[PATCH AUTOSEL 6.5 31/37] drm/amd/display: fix num_ways overflow error

From: Samson Tam [ Upstream commit 79f3f1b66753b3a3a269d73676bf50987921f267 ] [Why] Helper function calculates num_ways using 32-bit. But is returned as 8-bit. If num_ways exceeds 8-bit, then it reports back the incorrect num_ways and erroneously uses MALL when it should not [How] Make ret

[PATCH AUTOSEL 6.5 32/37] drm/amd: check num of link levels when update pcie param

From: "Lin.Cao" [ Upstream commit 406e8845356d18bdf3d3a23b347faf67706472ec ] In SR-IOV environment, the value of pcie_table->num_of_link_levels will be 0, and num_of_levels - 1 will cause array index out of bounds Signed-off-by: Lin.Cao Acked-by: Jingwen Chen Signed-off-by: Alex Deucher Sign

[PATCH AUTOSEL 6.1 01/25] drm/gma500: Fix call trace when psb_gem_mm_init() fails

From: Sui Jingfeng [ Upstream commit da596080b2b400c50fe9f8f237bcaf09fed06af8 ] Because the gma_irq_install() is call after psb_gem_mm_init() function, when psb_gem_mm_init() fails, the interrupt line haven't been allocated. Yet the gma_irq_uninstall() is called in the psb_driver_unload() functi

[PATCH AUTOSEL 6.1 02/25] drm/komeda: drop all currently held locks if deadlock happens

From: "baozhu.liu" [ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ] If komeda_pipeline_unbound_components() returns -EDEADLK, it means that a deadlock happened in the locking context. Currently, komeda is not dealing with the deadlock properly,producing the following output when CONF

[PATCH AUTOSEL 6.1 03/25] drm/amdgpu: not to save bo in the case of RAS err_event_athub

From: "David (Ming Qiang) Wu" [ Upstream commit fa1f1cc09d588a90c8ce3f507c47df257461d148 ] err_event_athub will corrupt VCPU buffer and not good to be restored in amdgpu_vcn_resume() and in this case the VCPU buffer needs to be cleared for VCN firmware to work properly. Acked-by: Leo Liu Signe

[PATCH AUTOSEL 6.1 04/25] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

From: Xiaogang Chen [ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ] prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free". Signed-off-by:

[PATCH AUTOSEL 6.1 05/25] drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments

From: Mario Limonciello [ Upstream commit 7752ccf85b929a22e658ec145283e8f31232f4bb ] The matching values for `pcie_gen_cap` and `pcie_width_cap` when fetched from powerplay tables are 1 byte, so narrow the arguments to match to ensure min() and max() comparisons without casts. Signed-off-by: Ma

[PATCH AUTOSEL 6.1 06/25] drm/amd/display: use full update for clip size increase of large plane source

From: Wenjing Liu [ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ] [why] Clip size increase will increase viewport, which could cause us to switch to MPC combine. If we skip full update, we are not able to change to MPC combine in fast update. This will cause corruption showing on t

[PATCH AUTOSEL 6.1 10/25] drm_lease.c: copy user-array safely

From: Philipp Stanner [ Upstream commit f37d63e219c39199a59b8b8a211412ff27192830 ] Currently, there is no overflow-check with memdup_user(). Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely. Suggested-by: David Airlie Signed-off-by:

[PATCH AUTOSEL 6.1 11/25] drm: vmwgfx_surface.c: copy user-array safely

From: Philipp Stanner [ Upstream commit 06ab64a0d836ac430c5f94669710a78aa43942cb ] Currently, there is no overflow-check with memdup_user(). Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely. Suggested-by: David Airlie Signed-off-by:

[PATCH AUTOSEL 6.1 12/25] drm/msm/dp: skip validity check for DP CTS EDID checksum

From: Jani Nikula [ Upstream commit a251c9d8e30833b260101edb9383b176ee2b7cb1 ] The DP CTS test for EDID last block checksum expects the checksum for the last block, invalid or not. Skip the validity check. For the most part (*), the EDIDs returned by drm_get_edid() will be valid anyway, and the

[PATCH AUTOSEL 6.1 13/25] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 6.1 14/25] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 6.1 15/25] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH AUTOSEL 6.1 16/25] drm/amdgpu: Fix potential null pointer derefernce

From: "Stanley.Yang" [ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ] The amdgpu_ras_get_context may return NULL if device not support ras feature, so add check before using. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

