From: Greg Kroah-Hartman Date: Tue, 22 Apr 2025 06:18:59 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v6.1.135~123 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e01a66fda7f9e9eecbb7dc744eaee9e2ac023654;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-prevent-division-by-zero.patch drm-repaper-fix-integer-overflows-in-repeat-functions.patch --- diff --git a/queue-5.10/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch b/queue-5.10/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..cb6f07df90 --- /dev/null +++ b/queue-5.10/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:16 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero + +From: Denis Arefev + +commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c +@@ -261,10 +261,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(stru + if (hwmgr->thermal_controller.fanInfo.bNoFan || + (hwmgr->thermal_controller.fanInfo. + ucTachometerPulsesPerRevolution == 0) || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return 0; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + smu7_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-5.10/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch b/queue-5.10/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..0b85fa091b --- /dev/null +++ b/queue-5.10/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch @@ -0,0 +1,34 @@ +From 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:33 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero + +From: Denis Arefev + +commit 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c +@@ -189,7 +189,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(st + uint32_t tach_period, crystal_clock_freq; + int result = 0; + +- if (!speed) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) { diff --git a/queue-5.10/drm-amd-pm-powerplay-prevent-division-by-zero.patch b/queue-5.10/drm-amd-pm-powerplay-prevent-division-by-zero.patch new file mode 100644 index 0000000000..f4d9870aad --- /dev/null +++ b/queue-5.10/drm-amd-pm-powerplay-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:15 +0300 +Subject: drm/amd/pm/powerplay: Prevent division by zero + +From: Denis Arefev + +commit 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +@@ -311,10 +311,10 @@ int vega10_fan_ctrl_set_fan_speed_rpm(st + int result = 0; + + if (hwmgr->thermal_controller.fanInfo.bNoFan || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return -1; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + result = vega10_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-5.10/drm-repaper-fix-integer-overflows-in-repeat-functions.patch b/queue-5.10/drm-repaper-fix-integer-overflows-in-repeat-functions.patch new file mode 100644 index 0000000000..600d27e760 --- /dev/null +++ b/queue-5.10/drm-repaper-fix-integer-overflows-in-repeat-functions.patch @@ -0,0 +1,53 @@ +From 4d098000ac193f359e6b8ca4801dbdbd6a27b41f Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Thu, 16 Jan 2025 05:48:01 -0800 +Subject: drm/repaper: fix integer overflows in repeat functions + +From: Nikita Zhandarovich + +commit 4d098000ac193f359e6b8ca4801dbdbd6a27b41f upstream. + +There are conditions, albeit somewhat unlikely, under which right hand +expressions, calculating the end of time period in functions like +repaper_frame_fixed_repeat(), may overflow. + +For instance, if 'factor10x' in repaper_get_temperature() is high +enough (170), as is 'epd->stage_time' in repaper_probe(), then the +resulting value of 'end' will not fit in unsigned int expression. + +Mitigate this by casting 'epd->factored_stage_time' to wider type before +any multiplication is done. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver") +Cc: stable@vger.kernel.org +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Lanzano +Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tiny/repaper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/tiny/repaper.c ++++ b/drivers/gpu/drm/tiny/repaper.c +@@ -454,7 +454,7 @@ static void repaper_frame_fixed_repeat(s + enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_fixed(epd, fixed_value, stage); +@@ -465,7 +465,7 @@ static void repaper_frame_data_repeat(st + const u8 *mask, enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_data(epd, image, mask, stage); diff --git a/queue-5.10/series b/queue-5.10/series index 3b8a4d13b2..9458e7b26f 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -133,3 +133,7 @@ tracing-fix-filter-string-testing.patch virtiofs-add-filesystem-context-source-name-check.patch perf-x86-intel-allow-to-update-user-space-gprs-from-pebs-records.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-snr.patch +drm-repaper-fix-integer-overflows-in-repeat-functions.patch +drm-amd-pm-powerplay-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch