dri-devel April 2022

dri-devel@lists.freedesktop.org

351 participants
951 discussions

[WARNING] [AMDGPU] Linux 5.16.18 warning about ttm_bo_release with R7 360
by Chris Rankin 03 Apr '22

03 Apr '22

Hi, I have resurrected my old AMD R7 360 card (Bonnaire?) for a machine that needed an upgrade, and now notice this warning in the dmesg log, soon after logging into X. (In fact, this warning looks rather familiar. I suspect I was already reporting it up until I removed this R7 360 from my own machine.) This is with a Fedora 5.16.18-200.fc35.x86_64 kernel. Kernel trace follows. Cheers, Chris [ 568.881348] ------------[ cut here ]------------ [ 568.881354] WARNING: CPU: 0 PID: 1 at drivers/gpu/drm/ttm/ttm_bo.c:411 ttm_bo_release+0x34c/0x370 [ttm] [ 568.881365] Modules linked in: rfcomm hid_logitech_hidpp joydev hid_logitech_dj nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter bnep sunrpc binfmt_misc btusb btrtl uvcvideo intel_rapl_msr btbcm intel_rapl_common btintel videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common bluetooth x86_pkg_temp_thermal intel_powerclamp snd_usb_audio snd_hda_codec_realtek videodev snd_hda_codec_hdmi snd_hda_codec_generic coretemp snd_usbmidi_lib snd_rawmidi mc ledtrig_audio snd_hda_intel ecdh_generic snd_intel_dspcfg snd_intel_sdw_acpi kvm_intel snd_hda_codec kvm snd_hda_core mei_pxp irqbypass snd_hwdep mei_hdcp snd_seq snd_seq_device [ 568.881405] rapl snd_pcm eeepc_wmi intel_cstate iTCO_wdt intel_pmc_bxt snd_timer mei_me iTCO_vendor_support intel_uncore snd soundcore asus_wmi sparse_keymap platform_profile rfkill at24 ppdev mei i2c_i801 i2c_smbus lpc_ich parport_pc parport wmi_bmof fuse ip_tables amdgpu iommu_v2 gpu_sched radeon crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel i2c_algo_bit drm_ttm_helper ttm drm_kms_helper cec drm r8169 wmi video ipmi_devintf ipmi_msghandler [ 568.881431] CPU: 0 PID: 1 Comm: systemd Not tainted 5.16.18-200.fc35.x86_64 #1 [ 568.881433] Hardware name: System manufacturer System Product Name/P8H61-M LE/USB3, BIOS 0803 10/21/2011 [ 568.881435] RIP: 0010:ttm_bo_release+0x34c/0x370 [ttm] [ 568.881441] Code: 00 e8 88 64 42 e3 48 8b 43 e8 eb a8 be 03 00 00 00 e8 a8 d2 1f e3 e9 97 fd ff ff e8 4e 42 42 e3 e9 8d fd ff ff 48 89 e8 eb 8a <0f> 0b e9 d7 fc ff ff e8 38 42 42 e3 e9 de fe ff ff be 03 00 00 00 [ 568.881443] RSP: 0018:ffffc1e64001fe00 EFLAGS: 00010202 [ 568.881446] RAX: 0000000000000001 RBX: ffff9fbcf26cb5b8 RCX: 000000000ce9e000 [ 568.881448] RDX: 0000000000000001 RSI: f8c959798f8a2452 RDI: ffff9fbcf26cb5b8 [ 568.881449] RBP: ffff9fbdca725280 R08: ffff9fbcf26cb5b8 R09: 00000000802a0028 [ 568.881451] R10: ffff9fbdc6386cc8 R11: ffff9fbcf4da3600 R12: ffff9fbcf26cb458 [ 568.881452] R13: ffff9fbdc01e3920 R14: ffff9fbcf4c06e40 R15: 0000000000000000 [ 568.881454] FS: 00007f869ebe8b40(0000) GS:ffff9fbdfb400000(0000) knlGS:0000000000000000 [ 568.881456] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 568.881458] CR2: 000055a016daa830 CR3: 0000000101c9c004 CR4: 00000000000606f0 [ 568.881460] Call Trace: [ 568.881463] <TASK> [ 568.881465] ? kfree+0xaa/0x3e0 [ 568.881471] ? kernfs_put.part.0+0xd9/0x1a0 [ 568.881476] amdgpu_bo_unref+0x1a/0x30 [amdgpu] [ 568.881725] amdgpu_gem_object_free+0x20/0x30 [amdgpu] [ 568.881886] drm_gem_dmabuf_release+0x36/0x50 [drm] [ 568.881930] dma_buf_release+0x42/0x90 [ 568.881936] __dentry_kill+0x101/0x180 [ 568.881942] __fput+0xe3/0x250 [ 568.881947] task_work_run+0x5c/0x90 [ 568.881952] exit_to_user_mode_prepare+0x229/0x230 [ 568.881958] syscall_exit_to_user_mode+0x18/0x40 [ 568.881963] do_syscall_64+0x48/0x90 [ 568.881968] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 568.881973] RIP: 0033:0x7f869f6d7f1b [ 568.881978] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 b3 81 f8 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 01 82 f8 ff 8b 44 [ 568.881981] RSP: 002b:00007fff4d1a6c00 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 568.881985] RAX: 0000000000000000 RBX: 00007f869ebe88f0 RCX: 00007f869f6d7f1b [ 568.881988] RDX: 0000000000000000 RSI: 000000055a016ea7 RDI: 0000000000000071 [ 568.881990] RBP: 0000000000000071 R08: 0000000000000000 R09: 000000000000007f [ 568.881992] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 [ 568.881995] R13: 000055a015029680 R14: 000055a014fe2719 R15: 000055a016dd7910 [ 568.881999] </TASK> [ 568.882001] ---[ end trace bf1924c74ac9a389 ]-

1 0

[PATCH] drivers/dma-buf: dma-buf.c: fix a typo
by Sui Jingfeng 03 Apr '22

03 Apr '22

Signed-off-by: Sui Jingfeng <15330273260(a)189.cn> --- drivers/dma-buf/dma-buf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index df23239b04fc..775d3afb4169 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -443,7 +443,7 @@ static struct file *dma_buf_getfile(struct dma_buf *dmabuf, int flags) * as a file descriptor by calling dma_buf_fd(). * * 2. Userspace passes this file-descriptors to all drivers it wants this buffer - * to share with: First the filedescriptor is converted to a &dma_buf using + * to share with: First the file descriptor is converted to a &dma_buf using * dma_buf_get(). Then the buffer is attached to the device using * dma_buf_attach(). * -- 2.25.1

2 1

[PATCH next] dma-buf/sync-file: do not allow zero size allocations
by Pavel Skripkin 03 Apr '22

03 Apr '22

syzbot reported GPF in dma_fence_array_first(), which is caused by dereferencing ZERO_PTR in dma-buf internals. ZERO_PTR was generated in sync_file_merge(). This functuion tries to reduce allocation size, but does not check if it reducing to 0. Fix reported bug by validating `index` value before passing it to krealloc_array(). Fail log: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 PID: 3595 Comm: syz-executor814 Not tainted 5.17.0-next-20220328-syzkaller #0 ... RIP: 0010:dma_fence_array_first+0x78/0xb0 drivers/dma-buf/dma-fence-array.c:234 ... Call Trace: <TASK> __dma_fence_unwrap_array include/linux/dma-fence-unwrap.h:42 [inline] dma_fence_unwrap_first include/linux/dma-fence-unwrap.h:57 [inline] sync_file_ioctl_fence_info drivers/dma-buf/sync_file.c:414 [inline] sync_file_ioctl+0x248/0x22c0 drivers/dma-buf/sync_file.c:477 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] There was same problem with initial kcalloc() allocation in same function, so it's fixed as well. Reported-and-tested-by: syzbot+5c943fe38e86d615cac2(a)syzkaller.appspotmail.com Fixes: 519f490db07e ("dma-buf/sync-file: fix warning about fence containers") Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> --- drivers/dma-buf/sync_file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/dma-buf/sync_file.c b/drivers/dma-buf/sync_file.c index b8dea4ec123b..aa744f017008 100644 --- a/drivers/dma-buf/sync_file.c +++ b/drivers/dma-buf/sync_file.c @@ -212,7 +212,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a, dma_fence_unwrap_for_each(b_fence, &b_iter, b->fence) ++num_fences; - if (num_fences > INT_MAX) + if (num_fences > INT_MAX || !num_fences) goto err_free_sync_file; fences = kcalloc(num_fences, sizeof(*fences), GFP_KERNEL); @@ -264,7 +264,7 @@ static struct sync_file *sync_file_merge(const char *name, struct sync_file *a, if (index == 0) add_fence(fences, &index, dma_fence_get_stub()); - if (num_fences > index) { + if (index && num_fences > index) { struct dma_fence **tmp; /* Keep going even when reducing the size failed */ -- 2.35.1