[PATCH AUTOSEL 6.1 17/25] drm/panel: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke

[PATCH AUTOSEL 6.1 18/25] drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ] In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke Reviewe

[PATCH AUTOSEL 6.1 19/25] drm/radeon: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit 2c1fe3c480f9e1deefd50d4b18be4a046011ee1f ] In radeon_tv_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null point dereference. Signed-off-by: Ma K

[PATCH AUTOSEL 6.1 20/25] drm/amdgpu/vkms: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ] In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null pointer dereference. Signed-off

[PATCH AUTOSEL 6.1 21/25] drm/panel: st7703: Pick different reset sequence

From: Ondrej Jirman [ Upstream commit d12d635bb03c7cb4830acb641eb176ee9ff2aa89 ] Switching to a different reset sequence, enabling IOVCC before enabling VCC. There also needs to be a delay after enabling the supplies and before deasserting the reset. The datasheet specifies 1ms after the suppli

[PATCH AUTOSEL 6.1 22/25] drm/amdkfd: Fix shift out-of-bounds issue

From: Jesse Zhang [ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ] [ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int' [ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu [ 567.614502] Har

[PATCH AUTOSEL 6.1 23/25] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

From: Qu Huang [ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresp

[PATCH AUTOSEL 5.15 01/20] drm/komeda: drop all currently held locks if deadlock happens

From: "baozhu.liu" [ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ] If komeda_pipeline_unbound_components() returns -EDEADLK, it means that a deadlock happened in the locking context. Currently, komeda is not dealing with the deadlock properly,producing the following output when CONF

[PATCH AUTOSEL 5.15 02/20] drm/amdkfd: Fix a race condition of vram buffer unref in svm code

From: Xiaogang Chen [ Upstream commit 709c348261618da7ed89d6c303e2ceb9e453ba74 ] prange->svm_bo unref can happen in both mmu callback and a callback after migrate to system ram. Both are async call in different tasks. Sync svm_bo unref operation to avoid random "use-after-free". Signed-off-by:

[PATCH AUTOSEL 5.15 03/20] drm/amd/display: use full update for clip size increase of large plane source

From: Wenjing Liu [ Upstream commit 05b78277ef0efc1deebc8a22384fffec29a3676e ] [why] Clip size increase will increase viewport, which could cause us to switch to MPC combine. If we skip full update, we are not able to change to MPC combine in fast update. This will cause corruption showing on t

[PATCH AUTOSEL 5.15 07/20] drm: vmwgfx_surface.c: copy user-array safely

From: Philipp Stanner [ Upstream commit 06ab64a0d836ac430c5f94669710a78aa43942cb ] Currently, there is no overflow-check with memdup_user(). Use the new function memdup_array_user() instead of memdup_user() for duplicating the user-space array safely. Suggested-by: David Airlie Signed-off-by:

[PATCH AUTOSEL 5.15 08/20] drm/msm/dp: skip validity check for DP CTS EDID checksum

From: Jani Nikula [ Upstream commit a251c9d8e30833b260101edb9383b176ee2b7cb1 ] The DP CTS test for EDID last block checksum expects the checksum for the last block, invalid or not. Skip the validity check. For the most part (*), the EDIDs returned by drm_get_edid() will be valid anyway, and the

[PATCH AUTOSEL 5.15 09/20] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.15 10/20] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.15 11/20] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH AUTOSEL 5.15 12/20] drm/amdgpu: Fix potential null pointer derefernce

From: "Stanley.Yang" [ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ] The amdgpu_ras_get_context may return NULL if device not support ras feature, so add check before using. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

[PATCH AUTOSEL 5.15 13/20] drm/panel: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke

[PATCH AUTOSEL 5.15 14/20] drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ] In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke Reviewe

[PATCH AUTOSEL 5.15 15/20] drm/amdgpu/vkms: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit cd90511557fdfb394bb4ac4c3b539b007383914c ] In amdgpu_vkms_conn_get_modes(), the return value of drm_cvt_mode() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_cvt_mode(). Add a check to avoid null pointer dereference. Signed-off

[PATCH AUTOSEL 5.15 16/20] drm/panel: st7703: Pick different reset sequence

From: Ondrej Jirman [ Upstream commit d12d635bb03c7cb4830acb641eb176ee9ff2aa89 ] Switching to a different reset sequence, enabling IOVCC before enabling VCC. There also needs to be a delay after enabling the supplies and before deasserting the reset. The datasheet specifies 1ms after the suppli

[PATCH AUTOSEL 5.15 17/20] drm/amdkfd: Fix shift out-of-bounds issue

From: Jesse Zhang [ Upstream commit 282c1d793076c2edac6c3db51b7e8ed2b41d60a5 ] [ 567.613292] shift exponent 255 is too large for 64-bit type 'long unsigned int' [ 567.614498] CPU: 5 PID: 238 Comm: kworker/5:1 Tainted: G OE 6.2.0-34-generic #34~22.04.1-Ubuntu [ 567.614502] Har

[PATCH AUTOSEL 5.15 18/20] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

From: Qu Huang [ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresp

[PATCH AUTOSEL 5.10 01/11] drm/komeda: drop all currently held locks if deadlock happens

From: "baozhu.liu" [ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ] If komeda_pipeline_unbound_components() returns -EDEADLK, it means that a deadlock happened in the locking context. Currently, komeda is not dealing with the deadlock properly,producing the following output when CONF

[PATCH AUTOSEL 5.10 02/11] drm/msm/dp: skip validity check for DP CTS EDID checksum

From: Jani Nikula [ Upstream commit a251c9d8e30833b260101edb9383b176ee2b7cb1 ] The DP CTS test for EDID last block checksum expects the checksum for the last block, invalid or not. Skip the validity check. For the most part (*), the EDIDs returned by drm_get_edid() will be valid anyway, and the

[PATCH AUTOSEL 5.10 03/11] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.10 04/11] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.10 05/11] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH AUTOSEL 5.10 06/11] drm/amdgpu: Fix potential null pointer derefernce

From: "Stanley.Yang" [ Upstream commit 80285ae1ec8717b597b20de38866c29d84d321a1 ] The amdgpu_ras_get_context may return NULL if device not support ras feature, so add check before using. Signed-off-by: Stanley.Yang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin

[PATCH AUTOSEL 5.10 08/11] drm/panel/panel-tpo-tpg110: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit f22def5970c423ea7f87d5247bd0ef91416b0658 ] In tpg110_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke Reviewe

[PATCH AUTOSEL 5.10 07/11] drm/panel: fix a possible null pointer dereference

From: Ma Ke [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke

[PATCH AUTOSEL 5.10 09/11] drm/panel: st7703: Pick different reset sequence

From: Ondrej Jirman [ Upstream commit d12d635bb03c7cb4830acb641eb176ee9ff2aa89 ] Switching to a different reset sequence, enabling IOVCC before enabling VCC. There also needs to be a delay after enabling the supplies and before deasserting the reset. The datasheet specifies 1ms after the suppli

[PATCH AUTOSEL 5.10 10/11] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

From: Qu Huang [ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresp

[PATCH AUTOSEL 5.4 1/6] drm/komeda: drop all currently held locks if deadlock happens

From: "baozhu.liu" [ Upstream commit 19ecbe8325a2a7ffda5ff4790955b84eaccba49f ] If komeda_pipeline_unbound_components() returns -EDEADLK, it means that a deadlock happened in the locking context. Currently, komeda is not dealing with the deadlock properly,producing the following output when CONF

[PATCH AUTOSEL 5.4 2/6] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.4 3/6] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 5.4 4/6] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH AUTOSEL 5.4 5/6] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

From: Qu Huang [ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresp

[PATCH AUTOSEL 4.19 2/5] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 4.19 1/5] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 4.19 3/5] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH AUTOSEL 4.19 4/5] drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

From: Qu Huang [ Upstream commit 5104fdf50d326db2c1a994f8b35dcd46e63ae4ad ] In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer access when the smc_rreg pointer is NULL. Below are the steps to reproduce this issue and the corresp

[PATCH AUTOSEL 4.14 1/4] drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7

From: Mario Limonciello [ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 4.14 2/4] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

From: Mario Limonciello [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] For pptable structs that use flexible array sizes, use flexible arrays. Suggested-by: Felix Held Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2894 Signed-off-by: Mario Limonciello Acked-by: Alex Deuc

[PATCH AUTOSEL 4.14 3/4] drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga

From: Mario Limonciello [ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] For pptable structs that use flexible array sizes, use flexible arrays. Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by

[PATCH 0/5] accel/ivpu: Replace IPC kthread with threaded IRQ

Use threaded IRQ to handle incoming IPC messages. IPC consumers can now provide optional callback that will be executed once message is received. This allows to handle multiple message types in a generic manner. Removing kthread also simplifies synchronization as disable_irq() will block until all

[PATCH 1/5] accel/ivpu: Rename cons->rx_msg_lock

From: Stanislaw Gruszka Now the cons->rx_msg_lock protects also 'abort' field so rename the lock. Signed-off-by: Stanislaw Gruszka --- drivers/accel/ivpu/ivpu_ipc.c | 27 +-- drivers/accel/ivpu/ivpu_ipc.h | 2 +- 2 files changed, 14 insertions(+), 15 deletions(-) diff

[PATCH 2/5] accel/ivpu: Do not use irqsave in ivpu_ipc_dispatch

From: Stanislaw Gruszka ivpu_ipc_dispatch is always called with irqs disabled. Add lockdep assertion and remove unneeded _irqsave/_irqrestore. Signed-off-by: Stanislaw Gruszka --- drivers/accel/ivpu/ivpu_ipc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/ac

[PATCH 4/5] accel/ivpu: Use dedicated work for job timeout detection

From: Stanislaw Gruszka Change to use work for timeout detection. Needed for thread_irq conversion. Signed-off-by: Stanislaw Gruszka --- drivers/accel/ivpu/ivpu_job.c | 24 +--- drivers/accel/ivpu/ivpu_pm.c | 31 +++ drivers/accel/ivpu/ivpu_pm.h

[PATCH 3/5] accel/ivpu: Do not use cons->aborted for job_done_thread

From: Stanislaw Gruszka This allow to simplify ivpu_ipc_receive() as now we do not have to process all messages in aborted state - they will be freed in ivpu_ipc_consumer_del(). Signed-off-by: Stanislaw Gruszka --- drivers/accel/ivpu/ivpu_ipc.c | 18 +- drivers/accel/ivpu/ivpu_

[PATCH 5/5] accel/ivpu: Use threaded IRQ to handle JOB done messages

Remove job_done thread and replace it with generic callback based mechanism. Signed-off-by: Jacek Lawrynowicz --- drivers/accel/ivpu/ivpu_drv.c | 30 ++--- drivers/accel/ivpu/ivpu_drv.h | 3 +- drivers/accel/ivpu/ivpu_hw_37xx.c | 29 +++-- drivers/accel/ivpu/ivpu_ipc.c | 195

Re: [PATCH drm-misc-next v3] drm/sched: implement dynamic job-flow control

On Tue, Nov 07, 2023 at 10:13:37AM +0100, Christian König wrote: > Am 06.11.23 um 17:46 schrieb Danilo Krummrich: > > On Fri, Nov 03, 2023 at 09:15:25AM +0100, Christian König wrote: > > > Am 02.11.23 um 19:03 schrieb Danilo Krummrich: > > > > On Thu, Nov 02, 2023 at 11:07:32AM +0100, Christian Kön

Re: [PATCH AUTOSEL 6.6 21/40] drm/radeon: Fix UBSAN array-index-out-of-bounds for Radeon HD 5430

On Tue, Nov 7, 2023 at 7:20 AM Sasha Levin wrote: > > From: Mario Limonciello > > [ Upstream commit c63079c61177ba1b17fa05c6875699a36924fe39 ] > > For pptable structs that use flexible array sizes, use flexible arrays. > > Suggested-by: Felix Held > Link: https://gitlab.freedesktop.org/drm/amd/-

Re: [PATCH v12 3/4] drm: renesas: Add RZ/G2L DU Support

Hi Biju the series does not apply on v6.3. What is the base for the series ? On Thu, Nov 02, 2023 at 03:07:43PM +, Biju Das wrote: > The LCD controller is composed of Frame Compression Processor (FCPVD), > Video Signal Processor (VSPD), and Display Unit (DU). > > It has DPI/DSI interfaces a

Re: [PATCH 00/22] fb: handle remove callbacks in .exit.text and convert to .remove_new

On 11/7/23 10:17, Uwe Kleine-König wrote: there are currently several platform drivers that have their .remove callback defined in .exit.text. While this works fine, it comes with a few downsides: Since commit f177cd0c15fc ("modpost: Don't let "driver"s reference .exit.*") it triggers a modpost w

