From 98aeac9caad0510bd7f54a8ed05a93c9fce3d27a Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 14 Sep 2024 12:11:55 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...vent-a-possible-int-overflow-in-wq-o.patch | 53 ++++++++++++ queue-6.1/series | 4 + ...nvert-to-platform-remove-callback-re.patch | 65 +++++++++++++++ ...qcom-fix-incorrect-free_irq-sequence.patch | 43 ++++++++++ ...do-runtime-pm-changes-at-driver-exit.patch | 82 +++++++++++++++++++ 5 files changed, 247 insertions(+) create mode 100644 queue-6.1/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch create mode 100644 queue-6.1/spi-geni-qcom-convert-to-platform-remove-callback-re.patch create mode 100644 queue-6.1/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch create mode 100644 queue-6.1/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch diff --git a/queue-6.1/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch b/queue-6.1/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch new file mode 100644 index 00000000000..875d0049809 --- /dev/null +++ b/queue-6.1/drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch @@ -0,0 +1,53 @@ +From 042f40754b44ebce7b39f67199b102e812644be5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jul 2024 08:59:25 -0700 +Subject: drm/i915/guc: prevent a possible int overflow in wq offsets + +From: Nikita Zhandarovich + +[ Upstream commit d3d37f74683e2f16f2635ee265884f7ca69350ae ] + +It may be possible for the sum of the values derived from +i915_ggtt_offset() and __get_parent_scratch_offset()/ +i915_ggtt_offset() to go over the u32 limit before being assigned +to wq offsets of u64 type. + +Mitigate these issues by expanding one of the right operands +to u64 to avoid any overflow issues just in case. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: c2aa552ff09d ("drm/i915/guc: Add multi-lrc context registration") +Cc: Matthew Brost +Cc: John Harrison +Signed-off-by: Nikita Zhandarovich +Link: https://patchwork.freedesktop.org/patch/msgid/20240725155925.14707-1-n.zhandarovich@fintech.ru +Reviewed-by: Rodrigo Vivi +Signed-off-by: Rodrigo Vivi +(cherry picked from commit 1f1c1bd56620b80ae407c5790743e17caad69cec) +Signed-off-by: Tvrtko Ursulin +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +index fecdc7ea78eb..56df4c4a8a1a 100644 +--- a/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c ++++ b/drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c +@@ -2603,9 +2603,9 @@ static void prepare_context_registration_info_v70(struct intel_context *ce, + ce->parallel.guc.wqi_tail = 0; + ce->parallel.guc.wqi_head = 0; + +- wq_desc_offset = i915_ggtt_offset(ce->state) + ++ wq_desc_offset = (u64)i915_ggtt_offset(ce->state) + + __get_parent_scratch_offset(ce); +- wq_base_offset = i915_ggtt_offset(ce->state) + ++ wq_base_offset = (u64)i915_ggtt_offset(ce->state) + + __get_wq_offset(ce); + info->wq_desc_lo = lower_32_bits(wq_desc_offset); + info->wq_desc_hi = upper_32_bits(wq_desc_offset); +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 0f6e5b9a229..edb77f86111 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -55,3 +55,7 @@ spi-nxp-fspi-fix-the-kasan-report-out-of-bounds-bug.patch soundwire-stream-revert-soundwire-stream-fix-programming-slave-ports-for-non-continous-port-maps.patch dma-buf-heaps-fix-off-by-one-in-cma-heap-fault-handler.patch drm-amdgpu-atomfirmware-silence-ubsan-warning.patch +spi-geni-qcom-convert-to-platform-remove-callback-re.patch +spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch +spi-geni-qcom-fix-incorrect-free_irq-sequence.patch +drm-i915-guc-prevent-a-possible-int-overflow-in-wq-o.patch diff --git a/queue-6.1/spi-geni-qcom-convert-to-platform-remove-callback-re.patch b/queue-6.1/spi-geni-qcom-convert-to-platform-remove-callback-re.patch new file mode 100644 index 00000000000..71198a69292 --- /dev/null +++ b/queue-6.1/spi-geni-qcom-convert-to-platform-remove-callback-re.patch @@ -0,0 +1,65 @@ +From 7f43b47f25e1ccb73f9b6c6df792d759c6bf9f8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Mar 2023 18:19:43 +0100 +Subject: spi: geni-qcom: Convert to platform remove callback returning void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit d0b52f6539e008a0d42bf673486bd21b7d2dc191 ] + +The .remove() callback for a platform driver returns an int which makes +many driver authors wrongly assume it's possible to do error handling by +returning an error code. However the value returned is (mostly) ignored +and this typically results in resource leaks. To improve here there is a +quest to make the remove callback return void. In the first step of this +quest all drivers are converted to .remove_new() which already returns +void. + +Trivially convert this driver from always returning zero in the remove +callback to the void returning variant. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20230303172041.2103336-30-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Stable-dep-of: 89e362c883c6 ("spi: geni-qcom: Undo runtime PM changes at driver exit time") +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 7b76dcd11e2b..ac5a581d1e5e 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -1003,7 +1003,7 @@ static int spi_geni_probe(struct platform_device *pdev) + return ret; + } + +-static int spi_geni_remove(struct platform_device *pdev) ++static void spi_geni_remove(struct platform_device *pdev) + { + struct spi_master *spi = platform_get_drvdata(pdev); + struct spi_geni_master *mas = spi_master_get_devdata(spi); +@@ -1015,7 +1015,6 @@ static int spi_geni_remove(struct platform_device *pdev) + + free_irq(mas->irq, spi); + pm_runtime_disable(&pdev->dev); +- return 0; + } + + static int __maybe_unused spi_geni_runtime_suspend(struct device *dev) +@@ -1097,7 +1096,7 @@ MODULE_DEVICE_TABLE(of, spi_geni_dt_match); + + static struct platform_driver spi_geni_driver = { + .probe = spi_geni_probe, +- .remove = spi_geni_remove, ++ .remove_new = spi_geni_remove, + .driver = { + .name = "geni_spi", + .pm = &spi_geni_pm_ops, +-- +2.43.0 + diff --git a/queue-6.1/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch b/queue-6.1/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch new file mode 100644 index 00000000000..ba224c490ae --- /dev/null +++ b/queue-6.1/spi-geni-qcom-fix-incorrect-free_irq-sequence.patch @@ -0,0 +1,43 @@ +From 5284007fb83ca0ae2300ce661e0537028d3cd6ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:31:40 +0800 +Subject: spi: geni-qcom: Fix incorrect free_irq() sequence + +From: Jinjie Ruan + +[ Upstream commit b787a33864121a565aeb0e88561bf6062a19f99c ] + +In spi_geni_remove(), the free_irq() sequence is different from that +on the probe error path. And the IRQ will still remain and it's interrupt +handler may use the dma channel after release dma channel and before free +irq, which is not secure, fix it. + +Fixes: b59c122484ec ("spi: spi-geni-qcom: Add support for GPI dma") +Signed-off-by: Jinjie Ruan +Reviewed-by: Dmitry Baryshkov +Link: https://patch.msgid.link/20240909073141.951494-3-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index 6d8eb7c26076..17b5299c18c7 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -1011,9 +1011,9 @@ static void spi_geni_remove(struct platform_device *pdev) + /* Unregister _before_ disabling pm_runtime() so we stop transfers */ + spi_unregister_master(spi); + +- spi_geni_release_dma_chan(mas); +- + free_irq(mas->irq, spi); ++ ++ spi_geni_release_dma_chan(mas); + } + + static int __maybe_unused spi_geni_runtime_suspend(struct device *dev) +-- +2.43.0 + diff --git a/queue-6.1/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch b/queue-6.1/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch new file mode 100644 index 00000000000..48c9bf2096c --- /dev/null +++ b/queue-6.1/spi-geni-qcom-undo-runtime-pm-changes-at-driver-exit.patch @@ -0,0 +1,82 @@ +From ad113abfff6f343bcf50945d48a57ed911e99f38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Sep 2024 15:31:39 +0800 +Subject: spi: geni-qcom: Undo runtime PM changes at driver exit time + +From: Jinjie Ruan + +[ Upstream commit 89e362c883c65ff94b76b9862285f63545fb5274 ] + +It's important to undo pm_runtime_use_autosuspend() with +pm_runtime_dont_use_autosuspend() at driver exit time unless driver +initially enabled pm_runtime with devm_pm_runtime_enable() +(which handles it for you). + +Hence, switch to devm_pm_runtime_enable() to fix it, so the +pm_runtime_disable() in probe error path and remove function +can be removed. + +Fixes: cfdab2cd85ec ("spi: spi-geni-qcom: Set an autosuspend delay of 250 ms") +Signed-off-by: Jinjie Ruan +Suggested-by: Dmitry Baryshkov +Reviewed-by: Dmitry Baryshkov +Link: https://patch.msgid.link/20240909073141.951494-2-ruanjinjie@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-geni-qcom.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-geni-qcom.c b/drivers/spi/spi-geni-qcom.c +index ac5a581d1e5e..6d8eb7c26076 100644 +--- a/drivers/spi/spi-geni-qcom.c ++++ b/drivers/spi/spi-geni-qcom.c +@@ -954,22 +954,24 @@ static int spi_geni_probe(struct platform_device *pdev) + spin_lock_init(&mas->lock); + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_set_autosuspend_delay(&pdev->dev, 250); +- pm_runtime_enable(dev); ++ ret = devm_pm_runtime_enable(dev); ++ if (ret) ++ return ret; + + ret = geni_icc_get(&mas->se, NULL); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + /* Set the bus quota to a reasonable value for register access */ + mas->se.icc_paths[GENI_TO_CORE].avg_bw = Bps_to_icc(CORE_2X_50_MHZ); + mas->se.icc_paths[CPU_TO_GENI].avg_bw = GENI_DEFAULT_BW; + + ret = geni_icc_set_bw(&mas->se); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + + ret = spi_geni_init(mas); + if (ret) +- goto spi_geni_probe_runtime_disable; ++ return ret; + + /* + * check the mode supported and set_cs for fifo mode only +@@ -998,8 +1000,6 @@ static int spi_geni_probe(struct platform_device *pdev) + free_irq(mas->irq, spi); + spi_geni_release_dma: + spi_geni_release_dma_chan(mas); +-spi_geni_probe_runtime_disable: +- pm_runtime_disable(dev); + return ret; + } + +@@ -1014,7 +1014,6 @@ static void spi_geni_remove(struct platform_device *pdev) + spi_geni_release_dma_chan(mas); + + free_irq(mas->irq, spi); +- pm_runtime_disable(&pdev->dev); + } + + static int __maybe_unused spi_geni_runtime_suspend(struct device *dev) +-- +2.43.0 + -- 2.47.3