3 5

[PATCH] video: fbdev: Prepare cleanup of powerpc's asm/prom.h
by Christophe Leroy 02 Apr '22

02 Apr '22

powerpc's asm/prom.h brings some headers that it doesn't need itself. In order to clean it up, first add missing headers in users of asm/prom.h Signed-off-by: Christophe Leroy <christophe.leroy(a)csgroup.eu> --- drivers/video/fbdev/aty/aty128fb.c | 1 - drivers/video/fbdev/aty/atyfb_base.c | 1 - drivers/video/fbdev/aty/radeon_pm.c | 1 - drivers/video/fbdev/aty/radeonfb.h | 2 +- drivers/video/fbdev/controlfb.c | 3 --- drivers/video/fbdev/matrox/matroxfb_base.h | 1 - drivers/video/fbdev/mb862xx/mb862xxfbdrv.c | 2 ++ drivers/video/fbdev/platinumfb.c | 2 +- drivers/video/fbdev/valkyriefb.c | 3 +-- 9 files changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/video/fbdev/aty/aty128fb.c b/drivers/video/fbdev/aty/aty128fb.c index 6ff16d3132e5..b26c81233b6b 100644 --- a/drivers/video/fbdev/aty/aty128fb.c +++ b/drivers/video/fbdev/aty/aty128fb.c @@ -68,7 +68,6 @@ #ifdef CONFIG_PPC_PMAC #include <asm/machdep.h> #include <asm/pmac_feature.h> -#include <asm/prom.h> #include "../macmodes.h" #endif diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c index 1aef3d6ebd88..a3e6faed7745 100644 --- a/drivers/video/fbdev/aty/atyfb_base.c +++ b/drivers/video/fbdev/aty/atyfb_base.c @@ -79,7 +79,6 @@ #ifdef __powerpc__ #include <asm/machdep.h> -#include <asm/prom.h> #include "../macmodes.h" #endif #ifdef __sparc__ diff --git a/drivers/video/fbdev/aty/radeon_pm.c b/drivers/video/fbdev/aty/radeon_pm.c index b5fbd5329652..97a5972f5b1f 100644 --- a/drivers/video/fbdev/aty/radeon_pm.c +++ b/drivers/video/fbdev/aty/radeon_pm.c @@ -22,7 +22,6 @@ #ifdef CONFIG_PPC_PMAC #include <asm/machdep.h> -#include <asm/prom.h> #include <asm/pmac_feature.h> #endif diff --git a/drivers/video/fbdev/aty/radeonfb.h b/drivers/video/fbdev/aty/radeonfb.h index 93f403cbb415..91d81b576231 100644 --- a/drivers/video/fbdev/aty/radeonfb.h +++ b/drivers/video/fbdev/aty/radeonfb.h @@ -21,7 +21,7 @@ #include <asm/io.h> -#if defined(CONFIG_PPC) || defined(CONFIG_SPARC) +#ifdef CONFIG_SPARC #include <asm/prom.h> #endif diff --git a/drivers/video/fbdev/controlfb.c b/drivers/video/fbdev/controlfb.c index bd59e7b11ed5..aba46118b208 100644 --- a/drivers/video/fbdev/controlfb.c +++ b/drivers/video/fbdev/controlfb.c @@ -47,9 +47,6 @@ #include <linux/nvram.h> #include <linux/adb.h> #include <linux/cuda.h> -#ifdef CONFIG_PPC_PMAC -#include <asm/prom.h> -#endif #ifdef CONFIG_BOOTX_TEXT #include <asm/btext.h> #endif diff --git a/drivers/video/fbdev/matrox/matroxfb_base.h b/drivers/video/fbdev/matrox/matroxfb_base.h index 759dee996af1..958be6805f87 100644 --- a/drivers/video/fbdev/matrox/matroxfb_base.h +++ b/drivers/video/fbdev/matrox/matroxfb_base.h @@ -47,7 +47,6 @@ #include <asm/unaligned.h> #if defined(CONFIG_PPC_PMAC) -#include <asm/prom.h> #include "../macmodes.h" #endif diff --git a/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c index 63721337a377..a7508f5be343 100644 --- a/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c +++ b/drivers/video/fbdev/mb862xx/mb862xxfbdrv.c @@ -18,6 +18,8 @@ #include <linux/interrupt.h> #include <linux/pci.h> #if defined(CONFIG_OF) +#include <linux/of_address.h> +#include <linux/of_irq.h> #include <linux/of_platform.h> #endif #include "mb862xxfb.h" diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c index ce413a9df06e..5b9e26ea6449 100644 --- a/drivers/video/fbdev/platinumfb.c +++ b/drivers/video/fbdev/platinumfb.c @@ -30,9 +30,9 @@ #include <linux/fb.h> #include <linux/init.h> #include <linux/nvram.h> +#include <linux/of_address.h> #include <linux/of_device.h> #include <linux/of_platform.h> -#include <asm/prom.h> #include "macmodes.h" #include "platinumfb.h" diff --git a/drivers/video/fbdev/valkyriefb.c b/drivers/video/fbdev/valkyriefb.c index 8425afe37d7c..a6c9d4f26669 100644 --- a/drivers/video/fbdev/valkyriefb.c +++ b/drivers/video/fbdev/valkyriefb.c @@ -54,10 +54,9 @@ #include <linux/nvram.h> #include <linux/adb.h> #include <linux/cuda.h> +#include <linux/of_address.h> #ifdef CONFIG_MAC #include <asm/macintosh.h> -#else -#include <asm/prom.h> #endif #include "macmodes.h" -- 2.35.1