Re: [PATCH] drm/amd/pm: clean up redundant comparisons with 0

On 11/7/23 00:29, José Pekkarinen wrote: There is a couple of function return checks of functions that return unsigned values, and local variables to hold them are also unsigned, so checking if they are negative will always return false. This patch will remove them, as well as the never reached c

[PATCH] nouveau/gsp/r535: uninitialized variable in r535_gsp_acpi_mux_id()

The if we hit the "continue" statement on the first iteration through the loop then "handle_mux" needs to be set to NULL so we continue looping. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dan Carpenter --- drivers/gpu/drm/nouveau/nvkm/subdev/gsp/r

Re: [RFC PATCH v3 00/12] Device Memory TCP

Is there a policy about cc'ing moderated lists on patch sets? I thought there was, but not finding anything under Documentation/. Getting a 'needs moderator approval response' on every message is rather annoying.

Re: [RFC PATCH 03/10] drm/mipi-dsi: add API for manual control over the DSI link power state

On Tue, Nov 07, 2023 at 01:18:14PM +0100, Maxime Ripard wrote: > On Tue, Nov 07, 2023 at 12:22:21PM +0100, Greg Kroah-Hartman wrote: > > On Tue, Nov 07, 2023 at 11:57:49AM +0100, Maxime Ripard wrote: > > > +GKH > > > > Why? I don't see a question for me here, sorry. > > I guess the question is:

Re: [PATCH] drm/amdgpu: don't put MQDs in VRAM on ARM | ARM64

On Tue, 31 Oct 2023 at 17:55, Alex Deucher wrote: > > Issues were reported with commit 1cfb4d612127 > ("drm/amdgpu: put MQDs in VRAM") on an ADLINK Ampere > Altra Developer Platform (AVA developer platform). > > Various ARM systems seem to have problems related > to PCIe and MMIO access. In this

Re: [PATCH] drm/amd/display: clean up redundant conversions to bool

On Tue, Nov 7, 2023 at 4:44 AM José Pekkarinen wrote: > > This patch will address the following couple of warnings retrieved by > using coccinelle, where there is an explicit conversion to bool that > are redundant. > > drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_replay.c:94:102-107: WARNING:

Re: [RFC PATCH 01/10] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-11-07 04:38, Pekka Paalanen wrote: > On Mon, 6 Nov 2023 11:24:50 -0500 > Harry Wentland wrote: > >> On 2023-10-20 06:17, Pekka Paalanen wrote: >>> On Thu, 19 Oct 2023 10:56:29 -0400 >>> Harry Wentland wrote: >>> On 2023-09-13 07:29, Pekka Paalanen wrote: > On Fri, 8 Sep

Re: [PATCH] drm/bridge: tc358767: Support input format negotiation hook

Hi Aradhya, On Tue, Nov 07, 2023 at 01:17:03AM +0530, Aradhya Bhatia wrote: > Hi Sam, > > Thank you for the suggestion! > > On 06-Nov-23 18:08, Sam Ravnborg wrote: > > Hi Aradhya, > > > > On Tue, Oct 31, 2023 at 12:58:46AM +0530, Aradhya Bhatia wrote: > >> With new connector model, tc358767 wil

Re: [PATCH v4 09/30] drm/dp: Add helpers to calculate the link BW overhead

On Tue, Nov 07, 2023 at 12:28:24AM +0200, Imre Deak wrote: > On Mon, Nov 06, 2023 at 11:31:51PM +0200, Ville Syrjälä wrote: > > On Mon, Oct 30, 2023 at 05:58:22PM +0200, Imre Deak wrote: > > > Add helpers drivers can use to calculate the BW allocation overhead - > > > due to SSC, FEC, DSC and data

Re: [PATCH] nouveau/gsp/r535: uninitialized variable in r535_gsp_acpi_mux_id()

On 11/7/23 16:18, Dan Carpenter wrote: The if we hit the "continue" statement on the first iteration through the loop then "handle_mux" needs to be set to NULL so we continue looping. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Signed-off-by: Dan Carpenter Goo

Re: [RFC PATCH v2 06/17] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-10-25 16:16, Alex Goins wrote: > Thank you Harry and all other contributors for your work on this. Responses > inline - > Thanks for your comments on this. Apologies for the late response. I was focussing on the simpler responses to my patch set first and left your last as it's the mos

Re: [RFC PATCH v2 06/17] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-10-26 04:57, Pekka Paalanen wrote: > On Wed, 25 Oct 2023 15:16:08 -0500 (CDT) > Alex Goins wrote: > >> Thank you Harry and all other contributors for your work on this. Responses >> inline - >> >> On Mon, 23 Oct 2023, Pekka Paalanen wrote: >> >>> On Fri, 20 Oct 2023 11:23:28 -0400 >>>

Re: [RFC PATCH v2 06/17] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-10-26 13:30, Sebastian Wick wrote: > On Thu, Oct 26, 2023 at 11:57:47AM +0300, Pekka Paalanen wrote: >> On Wed, 25 Oct 2023 15:16:08 -0500 (CDT) >> Alex Goins wrote: >> >>> Thank you Harry and all other contributors for your work on this. Responses >>> inline - >>> >>> On Mon, 23 Oct 20

Re: [RFC PATCH v2 06/17] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-10-26 15:25, Alex Goins wrote: > On Thu, 26 Oct 2023, Sebastian Wick wrote: > >> On Thu, Oct 26, 2023 at 11:57:47AM +0300, Pekka Paalanen wrote: >>> On Wed, 25 Oct 2023 15:16:08 -0500 (CDT) >>> Alex Goins wrote: >>> Thank you Harry and all other contributors for your work on this.

Re: [RFC PATCH v2 06/17] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-11-04 19:01, Christopher Braga wrote: > Just want to loop back to before we branched off deeper into the programming > performance talk > > On 10/26/2023 3:25 PM, Alex Goins wrote: >> On Thu, 26 Oct 2023, Sebastian Wick wrote: >> >>> On Thu, Oct 26, 2023 at 11:57:47AM +0300, Pekka Paal

Re: [RFC PATCH 01/10] drm/doc/rfc: Describe why prescriptive color pipeline is needed

On 2023-11-07 04:55, Pekka Paalanen wrote: > On Mon, 6 Nov 2023 11:19:27 -0500 > Harry Wentland wrote: > >> On 2023-10-20 06:36, Pekka Paalanen wrote: >>> On Thu, 19 Oct 2023 10:56:40 -0400 >>> Harry Wentland wrote: >>> On 2023-10-10 12:13, Melissa Wen wrote: > O 09/08, Harry We

Re: [PATCH] drm/msm: remove exra drm_kms_helper_poll_init() call

On 11/7/2023 3:14 AM, Dmitry Baryshkov wrote: It seems during rebases I have left a call to drm_kms_helper_poll_init() which is not guarded by the (priv->kms_init) check. This leads to the crash for the boards which don't have KMS output. Drop this call, as there is a correctly guarded one nex

Re: [PATCH] drm/amd/pm: clean up redundant comparisons with 0

On 2023-11-07 16:08, Guenter Roeck wrote: On 11/7/23 00:29, José Pekkarinen wrote: There is a couple of function return checks of functions that return unsigned values, and local variables to hold them are also unsigned, so checking if they are negative will always return false. This patch wil

Re: [RFC PATCH v3 09/12] net: add support for skbs with unreadable frags

On 11/06, Willem de Bruijn wrote: > > > > > I think my other issue with MSG_SOCK_DEVMEM being on recvmsg is that > > > > > it somehow implies that I have an option of passing or not passing it > > > > > for an individual system call. > > > > > If we know that we're going to use dmabuf with the sock

Re: [PATCH] drm/sched: Don't disturb the entity when in RR-mode scheduling

On 11/7/23 05:10, Luben Tuikov wrote: Don't call drm_sched_select_entity() in drm_sched_run_job_queue(). In fact, rename __drm_sched_run_job_queue() to just drm_sched_run_job_queue(), and let it do just that, schedule the work item for execution. The problem is that drm_sched_run_job_queue() ca

Re: [PATCH v5 1/4] drm/panel-edp: drm/panel-edp: Fix AUO B116XTN02, B116XAK01 name and timing

Hi, On Mon, Nov 6, 2023 at 4:00 PM Hsin-Yi Wang wrote: > > According to decoding edid and datahseet: > - Rename AUO 0x235c B116XTN02 to B116XTN02.3 > - Rename AUO 0x405c B116XAK01 to B116XAK01.0 and adjust the timing of > auo_b116xak01: T3=200, T12=500, T7_max = 50. > > Fixes: 3db2420422a5 ("drm/

