From: Greg Kroah-Hartman Date: Tue, 29 Mar 2022 11:24:04 +0000 (+0200) Subject: 5.16-stable patches X-Git-Tag: v4.14.275~67 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5632f546cf34052a5d9c5c93ae3106d730c6678b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch drm-amdgpu-only-check-for-_pr3-on-dgpus.patch locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch --- diff --git a/queue-5.16/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch b/queue-5.16/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch new file mode 100644 index 00000000000..462a60881a7 --- /dev/null +++ b/queue-5.16/drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch @@ -0,0 +1,81 @@ +From 901e2be20dc55079997ea1885ea77fc72e6826e7 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 24 Jan 2022 13:42:30 -0500 +Subject: drm/amdgpu: move PX checking into amdgpu_device_ip_early_init + +From: Alex Deucher + +commit 901e2be20dc55079997ea1885ea77fc72e6826e7 upstream. + +We need to set the APU flag from IP discovery before +we evaluate this code. + +Acked-by: Evan Quan +Signed-off-by: Alex Deucher +Signed-off-by: Mario Limonciello +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 13 +++++++++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 11 ----------- + 2 files changed, 13 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -2070,6 +2071,8 @@ out: + */ + static int amdgpu_device_ip_early_init(struct amdgpu_device *adev) + { ++ struct drm_device *dev = adev_to_drm(adev); ++ struct pci_dev *parent; + int i, r; + + amdgpu_device_enable_virtual_display(adev); +@@ -2134,6 +2137,16 @@ static int amdgpu_device_ip_early_init(s + break; + } + ++ if (amdgpu_has_atpx() && ++ (amdgpu_is_atpx_hybrid() || ++ amdgpu_has_atpx_dgpu_power_cntl()) && ++ ((adev->flags & AMD_IS_APU) == 0) && ++ !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) ++ adev->flags |= AMD_IS_PX; ++ ++ parent = pci_upstream_bridge(adev->pdev); ++ adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ + amdgpu_amdkfd_device_probe(adev); + + adev->pm.pp_feature = amdgpu_pp_feature_mask; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c +@@ -152,21 +152,10 @@ static void amdgpu_get_audio_func(struct + int amdgpu_driver_load_kms(struct amdgpu_device *adev, unsigned long flags) + { + struct drm_device *dev; +- struct pci_dev *parent; + int r, acpi_status; + + dev = adev_to_drm(adev); + +- if (amdgpu_has_atpx() && +- (amdgpu_is_atpx_hybrid() || +- amdgpu_has_atpx_dgpu_power_cntl()) && +- ((flags & AMD_IS_APU) == 0) && +- !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) +- flags |= AMD_IS_PX; +- +- parent = pci_upstream_bridge(adev->pdev); +- adev->has_pr3 = parent ? pci_pr3_present(parent) : false; +- + /* amdgpu_device_init should report only fatal error + * like memory allocation failure or iomapping failure, + * or memory manager initialization failure, it must diff --git a/queue-5.16/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch b/queue-5.16/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch new file mode 100644 index 00000000000..0ddc9a26ead --- /dev/null +++ b/queue-5.16/drm-amdgpu-only-check-for-_pr3-on-dgpus.patch @@ -0,0 +1,35 @@ +From 85ac2021fe3ace59cc0afd6edf005abad35625b0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 25 Jan 2022 15:04:54 -0500 +Subject: drm/amdgpu: only check for _PR3 on dGPUs + +From: Alex Deucher + +commit 85ac2021fe3ace59cc0afd6edf005abad35625b0 upstream. + +We don't support runtime pm on APUs. They support more +dynamic power savings using clock and powergating. + +Reviewed-by: Mario Limonciello +Tested-by: Mario Limonciello +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2144,8 +2144,10 @@ static int amdgpu_device_ip_early_init(s + !pci_is_thunderbolt_attached(to_pci_dev(dev->dev))) + adev->flags |= AMD_IS_PX; + +- parent = pci_upstream_bridge(adev->pdev); +- adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ if (!