2 1

[PATCH AUTOSEL 5.17 001/149] drm: Add orientation quirk for GPD Win Max
by Sasha Levin 02 Apr '22

02 Apr '22

From: Anisse Astier <anisse(a)astier.eu> [ Upstream commit 0b464ca3e0dd3cec65f28bc6d396d82f19080f69 ] Panel is 800x1280, but mounted on a laptop form factor, sideways. Signed-off-by: Anisse Astier <anisse(a)astier.eu> Reviewed-by: Hans de Goede <hdegoede(a)redhat.com> Signed-off-by: Jani Nikula <jani.nikula(a)intel.com> Link: https://patchwork.freedesktop.org/patch/msgid/20211229222200.53128-3-anisse… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c index b910978d3e48..4e853acfd1e8 100644 --- a/drivers/gpu/drm/drm_panel_orientation_quirks.c +++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c @@ -180,6 +180,12 @@ static const struct dmi_system_id orientation_data[] = { DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), }, .driver_data = (void *)&lcd720x1280_rightside_up, + }, { /* GPD Win Max */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), + }, + .driver_data = (void *)&lcd800x1280_rightside_up, }, { /* * GPD Pocket, note that the the DMI data is less generic then * it seems, devices with a board-vendor of "AMI Corporation" -- 2.34.1

3 23

Re: [PATCH 4/4] drm/etnaviv: Don't break exclusive fence ordering
by Sui Jingfeng 02 Apr '22

02 Apr '22

Hi, > There's only one exclusive slot, and we must not break the ordering. > Adding a new exclusive fence drops all previous fences from the > dma_resv. To avoid violating the signalling order we err on the side of > over-synchronizing by waiting for the existing fences, even if > userspace asked us to ignore them. > > A better fix would be to us a dma_fence_chain or _array like e.g. > amdgpu now uses, but it probably makes sense to lift this into > dma-resv.c code as a proper concept, so that drivers don't have to > hack up their own solution each on their own. Hence go with the simple > fix for now. I find a typo in the commit message, us -> use

1 0

[PATCH] drm/etnaviv: introduce a function to create etnaviv platform device
by Sui Jingfeng 02 Apr '22

