+ struct io_kiocb *req = container_of(pos, struct io_kiocb, comp_list);
+@@ -1078,11 +1077,11 @@ int io_do_iopoll(struct io_ring_ctx *ctx
+ req->cqe.flags = io_put_kbuf(req, 0);
+ __io_fill_cqe_req(req->ctx, req);
+ }
+- io_commit_cqring(ctx);
+- spin_unlock(&ctx->completion_lock);
++
+ if (unlikely(!nr_events))
+ return 0;
+
++ io_commit_cqring(ctx);
+ io_cqring_ev_posted_iopoll(ctx);
+ pos = start ? start->next : ctx->iopoll_list.first;
+ wq_list_cut(&ctx->iopoll_list, prev, start);
--- /dev/null
+From 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Mon, 28 Nov 2022 08:39:03 +0000
+Subject: media: dvbdev: fix build warning due to comments
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 3edfd14bb50fa6f94ed1a37bbb17d9f1c2793b57 upstream.
+
+Previous commit that introduces reference counter does not add proper
+comments, which will lead to warning when building htmldocs. Fix them.
+
+Reported-by: "Stephen Rothwell" <sfr@canb.auug.org.au>
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/media/dvbdev.h | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/include/media/dvbdev.h
++++ b/include/media/dvbdev.h
+@@ -126,6 +126,7 @@ struct dvb_adapter {
+ * struct dvb_device - represents a DVB device node
+ *
+ * @list_head: List head with all DVB devices
++ * @ref: reference counter
+ * @fops: pointer to struct file_operations
+ * @adapter: pointer to the adapter that holds this device node
+ * @type: type of the device, as defined by &enum dvb_device_type.
+@@ -196,7 +197,7 @@ struct dvb_device {
+ struct dvb_device *dvb_device_get(struct dvb_device *dvbdev);
+
+ /**
+- * dvb_device_get - Decrease dvb_device reference
++ * dvb_device_put - Decrease dvb_device reference
+ *
+ * @dvbdev: pointer to struct dvb_device
+ */
--- /dev/null
+From 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 Mon Sep 17 00:00:00 2001
+From: Lin Ma <linma@zju.edu.cn>
+Date: Mon, 28 Nov 2022 16:21:59 +0000
+Subject: media: dvbdev: fix refcnt bug
+
+From: Lin Ma <linma@zju.edu.cn>
+
+commit 3a664569b71b0a52be5ffb9fb87cc4f83d29bd71 upstream.
+
+Previous commit initialize the dvbdev->ref before the template copy,
+which will overwrite the reference and cause refcnt bug.
+
+refcount_t: addition on 0; use-after-free.
+WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+Modules linked in:
+CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.0-rc6-next-20221128-syzkaller #0
+...
+RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:25
+RSP: 0000:ffffc900000678d0 EFLAGS: 00010282
+RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+RDX: ffff88813ff58000 RSI: ffffffff81660e7c RDI: fffff5200000cf0c
+RBP: ffff888022a45010 R08: 0000000000000005 R09: 0000000000000000
+R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000001
+R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001
+FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffff88823ffff000 CR3: 000000000c48e000 CR4: 00000000003506f0
+DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+Call Trace:
+ <TASK>
+ __refcount_add include/linux/refcount.h:199 [inline]
+ __refcount_inc include/linux/refcount.h:250 [inline]
+ refcount_inc include/linux/refcount.h:267 [inline]
+ kref_get include/linux/kref.h:45 [inline]
+ dvb_device_get drivers/media/dvb-core/dvbdev.c:585 [inline]
+ dvb_register_device+0xe83/0x16e0 drivers/media/dvb-core/dvbdev.c:517
+...
+
+Just place the kref_init at correct position.
+
+Reported-by: syzbot+fce48a3dd3368645bd6c@syzkaller.appspotmail.com
+Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
+Signed-off-by: Lin Ma <linma@zju.edu.cn>
+Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/media/dvb-core/dvbdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb-core/dvbdev.c
++++ b/drivers/media/dvb-core/dvbdev.c
+@@ -480,8 +480,8 @@ int dvb_register_device(struct dvb_adapt
+ return -ENOMEM;
+ }
+
+- kref_init(&dvbdev->ref);
+ memcpy(dvbdev, template, sizeof(struct dvb_device));
++ kref_init(&dvbdev->ref);
+ dvbdev->type = type;
+ dvbdev->id = id;
+ dvbdev->adapter = adap;
--- /dev/null
+From 2cb815cfc78b137ee38bcd65e7c955d6cc2cc250 Mon Sep 17 00:00:00 2001
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+Date: Wed, 14 Dec 2022 16:01:17 +0800
+Subject: net: stmmac: fix errno when create_singlethread_workqueue() fails
+
+From: Gaosheng Cui <cuigaosheng1@huawei.com>
+
+commit 2cb815cfc78b137ee38bcd65e7c955d6cc2cc250 upstream.
+
+We should set the return value to -ENOMEM explicitly when
+create_singlethread_workqueue() fails in stmmac_dvr_probe(),
+otherwise we'll lose the error value.
+
+Fixes: a137f3f27f92 ("net: stmmac: fix possible memory leak in stmmac_dvr_probe()")
+Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
+Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
+Link: https://lore.kernel.org/r/20221214080117.3514615-1-cuigaosheng1@huawei.com
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -7115,6 +7115,7 @@ int stmmac_dvr_probe(struct device *devi
+ priv->wq = create_singlethread_workqueue("stmmac_wq");
+ if (!priv->wq) {
+ dev_err(priv->device, "failed to create workqueue\n");
++ ret = -ENOMEM;
+ goto error_wq_init;
+ }
+
io_uring-improve-io_double_lock_ctx-fail-handling.patch
io_uring-net-fix-cleanup-after-recycle.patch
io_uring-protect-cq_timeouts-with-timeout_lock.patch
+io_uring-remove-iopoll-spinlock.patch
+net-stmmac-fix-errno-when-create_singlethread_workqueue-fails.patch
+media-dvbdev-fix-build-warning-due-to-comments.patch
+media-dvbdev-fix-refcnt-bug.patch
+drm-amd-display-revert-disable-drr-actions-during-state-commit.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
