--- /dev/null
+From 470516c2925493594a690bc4d05b1f4471d9f996 Mon Sep 17 00:00:00 2001
+From: "David (Ming Qiang) Wu" <David.Wu3@amd.com>
+Date: Thu, 8 Aug 2024 12:19:50 -0400
+Subject: drm/amd/amdgpu: command submission parser for JPEG
+
+From: David (Ming Qiang) Wu <David.Wu3@amd.com>
+
+commit 470516c2925493594a690bc4d05b1f4471d9f996 upstream.
+
+Add JPEG IB command parser to ensure registers
+in the command are within the JPEG IP block.
+
+Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: David (Ming Qiang) Wu <David.Wu3@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit a7f670d5d8e77b092404ca8a35bb0f8f89ed3117)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 +
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 61 ++++++++++++++++++++++++++++++-
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h | 7 +++
+ drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c | 1
+ drivers/gpu/drm/amd/amdgpu/soc15d.h | 6 +++
+ 5 files changed, 76 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c
+@@ -1057,6 +1057,9 @@ static int amdgpu_cs_patch_ibs(struct am
+ r = amdgpu_ring_parse_cs(ring, p, job, ib);
+ if (r)
+ return r;
++
++ if (ib->sa_bo)
++ ib->gpu_addr = amdgpu_sa_bo_gpu_addr(ib->sa_bo);
+ } else {
+ ib->ptr = (uint32_t *)kptr;
+ r = amdgpu_ring_patch_cs_in_place(ring, p, job, ib);
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+@@ -23,6 +23,7 @@
+
+ #include "amdgpu.h"
+ #include "amdgpu_jpeg.h"
++#include "amdgpu_cs.h"
+ #include "soc15.h"
+ #include "soc15d.h"
+ #include "jpeg_v4_0_3.h"
+@@ -773,7 +774,11 @@ void jpeg_v4_0_3_dec_ring_emit_ib(struct
+
+ amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+- amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
++
++ if (ring->funcs->parse_cs)
++ amdgpu_ring_write(ring, 0);
++ else
++ amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
+
+ amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+@@ -1063,6 +1068,7 @@ static const struct amdgpu_ring_funcs jp
+ .get_rptr = jpeg_v4_0_3_dec_ring_get_rptr,
+ .get_wptr = jpeg_v4_0_3_dec_ring_get_wptr,
+ .set_wptr = jpeg_v4_0_3_dec_ring_set_wptr,
++ .parse_cs = jpeg_v4_0_3_dec_ring_parse_cs,
+ .emit_frame_size =
+ SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
+ SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
+@@ -1227,3 +1233,56 @@ static void jpeg_v4_0_3_set_ras_funcs(st
+ {
+ adev->jpeg.ras = &jpeg_v4_0_3_ras;
+ }
++
++/**
++ * jpeg_v4_0_3_dec_ring_parse_cs - command submission parser
++ *
++ * @parser: Command submission parser context
++ * @job: the job to parse
++ * @ib: the IB to parse
++ *
++ * Parse the command stream, return -EINVAL for invalid packet,
++ * 0 otherwise
++ */
++int jpeg_v4_0_3_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
++ struct amdgpu_job *job,
++ struct amdgpu_ib *ib)
++{
++ uint32_t i, reg, res, cond, type;
++ struct amdgpu_device *adev = parser->adev;
++
++ for (i = 0; i < ib->length_dw ; i += 2) {
