6.9-stable patches

added patches:
	drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
	drm-xe-bb-assert-width-in-xe_bb_create_job.patch

diff --git a/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch b/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
new file mode 100644 (file)
index 0000000..125aa7f
--- /dev/null
+++ b/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
@@ -0,0 +1,36 @@
+From 8b2faf1a4f3b6c748c0da36cda865a226534d520 Mon Sep 17 00:00:00 2001
+From: Bob Zhou <bob.zhou@amd.com>
+Date: Tue, 23 Apr 2024 16:58:11 +0800
+Subject: drm/amdgpu: add error handle to avoid out-of-bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bob Zhou <bob.zhou@amd.com>
+
+commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream.
+
+if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should
+be stop to avoid out-of-bounds read, so directly return -EINVAL.
+
+Signed-off-by: Bob Zhou <bob.zhou@amd.com>
+Acked-by: Christian König <christian.koenig@amd.com>
+Reviewed-by: Le Ma <le.ma@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c
+@@ -2021,6 +2021,9 @@ static int sdma_v4_0_process_trap_irq(st
+ 
+       DRM_DEBUG("IH: SDMA trap\n");
+       instance = sdma_v4_0_irq_id_to_seq(entry->client_id);
++      if (instance < 0)
++              return instance;
++
+       switch (entry->ring_id) {
+       case 0:
+               amdgpu_fence_process(&adev->sdma.instance[instance].ring);

diff --git a/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch b/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch
new file mode 100644 (file)
index 0000000..ca5e21e
--- /dev/null
+++ b/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch
@@ -0,0 +1,36 @@
+From 1008368e1c7e36bdec01b3cce1e76606dc3ad46f Mon Sep 17 00:00:00 2001
+From: Matthew Auld <matthew.auld@intel.com>
+Date: Wed, 20 Mar 2024 11:27:31 +0000
+Subject: drm/xe/bb: assert width in xe_bb_create_job()
+
+From: Matthew Auld <matthew.auld@intel.com>
+
+commit 1008368e1c7e36bdec01b3cce1e76606dc3ad46f upstream.
+
+The queue width will determine the number of batch buffer emitted into
+the ring. In the case of xe_bb_create_job() we pass exactly one batch
+address, therefore add an assert for the width to make sure we don't go
+out of bounds. While here also convert to the helper to determine if the
+queue is migration based.
+
+Signed-off-by: Matthew Auld <matthew.auld@intel.com>
+Cc: Nirmoy Das <nirmoy.das@intel.com>
+Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240320112730.219854-3-matthew.auld@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/xe/xe_bb.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/xe/xe_bb.c
++++ b/drivers/gpu/drm/xe/xe_bb.c
+@@ -96,7 +96,8 @@ struct xe_sched_job *xe_bb_create_job(st
+ {
+       u64 addr = xe_sa_bo_gpu_addr(bb->bo);
+ 
+-      xe_gt_assert(q->gt, !(q->vm && q->vm->flags & XE_VM_FLAG_MIGRATION));
++      xe_gt_assert(q->gt, !xe_sched_job_is_migration(q));
++      xe_gt_assert(q->gt, q->width == 1);
+       return __xe_bb_create_job(q, bb, &addr);
+ }
+ 

diff --git a/queue-6.9/series b/queue-6.9/series
index 6ea20228e577057a193a2cc9cb5f3c0966ecc470..577522ee5841f9d9e0112b3b9a34258e76743d31 100644 (file)
--- a/queue-6.9/series
+++ b/queue-6.9/series
@@ -6,3 +6,5 @@ x86-topology-amd-evaluate-smt-in-cpuid-leaf-0x8000001e-only-on-family-0x17-and-g
 vxlan-fix-regression-when-dropping-packets-due-to-invalid-src-addresses.patch
 f2fs-fix-to-do-sanity-check-on-i_xattr_nid-in-sanity_check_inode.patch
 media-lgdt3306a-add-a-check-against-null-pointer-def.patch
+drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch
+drm-xe-bb-assert-width-in-xe_bb_create_job.patch