02 Apr '22

This patch make the code more clear, call of_node_put(np) only once in for_each_compatible_node(np, NULL, "vivante,gc") loop instead of three. Signed-off-by: Sui Jingfeng <15330273260(a)189.cn> --- drivers/gpu/drm/etnaviv/etnaviv_drv.c | 36 +++++++++++++++++---------- 1 file changed, 23 insertions(+), 13 deletions(-) diff --git a/drivers/gpu/drm/etnaviv/etnaviv_drv.c b/drivers/gpu/drm/etnaviv/etnaviv_drv.c index 0b756ecb1bc2..42cb624cf1ae 100644 --- a/drivers/gpu/drm/etnaviv/etnaviv_drv.c +++ b/drivers/gpu/drm/etnaviv/etnaviv_drv.c @@ -659,6 +659,26 @@ static struct platform_driver etnaviv_platform_driver = { static struct platform_device *etnaviv_drm; +static int etnaviv_create_platform_device(const char *name) +{ + struct platform_device *pdev; + int ret; + + pdev = platform_device_alloc(name, PLATFORM_DEVID_NONE); + if (!pdev) + return -ENOMEM; + + ret = platform_device_add(pdev); + if (ret) { + platform_device_put(pdev); + return ret; + } + + etnaviv_drm = pdev; + + return 0; +} + static int __init etnaviv_init(void) { struct platform_device *pdev; @@ -683,22 +703,12 @@ static int __init etnaviv_init(void) if (!of_device_is_available(np)) continue; - pdev = platform_device_alloc("etnaviv", PLATFORM_DEVID_NONE); - if (!pdev) { - ret = -ENOMEM; - of_node_put(np); - goto unregister_platform_driver; - } + of_node_put(np); - ret = platform_device_add(pdev); - if (ret) { - platform_device_put(pdev); - of_node_put(np); + ret = etnaviv_create_platform_device("etnaviv"); + if (ret) goto unregister_platform_driver; - } - etnaviv_drm = pdev; - of_node_put(np); break; } -- 2.25.1

1 0

Patch "drm/dp: Fix off-by-one in register cache size" has been added to the 5.17-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled drm/dp: Fix off-by-one in register cache size to the 5.17-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: drm-dp-fix-off-by-one-in-register-cache-size.patch and it can be found in the queue-5.17 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From d4da1f27396fb1dde079447a3612f4f512caed07 Mon Sep 17 00:00:00 2001 From: Kees Cook <keescook(a)chromium.org> Date: Thu, 24 Feb 2022 19:56:09 -0800 Subject: drm/dp: Fix off-by-one in register cache size From: Kees Cook <keescook(a)chromium.org> commit d4da1f27396fb1dde079447a3612f4f512caed07 upstream. The pcon_dsc_dpcd array holds 13 registers (0x92 through 0x9E). Fix the math to calculate the max size. Found from a -Warray-bounds build: drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_pcon_dsc_bpp_incr': drivers/gpu/drm/drm_dp_helper.c:3130:28: error: array subscript 12 is outside array bounds of 'const u8[12]' {aka 'const unsigned char[12]'} [-Werror=array-bounds] 3130 | buf = pcon_dsc_dpcd[DP_PCON_DSC_BPP_INCR - DP_PCON_DSC_ENCODER]; | ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/drm_dp_helper.c:3126:39: note: while referencing 'pcon_dsc_dpcd' 3126 | int drm_dp_pcon_dsc_bpp_incr(const u8 pcon_dsc_dpcd[DP_PCON_DSC_ENCODER_CAP_SIZE]) | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)linux.ie> Cc: dri-devel(a)lists.freedesktop.org Fixes: e2e16da398d9 ("drm/dp_helper: Add support for Configuring DSC for HDMI2.1 Pcon") Cc: stable(a)vger.kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/lkml/20211214001849.GA62559@embeddedor/ Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20220105173310.2420598-1-keescook@chromium.org Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220225035610.2552144-2-kees… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/drm/drm_dp_helper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/drm/drm_dp_helper.h +++ b/include/drm/drm_dp_helper.h @@ -456,7 +456,7 @@ struct drm_panel; #define DP_FEC_CAPABILITY_1 0x091 /* 2.0 */ /* DP-HDMI2.1 PCON DSC ENCODER SUPPORT */ -#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xC /* 0x9E - 0x92 */ +#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xD /* 0x92 through 0x9E */ #define DP_PCON_DSC_ENCODER 0x092 # define DP_PCON_DSC_ENCODER_SUPPORTED (1 << 0) # define DP_PCON_DSC_PPS_ENC_OVERRIDE (1 << 1) Patches currently in stable-queue which might be from keescook(a)chromium.org are queue-5.17/stack-constrain-and-fix-stack-offset-randomization-w.patch queue-5.17/coredump-also-dump-first-pages-of-non-executable-elf-libraries.patch queue-5.17/selftests-lkdtm-add-ubsan-config.patch queue-5.17/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch queue-5.17/media-omap3isp-use-struct_group-for-memcpy-region.patch queue-5.17/gcc-plugins-stackleak-exactly-match-strings-instead-.patch queue-5.17/exec-force-single-empty-string-when-argv-is-empty.patch queue-5.17/drm-dp-fix-off-by-one-in-register-cache-size.patch queue-5.17/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch queue-5.17/drm-dp-fix-oob-read-when-handling-post-cursor2-regis.patch

