The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From ea958422291de248b9e2eaaeea36004e84b64043 Mon Sep 17 00:00:00 2001
From: Jani Nikula <jani.nikula(a)intel.com>
Date: Thu, 10 Feb 2022 12:36:42 +0200
Subject: [PATCH] drm/i915/opregion: check port number bounds for SWSCI display
power state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The mapping from enum port to whatever port numbering scheme is used by
the SWSCI Display Power State Notification is odd, and the memory of it
has faded. In any case, the parameter only has space for ports numbered
[0..4], and UBSAN reports bit shift beyond it when the platform has port
F or more.
Since the SWSCI functionality is supposed to be obsolete for new
platforms (i.e. ones that might have port F or more), just bail out
early if the mapped and mangled port number is beyond what the Display
Power State Notification can support.
Fixes: 9c4b0a683193 ("drm/i915: add opregion function to notify bios of encoder enable/disable")
Cc: <stable(a)vger.kernel.org> # v3.13+
Cc: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Cc: Lucas De Marchi <lucas.demarchi(a)intel.com>
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4800
Signed-off-by: Jani Nikula <jani.nikula(a)intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/cc363f42d6b5a5932b6d218fefcc8…
(cherry picked from commit 24a644ebbfd3b13cda702f98907f9dd123e34bf9)
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
diff --git a/drivers/gpu/drm/i915/display/intel_opregion.c b/drivers/gpu/drm/i915/display/intel_opregion.c
index 0065111593a6..4a2662838cd8 100644
--- a/drivers/gpu/drm/i915/display/intel_opregion.c
+++ b/drivers/gpu/drm/i915/display/intel_opregion.c
@@ -360,6 +360,21 @@ int intel_opregion_notify_encoder(struct intel_encoder *intel_encoder,
port++;
}
+ /*
+ * The port numbering and mapping here is bizarre. The now-obsolete
+ * swsci spec supports ports numbered [0..4]. Port E is handled as a
+ * special case, but port F and beyond are not. The functionality is
+ * supposed to be obsolete for new platforms. Just bail out if the port
+ * number is out of bounds after mapping.
+ */
+ if (port > 4) {
+ drm_dbg_kms(&dev_priv->drm,
+ "[ENCODER:%d:%s] port %c (index %u) out of bounds for display power state notification\n",
+ intel_encoder->base.base.id, intel_encoder->base.name,
+ port_name(intel_encoder->port), port);
+ return -EINVAL;
+ }
+
if (!enable)
parm |= 4 << 8;
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 698bef8ff5d2edea5d1c9d6e5adf1bfed1e8a106 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= <ville.syrjala(a)linux.intel.com>
Date: Mon, 7 Feb 2022 15:26:59 +0200
Subject: [PATCH] drm/i915: Fix dbuf slice config lookup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Apparently I totally fumbled the loop condition when I
removed the ARRAY_SIZE() stuff from the dbuf slice config
lookup. Comparing the loop index with the active_pipes bitmask
is utter nonsense, what we want to do is check to see if the
mask is zero or not.
Note that the code actually ended up working correctly despite
the fumble, up until commit eef173954432 ("drm/i915: Allow
!join_mbus cases for adlp+ dbuf configuration") when things
broke for real.
Cc: stable(a)vger.kernel.org
Fixes: 05e8155afe35 ("drm/i915: Use a sentinel to terminate the dbuf slice arrays")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20220207132700.481-1-ville.sy…
Reviewed-by: Jani Nikula <jani.nikula(a)intel.com>
(cherry picked from commit a28fde308c3c1c174249ff9559b57f24e6850086)
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)intel.com>
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 3edba7fd0c49..da6ce24a42b2 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -4870,7 +4870,7 @@ static u8 compute_dbuf_slices(enum pipe pipe, u8 active_pipes, bool join_mbus,
{
int i;
- for (i = 0; i < dbuf_slices[i].active_pipes; i++) {
+ for (i = 0; dbuf_slices[i].active_pipes != 0; i++) {
if (dbuf_slices[i].active_pipes == active_pipes &&
dbuf_slices[i].join_mbus == join_mbus)
return dbuf_slices[i].dbuf_mask[pipe];
I'm announcing the release of the 4.4.302 kernel.
