From: Greg Kroah-Hartman Date: Tue, 29 Mar 2022 11:24:10 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v4.14.275~66 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=11e458e7d8708ec6581de94da188378bef7b05fd;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch drm-amdgpu-only-check-for-_pr3-on-dgpus.patch locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch --- diff --git a/queue-5.17/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch b/queue-5.17/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch new file mode 100644 index 00000000000..26649da2205 --- /dev/null +++ b/queue-5.17/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch @@ -0,0 +1,81 @@ +From 901e2be20dc55079997ea1885ea77fc72e6826e7 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 24 Jan 2022 13:42:30 -0500 +Subject: drm/amdgpu: move PX checking into amdgpu_device_ip_early_init + +From: Alex Deucher + +commit 901e2be20dc55079997ea1885ea77fc72e6826e7 upstream. + +We need to set the APU flag from IP discovery before +we evaluate this code. + +Acked-by: Evan Quan +Signed-off-by: Alex Deucher +Cc: Mario Limonciello +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 +++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 ----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -2073,6 +2074,8 @@ out: + */ + static int amdgpu_device_ip_early_init(struct amdgpu_device *adev) + { ++ struct drm_device *dev = adev_to_drm(adev); ++ struct pci_dev *parent; + int i, r; + + amdgpu_device_enable_virtual_display(adev); +@@ -2137,6 +2140,16 @@ static int amdgpu_device_ip_early_init(s + break; + } + ++ if (amdgpu_has_atpx() && ++ (amdgpu_is_atpx_hybrid() || ++ amdgpu_has_atpx_dgpu_power_cntl()) && ++ ((adev->flags & AMD_IS_APU) == 0) && ++ !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) ++ adev->flags |= AMD_IS_PX; ++ ++ parent = pci_upstream_bridge(adev->pdev); ++ adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ + amdgpu_amdkfd_device_probe(adev); + + adev->pm.pp_feature = amdgpu_pp_feature_mask; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -152,21 +152,10 @@ static void amdgpu_get_audio_func(struct + int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags) + { + struct drm_device *dev; +- struct pci_dev *parent; + int r, acpi_status; + + dev = adev_to_drm(adev); + +- if (amdgpu_has_atpx() && +- (amdgpu_is_atpx_hybrid() || +- amdgpu_has_atpx_dgpu_power_cntl()) && +- ((flags & AMD_IS_APU) == 0) && +- !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) +- flags |= AMD_IS_PX; +- +- parent = pci_upstream_bridge(adev->pdev); +- adev->has_pr3 = parent ? pci_pr3_present(parent) : false; +- + /* amdgpu_device_init should report only fatal error + * like memory allocation failure or iomapping failure, + * or memory manager initialization failure, it must diff --git a/queue-5.17/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch b/queue-5.17/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch new file mode 100644 index 00000000000..cad4301a40f --- /dev/null +++ b/queue-5.17/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch @@ -0,0 +1,35 @@ +From 85ac2021fe3ace59cc0afd6edf005abad35625b0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 25 Jan 2022 15:04:54 -0500 +Subject: drm/amdgpu: only check for _PR3 on dGPUs + +From: Alex Deucher + +commit 85ac2021fe3ace59cc0afd6edf005abad35625b0 upstream. + +We don't support runtime pm on APUs. They support more +dynamic power savings using clock and powergating. + +Reviewed-by: Mario Limonciello +Tested-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2147,8 +2147,10 @@ static int amdgpu_device_ip_early_init(s + !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) + adev->flags |= AMD_IS_PX; + +- parent = pci_upstream_bridge(adev->pdev); +- adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ if (!(adev->flags & AMD_IS_APU)) { ++ parent = pci_upstream_bridge(adev->pdev); ++ adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ } + + amdgpu_amdkfd_device_probe(adev); + diff --git a/queue-5.17/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch b/queue-5.17/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch new file mode 100644 index 00000000000..034e133d6b1 --- /dev/null +++ b/queue-5.17/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch @@ -0,0 +1,87 @@ +From 61cc4534b6550997c97a03759ab46b29d44c0017 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Sun, 2 Jan 2022 21:35:58 -0500 +Subject: locking/lockdep: Avoid potential access of invalid memory in lock_class + +From: Waiman Long + +commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream. + +It was found that reading /proc/lockdep after a lockdep splat may +potentially cause an access to freed memory if lockdep_unregister_key() +is called after the splat but before access to /proc/lockdep [1]. This +is due to the fact that graph_lock() call in lockdep_unregister_key() +fails after the clearing of debug_locks by the splat process. + +After lockdep_unregister_key() is called, the lock_name may be freed +but the corresponding lock_class structure still have a reference to +it. That invalid memory pointer will then be accessed when /proc/lockdep +is read by a user and a use-after-free (UAF) error will be reported if +KASAN is enabled. + +To fix this problem, lockdep_unregister_key() is now modified to always +search for a matching key irrespective of the debug_locks state and +zap the corresponding lock class if a matching one is found. + +[1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/ + +Fixes: 8b39adbee805 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again") +Reported-by: Tetsuo Handa +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Bart Van Assche +Cc: Cheng-Jui Wang +Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -6290,7 +6290,13 @@ void lockdep_reset_lock(struct lockdep_m + lockdep_reset_lock_reg(lock); + } + +-/* Unregister a dynamically allocated key. */ ++/* ++ * Unregister a dynamically allocated key. ++ * ++ * Unlike lockdep_register_key(), a search is always done to find a matching ++ * key irrespective of debug_locks to avoid potential invalid access to freed ++ * memory in lock_class entry. ++ */ + void lockdep_unregister_key(struct lock_class_key *key) + { + struct hlist_head *hash_head = keyhashentry(key); +@@ -6305,10 +6311,8 @@ void lockdep_unregister_key(struct lock_ + return; + + raw_local_irq_save(flags); +- if (!graph_lock()) +- goto out_irq; ++ lockdep_lock(); + +- pf = get_pending_free(); + hlist_for_each_entry_rcu(k, hash_head, hash_entry) { + if (k == key) { + hlist_del_rcu(&k->hash_entry); +@@ -6316,11 +6320,13 @@ void lockdep_unregister_key(struct lock_ + break; + } + } +- WARN_ON_ONCE(!found); +- __lockdep_free_key_range(pf, key, 1); +- call_rcu_zapped(pf); +- graph_unlock(); +-out_irq: ++ WARN_ON_ONCE(!found && debug_locks); ++ if (found) { ++ pf = get_pending_free(); ++ __lockdep_free_key_range(pf, key, 1); ++ call_rcu_zapped(pf); ++ } ++ lockdep_unlock(); + raw_local_irq_restore(flags); + + /* Wait until is_dynamic_key() has finished accessing k->hash_entry. */ diff --git a/queue-5.17/series b/queue-5.17/series index a95cefa557e..1af68a5608f 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -4,3 +4,6 @@ dt-bindings-usb-hcd-correct-usb-device-path.patch usb-serial-pl2303-fix-gs-type-detection.patch usb-serial-simple-add-nokia-phone-driver.patch mm-kfence-fix-missing-objcg-housekeeping-for-slab.patch +locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch +drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch +drm-amdgpu-only-check-for-_pr3-on-dgpus.patch