++ reg = CP_PACKETJ_GET_REG(ib->ptr[i]);
++ res = CP_PACKETJ_GET_RES(ib->ptr[i]);
++ cond = CP_PACKETJ_GET_COND(ib->ptr[i]);
++ type = CP_PACKETJ_GET_TYPE(ib->ptr[i]);
++
++ if (res) /* only support 0 at the moment */
++ return -EINVAL;
++
++ switch (type) {
++ case PACKETJ_TYPE0:
++ if (cond != PACKETJ_CONDITION_CHECK0 || reg < JPEG_REG_RANGE_START || reg > JPEG_REG_RANGE_END) {
++ dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
++ return -EINVAL;
++ }
++ break;
++ case PACKETJ_TYPE3:
++ if (cond != PACKETJ_CONDITION_CHECK3 || reg < JPEG_REG_RANGE_START || reg > JPEG_REG_RANGE_END) {
++ dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
++ return -EINVAL;
++ }
++ break;
++ case PACKETJ_TYPE6:
++ if (ib->ptr[i] == CP_PACKETJ_NOP)
++ continue;
++ dev_err(adev->dev, "Invalid packet [0x%08x]!\n", ib->ptr[i]);
++ return -EINVAL;
++ default:
++ dev_err(adev->dev, "Unknown packet type %d !\n", type);
++ return -EINVAL;
++ }
++ }
++
++ return 0;
++}
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.h
+@@ -46,6 +46,9 @@
+
+ #define JRBC_DEC_EXTERNAL_REG_WRITE_ADDR 0x18000
+
++#define JPEG_REG_RANGE_START 0x4000
++#define JPEG_REG_RANGE_END 0x41c2
++
+ extern const struct amdgpu_ip_block_version jpeg_v4_0_3_ip_block;
+
+ void jpeg_v4_0_3_dec_ring_emit_ib(struct amdgpu_ring *ring,
+@@ -62,5 +65,7 @@ void jpeg_v4_0_3_dec_ring_insert_end(str
+ void jpeg_v4_0_3_dec_ring_emit_wreg(struct amdgpu_ring *ring, uint32_t reg, uint32_t val);
+ void jpeg_v4_0_3_dec_ring_emit_reg_wait(struct amdgpu_ring *ring, uint32_t reg,
+ uint32_t val, uint32_t mask);
+-
++int jpeg_v4_0_3_dec_ring_parse_cs(struct amdgpu_cs_parser *parser,
++ struct amdgpu_job *job,
++ struct amdgpu_ib *ib);
+ #endif /* __JPEG_V4_0_3_H__ */
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v5_0_0.c
+@@ -523,6 +523,7 @@ static const struct amdgpu_ring_funcs jp
+ .get_rptr = jpeg_v5_0_0_dec_ring_get_rptr,
+ .get_wptr = jpeg_v5_0_0_dec_ring_get_wptr,
+ .set_wptr = jpeg_v5_0_0_dec_ring_set_wptr,
++ .parse_cs = jpeg_v4_0_3_dec_ring_parse_cs,
+ .emit_frame_size =
+ SOC15_FLUSH_GPU_TLB_NUM_WREG * 6 +
+ SOC15_FLUSH_GPU_TLB_NUM_REG_WAIT * 8 +
+--- a/drivers/gpu/drm/amd/amdgpu/soc15d.h
++++ b/drivers/gpu/drm/amd/amdgpu/soc15d.h
+@@ -76,6 +76,12 @@
+ ((cond & 0xF) << 24) | \
+ ((type & 0xF) << 28))
+
++#define CP_PACKETJ_NOP 0x60000000
++#define CP_PACKETJ_GET_REG(x) ((x) & 0x3FFFF)
++#define CP_PACKETJ_GET_RES(x) (((x) >> 18) & 0x3F)
++#define CP_PACKETJ_GET_COND(x) (((x) >> 24) & 0xF)
++#define CP_PACKETJ_GET_TYPE(x) (((x) >> 28) & 0xF)
++
+ /* Packet 3 types */
+ #define PACKET3_NOP 0x10
+ #define PACKET3_SET_BASE 0x11
--- /dev/null
+From 56fb276d0244d430496f249335a44ae114dd5f54 Mon Sep 17 00:00:00 2001
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Date: Thu, 1 Aug 2024 16:16:35 -0600
+Subject: drm/amd/display: Adjust cursor position
+
+From: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+
+commit 56fb276d0244d430496f249335a44ae114dd5f54 upstream.
