From: Greg Kroah-Hartman Date: Sat, 9 Jul 2022 08:29:25 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v4.9.323~44 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5f45e66c8784037ecfe5b56b238e36b6435620de;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: fbcon-disallow-setting-font-bigger-than-screen-size.patch fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch fbdev-fbmem-fix-logo-center-image-dx-issue.patch fbmem-check-virtual-screen-sizes-in-fb_set_var.patch iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch memregion-fix-memregion_free-fallback-definition.patch pm-runtime-redefine-pm_runtime_release_supplier.patch video-of_display_timing.h-include-errno.h.patch --- diff --git a/queue-5.15/fbcon-disallow-setting-font-bigger-than-screen-size.patch b/queue-5.15/fbcon-disallow-setting-font-bigger-than-screen-size.patch new file mode 100644 index 00000000000..5aa33e59de8 --- /dev/null +++ b/queue-5.15/fbcon-disallow-setting-font-bigger-than-screen-size.patch @@ -0,0 +1,37 @@ +From 65a01e601dbba8b7a51a2677811f70f783766682 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 25 Jun 2022 12:56:49 +0200 +Subject: fbcon: Disallow setting font bigger than screen size + +From: Helge Deller + +commit 65a01e601dbba8b7a51a2677811f70f783766682 upstream. + +Prevent that users set a font size which is bigger than the physical screen. +It's unlikely this may happen (because screens are usually much larger than the +fonts and each font char is limited to 32x32 pixels), but it may happen on +smaller screens/LCD displays. + +Signed-off-by: Helge Deller +Reviewed-by: Daniel Vetter +Reviewed-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org # v4.14+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2480,6 +2480,11 @@ static int fbcon_set_font(struct vc_data + if (charcount != 256 && charcount != 512) + return -EINVAL; + ++ /* font bigger than screen resolution ? */ ++ if (w > FBCON_SWAP(info->var.rotate, info->var.xres, info->var.yres) || ++ h > FBCON_SWAP(info->var.rotate, info->var.yres, info->var.xres)) ++ return -EINVAL; ++ + /* Make sure drawing engine can handle the font */ + if (!(info->pixmap.blit_x & (1 << (font->width - 1))) || + !(info->pixmap.blit_y & (1 << (font->height - 1)))) diff --git a/queue-5.15/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch b/queue-5.15/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch new file mode 100644 index 00000000000..0738680fcbe --- /dev/null +++ b/queue-5.15/fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch @@ -0,0 +1,99 @@ +From e64242caef18b4a5840b0e7a9bff37abd4f4f933 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 25 Jun 2022 13:00:34 +0200 +Subject: fbcon: Prevent that screen size is smaller than font size + +From: Helge Deller + +commit e64242caef18b4a5840b0e7a9bff37abd4f4f933 upstream. + +We need to prevent that users configure a screen size which is smaller than the +currently selected font size. Otherwise rendering chars on the screen will +access memory outside the graphics memory region. + +This patch adds a new function fbcon_modechange_possible() which +implements this check and which later may be extended with other checks +if necessary. The new function is called from the FBIOPUT_VSCREENINFO +ioctl handler in fbmem.c, which will return -EINVAL if userspace asked +for a too small screen size. + +Signed-off-by: Helge Deller +Reviewed-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org # v5.4+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbcon.c | 28 ++++++++++++++++++++++++++++ + drivers/video/fbdev/core/fbmem.c | 4 +++- + include/linux/fbcon.h | 4 ++++ + 3 files changed, 35 insertions(+), 1 deletion(-) + +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2747,6 +2747,34 @@ void fbcon_update_vcs(struct fb_info *in + } + EXPORT_SYMBOL(fbcon_update_vcs); + ++/* let fbcon check if it supports a new screen resolution */ ++int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var) ++{ ++ struct fbcon_ops *ops = info->fbcon_par; ++ struct vc_data *vc; ++ unsigned int i; ++ ++ WARN_CONSOLE_UNLOCKED(); ++ ++ if (!ops) ++ return 0; ++ ++ /* prevent setting a screen size which is smaller than font size */ ++ for (i = first_fb_vc; i <= last_fb_vc; i++) { ++ vc = vc_cons[i].d; ++ if (!vc || vc->vc_mode != KD_TEXT || ++ registered_fb[con2fb_map[i]] != info) ++ continue; ++ ++ if (vc->vc_font.width > FBCON_SWAP(var->rotate, var->xres, var->yres) || ++ vc->vc_font.height > FBCON_SWAP(var->rotate, var->yres, var->xres)) ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(fbcon_modechange_possible); ++ + int fbcon_mode_deleted(struct fb_info *info, + struct fb_videomode *mode) + { +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1120,7 +1120,9 @@ static long do_fb_ioctl(struct fb_info * + return -EFAULT; + console_lock(); + lock_fb_info(info); +- ret = fb_set_var(info, &var); ++ ret = fbcon_modechange_possible(info, &var); ++ if (!ret) ++ ret = fb_set_var(info, &var); + if (!ret) + fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL); + unlock_fb_info(info); +--- a/include/linux/fbcon.h ++++ b/include/linux/fbcon.h +@@ -15,6 +15,8 @@ void fbcon_new_modelist(struct fb_info * + void fbcon_get_requirement(struct fb_info *info, + struct fb_blit_caps *caps); + void fbcon_fb_blanked(struct fb_info *info, int blank); ++int fbcon_modechange_possible(struct fb_info *info, ++ struct fb_var_screeninfo *var); + void fbcon_update_vcs(struct fb_info *info, bool all); + void fbcon_remap_all(struct fb_info *info); + int fbcon_set_con2fb_map_ioctl(void __user *argp); +@@ -33,6 +35,8 @@ static inline void fbcon_new_modelist(st + static inline void fbcon_get_requirement(struct fb_info *info, + struct fb_blit_caps *caps) {} + static inline void fbcon_fb_blanked(struct fb_info *info, int blank) {} ++static inline int fbcon_modechange_possible(struct fb_info *info, ++ struct fb_var_screeninfo *var) { return 0; } + static inline void fbcon_update_vcs(struct fb_info *info, bool all) {} + static inline void fbcon_remap_all(struct fb_info *info) {} + static inline int fbcon_set_con2fb_map_ioctl(void __user *argp) { return 0; } diff --git a/queue-5.15/fbdev-fbmem-fix-logo-center-image-dx-issue.patch b/queue-5.15/fbdev-fbmem-fix-logo-center-image-dx-issue.patch new file mode 100644 index 00000000000..c0dae5b5602 --- /dev/null +++ b/queue-5.15/fbdev-fbmem-fix-logo-center-image-dx-issue.patch @@ -0,0 +1,33 @@ +From 955f04766d4e6eb94bf3baa539e096808c74ebfb Mon Sep 17 00:00:00 2001 +From: Guiling Deng +Date: Tue, 28 Jun 2022 09:36:41 -0700 +Subject: fbdev: fbmem: Fix logo center image dx issue + +From: Guiling Deng + +commit 955f04766d4e6eb94bf3baa539e096808c74ebfb upstream. + +Image.dx gets wrong value because of missing '()'. + +If xres == logo->width and n == 1, image.dx = -16. + +Signed-off-by: Guiling Deng +Fixes: 3d8b1933eb1c ("fbdev: fbmem: add config option to center the bootup logo") +Cc: stable@vger.kernel.org # v5.0+ +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbmem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -514,7 +514,7 @@ static int fb_show_logo_line(struct fb_i + + while (n && (n * (logo->width + 8) - 8 > xres)) + --n; +- image.dx = (xres - n * (logo->width + 8) - 8) / 2; ++ image.dx = (xres - (n * (logo->width + 8) - 8)) / 2; + image.dy = y ?: (yres - logo->height) / 2; + } else { + image.dx = 0; diff --git a/queue-5.15/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch b/queue-5.15/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch new file mode 100644 index 00000000000..7e5e2234d5c --- /dev/null +++ b/queue-5.15/fbmem-check-virtual-screen-sizes-in-fb_set_var.patch @@ -0,0 +1,40 @@ +From 6c11df58fd1ac0aefcb3b227f72769272b939e56 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Wed, 29 Jun 2022 15:53:55 +0200 +Subject: fbmem: Check virtual screen sizes in fb_set_var() + +From: Helge Deller + +commit 6c11df58fd1ac0aefcb3b227f72769272b939e56 upstream. + +Verify that the fbdev or drm driver correctly adjusted the virtual +screen sizes. On failure report the failing driver and reject the screen +size change. + +Signed-off-by: Helge Deller +Reviewed-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org # v5.4+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/fbdev/core/fbmem.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1020,6 +1020,16 @@ fb_set_var(struct fb_info *info, struct + if (ret) + return ret; + ++ /* verify that virtual resolution >= physical resolution */ ++ if (var->xres_virtual < var->xres || ++ var->yres_virtual < var->yres) { ++ pr_warn("WARNING: fbcon: Driver '%s' missed to adjust virtual screen size (%ux%u vs. %ux%u)\n", ++ info->fix.id, ++ var->xres_virtual, var->yres_virtual, ++ var->xres, var->yres); ++ return -EINVAL; ++ } ++ + if ((var->activate & FB_ACTIVATE_MASK) != FB_ACTIVATE_NOW) + return 0; + diff --git a/queue-5.15/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch b/queue-5.15/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch new file mode 100644 index 00000000000..f555c9115e3 --- /dev/null +++ b/queue-5.15/iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch @@ -0,0 +1,57 @@ +From 316f92a705a4c2bf4712135180d56f3cca09243a Mon Sep 17 00:00:00 2001 +From: Yian Chen +Date: Fri, 20 May 2022 17:21:15 -0700 +Subject: iommu/vt-d: Fix PCI bus rescan device hot add + +From: Yian Chen + +commit 316f92a705a4c2bf4712135180d56f3cca09243a upstream. + +Notifier calling chain uses priority to determine the execution +order of the notifiers or listeners registered to the chain. +PCI bus device hot add utilizes the notification mechanism. + +The current code sets low priority (INT_MIN) to Intel +dmar_pci_bus_notifier and postpones DMAR decoding after adding +new device into IOMMU. The result is that struct device pointer +cannot be found in DRHD search for the new device's DMAR/IOMMU. +Subsequently, the device is put under the "catch-all" IOMMU +instead of the correct one. This could cause system hang when +device TLB invalidation is sent to the wrong IOMMU. Invalidation +timeout error and hard lockup have been observed and data +inconsistency/crush may occur as well. + +This patch fixes the issue by setting a positive priority(1) for +dmar_pci_bus_notifier while the priority of IOMMU bus notifier +uses the default value(0), therefore DMAR decoding will be in +advance of DRHD search for a new device to find the correct IOMMU. + +Following is a 2-step example that triggers the bug by simulating +PCI device hot add behavior in Intel Sapphire Rapids server. + +echo 1 > /sys/bus/pci/devices/0000:6a:01.0/remove +echo 1 > /sys/bus/pci/rescan + +Fixes: 59ce0515cdaf ("iommu/vt-d: Update DRHD/RMRR/ATSR device scope") +Cc: stable@vger.kernel.org # v3.15+ +Reported-by: Zhang, Bernice +Signed-off-by: Jacob Pan +Signed-off-by: Yian Chen +Link: https://lore.kernel.org/r/20220521002115.1624069-1-yian.chen@intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iommu/intel/dmar.