From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 12:40:12 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.179~51 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=22841fadd632852ec3252cdd9b24ccbfd1ef48eb;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch drm-i915-return-null-on-error-in-active_instance.patch --- diff --git a/queue-6.6/drm-displayid-fix-tiled-display-topology-id-size.patch b/queue-6.6/drm-displayid-fix-tiled-display-topology-id-size.patch deleted file mode 100644 index 8e6570f3b5..0000000000 --- a/queue-6.6/drm-displayid-fix-tiled-display-topology-id-size.patch +++ /dev/null @@ -1,138 +0,0 @@ -From 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b Mon Sep 17 00:00:00 2001 -From: Jani Nikula -Date: Wed, 10 Jun 2026 17:15:49 +0300 -Subject: drm/displayid: fix Tiled Display Topology ID size - -From: Jani Nikula - -commit 90c0486a82e27393f9eaf3bb350f51a0bd38cb6b upstream. - -The Tiled Display Topology ID of a DisplayID Tiled Display Topology Data -Block consists of three fields: - -- Tiled Display Manufacturer/Vendor ID Field (3 bytes) -- Tiled Display Product ID Code Field (2 bytes) -- Tiled Display Serial Number Field (4 bytes) - -i.e. a total of 9 bytes, not 8. - -The DisplayID Tiled Display Topology ID is used as the tile group -identifier. - -Update both struct displayid_tiled_block topology_id member and struct -drm_tile_group group_data member to full 9 bytes. - -The group data was missing the last byte of the serial number. I don't -know whether there are known bug reports that might be linked to this, -but it's plausible the last byte could be the differentiating part for -the tile groups, and fewer tile groups might have been created than -intended. - -Fixes: b49b55bd4fba ("drm/displayid: add displayid defines and edid extension (v2)") -Fixes: 138f9ebb9755 ("drm: add tile_group support. (v3)") -Cc: Dave Airlie -Cc: stable@vger.kernel.org # v3.19+ -Reviewed-by: Dave Airlie -Link: https://patch.msgid.link/20260610141549.555605-1-jani.nikula@intel.com -Signed-off-by: Jani Nikula -Signed-off-by: Greg Kroah-Hartman ---- - drivers/gpu/drm/drm_connector.c | 12 ++++++------ - drivers/gpu/drm/drm_displayid_internal.h | 2 +- - include/drm/drm_connector.h | 6 +++--- - 3 files changed, 10 insertions(+), 10 deletions(-) - -diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c -index 47dc53c4a738..29634757c06d 100644 ---- a/drivers/gpu/drm/drm_connector.c -+++ b/drivers/gpu/drm/drm_connector.c -@@ -3576,7 +3576,7 @@ EXPORT_SYMBOL(drm_mode_put_tile_group); - /** - * drm_mode_get_tile_group - get a reference to an existing tile group - * @dev: DRM device -- * @topology: 8-bytes unique per monitor. -+ * @topology_id: 9-byte unique ID per monitor. - * - * Use the unique bytes to get a reference to an existing tile group. - * -@@ -3584,14 +3584,14 @@ EXPORT_SYMBOL(drm_mode_put_tile_group); - * tile group or NULL if not found. - */ - struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev, -- const char topology[8]) -+ const char topology_id[9]) - { - struct drm_tile_group *tg; - int id; - - mutex_lock(&dev->mode_config.idr_mutex); - idr_for_each_entry(&dev->mode_config.tile_idr, tg, id) { -- if (!memcmp(tg->group_data, topology, 8)) { -+ if (!memcmp(tg->group_data, topology_id, sizeof(tg->group_data))) { - if (!kref_get_unless_zero(&tg->refcount)) - tg = NULL; - mutex_unlock(&dev->mode_config.idr_mutex); -@@ -3606,7 +3606,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group); - /** - * drm_mode_create_tile_group - create a tile group from a displayid description - * @dev: DRM device -- * @topology: 8-bytes unique per monitor. -+ * @topology_id: 9-byte unique ID per monitor. - * - * Create a tile group for the unique monitor, and get a unique - * identifier for the tile group. -@@ -3615,7 +3615,7 @@ EXPORT_SYMBOL(drm_mode_get_tile_group); - * new tile group or NULL. - */ - struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, -- const char topology[8]) -+ const char topology_id[9]) - { - struct drm_tile_group *tg; - int ret; -@@ -3625,7 +3625,7 @@ struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, - return NULL; - - kref_init(&tg->refcount); -- memcpy(tg->group_data, topology, 8); -+ memcpy(tg->group_data, topology_id, sizeof(tg->group_data)); - tg->dev = dev; - - mutex_lock(&dev->mode_config.idr_mutex); -diff --git a/drivers/gpu/drm/drm_displayid_internal.h b/drivers/gpu/drm/drm_displayid_internal.h -index 5b1b32f73516..4590d6a3d821 100644 ---- a/drivers/gpu/drm/drm_displayid_internal.h -+++ b/drivers/gpu/drm/drm_displayid_internal.h -@@ -109,7 +109,7 @@ struct displayid_tiled_block { - u8 topo[3]; - u8 tile_size[4]; - u8 tile_pixel_bezel[5]; -- u8 topology_id[8]; -+ u8 topology_id[9]; - } __packed; - - struct displayid_detailed_timings_1 { -diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h -index f83f28cae207..877b5ca87e95 100644 ---- a/include/drm/drm_connector.h -+++ b/include/drm/drm_connector.h -@@ -2608,13 +2608,13 @@ struct drm_tile_group { - struct kref refcount; - struct drm_device *dev; - int id; -- u8 group_data[8]; -+ u8 group_data[9]; - }; - - struct drm_tile_group *drm_mode_create_tile_group(struct drm_device *dev, -- const char topology[8]); -+ const char topology_id[9]); - struct drm_tile_group *drm_mode_get_tile_group(struct drm_device *dev, -- const char topology[8]); -+ const char topology_id[9]); - void drm_mode_put_tile_group(struct drm_device *dev, - struct drm_tile_group *tg); - --- -2.55.0 - diff --git a/queue-6.6/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch b/queue-6.6/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch new file mode 100644 index 0000000000..b4793d769c --- /dev/null +++ b/queue-6.6/drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch @@ -0,0 +1,84 @@ +From eed3de2acf6aa5154d49098b026710b646db67ee Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:30:30 +0300 +Subject: drm/i915/gem: Do not leak siblings[] on proto context error + +From: Joonas Lahtinen + +commit eed3de2acf6aa5154d49098b026710b646db67ee upstream. + +After a successful BALANCE/PARALLEL_SUBMIT extension on context +creation, error during processing of next user extension leaks +the siblings[] array. Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Signed-off-by: Tvrtko Ursulin +Link: https://lore.kernel.org/r/20260701073030.44850-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit aa65e0a4b51b3b54b53e4142aaa2d997aa1061ff) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 22 ++++++++++++++-------- + 1 file changed, 14 insertions(+), 8 deletions(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -768,8 +768,8 @@ static int set_proto_ctx_engines(struct + struct intel_engine_cs *engine; + + if (copy_from_user(&ci, &user->engines[n], sizeof(ci))) { +- kfree(set.engines); +- return -EFAULT; ++ err = -EFAULT; ++ goto err; + } + + memset(&set.engines[n], 0, sizeof(set.engines[n])); +@@ -785,8 +785,8 @@ static int set_proto_ctx_engines(struct + drm_dbg(&i915->drm, + "Invalid engine[%d]: { class:%d, instance:%d }\n", + n, ci.engine_class, ci.engine_instance); +- kfree(set.engines); +- return -ENOENT; ++ err = -ENOENT; ++ goto err; + } + + set.engines[n].type = I915_GEM_ENGINE_TYPE_PHYSICAL; +@@ -799,15 +799,21 @@ static int set_proto_ctx_engines(struct + set_proto_ctx_engines_extensions, + ARRAY_SIZE(set_proto_ctx_engines_extensions), + &set); +- if (err) { +- kfree(set.engines); +- return err; +- } ++ if (err) ++ goto err_extensions; + + pc->num_user_engines = set.num_engines; + pc->user_engines = set.engines; + + return 0; ++ ++err_extensions: ++ for (n = 0; n < set.num_engines; n++) ++ kfree(set.engines[n].siblings); ++err: ++ kfree(set.engines); ++ ++ return err; + } + + static int set_proto_ctx_sseu(struct drm_i915_file_private *fpriv, diff --git