+
+[why & how]
+When the commit 9d84c7ef8a87 ("drm/amd/display: Correct cursor position
+on horizontal mirror") was introduced, it used the wrong calculation for
+the position copy for X. This commit uses the correct calculation for that
+based on the original patch.
+
+Fixes: 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror")
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Acked-by: Wayne Lin <wayne.lin@amd.com>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8f9b23abbae5ffcd64856facd26a86b67195bc2f)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+@@ -3698,7 +3698,7 @@ void dcn10_set_cursor_position(struct pi
+ (int)hubp->curs_attr.width || pos_cpy.x
+ <= (int)hubp->curs_attr.width +
+ pipe_ctx->plane_state->src_rect.x) {
+- pos_cpy.x = 2 * viewport_width - temp_x;
++ pos_cpy.x = temp_x + viewport_width;
+ }
+ }
+ } else {
--- /dev/null
+From 0dbb81d44108a2a1004e5b485ef3fca5bc078424 Mon Sep 17 00:00:00 2001
+From: Loan Chen <lo-an.chen@amd.com>
+Date: Fri, 2 Aug 2024 13:57:40 +0800
+Subject: drm/amd/display: Enable otg synchronization logic for DCN321
+
+From: Loan Chen <lo-an.chen@amd.com>
+
+commit 0dbb81d44108a2a1004e5b485ef3fca5bc078424 upstream.
+
+[Why]
+Tiled display cannot synchronize properly after S3.
+The fix for commit 5f0c74915815 ("drm/amd/display: Fix for otg
+synchronization logic") is not enable in DCN321, which causes
+the otg is excluded from synchronization.
+
+[How]
+Enable otg synchronization logic in dcn321.
+
+Fixes: 5f0c74915815 ("drm/amd/display: Fix for otg synchronization logic")
+Cc: Mario Limonciello <mario.limonciello@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Reviewed-by: Alvin Lee <alvin.lee2@amd.com>
+Signed-off-by: Loan Chen <lo-an.chen@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit d6ed53712f583423db61fbb802606759e023bf7b)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
++++ b/drivers/gpu/drm/amd/display/dc/resource/dcn321/dcn321_resource.c
+@@ -1778,6 +1778,9 @@ static bool dcn321_resource_construct(
+ dc->caps.color.mpc.ogam_rom_caps.hlg = 0;
+ dc->caps.color.mpc.ocsc = 1;
+
++ /* Use pipe context based otg sync logic */
++ dc->config.use_pipe_ctx_sync_logic = true;
++
+ dc->config.dc_mode_clk_limit_support = true;
+ dc->config.enable_windowed_mpo_odm = true;
+ /* read VBIOS LTTPR caps */
--- /dev/null
+From 737222cebecbdbcdde2b69475c52bcb9ecfeb830 Mon Sep 17 00:00:00 2001
+From: Melissa Wen <mwen@igalia.com>
+Date: Tue, 31 Jan 2023 15:05:46 -0100
+Subject: drm/amd/display: fix cursor offset on rotation 180
+
+From: Melissa Wen <mwen@igalia.com>
+
+commit 737222cebecbdbcdde2b69475c52bcb9ecfeb830 upstream.
+
+[why & how]
+Cursor gets clipped off in the middle of the screen with hw
+rotation 180. Fix a miscalculation of cursor offset when it's
+placed near the edges in the pipe split case.
+
+Cursor bugs with hw rotation were reported on AMD issue
+tracker:
+https://gitlab.freedesktop.org/drm/amd/-/issues/2247
+
+The issues on rotation 270 was fixed by:
+https://lore.kernel.org/amd-gfx/20221118125935.4013669-22-Brian.Chang@amd.com/
+that partially addressed the rotation 180 too. So, this patch is the
+final bits for rotation 180.