1 0

Patch "drm/dp: Fix off-by-one in register cache size" has been added to the 5.16-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled drm/dp: Fix off-by-one in register cache size to the 5.16-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: drm-dp-fix-off-by-one-in-register-cache-size.patch and it can be found in the queue-5.16 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From d4da1f27396fb1dde079447a3612f4f512caed07 Mon Sep 17 00:00:00 2001 From: Kees Cook <keescook(a)chromium.org> Date: Thu, 24 Feb 2022 19:56:09 -0800 Subject: drm/dp: Fix off-by-one in register cache size From: Kees Cook <keescook(a)chromium.org> commit d4da1f27396fb1dde079447a3612f4f512caed07 upstream. The pcon_dsc_dpcd array holds 13 registers (0x92 through 0x9E). Fix the math to calculate the max size. Found from a -Warray-bounds build: drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_pcon_dsc_bpp_incr': drivers/gpu/drm/drm_dp_helper.c:3130:28: error: array subscript 12 is outside array bounds of 'const u8[12]' {aka 'const unsigned char[12]'} [-Werror=array-bounds] 3130 | buf = pcon_dsc_dpcd[DP_PCON_DSC_BPP_INCR - DP_PCON_DSC_ENCODER]; | ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/drm_dp_helper.c:3126:39: note: while referencing 'pcon_dsc_dpcd' 3126 | int drm_dp_pcon_dsc_bpp_incr(const u8 pcon_dsc_dpcd[DP_PCON_DSC_ENCODER_CAP_SIZE]) | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)linux.ie> Cc: dri-devel(a)lists.freedesktop.org Fixes: e2e16da398d9 ("drm/dp_helper: Add support for Configuring DSC for HDMI2.1 Pcon") Cc: stable(a)vger.kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/lkml/20211214001849.GA62559@embeddedor/ Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20220105173310.2420598-1-keescook@chromium.org Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220225035610.2552144-2-kees… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/drm/drm_dp_helper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/drm/drm_dp_helper.h +++ b/include/drm/drm_dp_helper.h @@ -456,7 +456,7 @@ struct drm_panel; #define DP_FEC_CAPABILITY_1 0x091 /* 2.0 */ /* DP-HDMI2.1 PCON DSC ENCODER SUPPORT */ -#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xC /* 0x9E - 0x92 */ +#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xD /* 0x92 through 0x9E */ #define DP_PCON_DSC_ENCODER 0x092 # define DP_PCON_DSC_ENCODER_SUPPORTED (1 << 0) # define DP_PCON_DSC_PPS_ENC_OVERRIDE (1 << 1) Patches currently in stable-queue which might be from keescook(a)chromium.org are queue-5.16/stack-constrain-and-fix-stack-offset-randomization-w.patch queue-5.16/coredump-also-dump-first-pages-of-non-executable-elf-libraries.patch queue-5.16/selftests-lkdtm-add-ubsan-config.patch queue-5.16/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch queue-5.16/media-omap3isp-use-struct_group-for-memcpy-region.patch queue-5.16/gcc-plugins-stackleak-exactly-match-strings-instead-.patch queue-5.16/exec-force-single-empty-string-when-argv-is-empty.patch queue-5.16/drm-dp-fix-off-by-one-in-register-cache-size.patch queue-5.16/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch

1 0

Patch "drm/dp: Fix off-by-one in register cache size" has been added to the 5.15-stable tree
by gregkh＠linuxfoundation.org 02 Apr '22

02 Apr '22

This is a note to let you know that I've just added the patch titled drm/dp: Fix off-by-one in register cache size to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… The filename of the patch is: drm-dp-fix-off-by-one-in-register-cache-size.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable(a)vger.kernel.org> know about it. >From d4da1f27396fb1dde079447a3612f4f512caed07 Mon Sep 17 00:00:00 2001 From: Kees Cook <keescook(a)chromium.org> Date: Thu, 24 Feb 2022 19:56:09 -0800 Subject: drm/dp: Fix off-by-one in register cache size From: Kees Cook <keescook(a)chromium.org> commit d4da1f27396fb1dde079447a3612f4f512caed07 upstream. The pcon_dsc_dpcd array holds 13 registers (0x92 through 0x9E). Fix the math to calculate the max size. Found from a -Warray-bounds build: drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_pcon_dsc_bpp_incr': drivers/gpu/drm/drm_dp_helper.c:3130:28: error: array subscript 12 is outside array bounds of 'const u8[12]' {aka 'const unsigned char[12]'} [-Werror=array-bounds] 3130 | buf = pcon_dsc_dpcd[DP_PCON_DSC_BPP_INCR - DP_PCON_DSC_ENCODER]; | ~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/drm_dp_helper.c:3126:39: note: while referencing 'pcon_dsc_dpcd' 3126 | int drm_dp_pcon_dsc_bpp_incr(const u8 pcon_dsc_dpcd[DP_PCON_DSC_ENCODER_CAP_SIZE]) | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Cc: Daniel Vetter <daniel(a)ffwll.ch> Cc: Maarten Lankhorst <maarten.lankhorst(a)linux.intel.com> Cc: Maxime Ripard <mripard(a)kernel.org> Cc: Thomas Zimmermann <tzimmermann(a)suse.de> Cc: David Airlie <airlied(a)linux.ie> Cc: dri-devel(a)lists.freedesktop.org Fixes: e2e16da398d9 ("drm/dp_helper: Add support for Configuring DSC for HDMI2.1 Pcon") Cc: stable(a)vger.kernel.org Reviewed-by: Gustavo A. R. Silva <gustavoars(a)kernel.org> Link: https://lore.kernel.org/lkml/20211214001849.GA62559@embeddedor/ Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20220105173310.2420598-1-keescook@chromium.org Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20220225035610.2552144-2-kees… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- include/drm/drm_dp_helper.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/include/drm/drm_dp_helper.h +++ b/include/drm/drm_dp_helper.h @@ -455,7 +455,7 @@ struct drm_panel; # define DP_FEC_BIT_ERROR_COUNT_CAP (1 << 3) /* DP-HDMI2.1 PCON DSC ENCODER SUPPORT */ -#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xC /* 0x9E - 0x92 */ +#define DP_PCON_DSC_ENCODER_CAP_SIZE 0xD /* 0x92 through 0x9E */ #define DP_PCON_DSC_ENCODER 0x092 # define DP_PCON_DSC_ENCODER_SUPPORTED (1 << 0) # define DP_PCON_DSC_PPS_ENC_OVERRIDE (1 << 1) Patches currently in stable-queue which might be from keescook(a)chromium.org are queue-5.15/stack-constrain-and-fix-stack-offset-randomization-w.patch queue-5.15/coredump-also-dump-first-pages-of-non-executable-elf-libraries.patch queue-5.15/selftests-lkdtm-add-ubsan-config.patch queue-5.15/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch queue-5.15/gcc-plugins-stackleak-exactly-match-strings-instead-.patch queue-5.15/exec-force-single-empty-string-when-argv-is-empty.patch queue-5.15/drm-dp-fix-off-by-one-in-register-cache-size.patch queue-5.15/pstore-don-t-use-semaphores-in-always-atomic-context-code.patch

1 0

← Newer
1
...
88
89
90
91
92
93
94
95
96
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

dri-devel April 2022