From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 10:39:27 +0000 (+0200) Subject: 6.6-stable patches X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=cefd81e882a1993bd6b920cbbb2021c9a9c1e655;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch --- diff --git a/queue-6.6/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch b/queue-6.6/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch new file mode 100644 index 0000000000..f36fc3f4f4 --- /dev/null +++ b/queue-6.6/drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch @@ -0,0 +1,106 @@ +From 32bd35f068a3507a1b3922cd12ea2985fc58c85b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:20 +0200 +Subject: drm/amdgpu/uvd: Fix forcing MSG, FB BOs into VCPU segment when it isn't at 0 (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 32bd35f068a3507a1b3922cd12ea2985fc58c85b upstream. + +UVD 4.x and older can only access MSG, FEEDBACK buffers from a +specific 256M VRAM segment that the VCPU BO is also located in. +We already modify all placements of the given BO to ensure +the BO is placed within this segment. + +Previously, it always assumed that the VCPU segment is +the first 256M of VRAM, even though under some conditions +the VCPU BO could be allocated outside this segment, +which made UVD non-functional as the BOs were +not inside the same segment as the UVD VCPU BO. + +Solve that by using the segment where the VCPU BO actually is. + +This fixes an issue with UVD failing to initialize on SI/CIK +when resizable BAR is enabled and the VCPU BO is allocated +in a different segment. + +v2: +- For other BOs, keep using the same UVD segment as before. + +Closes: https://gitlab.freedesktop.org/drm/amd/-/work_items/3851 +Reviewed-by: Christian König +Signed-off-by: Timur Kristóf +Signed-off-by: Alex Deucher +(cherry picked from commit cbfd4d3fc2061a1ec8e9d36e65973ac3e813358a) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 33 +++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -135,7 +135,7 @@ MODULE_FIRMWARE(FIRMWARE_VEGA12); + MODULE_FIRMWARE(FIRMWARE_VEGA20); + + static void amdgpu_uvd_idle_work_handler(struct work_struct *work); +-static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo); ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *abo); + + static int amdgpu_uvd_create_msg_bo_helper(struct amdgpu_device *adev, + uint32_t size, +@@ -158,7 +158,7 @@ static int amdgpu_uvd_create_msg_bo_help + amdgpu_bo_kunmap(bo); + amdgpu_bo_unpin(bo); + amdgpu_bo_placement_from_domain(bo, AMDGPU_GEM_DOMAIN_VRAM); +- amdgpu_uvd_force_into_uvd_segment(bo); ++ amdgpu_uvd_force_into_vcpu_segment(bo); + r = ttm_bo_validate(&bo->tbo, &bo->placement, &ctx); + if (r) + goto err; +@@ -539,6 +539,24 @@ void amdgpu_uvd_free_handles(struct amdg + } + } + ++static void amdgpu_uvd_force_into_vcpu_segment(struct amdgpu_bo *bo) ++{ ++ struct amdgpu_device *adev = amdgpu_ttm_adev(bo->tbo.bdev); ++ struct amdgpu_bo *vcpu_bo = adev->uvd.inst[0].vcpu_bo; ++ struct amdgpu_res_cursor vcpu_cur; ++ ++ amdgpu_res_first(vcpu_bo->tbo.resource, 0, ++ amdgpu_bo_size(vcpu_bo), &vcpu_cur); ++ ++ bo->placement.num_placement = 1; ++ bo->placement.placement = &bo->placements[0]; ++ bo->placements[0].fpfn = ALIGN_DOWN(vcpu_cur.start, SZ_256M) >> PAGE_SHIFT; ++ bo->placements[0].lpfn = bo->placements[0].fpfn + (SZ_256M >> PAGE_SHIFT); ++ bo->placements[0].mem_type = vcpu_bo->tbo.resource->mem_type; ++ if (bo->placements[0].mem_type == TTM_PL_VRAM) ++ bo->placements[0].flags |= TTM_PL_FLAG_CONTIGUOUS; ++} ++ + static void amdgpu_uvd_force_into_uvd_segment(struct amdgpu_bo *abo) + { + int i; +@@ -587,13 +605,10 @@ static int amdgpu_uvd_cs_pass1(struct am + if (!ctx->parser->adev->uvd.address_64_bit) { + /* check if it's a message or feedback command */ + cmd = amdgpu_ib_get_value(ctx->ib, ctx->idx) >> 1; +- if (cmd == 0x0 || cmd == 0x3) { +- /* yes, force it into VRAM */ +- uint32_t domain = AMDGPU_GEM_DOMAIN_VRAM; +- +- amdgpu_bo_placement_from_domain(bo, domain); +- } +- amdgpu_uvd_force_into_uvd_segment(bo); ++ if (cmd == 0x0 || cmd == 0x3) ++ amdgpu_uvd_force_into_vcpu_segment(bo); ++ else ++ amdgpu_uvd_force_into_uvd_segment(bo); + + r = ttm_bo_validate(&bo->tbo, &bo->placement, &tctx); + } diff --git a/queue-6.6/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch b/queue-6.6/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch new file mode 100644 index 0000000000..854b05e323 --- /dev/null +++ b/queue-6.6/drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch @@ -0,0 +1,69 @@ +From 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Timur=20Krist=C3=B3f?= +Date: Mon, 25 May 2026 13:33:19 +0200 +Subject: drm/amdgpu/uvd: Place VCPU BO only in VRAM for UVD 4.x and older +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timur Kristóf + +commit 8002b744ad70055ef11ff7d0a7d685bfe8ffe6e4 upstream. + +These UVD versions don't fully support GPUVM and are only +validated to work when their VCPU BO is placed in VRAM. + +Signed-off-by: Timur Kristóf +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +(cherry picked from commit 01b8dfc0660db5d6cdd62c22dc20f774a26ce853) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -188,6 +188,7 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + const struct common_firmware_header *hdr; + unsigned int family_id; + int i, j, r; ++ u32 vcpu_bo_domain; + + INIT_DELAYED_WORK(&adev->uvd.idle_work, amdgpu_uvd_idle_work_handler); + +@@ -319,12 +320,20 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + if (adev->firmware.load_type != AMDGPU_FW_LOAD_PSP) + bo_size += AMDGPU_GPU_PAGE_ALIGN(le32_to_cpu(hdr->ucode_size_bytes) + 8); + ++ /* UVD 5.0 and newer HW can use 64 bit addressing. */ ++ adev->uvd.address_64_bit = ++ !amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0); ++ ++ vcpu_bo_domain = AMDGPU_GEM_DOMAIN_VRAM; ++ if (adev->uvd.address_64_bit) ++ vcpu_bo_domain |= AMDGPU_GEM_DOMAIN_GTT; ++ + for (j = 0; j < adev->uvd.num_uvd_inst; j++) { + if (adev->uvd.harvest_config & (1 << j)) + continue; ++ + r = amdgpu_bo_create_kernel(adev, bo_size, PAGE_SIZE, +- AMDGPU_GEM_DOMAIN_VRAM | +- AMDGPU_GEM_DOMAIN_GTT, ++ vcpu_bo_domain, + &adev->uvd.inst[j].vcpu_bo, + &adev->uvd.inst[j].gpu_addr, + &adev->uvd.inst[j].cpu_addr); +@@ -339,10 +348,6 @@ int amdgpu_uvd_sw_init(struct amdgpu_dev + adev->uvd.filp[i] = NULL; + } + +- /* from uvd v5.0 HW addressing capacity increased to 64 bits */ +- if (!amdgpu_device_ip_block_version_cmp(adev, AMD_IP_BLOCK_TYPE_UVD, 5, 0)) +- adev->uvd.address_64_bit = true; +- + r = amdgpu_uvd_create_msg_bo_helper(adev, 128 << 10, &adev->uvd.ib_bo); + if (r) + return r; diff --git a/queue-6.6/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch b/queue-6.6/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch new file mode 100644 index 0000000000..3f4ff54680 --- /dev/null +++ b/queue-6.6/drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch @@ -0,0 +1,90 @@ +From 2d8b08844c0ecc6f2002fa68711e779aa18c8585 Mon Sep 17 00:00:00 2001 +From: Vitor Soares +Date: Tue, 5 May 2026 14:47:05 +0100 +Subject: drm/bridge: cdns-dsi: Replace deprecated UNIVERSAL_DEV_PM_OPS() + +From: Vitor Soares + +commit 2d8b08844c0ecc6f2002fa68711e779aa18c8585 upstream. + +The deprecated UNIVERSAL_DEV_PM_OPS() macro uses the provided callbacks +for both runtime PM and system sleep. This causes the DSI clocks to be +disabled twice: once during runtime suspend and again during system +suspend, resulting in a WARN message from the clock framework when +attempting to disable already-disabled clocks. + +[ 84.384540] clk:231:5 already disabled +[ 84.388314] WARNING: CPU: 2 PID: 531 at /drivers/clk/clk.c:1181 clk_core_disable+0xa4/0xac +... +[ 84.579183] Call trace: +[ 84.581624] clk_core_disable+0xa4/0xac +[ 84.585457] clk_disable+0x30/0x4c +[ 84.588857] cdns_dsi_suspend+0x20/0x58 [cdns_dsi] +[ 84.593651] pm_generic_suspend+0x2c/0x44 +[ 84.597661] ti_sci_pd_suspend+0xbc/0x15c +[ 84.601670] dpm_run_callback+0x8c/0x14c +[ 84.605588] __device_suspend+0x1a0/0x56c +[ 84.609594] dpm_suspend+0x17c/0x21c +[ 84.613165] dpm_suspend_start+0xa0/0xa8 +[ 84.617083] suspend_devices_and_enter+0x12c/0x634 +[ 84.621872] pm_suspend+0x1fc/0x368 + +To address this issue, replace UNIVERSAL_DEV_PM_OPS() with +RUNTIME_PM_OPS(). Bridge and panel drivers should only deal with runtime +PM, as the DRM framework manages system-wide power transitions through +the bridge enable() and disable() hooks. + +Link: https://lore.kernel.org/all/fbde0659-78f3-46e4-98cf-d832f765a18b@ideasonboard.com/ +Cc: stable@vger.kernel.org # 6.1.x +Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver") +Reviewed-by: Tomi Valkeinen +Signed-off-by: Vitor Soares +Reviewed-by: Luca Ceresoli +Link: https://patch.msgid.link/20260505134705.188661-2-ivitro@gmail.com +Signed-off-by: Tomi Valkeinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c ++++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c +@@ -1157,7 +1157,7 @@ static const struct mipi_dsi_host_ops cd + .transfer = cdns_dsi_transfer, + }; + +-static int __maybe_unused cdns_dsi_resume(struct device *dev) ++static int cdns_dsi_resume(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1168,7 +1168,7 @@ static int __maybe_unused cdns_dsi_resum + return 0; + } + +-static int __maybe_unused cdns_dsi_suspend(struct device *dev) ++static int cdns_dsi_suspend(struct device *dev) + { + struct cdns_dsi *dsi = dev_get_drvdata(dev); + +@@ -1178,8 +1178,9 @@ static int __maybe_unused cdns_dsi_suspe + return 0; + } + +-static UNIVERSAL_DEV_PM_OPS(cdns_dsi_pm_ops, cdns_dsi_suspend, cdns_dsi_resume, +- NULL); ++static const struct dev_pm_ops cdns_dsi_pm_ops = { ++ RUNTIME_PM_OPS(cdns_dsi_suspend, cdns_dsi_resume, NULL) ++}; + + static int cdns_dsi_drm_probe(struct platform_device *pdev) + { +@@ -1326,7 +1327,7 @@ static struct platform_driver cdns_dsi_p + .driver = { + .name = "cdns-dsi", + .of_match_table = cdns_dsi_of_match, +- .pm = &cdns_dsi_pm_ops, ++ .pm = pm_ptr(&cdns_dsi_pm_ops), + }, + }; + module_platform_driver(cdns_dsi_platform_driver); diff --git a/queue-6.6/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch b/queue-6.6/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch new file mode 100644 index 0000000000..fca4282f68 --- /dev/null +++ b/queue-6.6/drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch @@ -0,0 +1,67 @@ +From 55bd5e685bda455b9b50c835f8c8442d52a344a3 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Fri, 10 Apr 2026 04:19:01 +0000 +Subject: drm/dp/mst: fix buffer overflows in sideband chunk accumulation + +From: Ashutosh Desai + +commit 55bd5e685bda455b9b50c835f8c8442d52a344a3 upstream. + +drm_dp_sideband_append_payload() has three related bugs when processing +device-provided sideband reply data: + +1. Zero-length curchunk_len underflow: msg_len is a 6-bit field taken + directly from the DP sideband header. If a device sends msg_len=0, + curchunk_len is set to zero. The condition (curchunk_idx >= curchunk_len) + is immediately true, and curchunk_len-1 wraps to 255 (u8 underflow). + drm_dp_msg_data_crc4() reads 255 bytes from chunk[48], then memcpy() + writes 255 bytes into msg[], both far out of bounds. + +2. chunk[48] overflow: curchunk_len can reach 63 (6-bit field). chunk[] is + only 48 bytes. Multi-iteration payload assembly appends 16-byte blocks + until curchunk_idx reaches curchunk_len, writing up to 15 bytes past + the end of chunk[] into msg[]. + +3. msg[256] overflow: each chunk contributes (curchunk_len-1) bytes to + msg[]. No check ensures curlen + (curchunk_len-1) stays within msg[256], + so the memcpy can spill into adjacent struct fields. + +All three are reachable from any DP MST device that can forge sideband +reply messages on a physical connection. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260410041901.2438960-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -779,6 +779,12 @@ static bool drm_dp_sideband_append_paylo + { + u8 crc4; + ++ /* curchunk_len must be >= 1 (min 1 CRC byte) and fit in chunk[] */ ++ if (!msg->curchunk_len || ++ msg->curchunk_len > ARRAY_SIZE(msg->chunk) || ++ msg->curchunk_idx + replybuflen > ARRAY_SIZE(msg->chunk)) ++ return false; ++ + memcpy(&msg->chunk[msg->curchunk_idx], replybuf, replybuflen); + msg->curchunk_idx += replybuflen; + +@@ -789,6 +795,9 @@ static bool drm_dp_sideband_append_paylo + print_hex_dump(KERN_DEBUG, "wrong crc", + DUMP_PREFIX_NONE, 16, 1, + msg->chunk, msg->curchunk_len, false); ++ /* Guard against accumulated msg[] overflow */ ++ if (msg->curlen + msg->curchunk_len - 1 > ARRAY_SIZE(msg->msg)) ++ return false; + /* copy chunk into bigger msg */ + memcpy(&msg->msg[msg->curlen], msg->chunk, msg->curchunk_len - 1); + msg->curlen += msg->curchunk_len - 1; diff --git a/queue-6.6/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch b/queue-6.6/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch new file mode 100644 index 0000000000..db93166142 --- /dev/null +++ b/queue-6.6/drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch @@ -0,0 +1,61 @@ +From 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:17:33 +0000 +Subject: drm/dp/mst: fix OOB reads in remote DPCD/I2C sideband reply parsers + +From: Ashutosh Desai + +commit 1a8f537f5a1eeac941f262fe73078d6b08ba83c0 upstream. + +drm_dp_sideband_parse_remote_dpcd_read() reads num_bytes from the raw +message and then unconditionally does: + + memcpy(bytes, &raw->msg[idx], num_bytes); + +without checking that idx + num_bytes <= raw->curlen. raw->msg[] is +256 bytes; if a malicious or misbehaving MST hub sets num_bytes larger +than the remaining payload, the memcpy reads past the received data +into whatever follows in raw->msg[]. + +drm_dp_sideband_parse_remote_i2c_read_ack() has