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/iommu/intel/dmar.c ++++ b/drivers/iommu/intel/dmar.c +@@ -385,7 +385,7 @@ static int dmar_pci_bus_notifier(struct + + static struct notifier_block dmar_pci_bus_nb = { + .notifier_call = dmar_pci_bus_notifier, +- .priority = INT_MIN, ++ .priority = 1, + }; + + static struct dmar_drhd_unit * diff --git a/queue-5.15/memregion-fix-memregion_free-fallback-definition.patch b/queue-5.15/memregion-fix-memregion_free-fallback-definition.patch new file mode 100644 index 00000000000..fc6332bfd52 --- /dev/null +++ b/queue-5.15/memregion-fix-memregion_free-fallback-definition.patch @@ -0,0 +1,39 @@ +From f50974eee5c4a5de1e4f1a3d873099f170df25f8 Mon Sep 17 00:00:00 2001 +From: Dan Williams +Date: Thu, 23 Jun 2022 13:02:31 -0700 +Subject: memregion: Fix memregion_free() fallback definition + +From: Dan Williams + +commit f50974eee5c4a5de1e4f1a3d873099f170df25f8 upstream. + +In the CONFIG_MEMREGION=n case, memregion_free() is meant to be a static +inline. 0day reports: + + In file included from drivers/cxl/core/port.c:4: + include/linux/memregion.h:19:6: warning: no previous prototype for + function 'memregion_free' [-Wmissing-prototypes] + +Mark memregion_free() static. + +Fixes: 33dd70752cd7 ("lib: Uplevel the pmem "region" ida to a global allocator") +Reported-by: kernel test robot +Reviewed-by: Alison Schofield +Link: https://lore.kernel.org/r/165601455171.4042645.3350844271068713515.stgit@dwillia2-xfh +Signed-off-by: Dan Williams +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/memregion.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/include/linux/memregion.h ++++ b/include/linux/memregion.h +@@ -16,7 +16,7 @@ static inline int memregion_alloc(gfp_t + { + return -ENOMEM; + } +-void memregion_free(int id) ++static inline void memregion_free(int id) + { + } + #endif diff --git a/queue-5.15/pm-runtime-redefine-pm_runtime_release_supplier.patch b/queue-5.15/pm-runtime-redefine-pm_runtime_release_supplier.patch new file mode 100644 index 00000000000..afcad8ce563 --- /dev/null +++ b/queue-5.15/pm-runtime-redefine-pm_runtime_release_supplier.patch @@ -0,0 +1,111 @@ +From 07358194badf73e267289b40b761f5dc56928eab Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Mon, 27 Jun 2022 20:42:18 +0200 +Subject: PM: runtime: Redefine pm_runtime_release_supplier() + +From: Rafael J. Wysocki + +commit 07358194badf73e267289b40b761f5dc56928eab upstream. + +Instead of passing an extra bool argument to pm_runtime_release_supplier(), +make its callers take care of triggering a runtime-suspend of the +supplier device as needed. + +No expected functional impact. + +Suggested-by: Greg Kroah-Hartman +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Greg Kroah-Hartman +Cc: 5.1+ # 5.1+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/base/core.c | 3 ++- + drivers/base/power/runtime.c | 20 +++++++++----------- + include/linux/pm_runtime.h | 5 ++--- + 3 files changed, 13 insertions(+), 15 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -485,7 +485,8 @@ static void device_link_release_fn(struc + /* Ensure that all references to the link object have been dropped. */ + device_link_synchronize_removal(); + +- pm_runtime_release_supplier(link, true); ++ pm_runtime_release_supplier(link); ++ pm_request_idle(link->supplier); + + put_device(link->consumer); + put_device(link->supplier); +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -308,13 +308,10 @@ static int rpm_get_suppliers(struct devi + /** + * pm_runtime_release_supplier - Drop references to device link's supplier. + * @link: Target device link. +- * @check_idle: Whether or not to check if the supplier device is idle. + * +- * Drop all runtime PM references associated with @link to its supplier device +- * and if @check_idle is set, check if that device is idle (and so it can be +- * suspended). ++ * Drop all runtime PM references associated with @link to its supplier device. + */ +-void pm_runtime_release_supplier(struct device_link *link, bool check_idle) ++void pm_runtime_release_supplier(struct device_link *link) + { + struct device *supplier = link->supplier; + +@@ -327,9 +324,6 @@ void pm_runtime_release_supplier(struct + while (refcount_dec_not_one(&link->rpm_active) && + atomic_read(&supplier->power.usage_count) > 