From: Greg Kroah-Hartman Date: Wed, 29 Jul 2026 11:18:59 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v6.1.179~58 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=eefa7bb5b1fbfec201390d21a753f5e2b6781311;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch --- diff --git a/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..4f0eee650d --- /dev/null +++ b/queue-6.1/drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From 9e98ed3113943257ad6e5c1e6beddbdb482a70ad Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:26:28 -0400 +Subject: drm/amdgpu/sdma5.0: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit 9e98ed3113943257ad6e5c1e6beddbdb482a70ad upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit 8d144a0eb09537055841af48c9e7c2d4cd48e84d) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c +@@ -548,7 +548,7 @@ static void sdma_v5_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -559,7 +559,7 @@ static void sdma_v5_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..344eb48145 --- /dev/null +++ b/queue-6.1/drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From b9dd618a635d39fbb211454b6e8837b2a7f10fb0 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:27:15 -0400 +Subject: drm/amdgpu/sdma5.2: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit b9dd618a635d39fbb211454b6e8837b2a7f10fb0 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit ae658afc7f47f6147371ec42cc6b1a793dfdb5af) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v5_2.c +@@ -390,7 +390,7 @@ static void sdma_v5_2_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -401,7 +401,7 @@ static void sdma_v5_2_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch b/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch new file mode 100644 index 0000000000..7f68ddd61b --- /dev/null +++ b/queue-6.1/drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch @@ -0,0 +1,40 @@ +From ec42c96c322e5cc48099ab5e67b5cbe236cb1949 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Mon, 15 Jun 2026 18:27:54 -0400 +Subject: drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() + +From: Alex Deucher + +commit ec42c96c322e5cc48099ab5e67b5cbe236cb1949 upstream. + +There's no need to crash the kernel for these cases. + +Reviewed-by: Vitaly Prosyak +Signed-off-by: Alex Deucher +(cherry picked from commit c17a508a7d652da3728f8bbc481bfffe96d65a87) +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v6_0.c +@@ -363,7 +363,7 @@ static void sdma_v6_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); /* Ucached(UC) */ + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, lower_32_bits(seq)); +@@ -374,7 +374,7 @@ static void sdma_v6_0_ring_emit_fence(st + amdgpu_ring_write(ring, SDMA_PKT_COPY_LINEAR_HEADER_OP(SDMA_OP_FENCE) | + SDMA_PKT_FENCE_HEADER_MTYPE(0x3)); + /* zero in first two bits */ +- BUG_ON(addr & 0x3); ++ WARN_ON(addr & 0x3); + amdgpu_ring_write(ring, lower_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(addr)); + amdgpu_ring_write(ring, upper_32_bits(seq)); diff --git a/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch b/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch new file mode 100644 index 0000000000..9b79029367 --- /dev/null +++ b/queue-6.1/drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch @@ -0,0 +1,42 @@ +From 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd Mon Sep 17 00:00:00 2001 +From: Bryam Vargas +Date: Sat, 20 Jun 2026 21:43:34 -0500 +Subject: drm/virtio: bound EDID block reads to the response buffer + +From: Bryam Vargas + +commit 4e1a53892ba7f8a3e1da6bfc53c83ae7c812dccd upstream. + +virtio_get_edid_block() validates the read offset only against the +device-supplied resp->size field, never against the fixed-size resp->edid +array. The EDID block index is driven by the device-supplied extension +count, so a malicious virtio-gpu backend can advertise a large size +together with a high block count and read far past the array into adjacent +kernel memory, which is then surfaced in the parsed EDID (an out-of-bounds +read / info leak). + +Also reject any read whose end exceeds the size of the edid array. +Conforming EDID responses stay within the array and are unaffected. + +Fixes: b4b01b4995fb ("drm/virtio: add edid support") +Cc: stable@vger.kernel.org +Signed-off-by: Bryam Vargas +Signed-off-by: Dmitry Osipenko +Link: https://patch.msgid.link/20260620-b4-disp-22bba7bf-v1-1-b95924cee742@proton.me +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/virtio/virtgpu_vq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -719,7 +719,8 @@ static int virtio_get_edid_block(void *d + struct virtio_gpu_resp_edid *resp = data; + size_t start = block * EDID_LENGTH; + +- if (start + len > le32_to_cpu(resp->size)) ++ if (start + len > le32_to_cpu(resp->size) || ++ start + len > sizeof(resp->edid)) + return -EINVAL; + memcpy(buf, resp->edid + start, len); + return 0; diff --git a/queue-6.1/series b/queue-6.1/series index a145197e98..310fa55f33 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -176,3 +176,7 @@ drm-i915-gem-add-missing-nospec-on-parallel-submit-slot.patch drm-nouveau-acr-fix-missing-nvkm_done-in-error-path-of-nvkm_acr_oneinit.patch drm-radeon-fix-r100_copy_blit-for-large-bos.patch drm-amdkfd-check-bounds-in-allocate_event_notification_slot.patch +drm-virtio-bound-edid-block-reads-to-the-response-buffer.patch +drm-amdgpu-sdma6.0-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma5.2-replace-bug_on-with-warn_on.patch +drm-amdgpu-sdma5.0-replace-bug_on-with-warn_on.patch