+
+Reported-by: Xaver Hugl <xaver.hugl@gmail.com>
+Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2247
+Reviewed-by: Harry Wentland <harry.wentland@amd.com>
+Fixes: 9d84c7ef8a87 ("drm/amd/display: Correct cursor position on horizontal mirror")
+Signed-off-by: Melissa Wen <mwen@igalia.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Tom Chung <chiahsuan.chung@amd.com>
+Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 1fd2cf090096af8a25bf85564341cfc21cec659d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
++++ b/drivers/gpu/drm/amd/display/dc/hwss/dcn10/dcn10_hwseq.c
+@@ -3605,7 +3605,7 @@ void dcn10_set_cursor_position(struct pi
+ (int)hubp->curs_attr.width || pos_cpy.x
+ <= (int)hubp->curs_attr.width +
+ pipe_ctx->plane_state->src_rect.x) {
+- pos_cpy.x = temp_x + viewport_width;
++ pos_cpy.x = 2 * viewport_width - temp_x;
+ }
+ }
+ } else {
--- /dev/null
+From f6098641d3e1e4d4052ff9378857c831f9675f6b Mon Sep 17 00:00:00 2001
+From: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Date: Tue, 6 Aug 2024 09:55:55 -0400
+Subject: drm/amd/display: fix s2idle entry for DCN3.5+
+
+From: Hamza Mahfooz <hamza.mahfooz@amd.com>
+
+commit f6098641d3e1e4d4052ff9378857c831f9675f6b upstream.
+
+To be able to get to the lowest power state when suspending systems with
+DCN3.5+, we must be in IPS before the display hardware is put into
+D3cold. So, to ensure that the system always reaches the lowest power
+state while suspending, force systems that support IPS to enter idle
+optimizations before entering D3cold.
+
+Reviewed-by: Roman Li <roman.li@amd.com>
+Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 237193e21b29d4aa0617ffeea3d6f49e72999708)
+Cc: stable@vger.kernel.org # 6.10+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+@@ -2724,6 +2724,9 @@ static int dm_suspend(void *handle)
+
+ hpd_rx_irq_work_suspend(dm);
+
++ if (adev->dm.dc->caps.ips_support)
++ dc_allow_idle_optimizations(adev->dm.dc, true);
++
+ dc_set_power_state(dm->dc, DC_ACPI_CM_POWER_STATE_D3);
+ dc_dmub_srv_set_power_state(dm->dc->ctx->dmub_srv, DC_ACPI_CM_POWER_STATE_D3);
+
--- /dev/null
+From e414a304f2c5368a84f03ad34d29b89f965a33c9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 12 Jul 2024 10:00:33 -0400
+Subject: drm/amdgpu/jpeg2: properly set atomics vmid field
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e414a304f2c5368a84f03ad34d29b89f965a33c9 upstream.
+
+This needs to be set as well if the IB uses atomics.
+
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 35c628774e50b3784c59e8ca7973f03bcb067132)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_0.c
+@@ -543,11 +543,11 @@ void jpeg_v2_0_dec_ring_emit_ib(struct a
+
+ amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+- amdgpu_ring_write(ring, (vmid | (vmid << 4)));
++ amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
+
+ amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+- amdgpu_ring_write(ring, (vmid | (vmid << 4)));
++ amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
+
+ amdgpu_ring_write(ring, PACKETJ(mmUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
--- /dev/null
+From e6c6bd6253e792cee6c5c065e106e87b9f0d9ae9 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Fri, 12 Jul 2024 10:06:05 -0400
+Subject: drm/amdgpu/jpeg4: properly set atomics vmid field
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit e6c6bd6253e792cee6c5c065e106e87b9f0d9ae9 upstream.
+
+This needs to be set as well if the IB uses atomics.
+
+Reviewed-by: Leo Liu <leo.liu@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c6c2e8b6a427d4fecc7c36cffccb908185afcab2)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v4_0_3.c
+@@ -773,11 +773,11 @@ void jpeg_v4_0_3_dec_ring_emit_ib(struct
+
+ amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JRBC_IB_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+- amdgpu_ring_write(ring, (vmid | (vmid << 4)));
++ amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
+
+ amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JPEG_VMID_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
+- amdgpu_ring_write(ring, (vmid | (vmid << 4)));
++ amdgpu_ring_write(ring, (vmid | (vmid << 4) | (vmid << 8)));
+
+ amdgpu_ring_write(ring, PACKETJ(regUVD_LMI_JRBC_IB_64BIT_BAR_LOW_INTERNAL_OFFSET,
+ 0, 0, PACKETJ_TYPE0));
--- /dev/null
+From 3b5bbe798b2451820e74243b738268f51901e7d0 Mon Sep 17 00:00:00 2001
+From: Christian Brauner <brauner@kernel.org>
+Date: Wed, 31 Jul 2024 12:01:12 +0200
+Subject: pidfd: prevent creation of pidfds for kthreads
+
+From: Christian Brauner <brauner@kernel.org>
+
+commit 3b5bbe798b2451820e74243b738268f51901e7d0 upstream.
+
+It's currently possible to create pidfds for kthreads but it is unclear
+what that is supposed to mean. Until we have use-cases for it and we
+figured out what behavior we want block the creation of pidfds for
+kthreads.
+
+Link: https://lore.kernel.org/r/20240731-gleis-mehreinnahmen-6bbadd128383@brauner
+Fixes: 32fcb426ec00 ("pid: add pidfd_open()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/fork.c | 25 ++++++++++++++++++++++---
+ 1 file changed, 22 insertions(+), 3 deletions(-)
+
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -2069,11 +2069,24 @@ static int __pidfd_prepare(struct pid *p
+ */
+ int pidfd_prepare(struct pid *pid, unsigned int flags, struct file **ret)
+ {
+- bool thread = flags & PIDFD_THREAD;
+-
+- if (!pid || !pid_has_task(pid, thread ? PIDTYPE_PID : PIDTYPE_TGID))
++ if (!pid)
+ return -EINVAL;
+
++ scoped_guard(rcu) {
++ struct task_struct *tsk;
++
++ if (flags & PIDFD_THREAD)
++ tsk = pid_task(pid, PIDTYPE_PID);
++ else
++ tsk = pid_task(pid, PIDTYPE_TGID);
++ if (!tsk)
++ return -EINVAL;
++
++ /* Don't create pidfds for kernel threads for now. */
++ if (tsk->flags & PF_KTHREAD)
++ return -EINVAL;
++ }
++
+ return __pidfd_prepare(pid, flags, ret);
+ }
+
+@@ -2419,6 +2432,12 @@ __latent_entropy struct task_struct *cop
+ if (clone_flags & CLONE_PIDFD) {
+ int flags = (clone_flags & CLONE_THREAD) ? PIDFD_THREAD : 0;
+
++ /* Don't create pidfds for kernel threads for now. */
++ if (args->kthread) {
++ retval = -EINVAL;
++ goto bad_fork_free_pid;
++ }
++
+ /* Note that no task has been attached to @pid yet. */
+ retval = __pidfd_prepare(pid, flags, &pidfile);
+ if (retval < 0)
btrfs-only-enable-extent-map-shrinker-for-debug-builds.patch
drm-amdgpu-actually-check-flags-for-all-context-ops.patch
memcg_write_event_control-fix-a-user-triggerable-oops.patch
+drm-amd-display-adjust-cursor-position.patch
+drm-amd-display-fix-s2idle-entry-for-dcn3.5.patch
+drm-amd-display-enable-otg-synchronization-logic-for-dcn321.patch
+drm-amd-display-fix-cursor-offset-on-rotation-180.patch
+drm-amdgpu-jpeg2-properly-set-atomics-vmid-field.patch
+drm-amdgpu-jpeg4-properly-set-atomics-vmid-field.patch
+drm-amd-amdgpu-command-submission-parser-for-jpeg.patch
+pidfd-prevent-creation-of-pidfds-for-kthreads.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