(adev->flags & AMD_IS_APU)) { ++ parent = pci_upstream_bridge(adev->pdev); ++ adev->has_pr3 = parent ? pci_pr3_present(parent) : false; ++ } + + amdgpu_amdkfd_device_probe(adev); + diff --git a/queue-5.16/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch b/queue-5.16/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch new file mode 100644 index 00000000000..d69813921f4 --- /dev/null +++ b/queue-5.16/locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch @@ -0,0 +1,87 @@ +From 61cc4534b6550997c97a03759ab46b29d44c0017 Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Sun, 2 Jan 2022 21:35:58 -0500 +Subject: locking/lockdep: Avoid potential access of invalid memory in lock_class + +From: Waiman Long + +commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream. + +It was found that reading /proc/lockdep after a lockdep splat may +potentially cause an access to freed memory if lockdep_unregister_key() +is called after the splat but before access to /proc/lockdep [1]. This +is due to the fact that graph_lock() call in lockdep_unregister_key() +fails after the clearing of debug_locks by the splat process. + +After lockdep_unregister_key() is called, the lock_name may be freed +but the corresponding lock_class structure still have a reference to +it. That invalid memory pointer will then be accessed when /proc/lockdep +is read by a user and a use-after-free (UAF) error will be reported if +KASAN is enabled. + +To fix this problem, lockdep_unregister_key() is now modified to always +search for a matching key irrespective of the debug_locks state and +zap the corresponding lock class if a matching one is found. + +[1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-love.sakura.ne.jp/ + +Fixes: 8b39adbee805 ("locking/lockdep: Make lockdep_unregister_key() honor 'debug_locks' again") +Reported-by: Tetsuo Handa +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Bart Van Assche +Cc: Cheng-Jui Wang +Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com +Signed-off-by: Greg Kroah-Hartman +--- + kernel/locking/lockdep.c | 24 +++++++++++++++--------- + 1 file changed, 15 insertions(+), 9 deletions(-) + +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -6288,7 +6288,13 @@ void lockdep_reset_lock(struct lockdep_m + lockdep_reset_lock_reg(lock); + } + +-/* Unregister a dynamically allocated key. */ ++/* ++ * Unregister a dynamically allocated key. ++ * ++ * Unlike lockdep_register_key(), a search is always done to find a matching ++ * key irrespective of debug_locks to avoid potential invalid access to freed ++ * memory in lock_class entry. ++ */ + void lockdep_unregister_key(struct lock_class_key *key) + { + struct hlist_head *hash_head = keyhashentry(key); +@@ -6303,10 +6309,8 @@ void lockdep_unregister_key(struct lock_ + return; + + raw_local_irq_save(flags); +- if (!graph_lock()) +- goto out_irq; ++ lockdep_lock(); + +- pf = get_pending_free(); + hlist_for_each_entry_rcu(k, hash_head, hash_entry) { + if (k == key) { + hlist_del_rcu(&k->hash_entry); +@@ -6314,11 +6318,13 @@ void lockdep_unregister_key(struct lock_ + break; + } + } +- WARN_ON_ONCE(!found); +- __lockdep_free_key_range(pf, key, 1); +- call_rcu_zapped(pf); +- graph_unlock(); +-out_irq: ++ WARN_ON_ONCE(!found && debug_locks); ++ if (found) { ++ pf = get_pending_free(); ++ __lockdep_free_key_range(pf, key, 1); ++ call_rcu_zapped(pf); ++ } ++ lockdep_unlock(); + raw_local_irq_restore(flags); + + /* Wait until is_dynamic_key() has finished accessing k->hash_entry. */ diff --git a/queue-5.16/series b/queue-5.16/series index 6277e9f6875..3afcc1a1c0d 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -23,3 +23,6 @@ af_key-add-__gfp_zero-flag-for-compose_sadb_supporte.patch net-dsa-microchip-add-spi_device_id-tables.patch scsi-fnic-finish-scsi_cmnd-before-dropping-the-spinl.patch selftests-vm-fix-clang-build-error-multiple-output-f.patch +locking-lockdep-avoid-potential-access-of-invalid-memory-in-lock_class.patch +drm-amdgpu-move-px-checking-into-amdgpu_device_ip_early_init.patch +drm-amdgpu-only-check-for-_pr3-on-dgpus.patch