0) + pm_runtime_put_noidle(supplier); +- +- if (check_idle) +- pm_request_idle(supplier); + } + + static void __rpm_put_suppliers(struct device *dev, bool try_to_suspend) +@@ -337,8 +331,11 @@ static void __rpm_put_suppliers(struct d + struct device_link *link; + + list_for_each_entry_rcu(link, &dev->links.suppliers, c_node, +- device_links_read_lock_held()) +- pm_runtime_release_supplier(link, try_to_suspend); ++ device_links_read_lock_held()) { ++ pm_runtime_release_supplier(link); ++ if (try_to_suspend) ++ pm_request_idle(link->supplier); ++ } + } + + static void rpm_put_suppliers(struct device *dev) +@@ -1791,7 +1788,8 @@ void pm_runtime_drop_link(struct device_ + return; + + pm_runtime_drop_link_count(link->consumer); +- pm_runtime_release_supplier(link, true); ++ pm_runtime_release_supplier(link); ++ pm_request_idle(link->supplier); + } + + static bool pm_runtime_need_not_resume(struct device *dev) +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -58,7 +58,7 @@ extern void pm_runtime_get_suppliers(str + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); + extern void pm_runtime_drop_link(struct device_link *link); +-extern void pm_runtime_release_supplier(struct device_link *link, bool check_idle); ++extern void pm_runtime_release_supplier(struct device_link *link); + + extern int devm_pm_runtime_enable(struct device *dev); + +@@ -284,8 +284,7 @@ static inline void pm_runtime_get_suppli + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} + static inline void pm_runtime_drop_link(struct device_link *link) {} +-static inline void pm_runtime_release_supplier(struct device_link *link, +- bool check_idle) {} ++static inline void pm_runtime_release_supplier(struct device_link *link) {} + + #endif /* !CONFIG_PM */ + diff --git a/queue-5.15/series b/queue-5.15/series index b720e62ec0d..aed1c498e9b 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -159,3 +159,11 @@ dt-bindings-soc-qcom-smd-rpm-add-compatible-for-msm8.patch dt-bindings-soc-qcom-smd-rpm-fix-missing-msm8936-com.patch module-change-to-print-useful-messages-from-elf_vali.patch module-fix-e_shstrndx-.sh_size-0-oob-access.patch +iommu-vt-d-fix-pci-bus-rescan-device-hot-add.patch +fbdev-fbmem-fix-logo-center-image-dx-issue.patch +fbmem-check-virtual-screen-sizes-in-fb_set_var.patch +fbcon-disallow-setting-font-bigger-than-screen-size.patch +fbcon-prevent-that-screen-size-is-smaller-than-font-size.patch +pm-runtime-redefine-pm_runtime_release_supplier.patch +memregion-fix-memregion_free-fallback-definition.patch +video-of_display_timing.h-include-errno.h.patch diff --git a/queue-5.15/video-of_display_timing.h-include-errno.h.patch b/queue-5.15/video-of_display_timing.h-include-errno.h.patch new file mode 100644 index 00000000000..d4279e918c7 --- /dev/null +++ b/queue-5.15/video-of_display_timing.h-include-errno.h.patch @@ -0,0 +1,33 @@ +From 3663a2fb325b8782524f3edb0ae32d6faa615109 Mon Sep 17 00:00:00 2001 +From: Hsin-Yi Wang +Date: Fri, 1 Jul 2022 01:33:29 +0800 +Subject: video: of_display_timing.h: include errno.h + +From: Hsin-Yi Wang + +commit 3663a2fb325b8782524f3edb0ae32d6faa615109 upstream. + +If CONFIG_OF is not enabled, default of_get_display_timing() returns an +errno, so include the header. + +Fixes: 422b67e0b31a ("videomode: provide dummy inline functions for !CONFIG_OF") +Suggested-by: Stephen Boyd +Signed-off-by: Hsin-Yi Wang +Reviewed-by: Stephen Boyd +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + include/video/of_display_timing.h | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/include/video/of_display_timing.h ++++ b/include/video/of_display_timing.h +@@ -8,6 +8,8 @@ + #ifndef __LINUX_OF_DISPLAY_TIMING_H + #define __LINUX_OF_DISPLAY_TIMING_H + ++#include ++ + struct device_node; + struct display_timing; + struct display_timings;