This kernel branch is now END-OF-LIFE. It will not be getting any more
updates from the kernel stable team, and will most likely quickly become
insecure and out-of-date. Do not use it anymore unless you really know
what you are doing.
Note, the CIP project at https://www.cip-project.org/ is considering to
maintain the 4.4 branch in a limited capability going forward. If you
really need to use this kernel version, please contact them.
Some simple statistics for the 4.4.y kernel branch:
First release: January 10, 2016
Last release: Febuary 3, 2022
Days supported: 2216
Changes added: 18712
Changes added per day: 8.44
Unique developers: 3532
Unique companies: 503
It was a good kernel branch, helped out by many to work as well as it
has, thanks to all for your help with this. It has powered many
millions, maybe a few billion, devices out in the world, but now it's
time to say good-bye.
The updated 4.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/s390/hypfs/hypfs_vm.c | 6 +-
arch/x86/kvm/x86.c | 14 ++--
drivers/gpu/drm/msm/msm_drv.c | 2
drivers/gpu/drm/radeon/ci_dpm.c | 6 --
drivers/hwmon/lm90.c | 2
drivers/input/serio/i8042-x86ia64io.h | 11 ++-
drivers/media/i2c/tc358743.c | 2
drivers/s390/scsi/zfcp_fc.c | 13 ++++
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 20 +-----
drivers/tty/n_gsm.c | 4 +
drivers/tty/serial/8250/8250_pci.c | 100 +++++++++++++++++++++++++++++++++-
drivers/tty/serial/stm32-usart.c | 2
drivers/usb/core/hcd.c | 14 ++++
drivers/usb/core/urb.c | 12 ++++
drivers/usb/storage/unusual_devs.h | 10 +++
fs/udf/inode.c | 9 +--
include/linux/netdevice.h | 1
include/net/ip.h | 21 +++----
kernel/power/wakelock.c | 12 +---
net/bluetooth/hci_event.c | 10 +--
net/bluetooth/mgmt.c | 8 +-
net/can/bcm.c | 20 +++---
net/core/net-procfs.c | 38 +++++++++++-
net/ipv4/ip_output.c | 11 +++
net/ipv4/raw.c | 5 +
net/ipv6/ip6_tunnel.c | 8 +-
net/packet/af_packet.c | 2
28 files changed, 267 insertions(+), 98 deletions(-)
Alan Stern (2):
usb-storage: Add unusual-devs entry for VL817 USB-SATA bridge
USB: core: Fix hang in usb_kill_urb by adding memory barriers
Brian Gix (1):
Bluetooth: refactor malicious adv data check
Cameron Williams (1):
tty: Add support for Brainboxes UC cards.
Congyu Liu (1):
net: fix information leakage in /proc/net/ptype
Eric Dumazet (3):
ipv4: avoid using shared IP generator for connected sockets
ipv4: raw: lock the socket in raw_bind()
ipv4: tcp: send zero IPID in SYNACK messages
Greg Kroah-Hartman (2):
PM: wakeup: simplify the output logic of pm_show_wakelocks()
Linux 4.4.302
Guenter Roeck (1):
hwmon: (lm90) Reduce maximum conversion rate for G781
Guillaume Bertholon (5):
Bluetooth: MGMT: Fix misplaced BT_HS check
Revert "drm/radeon/ci: disable mclk switching for high refresh rates (v2)"
Revert "tc358743: fix register i2c_rd/wr function fix"
KVM: x86: Fix misplaced backport of "work around leak of uninitialized stack contents"
Input: i8042 - Fix misplaced backport of "add ASUS Zenbook Flip to noselftest list"
Ido Schimmel (1):
ipv6_tunnel: Rate limit warning messages
Jan Kara (2):
udf: Restore i_lenAlloc when inode expansion fails
udf: Fix NULL ptr deref when converting from inline format
Jianguo Wu (1):
net-procfs: show net devices bound packet types
John Meneghini (1):
scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
Steffen Maier (1):
scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices
Valentin Caron (1):
serial: stm32: fix software flow control transfer
Vasily Gorbik (1):
s390/hypfs: include z/VM guests with access control group set
Xianting Tian (1):
drm/msm: Fix wrong size calculation
Ziyang Xuan (1):
can: bcm: fix UAF of bcm op
daniel.starke(a)siemens.com (1):
tty: n_gsm: fix SW flow control encoding/handling