From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:55:14 +0000 (+0200) Subject: 5.15-stable patches X-Git-Tag: v6.1.179~73 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=932b8e88d2e610ca81545548ed691ff2d26bfbf4;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch --- diff --git a/queue-5.15/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch b/queue-5.15/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch new file mode 100644 index 0000000000..c98261441c --- /dev/null +++ b/queue-5.15/drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch @@ -0,0 +1,44 @@ +From c3027973f692077a1b66a9fb26d6a7c46c0dc72c Mon Sep 17 00:00:00 2001 +From: Wentao Liang +Date: Sat, 6 Jun 2026 15:56:06 +0000 +Subject: drm/nouveau/acr: fix missing nvkm_done() in error path of nvkm_acr_oneinit() + +From: Wentao Liang + +commit c3027973f692077a1b66a9fb26d6a7c46c0dc72c upstream. + +In nvkm_acr_oneinit(), nvkm_kmap(acr->wpr) is invoked unconditionally +at line 309 to obtain a mapping reference. Additionally, when both +acr->wpr_fw and acr->wpr_comp are present, a second nvkm_kmap() is +called inside the conditional block. Both mappings are expected to be +released by nvkm_done(acr->wpr) at line 320 before the function returns +successfully. + +However, when a mismatch is detected during the loop within the +conditional block, the function returns -EINVAL at line 318 without +calling nvkm_done(). This results in a leak of the kmap reference(s) +acquired earlier. + +Fix the issue by invoking nvkm_done(acr->wpr) prior to the early return +to ensure proper release of the mapping references. + +Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") +Cc: stable@vger.kernel.org +Signed-off-by: Wentao Liang +Link: https://patch.msgid.link/20260606155606.77593-1-vulab@iscas.ac.cn +Signed-off-by: Danilo Krummrich +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/base.c +@@ -314,6 +314,7 @@ nvkm_acr_oneinit(struct nvkm_subdev *sub + i, us, fw); + } + } ++ nvkm_done(acr->wpr); + return -EINVAL; + } + nvkm_done(acr->wpr); diff --git a/queue-5.15/drm-radeon-fix-r100_copy_blit-for-large-bos.patch b/queue-5.15/drm-radeon-fix-r100_copy_blit-for-large-bos.patch new file mode 100644 index 0000000000..126b166f50 --- /dev/null +++ b/queue-5.15/drm-radeon-fix-r100_copy_blit-for-large-bos.patch @@ -0,0 +1,82 @@ +From f896e86273dbbebb5eac966b4a201b5c62a02e9a Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Pavel=20Ondra=C4=8Dka?= +Date: Wed, 10 Jun 2026 10:32:45 +0200 +Subject: drm/radeon: fix r100_copy_blit for large BOs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Ondračka + +commit f896e86273dbbebb5eac966b4a201b5c62a02e9a upstream. + +r100_copy_blit() copies BOs as 1024-pixel-wide ARGB8888 blits, so one +GPU page becomes one blit row. Large copies are split into chunks of at +most 8191 rows. + +The kernel register header names the packet coordinate dwords SRC_Y_X +and DST_Y_X. In the BITBLT_MULTI description in +R5xx_Acceleration_v1.5.pdf docs, these correspond to [SRC_X1 | SRC_Y1] +and [DST_X1 | DST_Y1], which are signed 13-bit coordinates in the +-8192..8191 range. The old code kept SRC/DST_PITCH_OFFSET at the BO base +and used SRC_Y_X/DST_Y_X as the chunk address, so large BO moves could +exceed that coordinate range. + +Compute per-chunk SRC/DST_PITCH_OFFSET bases and emit zero source and +destination coordinates. r100_copy_blit() already packs +SRC/DST_PITCH_OFFSET as pitch plus base offset, so large chunk addresses +belong there rather than in the coordinate fields. + +This fixes Prison Architect corruption with 4096x4096 mipped textures +after they are evicted to GTT under memory pressure on RV530. + +Closes: https://gitlab.freedesktop.org/mesa/mesa/-/work_items/6716 +Acked-by: Christian König +Signed-off-by: Pavel Ondračka +Signed-off-by: Alex Deucher +(cherry picked from commit 87be26aee76239c6da03e599f238a426897f78ad) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/radeon/r100.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/radeon/r100.c ++++ b/drivers/gpu/drm/radeon/r100.c +@@ -904,6 +904,7 @@ struct radeon_fence *r100_copy_blit(stru + { + struct radeon_ring *ring = &rdev->ring[RADEON_RING_TYPE_GFX_INDEX]; + struct radeon_fence *fence; ++ uint64_t cur_src_offset, cur_dst_offset; + uint32_t cur_pages; + uint32_t stride_bytes = RADEON_GPU_PAGE_SIZE; + uint32_t pitch; +@@ -932,6 +933,10 @@ struct radeon_fence *r100_copy_blit(stru + cur_pages = 8191; + } + num_gpu_pages -= cur_pages; ++ cur_src_offset = src_offset + ++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE; ++ cur_dst_offset = dst_offset + ++ (uint64_t)num_gpu_pages * RADEON_GPU_PAGE_SIZE; + + /* pages are in Y direction - height + page width in X direction - width */ +@@ -948,13 +953,13 @@ struct radeon_fence *r100_copy_blit(stru + RADEON_DP_SRC_SOURCE_MEMORY | + RADEON_GMC_CLR_CMP_CNTL_DIS | + RADEON_GMC_WR_MSK_DIS); +- radeon_ring_write(ring, (pitch << 22) | (src_offset >> 10)); +- radeon_ring_write(ring, (pitch << 22) | (dst_offset >> 10)); ++ radeon_ring_write(ring, (pitch << 22) | (cur_src_offset >> 10)); ++ radeon_ring_write(ring, (pitch << 22) | (cur_dst_offset >> 10)); + radeon_ring_write(ring, (0x1fff) | (0x1fff << 16)); + radeon_ring_write(ring, 0); + radeon_ring_write(ring, (0x1fff) | (0x1fff << 16)); +- radeon_ring_write(ring, num_gpu_pages); +- radeon_ring_write(ring, num_gpu_pages); ++ radeon_ring_write(ring, 0); ++ radeon_ring_write(ring, 0); + radeon_ring_write(ring, cur_pages | (stride_pixels << 16)); + } + radeon_ring_write(ring, PACKET0(RADEON_DSTCACHE_CTLSTAT, 0)); diff --git a/queue-5.15/series b/queue-5.15/series index 5ca0fbdd7a..188ade29f3 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -142,3 +142,5 @@ can-bcm-fix-stale-rx-tx-ops-after-device-removal.patch can-bcm-fix-data-race-on-rx_stamp-rx_ifindex-in-bcm_.patch can-bcm-track-a-single-source-interface-for-anydev-t.patch drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch +drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch +drm-radeon-fix-r100_copy_blit-for-large-bos.patch