6.1-stable patches

added patches:
	drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
	drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
	drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
	drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch

diff --git a/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
new file mode 100644 (file)
index 0000000..4f0eee6
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch
@@ -0,0 +1,40 @@
+From 9e98ed3113943257ad6e5c1e6beddbdb482a70ad Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:26:28 -0400
+Subject: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit 9e98ed3113943257ad6e5c1e6beddbdb482a70ad upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
+@@ -548,7 +548,7 @@ static void sdma_v5_0_ring_emit_fence(st
+       amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+                         SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+       /* zero in first two bits */
+-      BUG_ON(addr & 0x3);
++      WARN_ON(addr & 0x3);
+       amdgpu_ring_write(ring, lower_32_bits(addr));
+       amdgpu_ring_write(ring, upper_32_bits(addr));
+       amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -559,7 +559,7 @@ static void sdma_v5_0_ring_emit_fence(st
+               amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+                                 SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+               /* zero in first two bits */
+-              BUG_ON(addr & 0x3);
++              WARN_ON(addr & 0x3);
+               amdgpu_ring_write(ring, lower_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(seq));

diff --git a/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
new file mode 100644 (file)
index 0000000..344eb48
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
@@ -0,0 +1,40 @@
+From b9dd618a635d39fbb211454b6e8837b2a7f10fb0 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:15 -0400
+Subject: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit b9dd618a635d39fbb211454b6e8837b2a7f10fb0 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c
+@@ -390,7 +390,7 @@ static void sdma_v5_2_ring_emit_fence(st
+       amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+                         SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+       /* zero in first two bits */
+-      BUG_ON(addr & 0x3);
++      WARN_ON(addr & 0x3);
+       amdgpu_ring_write(ring, lower_32_bits(addr));
+       amdgpu_ring_write(ring, upper_32_bits(addr));
+       amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -401,7 +401,7 @@ static void sdma_v5_2_ring_emit_fence(st
+               amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) |
+                                 SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+               /* zero in first two bits */
+-              BUG_ON(addr & 0x3);
++              WARN_ON(addr & 0x3);
+               amdgpu_ring_write(ring, lower_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(seq));

diff --git a/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
new file mode 100644 (file)
index 0000000..7f68ddd
--- /dev/null
+++ b/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
@@ -0,0 +1,40 @@
+From ec42c96c322e5cc48099ab5e67b5cbe236cb1949 Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Mon, 15 Jun 2026 18:27:54 -0400
+Subject: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON()
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit ec42c96c322e5cc48099ab5e67b5cbe236cb1949 upstream.
+
+There's no need to crash the kernel for these cases.
+
+Reviewed-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+(cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87)
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c
+@@ -363,7 +363,7 @@ static void sdma_v6_0_ring_emit_fence(st
+       amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+                         SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */
+       /* zero in first two bits */
+-      BUG_ON(addr & 0x3);
++      WARN_ON(addr & 0x3);
+       amdgpu_ring_write(ring, lower_32_bits(addr));
+       amdgpu_ring_write(ring, upper_32_bits(addr));
+       amdgpu_ring_write(ring, lower_32_bits(seq));
+@@ -374,7 +374,7 @@ static void sdma_v6_0_ring_emit_fence(st
+               amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) |
+                                 SDMA_PKT_FENCE_HEADER_MTYPE(0x3));
+               /* zero in first two bits */
+-              BUG_ON(addr & 0x3);
++              WARN_ON(addr & 0x3);
+               amdgpu_ring_write(ring, lower_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(addr));
+               amdgpu_ring_write(ring, upper_32_bits(seq));

diff --git a/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch b/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch
new file mode 100644 (file)
index 0000000..9b79029
--- /dev/null
+++ b/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch
@@ -0,0 +1,42 @@
+From 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd Mon Sep 17 00:00:00 2001
+From: Bryam Vargas <hexlabsecurity@proton.me>
+Date: Sat, 20 Jun 2026 21:43:34 -0500
+Subject: drm/virtio: bound EDID block reads to the response buffer
+
+From: Bryam Vargas <hexlabsecurity@proton.me>
+
+commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd upstream.
+
+virtio_get_edid_block() validates the read offset only against the
+device-supplied resp->size field, never against the fixed-size resp->edid
+array. The EDID block index is driven by the device-supplied extension
+count, so a malicious virtio-gpu backend can advertise a large size
+together with a high block count and read far past the array into adjacent
+kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds
+read / info leak).
+
+Also reject any read whose end exceeds the size of the edid array.
+Conforming EDID responses stay within the array and are unaffected.
+
+Fixes: b4b01b4995fb ("drm/virtio: add edid support")
+Cc: stable@vger.kernel.org
+Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
+Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
+Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/virtio/virtgpu_vq.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -719,7 +719,8 @@ static int virtio_get_edid_block(void *d
+       struct virtio_gpu_resp_edid *resp = data;
+       size_t start = block * EDID_LENGTH;
+ 
+-      if (start + len > le32_to_cpu(resp->size))
++      if (start + len > le32_to_cpu(resp->size) ||
++          start + len > sizeof(resp->edid))
+               return -EINVAL;
+       memcpy(buf, resp->edid + start, len);
+       return 0;

diff --git a/queue-6.1/series b/queue-6.1/series
index a145197e982d4b367408dd58f631bdc792d9be1a..310fa55f336e5b613696a7fc15ef9007319a5e38 100644 (file)
--- a/queue-6.1/series
+++ b/queue-6.1/series
@@ -176,3 +176,7 @@ drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch
 drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch
 drm-radeon-fix-r100_copy_blit-for-large-bos.patch
 drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch
+drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch
+drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch
+drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch