diff options
author | Sasha Levin <sashal@kernel.org> | 2024-04-21 13:10:14 -0400 |
---|---|---|
committer | Sasha Levin <sashal@kernel.org> | 2024-04-21 13:10:14 -0400 |
commit | ba307a5410f4272d164235157b30053427b626a0 (patch) | |
tree | 6fa9939bf0d89240c6c641cbeffb0d12fb8c4406 | |
parent | 57d2d8b91e32f78ae58aeb870e397ebf0b4c69aa (diff) | |
download | stable-queue-ba307a5410f4272d164235157b30053427b626a0.tar.gz |
Fixes for 4.19
Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r-- | queue-4.19/drm-nv04-fix-out-of-bounds-access.patch | 86 | ||||
-rw-r--r-- | queue-4.19/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch | 41 | ||||
-rw-r--r-- | queue-4.19/series | 2 |
3 files changed, 129 insertions, 0 deletions
diff --git a/queue-4.19/drm-nv04-fix-out-of-bounds-access.patch b/queue-4.19/drm-nv04-fix-out-of-bounds-access.patch new file mode 100644 index 0000000000..ce22c01e1b --- /dev/null +++ b/queue-4.19/drm-nv04-fix-out-of-bounds-access.patch @@ -0,0 +1,86 @@ +From 1559b35428e3fad2bb7129cb459338ebb217684c Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Thu, 11 Apr 2024 14:08:52 +0300 +Subject: drm: nv04: Fix out of bounds access + +From: Mikhail Kobuk <m.kobuk@ispras.ru> + +[ Upstream commit cf92bb778eda7830e79452c6917efa8474a30c1e ] + +When Output Resource (dcb->or) value is assigned in +fabricate_dcb_output(), there may be out of bounds access to +dac_users array in case dcb->or is zero because ffs(dcb->or) is +used as index there. +The 'or' argument of fabricate_dcb_output() must be interpreted as a +number of bit to set, not value. + +Utilize macros from 'enum nouveau_or' in calls instead of hardcoding. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 2e5702aff395 ("drm/nouveau: fabricate DCB encoder table for iMac G4") +Fixes: 670820c0e6a9 ("drm/nouveau: Workaround incorrect DCB entry on a GeForce3 Ti 200.") +Signed-off-by: Mikhail Kobuk <m.kobuk@ispras.ru> +Signed-off-by: Danilo Krummrich <dakr@redhat.com> +Link: https://patchwork.freedesktop.org/patch/msgid/20240411110854.16701-1-m.kobuk@ispras.ru +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/gpu/drm/nouveau/nouveau_bios.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c +index 66bf2aff4a3ed..adecda51a306d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_bios.c ++++ b/drivers/gpu/drm/nouveau/nouveau_bios.c +@@ -25,6 +25,7 @@ + #include <drm/drmP.h> + + #include "nouveau_drv.h" ++#include "nouveau_bios.h" + #include "nouveau_reg.h" + #include "dispnv04/hw.h" + #include "nouveau_encoder.h" +@@ -1674,7 +1675,7 @@ apply_dcb_encoder_quirks(struct drm_device *dev, int idx, u32 *conn, u32 *conf) + */ + if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) { + if (*conn == 0xf2005014 && *conf == 0xffffffff) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B); + return false; + } + } +@@ -1760,26 +1761,26 @@ fabricate_dcb_encoder_table(struct drm_device *dev, struct nvbios *bios) + #ifdef __powerpc__ + /* Apple iMac G4 NV17 */ + if (of_machine_is_compatible("PowerMac4,5")) { +- fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1); +- fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B); ++ fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C); + return; + } + #endif + + /* Make up some sane defaults */ + fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, +- bios->legacy.i2c_indices.crt, 1, 1); ++ bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B); + + if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0) + fabricate_dcb_output(dcb, DCB_OUTPUT_TV, + bios->legacy.i2c_indices.tv, +- all_heads, 0); ++ all_heads, DCB_OUTPUT_A); + + else if (bios->tmds.output0_script_ptr || + bios->tmds.output1_script_ptr) + fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, + bios->legacy.i2c_indices.panel, +- all_heads, 1); ++ all_heads, DCB_OUTPUT_B); + } + + static int +-- +2.43.0 + diff --git a/queue-4.19/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch b/queue-4.19/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch new file mode 100644 index 0000000000..110602e247 --- /dev/null +++ b/queue-4.19/rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch @@ -0,0 +1,41 @@ +From 76861fa9986353d2e22321d3ddc6556a78aa9584 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 3 Apr 2024 12:03:46 +0300 +Subject: RDMA/mlx5: Fix port number for counter query in multi-port + configuration + +From: Michael Guralnik <michaelgur@nvidia.com> + +[ Upstream commit be121ffb384f53e966ee7299ffccc6eeb61bc73d ] + +Set the correct port when querying PPCNT in multi-port configuration. +Distinguish between cases where switchdev mode was enabled to multi-port +configuration and don't overwrite the queried port to 1 in multi-port +case. + +Fixes: 74b30b3ad5ce ("RDMA/mlx5: Set local port to one when accessing counters") +Signed-off-by: Michael Guralnik <michaelgur@nvidia.com> +Link: https://lore.kernel.org/r/9bfcc8ade958b760a51408c3ad654a01b11f7d76.1712134988.git.leon@kernel.org +Signed-off-by: Leon Romanovsky <leon@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/infiniband/hw/mlx5/mad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/mad.c +index fb6dcd12db254..a7b20db03901c 100644 +--- a/drivers/infiniband/hw/mlx5/mad.c ++++ b/drivers/infiniband/hw/mlx5/mad.c +@@ -216,7 +216,8 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8 port_num, + mdev = dev->mdev; + mdev_port_num = 1; + } +- if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1) { ++ if (MLX5_CAP_GEN(dev->mdev, num_ports) == 1 && ++ !mlx5_core_mp_enabled(mdev)) { + /* set local port to one for Function-Per-Port HCA. */ + mdev = dev->mdev; + mdev_port_num = 1; +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 244c1d5f01..386ce761e9 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -17,3 +17,5 @@ revert-tracing-trigger-fix-to-return-error-if-failed-to-alloc-snapshot.patch netfilter-nf_tables-__nft_expr_type_get-selects-spec.patch netfilter-nf_tables-fix-potential-data-race-in-__nft.patch tun-limit-printing-rate-when-illegal-packet-received.patch +rdma-mlx5-fix-port-number-for-counter-query-in-multi.patch +drm-nv04-fix-out-of-bounds-access.patch |