a/queue-6.6/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch b/queue-6.6/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch new file mode 100644 index 0000000000..bfdeeefd45 --- /dev/null +++ b/queue-6.6/drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch @@ -0,0 +1,46 @@ +From 2b56757a9a7456825eb668fde92299e01c5e2721 Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 1 Jul 2026 10:55:55 +0300 +Subject: drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU + +From: Joonas Lahtinen + +commit 2b56757a9a7456825eb668fde92299e01c5e2721 upstream. + +Setting context engine slot N into I915_ENGINE_CLASS_INVALID / +I915_ENGINE_CLASS_INVALID_NONE and attempting to apply +I915_CONTEXT_PARAM_SSEU to the same slot N will deref NULL. +Fix that. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: d4433c7600f7 ("drm/i915/gem: Use the proto-context to handle create parameters (v5)") +Cc: Faith Ekstrand +Cc: Simona Vetter +Cc: Tvrtko Ursulin +Cc: Maarten Lankhorst +Cc: # v5.15+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Maarten Lankhorst +Reviewed-by: Andi Shyti +Link: https://patch.msgid.link/20260701075555.52142-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 36eda5b5c2d40da41cc0a5403c26986237cf9e87) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -855,7 +855,7 @@ static int set_proto_ctx_sseu(struct drm + pe = &pc->user_engines[idx]; + + /* Only render engine supports RPCS configuration. */ +- if (pe->engine->class != RENDER_CLASS) ++ if (!pe->engine || pe->engine->class != RENDER_CLASS) + return -EINVAL; + + sseu = &pe->sseu; diff --git a/queue-6.6/drm-i915-return-null-on-error-in-active_instance.patch b/queue-6.6/drm-i915-return-null-on-error-in-active_instance.patch new file mode 100644 index 0000000000..3fc350f8b6 --- /dev/null +++ b/queue-6.6/drm-i915-return-null-on-error-in-active_instance.patch @@ -0,0 +1,58 @@ +From 1e33f0de5fdcd09e51fdec1e5822448970b6420f Mon Sep 17 00:00:00 2001 +From: Joonas Lahtinen +Date: Wed, 24 Jun 2026 12:09:40 +0300 +Subject: drm/i915: Return NULL on error in active_instance +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Joonas Lahtinen + +commit 1e33f0de5fdcd09e51fdec1e5822448970b6420f upstream. + +Avoid returning &node->base when node is NULL due to OOM +during GFP_ATOMIC allocation. + +Discovered using AI-assisted static analysis confirmed by +Intel Product Security. + +Reported-by: Martin Hodo +Fixes: bfaae47db3c0 ("drm/i915: make lockdep slightly happier about execbuf.") +Cc: Maarten Lankhorst +Cc: Thomas Hellström +Cc: Simona Vetter +Cc: # v5.13+ +Signed-off-by: Joonas Lahtinen +Reviewed-by: Sebastian Brzezinka +Reviewed-by: Maarten Lankhorst +Link: https://patch.msgid.link/20260624090940.74840-1-joonas.lahtinen@linux.intel.com +(cherry picked from commit 6029bc064f0b1bac184203a50fbaaf070fa18832) +Signed-off-by: Joonas Lahtinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/i915_active.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/i915_active.c ++++ b/drivers/gpu/drm/i915/i915_active.c +@@ -319,7 +319,7 @@ active_instance(struct i915_active *ref, + */ + node = kmem_cache_alloc(slab_cache, GFP_ATOMIC); + if (!node) +- goto out; ++ goto err; + + __i915_active_fence_init(&node->base, NULL, node_retire); + node->ref = ref; +@@ -333,6 +333,11 @@ out: + spin_unlock_irq(&ref->tree_lock); + + return &node->base; ++ ++err: ++ spin_unlock_irq(&ref->tree_lock); ++ ++ return NULL; + } + + void __i915_active_init(struct i915_active *ref, diff --git a/queue-6.6/series b/queue-6.6/series index bbec0008d4..64bf8235e6 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -224,4 +224,6 @@ drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch -drm-displayid-fix-tiled-display-topology-id-size.patch +drm-i915-return-null-on-error-in-active_instance.patch +drm-i915-gem-do-not-leak-siblings-on-proto-context-error.patch +drm-i915-gem-fix-null-deref-in-i915_context_param_sseu.patch