Re: [RFC PATCH v3 09/12] net: add support for skbs with unreadable frags

On Tue, Nov 7, 2023 at 12:44 PM Stanislav Fomichev wrote: > > On 11/06, Willem de Bruijn wrote: > > > > > > I think my other issue with MSG_SOCK_DEVMEM being on recvmsg is that > > > > > > it somehow implies that I have an option of passing or not passing > > > > > > it > > > > > > for an individ

Re: [PATCH v5 4/4] drm/panel-edp: Avoid adding multiple preferred modes

Hi, On Mon, Nov 6, 2023 at 4:00 PM Hsin-Yi Wang wrote: > > If a non generic edp-panel is under aux-bus, the mode read from edid would > still be selected as preferred and results in multiple preferred modes, > which is ambiguous. > > If both hard-coded mode and edid exists, only add mode from har

Re: [PATCH] drm/amd/pm: clean up redundant comparisons with 0

On 11/7/23 09:26, José Pekkarinen wrote: On 2023-11-07 16:08, Guenter Roeck wrote: On 11/7/23 00:29, José Pekkarinen wrote: There is a couple of function return checks of functions that return unsigned values, and local variables to hold them are also unsigned, so checking if they are negative

Re: [RFC PATCH v3 09/12] net: add support for skbs with unreadable frags

On 11/07, Willem de Bruijn wrote: > On Tue, Nov 7, 2023 at 12:44 PM Stanislav Fomichev wrote: > > > > On 11/06, Willem de Bruijn wrote: > > > > > > > I think my other issue with MSG_SOCK_DEVMEM being on recvmsg is > > > > > > > that > > > > > > > it somehow implies that I have an option of passin

Re: 6.7/regression/KASAN: null-ptr-deref in amdgpu_ras_reset_error_count+0x2d6

On Mon, Nov 6, 2023 at 8:29 PM Alex Deucher wrote: > > Already fixed in this commit: > https://gitlab.freedesktop.org/agd5f/linux/-/commit/d1d4c0b7b65b7fab2bc6f97af9e823b1c42ccdb0 > Which is in included in last weeks PR. > Thanks, it fixed the issue above. But, unfortunately this is not the only

Re: [PATCH] drm/bridge: tc358767: Support input format negotiation hook

Hi Sam, On 07-Nov-23 21:11, Sam Ravnborg wrote: > Hi Aradhya, > > On Tue, Nov 07, 2023 at 01:17:03AM +0530, Aradhya Bhatia wrote: >> Hi Sam, >> >> Thank you for the suggestion! >> >> On 06-Nov-23 18:08, Sam Ravnborg wrote: >>> Hi Aradhya, >>> >>> On Tue, Oct 31, 2023 at 12:58:46AM +0530, Aradhya

Re: [PATCH] drm/sched: Don't disturb the entity when in RR-mode scheduling

On Mon, Nov 06, 2023 at 11:10:21PM -0500, Luben Tuikov wrote: > Don't call drm_sched_select_entity() in drm_sched_run_job_queue(). In fact, > rename __drm_sched_run_job_queue() to just drm_sched_run_job_queue(), and let > it do just that, schedule the work item for execution. > > The problem is t

Re: [Nouveau] [PATCH 3/3] nouveau/gsp: add some basic registry entries.

On Tue, 2023-10-31 at 15:18 +1000, Dave Airlie wrote: + strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES]; I get a UBSAN index-out-of-bounds error on boot at this line. [ 17.765746] nouveau :65:00.0: gsp: cmdq: wptr 1 [ 17.765748] =

Re: [Nouveau] [PATCH 3/3] nouveau/gsp: add some basic registry entries.

On Wed, 8 Nov 2023 at 04:51, Timur Tabi wrote: > > On Tue, 2023-10-31 at 15:18 +1000, Dave Airlie wrote: > > + strings = (char *)&rpc->entries[NV_GSP_REG_NUM_ENTRIES]; > > > I get a UBSAN index-out-of-bounds error on boot at this line. > > [ 17.765746] nouveau :65:00.0: gsp: cmdq: wptr 1

Re: [Nouveau] [PATCH 3/3] nouveau/gsp: add some basic registry entries.

On Wed, 2023-11-08 at 04:54 +1000, Dave Airlie wrote: yes that is probably the right answer for this, if we want to reuse the structs that we get from the nvidia driver. ok, I'll submit a patch.

<    1   2   3   >