From: Greg Kroah-Hartman Date: Mon, 31 Oct 2022 06:39:22 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.263~56 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=45f74ade805466affca0469d16af2210d3b1ea59;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-msm-dp-fix-irq-lifetime.patch drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch --- diff --git a/queue-5.10/drm-msm-dp-fix-irq-lifetime.patch b/queue-5.10/drm-msm-dp-fix-irq-lifetime.patch new file mode 100644 index 00000000000..3a58f4d908e --- /dev/null +++ b/queue-5.10/drm-msm-dp-fix-irq-lifetime.patch @@ -0,0 +1,49 @@ +From a79343dcaba4b11adb57350e0b6426906a9b658e Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:15 +0200 +Subject: drm/msm/dp: fix IRQ lifetime + +From: Johan Hovold + +commit a79343dcaba4b11adb57350e0b6426906a9b658e upstream. + +Device-managed resources allocated post component bind must be tied to +the lifetime of the aggregate DRM device or they will not necessarily be +released when binding of the aggregate device is deferred. + +This is specifically true for the DP IRQ, which will otherwise remain +requested so that the next bind attempt fails when requesting the IRQ a +second time. + +Since commit c3bf8e21b38a ("drm/msm/dp: Add eDP support via aux_bus") +this can happen when the aux-bus panel driver has not yet been loaded so +that probe is deferred. + +Fix this by tying the device-managed lifetime of the DP IRQ to the DRM +device so that it is released when bind fails. + +Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support") +Cc: stable@vger.kernel.org # 5.10 +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Patchwork: https://patchwork.freedesktop.org/patch/502679/ +Link: https://lore.kernel.org/r/20220913085320.8577-6-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dp/dp_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1201,7 +1201,7 @@ int dp_display_request_irq(struct msm_dp + return -EINVAL; + } + +- rc = devm_request_irq(&dp->pdev->dev, dp->irq, ++ rc = devm_request_irq(dp_display->drm_dev->dev, dp->irq, + dp_display_irq_handler, + IRQF_TRIGGER_HIGH, "dp_display_isr", dp); + if (rc < 0) { diff --git a/queue-5.10/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.10/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..28eabd0e98c --- /dev/null +++ b/queue-5.10/drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,42 @@ +From 2e786eb2f9cebb07e317226b60054df510b60c65 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:13 +0200 +Subject: drm/msm/dsi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 2e786eb2f9cebb07e317226b60054df510b60c65 upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support") +Cc: stable@vger.kernel.org # 4.1 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502668/ +Link: https://lore.kernel.org/r/20220913085320.8577-4-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/dsi/dsi.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +--- a/drivers/gpu/drm/msm/dsi/dsi.c ++++ b/drivers/gpu/drm/msm/dsi/dsi.c +@@ -205,6 +205,12 @@ int msm_dsi_modeset_init(struct msm_dsi + return -EINVAL; + + priv = dev->dev_private; ++ ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + msm_dsi->dev = dev; + + ret = msm_dsi_host_modeset_init(msm_dsi->host, dev); diff --git a/queue-5.10/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch b/queue-5.10/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch new file mode 100644 index 00000000000..d89d8b5e1c5 --- /dev/null +++ b/queue-5.10/drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch @@ -0,0 +1,41 @@ +From 4c1294da6aed1f16d47a417dcfe6602833c3c95c Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 13 Sep 2022 10:53:14 +0200 +Subject: drm/msm/hdmi: fix memory corruption with too many bridges + +From: Johan Hovold + +commit 4c1294da6aed1f16d47a417dcfe6602833c3c95c upstream. + +Add the missing sanity check on the bridge counter to avoid corrupting +data beyond the fixed-sized bridge array in case there are ever more +than eight bridges. + +Fixes: a3376e3ec81c ("drm/msm: convert to drm_bridge") +Cc: stable@vger.kernel.org # 3.12 +Signed-off-by: Johan Hovold +Tested-by: Kuogee Hsieh +Reviewed-by: Kuogee Hsieh +Reviewed-by: Dmitry Baryshkov +Patchwork: https://patchwork.freedesktop.org/patch/502670/ +Link: https://lore.kernel.org/r/20220913085320.8577-5-johan+linaro@kernel.org +Signed-off-by: Abhinav Kumar +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/msm/hdmi/hdmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/gpu/drm/msm/hdmi/hdmi.c ++++ b/drivers/gpu/drm/msm/hdmi/hdmi.c +@@ -293,6 +293,11 @@ int msm_hdmi_modeset_init(struct hdmi *h + struct platform_device *pdev = hdmi->pdev; + int ret; + ++ if (priv->num_bridges == ARRAY_SIZE(priv->bridges)) { ++ DRM_DEV_ERROR(dev->dev, "too many bridges\n"); ++ return -ENOSPC; ++ } ++ + hdmi->dev = dev; + hdmi->encoder = encoder; + diff --git a/queue-5.10/series b/queue-5.10/series index cce8dc910d3..2e030164fc3 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -19,3 +19,6 @@ fs-binfmt_elf-fix-memory-leak-in-load_elf_binary.patch exec-copy-oldsighand-action-under-spin-lock.patch mac802154-fix-lqi-recording.patch scsi-qla2xxx-use-transport-defined-speed-mask-for-supported_speeds.patch +drm-msm-dsi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-hdmi-fix-memory-corruption-with-too-many-bridges.patch +drm-msm-dp-fix-irq-lifetime.patch