From a4332cec86ecc49775503726757e112877b15984 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 12 Jun 2024 16:53:33 +0200 Subject: [PATCH] 6.9-stable patches added patches: drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch drm-xe-bb-assert-width-in-xe_bb_create_job.patch --- ...-error-handle-to-avoid-out-of-bounds.patch | 36 +++++++++++++++++++ ...-bb-assert-width-in-xe_bb_create_job.patch | 36 +++++++++++++++++++ queue-6.9/series | 2 ++ 3 files changed, 74 insertions(+) create mode 100644 queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch create mode 100644 queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch diff --git a/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch b/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch new file mode 100644 index 00000000000..125aa7ff54d --- /dev/null +++ b/queue-6.9/drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch @@ -0,0 +1,36 @@ +From 8b2faf1a4f3b6c748c0da36cda865a226534d520 Mon Sep 17 00:00:00 2001 +From: Bob Zhou +Date: Tue, 23 Apr 2024 16:58:11 +0800 +Subject: drm/amdgpu: add error handle to avoid out-of-bounds +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bob Zhou + +commit 8b2faf1a4f3b6c748c0da36cda865a226534d520 upstream. + +if the sdma_v4_0_irq_id_to_seq return -EINVAL, the process should +be stop to avoid out-of-bounds read, so directly return -EINVAL. + +Signed-off-by: Bob Zhou +Acked-by: Christian König +Reviewed-by: Le Ma +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -2021,6 +2021,9 @@ static int sdma_v4_0_process_trap_irq(st + + DRM_DEBUG("IH: SDMA trap\n"); + instance = sdma_v4_0_irq_id_to_seq(entry->client_id); ++ if (instance < 0) ++ return instance; ++ + switch (entry->ring_id) { + case 0: + amdgpu_fence_process(&adev->sdma.instance[instance].ring); diff --git a/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch b/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch new file mode 100644 index 00000000000..ca5e21e2a34 --- /dev/null +++ b/queue-6.9/drm-xe-bb-assert-width-in-xe_bb_create_job.patch @@ -0,0 +1,36 @@ +From 1008368e1c7e36bdec01b3cce1e76606dc3ad46f Mon Sep 17 00:00:00 2001 +From: Matthew Auld +Date: Wed, 20 Mar 2024 11:27:31 +0000 +Subject: drm/xe/bb: assert width in xe_bb_create_job() + +From: Matthew Auld + +commit 1008368e1c7e36bdec01b3cce1e76606dc3ad46f upstream. + +The queue width will determine the number of batch buffer emitted into +the ring. In the case of xe_bb_create_job() we pass exactly one batch +address, therefore add an assert for the width to make sure we don't go +out of bounds. While here also convert to the helper to determine if the +queue is migration based. + +Signed-off-by: Matthew Auld +Cc: Nirmoy Das +Reviewed-by: Nirmoy Das +Link: https://patchwork.freedesktop.org/patch/msgid/20240320112730.219854-3-matthew.auld@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/xe/xe_bb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/xe/xe_bb.c ++++ b/drivers/gpu/drm/xe/xe_bb.c +@@ -96,7 +96,8 @@ struct xe_sched_job *xe_bb_create_job(st + { + u64 addr = xe_sa_bo_gpu_addr(bb->bo); + +- xe_gt_assert(q->gt, !(q->vm && q->vm->flags & XE_VM_FLAG_MIGRATION)); ++ xe_gt_assert(q->gt, !xe_sched_job_is_migration(q)); ++ xe_gt_assert(q->gt, q->width == 1); + return __xe_bb_create_job(q, bb, &addr); + } + diff --git a/queue-6.9/series b/queue-6.9/series index 6ea20228e57..577522ee584 100644 --- a/queue-6.9/series +++ b/queue-6.9/series @@ -6,3 +6,5 @@ x86-topology-amd-evaluate-smt-in-cpuid-leaf-0x8000001e-only-on-family-0x17-and-g vxlan-fix-regression-when-dropping-packets-due-to-invalid-src-addresses.patch f2fs-fix-to-do-sanity-check-on-i_xattr_nid-in-sanity_check_inode.patch media-lgdt3306a-add-a-check-against-null-pointer-def.patch +drm-amdgpu-add-error-handle-to-avoid-out-of-bounds.patch +drm-xe-bb-assert-width-in-xe_bb_create_job.patch -- 2.47.3