the same flaw (noted +with a /* TODO check */ comment since the code was introduced). + +Fix both functions by using a single combined check +(idx + num_bytes > curlen) before each memcpy. Since num_bytes is u8, +it is always >= 0, so this strictly subsumes the simpler idx > curlen +form and no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added missing fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510201733.2882224-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -861,7 +861,7 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_dpcd_read_ack.num_bytes = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + repmsg->u.remote_dpcd_read_ack.num_bytes > raw->curlen) + goto fail_len; + + memcpy(repmsg->u.remote_dpcd_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_dpcd_read_ack.num_bytes); +@@ -897,7 +897,9 @@ static bool drm_dp_sideband_parse_remote + goto fail_len; + repmsg->u.remote_i2c_read_ack.num_bytes = raw->msg[idx]; + idx++; +- /* TODO check */ ++ if (idx + repmsg->u.remote_i2c_read_ack.num_bytes > raw->curlen) ++ goto fail_len; ++ + memcpy(repmsg->u.remote_i2c_read_ack.bytes, &raw->msg[idx], repmsg->u.remote_i2c_read_ack.num_bytes); + return true; + fail_len: diff --git a/queue-6.6/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch b/queue-6.6/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch new file mode 100644 index 0000000000..6f590d016f --- /dev/null +++ b/queue-6.6/drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch @@ -0,0 +1,90 @@ +From 6b89ba3dba2f583626fb693e47e951ffb8bf591f Mon Sep 17 00:00:00 2001 +From: Ashutosh Desai +Date: Sun, 10 May 2026 20:31:28 +0000 +Subject: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers + +From: Ashutosh Desai + +commit 6b89ba3dba2f583626fb693e47e951ffb8bf591f upstream. + +Three sideband reply parsers read 16-bit fields as: + + val = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + +and check bounds only after the fact. When idx == raw->curlen, +raw->msg[idx+1] reads one byte past the received message data into +the following struct fields (curchunk_len, curchunk_idx, curlen). + +Affected functions: + - drm_dp_sideband_parse_enum_path_resources_ack() + full_payload_bw_number and avail_payload_bw_number fields + - drm_dp_sideband_parse_allocate_payload_ack() + allocated_pbn field + - drm_dp_sideband_parse_query_payload_ack() + allocated_pbn field + +Fix by using a single combined check (idx + 2 > curlen) before each +2-byte read. Since the check is strictly tighter than idx > curlen, +no separate step is needed. + +Fixes: ad7f8a1f9ced ("drm/helper: add Displayport multi-stream helper (v0.6)") +Cc: # v3.17+ +Signed-off-by: Ashutosh Desai +Reviewed-by: Lyude Paul +[added fixes tag] +Signed-off-by: Lyude Paul +Link: https://patch.msgid.link/20260510203128.2884846-1-ashutoshdesai993@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/display/drm_dp_mst_topology.c | 17 ++++------------- + 1 file changed, 4 insertions(+), 13 deletions(-) + +--- a/drivers/gpu/drm/display/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/display/drm_dp_mst_topology.c +@@ -924,16 +924,13 @@ static bool drm_dp_sideband_parse_enum_p + repmsg->u.path_resources.port_number = (raw->msg[idx] >> 4) & 0xf; + repmsg->u.path_resources.fec_capable = raw->msg[idx] & 0x1; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.full_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); + idx += 2; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.path_resources.avail_payload_bw_number = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("enum resource parse length fail %d %d\n", idx, raw->curlen); +@@ -951,12 +948,9 @@ static bool drm_dp_sideband_parse_alloca + goto fail_len; + repmsg->u.allocate_payload.vcpi = raw->msg[idx]; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.allocate_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx+1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("allocate payload parse length fail %d %d\n", idx, raw->curlen); +@@ -970,12 +964,9 @@ static bool drm_dp_sideband_parse_query_ + + repmsg->u.query_payload.port_number = (raw->msg[idx] >> 4) & 0xf; + idx++; +- if (idx > raw->curlen) ++ if (idx + 2 > raw->curlen) + goto fail_len; + repmsg->u.query_payload.allocated_pbn = (raw->msg[idx] << 8) | (raw->msg[idx + 1]); +- idx += 2; +- if (idx > raw->curlen) +- goto fail_len; + return true; + fail_len: + DRM_DEBUG_KMS("query payload parse length fail %d %d\n", idx, raw->curlen); diff --git a/queue-6.6/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch b/queue-6.6/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch new file mode 100644 index 0000000000..09f6345311 --- /dev/null +++ b/queue-6.6/drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch @@ -0,0 +1,38 @@ +From 46c31e1604d121221167cb09380de8c7d53290b9 Mon Sep 17 00:00:00 2001 +From: Sergey Shtylyov +Date: Fri, 30 Jan 2026 23:35:42 +0300 +Subject: drm/rockchip: cdn-dp: add missing check in cdn_dp_config_video() + +From: Sergey Shtylyov + +commit 46c31e1604d121221167cb09380de8c7d53290b9 upstream. + +The result of cdn_dp_reg_write() is checked everywhere (with the error +being logged by the callers) except one place in cdn_dp_config_video(). +Add the missing result check, bailing out early on error... + +Found by Linux Verification Center (linuxtesting.org) with the Svace static +analysis tool. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Signed-off-by: Sergey Shtylyov +Cc: stable@vger.kernel.org +Reviewed-by: Chaoyi Chen +Signed-off-by: Heiko Stuebner +Link: https://patch.msgid.link/adf6b313-f7db-4d8f-9000-8c65446ba041@auroraos.dev +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -683,6 +683,8 @@ int cdn_dp_config_video(struct cdn_dp_de + val = div_u64(8 * (symbol + 1), bit_per_pix) - val; + val += 2; + ret = cdn_dp_reg_write(dp, DP_VC_TABLE(15), val); ++ if (ret) ++ goto err_config_video; + + switch (video->color_depth) { + case 6: diff --git a/queue-6.6/series b/queue-6.6/series index cce986689b..18c85e49c3 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -204,3 +204,10 @@ net-mlx5e-reject-unsupported-cb-shaper-tsa-in-ets-va.patch net-ipv6-fix-dif-and-sdif-mismatch-in-raw6_icmp_erro.patch ice-fix-lag-recipe-to-profile-association.patch bpf-sockmap-fix-cork-use-after-free-in-tcp_bpf_sendm.patch +drm-rockchip-cdn-dp-add-missing-check-in-cdn_dp_config_video.patch +drm-bridge-cdns-dsi-replace-deprecated-universal_dev_pm_ops.patch +drm-dp-mst-fix-oob-reads-in-remote-dpcd-i2c-sideband-reply-parsers.patch +drm-dp-mst-fix-buffer-overflows-in-sideband-chunk-accumulation.patch +drm-dp-mst-fix-oob-reads-on-2-byte-fields-in-sideband-reply-parsers.patch +drm-amdgpu-uvd-fix-forcing-msg-fb-bos-into-vcpu-segment-when-it-isn-t-at-0-v2.patch +drm-amdgpu-uvd-place-vcpu-bo-only-in-vram-for-uvd-4.x-and-older.patch