From c08a1a90aea769614c79784f5eb320b83bf2061f Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 22 Apr 2025 08:19:08 +0200 Subject: [PATCH] 5.15-stable patches added patches: drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch drm-amd-pm-powerplay-prevent-division-by-zero.patch drm-amd-pm-prevent-division-by-zero.patch drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch drm-repaper-fix-integer-overflows-in-repeat-functions.patch --- ...mu7_thermal-prevent-division-by-zero.patch | 38 +++++++++++++ ...a20_thermal-prevent-division-by-zero.patch | 34 ++++++++++++ ...m-powerplay-prevent-division-by-zero.patch | 38 +++++++++++++ .../drm-amd-pm-prevent-division-by-zero.patch | 35 ++++++++++++ ...3-smu_v13_0-prevent-division-by-zero.patch | 34 ++++++++++++ ...nteger-overflows-in-repeat-functions.patch | 53 +++++++++++++++++++ queue-5.15/series | 6 +++ 7 files changed, 238 insertions(+) create mode 100644 queue-5.15/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch create mode 100644 queue-5.15/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch create mode 100644 queue-5.15/drm-amd-pm-powerplay-prevent-division-by-zero.patch create mode 100644 queue-5.15/drm-amd-pm-prevent-division-by-zero.patch create mode 100644 queue-5.15/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch create mode 100644 queue-5.15/drm-repaper-fix-integer-overflows-in-repeat-functions.patch diff --git a/queue-5.15/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch b/queue-5.15/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..5d13073cb2 --- /dev/null +++ b/queue-5.15/drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:16 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/smu7_thermal: Prevent division by zero + +From: Denis Arefev + +commit 7c246a05df51c52fe0852ce56ba10c41e6ed1f39 upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_thermal.c +@@ -267,10 +267,10 @@ int smu7_fan_ctrl_set_fan_speed_rpm(stru + if (hwmgr->thermal_controller.fanInfo.bNoFan || + (hwmgr->thermal_controller.fanInfo. + ucTachometerPulsesPerRevolution == 0) || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return 0; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + smu7_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-5.15/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch b/queue-5.15/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch new file mode 100644 index 0000000000..f1dcf63539 --- /dev/null +++ b/queue-5.15/drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch @@ -0,0 +1,34 @@ +From 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:33 +0300 +Subject: drm/amd/pm/powerplay/hwmgr/vega20_thermal: Prevent division by zero + +From: Denis Arefev + +commit 4e3d9508c056d7e0a56b58d5c81253e2a0d22b6c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 031db09017da ("drm/amd/powerplay/vega20: enable fan RPM and pwm settings V2") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega20_thermal.c +@@ -191,7 +191,7 @@ int vega20_fan_ctrl_set_fan_speed_rpm(st + uint32_t tach_period, crystal_clock_freq; + int result = 0; + +- if (!speed) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) { diff --git a/queue-5.15/drm-amd-pm-powerplay-prevent-division-by-zero.patch b/queue-5.15/drm-amd-pm-powerplay-prevent-division-by-zero.patch new file mode 100644 index 0000000000..700ae8669c --- /dev/null +++ b/queue-5.15/drm-amd-pm-powerplay-prevent-division-by-zero.patch @@ -0,0 +1,38 @@ +From 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 14:08:15 +0300 +Subject: drm/amd/pm/powerplay: Prevent division by zero + +From: Denis Arefev + +commit 4b8c3c0d17c07f301011e2908fecd2ebdcfe3d1c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c52dcf49195d ("drm/amd/pp: Avoid divide-by-zero in fan_ctrl_set_fan_speed_rpm") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c ++++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/vega10_thermal.c +@@ -307,10 +307,10 @@ int vega10_fan_ctrl_set_fan_speed_rpm(st + int result = 0; + + if (hwmgr->thermal_controller.fanInfo.bNoFan || +- speed == 0 || ++ (!speed || speed > UINT_MAX/8) || + (speed < hwmgr->thermal_controller.fanInfo.ulMinRPM) || + (speed > hwmgr->thermal_controller.fanInfo.ulMaxRPM)) +- return -1; ++ return -EINVAL; + + if (PP_CAP(PHM_PlatformCaps_MicrocodeFanControl)) + result = vega10_fan_ctrl_stop_smc_fan_control(hwmgr); diff --git a/queue-5.15/drm-amd-pm-prevent-division-by-zero.patch b/queue-5.15/drm-amd-pm-prevent-division-by-zero.patch new file mode 100644 index 0000000000..7d464dc783 --- /dev/null +++ b/queue-5.15/drm-amd-pm-prevent-division-by-zero.patch @@ -0,0 +1,35 @@ +From 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:32 +0300 +Subject: drm/amd/pm: Prevent division by zero + +From: Denis Arefev + +commit 7d641c2b83275d3b0424127b2e0d2d0f7dd82aef upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: b64625a303de ("drm/amd/pm: correct the address of Arcturus fan related registers") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c +@@ -1278,6 +1278,9 @@ static int arcturus_set_fan_speed_rpm(st + uint32_t crystal_clock_freq = 2500; + uint32_t tach_period; + ++ if (!speed || speed > UINT_MAX/8) ++ return -EINVAL; ++ + tach_period = 60 * crystal_clock_freq * 10000 / (8 * speed); + WREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT, + REG_SET_FIELD(RREG32_SOC15(THM, 0, mmCG_TACH_CTRL_ARCT), diff --git a/queue-5.15/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch b/queue-5.15/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch new file mode 100644 index 0000000000..e0dc8a85c9 --- /dev/null +++ b/queue-5.15/drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch @@ -0,0 +1,34 @@ +From f23e9116ebb71b63fe9cec0dcac792aa9af30b0c Mon Sep 17 00:00:00 2001 +From: Denis Arefev +Date: Fri, 21 Mar 2025 13:52:31 +0300 +Subject: drm/amd/pm/swsmu/smu13/smu_v13_0: Prevent division by zero + +From: Denis Arefev + +commit f23e9116ebb71b63fe9cec0dcac792aa9af30b0c upstream. + +The user can set any speed value. +If speed is greater than UINT_MAX/8, division by zero is possible. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: c05d1c401572 ("drm/amd/swsmu: add aldebaran smu13 ip support (v3)") +Signed-off-by: Denis Arefev +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0.c +@@ -1154,7 +1154,7 @@ int smu_v13_0_set_fan_speed_rpm(struct s + int ret; + uint32_t tach_period, crystal_clock_freq; + +- if (!speed) ++ if (!speed || speed > UINT_MAX/8) + return -EINVAL; + + ret = smu_v13_0_auto_fan_control(smu, 0); diff --git a/queue-5.15/drm-repaper-fix-integer-overflows-in-repeat-functions.patch b/queue-5.15/drm-repaper-fix-integer-overflows-in-repeat-functions.patch new file mode 100644 index 0000000000..600d27e760 --- /dev/null +++ b/queue-5.15/drm-repaper-fix-integer-overflows-in-repeat-functions.patch @@ -0,0 +1,53 @@ +From 4d098000ac193f359e6b8ca4801dbdbd6a27b41f Mon Sep 17 00:00:00 2001 +From: Nikita Zhandarovich +Date: Thu, 16 Jan 2025 05:48:01 -0800 +Subject: drm/repaper: fix integer overflows in repeat functions + +From: Nikita Zhandarovich + +commit 4d098000ac193f359e6b8ca4801dbdbd6a27b41f upstream. + +There are conditions, albeit somewhat unlikely, under which right hand +expressions, calculating the end of time period in functions like +repaper_frame_fixed_repeat(), may overflow. + +For instance, if 'factor10x' in repaper_get_temperature() is high +enough (170), as is 'epd->stage_time' in repaper_probe(), then the +resulting value of 'end' will not fit in unsigned int expression. + +Mitigate this by casting 'epd->factored_stage_time' to wider type before +any multiplication is done. + +Found by Linux Verification Center (linuxtesting.org) with static +analysis tool SVACE. + +Fixes: 3589211e9b03 ("drm/tinydrm: Add RePaper e-ink driver") +Cc: stable@vger.kernel.org +Signed-off-by: Nikita Zhandarovich +Signed-off-by: Alex Lanzano +Link: https://patchwork.freedesktop.org/patch/msgid/20250116134801.22067-1-n.zhandarovich@fintech.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/tiny/repaper.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/tiny/repaper.c ++++ b/drivers/gpu/drm/tiny/repaper.c +@@ -454,7 +454,7 @@ static void repaper_frame_fixed_repeat(s + enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_fixed(epd, fixed_value, stage); +@@ -465,7 +465,7 @@ static void repaper_frame_data_repeat(st + const u8 *mask, enum repaper_stage stage) + { + u64 start = local_clock(); +- u64 end = start + (epd->factored_stage_time * 1000 * 1000); ++ u64 end = start + ((u64)epd->factored_stage_time * 1000 * 1000); + + do { + repaper_frame_data(epd, image, mask, stage); diff --git a/queue-5.15/series b/queue-5.15/series index 8f011e8167..5a174b3353 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -174,3 +174,9 @@ perf-x86-intel-allow-to-update-user-space-gprs-from-pebs-records.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-snr.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-icx.patch perf-x86-intel-uncore-fix-the-scale-of-iio-free-running-counters-on-spr.patch +drm-repaper-fix-integer-overflows-in-repeat-functions.patch +drm-amd-pm-prevent-division-by-zero.patch +drm-amd-pm-powerplay-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-smu7_thermal-prevent-division-by-zero.patch +drm-amd-pm-swsmu-smu13-smu_v13_0-prevent-division-by-zero.patch +drm-amd-pm-powerplay-hwmgr-vega20_thermal-prevent-division-by-zero.patch -- 2.47.3