From: Greg Kroah-Hartman Date: Mon, 31 May 2021 06:57:23 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.271~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d6834e8cf2f994c1c1c01286743631bb9870cff2;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: drm-i915-display-fix-compiler-warning-about-array-overrun.patch i915-fix-build-warning-in-intel_dp_get_link_status.patch --- diff --git a/queue-5.4/drm-i915-display-fix-compiler-warning-about-array-overrun.patch b/queue-5.4/drm-i915-display-fix-compiler-warning-about-array-overrun.patch new file mode 100644 index 00000000000..b6e6f4c46fc --- /dev/null +++ b/queue-5.4/drm-i915-display-fix-compiler-warning-about-array-overrun.patch @@ -0,0 +1,72 @@ +From fec4d42724a1bf3dcba52307e55375fdb967b852 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Sat, 8 May 2021 11:30:22 -0700 +Subject: drm/i915/display: fix compiler warning about array overrun +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Linus Torvalds + +commit fec4d42724a1bf3dcba52307e55375fdb967b852 upstream. + +intel_dp_check_mst_status() uses a 14-byte array to read the DPRX Event +Status Indicator data, but then passes that buffer at offset 10 off as +an argument to drm_dp_channel_eq_ok(). + +End result: there are only 4 bytes remaining of the buffer, yet +drm_dp_channel_eq_ok() wants a 6-byte buffer. gcc-11 correctly warns +about this case: + + drivers/gpu/drm/i915/display/intel_dp.c: In function ‘intel_dp_check_mst_status’: + drivers/gpu/drm/i915/display/intel_dp.c:3491:22: warning: ‘drm_dp_channel_eq_ok’ reading 6 bytes from a region of size 4 [-Wstringop-overread] + 3491 | !drm_dp_channel_eq_ok(&esi[10], intel_dp->lane_count)) { + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + drivers/gpu/drm/i915/display/intel_dp.c:3491:22: note: referencing argument 1 of type ‘const u8 *’ {aka ‘const unsigned char *’} + In file included from drivers/gpu/drm/i915/display/intel_dp.c:38: + include/drm/drm_dp_helper.h:1466:6: note: in a call to function ‘drm_dp_channel_eq_ok’ + 1466 | bool drm_dp_channel_eq_ok(const u8 link_status[DP_LINK_STATUS_SIZE], + | ^~~~~~~~~~~~~~~~~~~~ + 6:14 elapsed + +This commit just extends the original array by 2 zero-initialized bytes, +avoiding the warning. + +There may be some underlying bug in here that caused this confusion, but +this is at least no worse than the existing situation that could use +random data off the stack. + +Cc: Jani Nikula +Cc: Ville Syrjälä +Cc: Joonas Lahtinen +Cc: Rodrigo Vivi +Cc: Daniel Vetter +Cc: Dave Airlie +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -4706,7 +4706,18 @@ intel_dp_check_mst_status(struct intel_d + bool bret; + + if (intel_dp->is_mst) { +- u8 esi[DP_DPRX_ESI_LEN] = { 0 }; ++ /* ++ * The +2 is because DP_DPRX_ESI_LEN is 14, but we then ++ * pass in "esi+10" to drm_dp_channel_eq_ok(), which ++ * takes a 6-byte array. So we actually need 16 bytes ++ * here. ++ * ++ * Somebody who knows what the limits actually are ++ * should check this, but for now this is at least ++ * harmless and avoids a valid compiler warning about ++ * using more of the array than we have allocated. ++ */ ++ u8 esi[DP_DPRX_ESI_LEN+2] = {}; + int ret = 0; + int retry; + bool handled; diff --git a/queue-5.4/i915-fix-build-warning-in-intel_dp_get_link_status.patch b/queue-5.4/i915-fix-build-warning-in-intel_dp_get_link_status.patch new file mode 100644 index 00000000000..6a53ba57d2f --- /dev/null +++ b/queue-5.4/i915-fix-build-warning-in-intel_dp_get_link_status.patch @@ -0,0 +1,42 @@ +From foo@baz Mon May 31 08:35:11 AM CEST 2021 +Date: Mon, 31 May 2021 08:35:11 +0200 +To: Greg KH +From: Greg Kroah-Hartman +Subject: i915: fix build warning in intel_dp_get_link_status() + +From: Greg Kroah-Hartman + +There is a build warning using gcc-11 showing a mis-match in the .h and .c +definitions of intel_dp_get_link_status(): + CC [M] drivers/gpu/drm/i915/display/intel_dp.o +drivers/gpu/drm/i915/display/intel_dp.c:4139:56: warning: argument 2 of type ‘u8[6]’ {aka ‘unsigned char[6]’} with mismatched bound [-Warray-parameter=] + 4139 | intel_dp_get_link_status(struct intel_dp *intel_dp, u8 link_status[DP_LINK_STATUS_SIZE]) + | ~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from drivers/gpu/drm/i915/display/intel_dp.c:51: +drivers/gpu/drm/i915/display/intel_dp.h:105:57: note: previously declared as ‘u8 *’ {aka ‘unsigned char *’} + 105 | intel_dp_get_link_status(struct intel_dp *intel_dp, u8 *link_status); + | ~~~~^~~~~~~~~~~ + +This was fixed accidentally commit b30edfd8d0b4 ("drm/i915: Switch to LTTPR +non-transparent mode link training") by getting rid of the function entirely, +but that is not a viable backport for a stable kernel, so just fix up the +function definition to remove the build warning entirely. There is no +functional change for this, and it fixes up one of the last 'make allmodconfig' +build warnings when using gcc-11 on this kernel tree. + +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_dp.c ++++ b/drivers/gpu/drm/i915/display/intel_dp.c +@@ -3634,7 +3634,7 @@ static void chv_dp_post_pll_disable(stru + * link status information + */ + bool +-intel_dp_get_link_status(struct intel_dp *intel_dp, u8 link_status[DP_LINK_STATUS_SIZE]) ++intel_dp_get_link_status(struct intel_dp *intel_dp, u8 *link_status) + { + return drm_dp_dpcd_read(&intel_dp->aux, DP_LANE0_1_STATUS, link_status, + DP_LINK_STATUS_SIZE) == DP_LINK_STATUS_SIZE; diff --git a/queue-5.4/series b/queue-5.4/series index dcde290bad1..9827dc85c6e 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -167,3 +167,5 @@ net-ethernet-mtk_eth_soc-fix-packet-statistics-suppo.patch sch_dsmark-fix-a-null-deref-in-qdisc_reset.patch mips-alchemy-xxs1500-add-gpio-au1000.h-header-file.patch mips-ralink-export-rt_sysc_membase-for-rt2880_wdt.c.patch +drm-i915-display-fix-compiler-warning-about-array-overrun.patch +i915-fix-build-warning-in-intel_dp_get_link_status.patch