From: Alex Hung alex.hung@amd.com

stable inclusion from stable-v6.6.31 commit 951a498fa993c5501994ec2df97c9297b02488c7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9U8NY CVE: CVE-2024-36914

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=...

--------------------------------

[ Upstream commit ecedd99a9369fb5cde601ae9abd58bca2739f1ae ]

[WHY] dynamic memory safety error detector (KASAN) catches and generates error messages "BUG: KASAN: slab-out-of-bounds" as writeback connector does not support certain features which are not initialized.

[HOW] Skip them when connector type is DRM_MODE_CONNECTOR_WRITEBACK.

Link: https://gitlab.freedesktop.org/drm/amd/-/issues/3199 Reviewed-by: Harry Wentland harry.wentland@amd.com Reviewed-by: Rodrigo Siqueira rodrigo.siqueira@amd.com Acked-by: Roman Li roman.li@amd.com Signed-off-by: Alex Hung alex.hung@amd.com Signed-off-by: Alex Deucher alexander.deucher@amd.com Signed-off-by: Sasha Levin sashal@kernel.org Conflicts: drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c [Yongqiang: no need adaption for freesync mode] Signed-off-by: Yongqiang Liu liuyongqiang13@huawei.com --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++++ 1 file changed, 7 insertions(+)

diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c index 3578e3b3536e..8ffe17b94ca3 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -2051,6 +2051,10 @@ static int dm_resume(void *handle) /* Do detection*/ drm_connector_list_iter_begin(ddev, &iter); drm_for_each_connector_iter(connector, &iter) { + + if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK) + continue; + aconnector = to_amdgpu_dm_connector(connector);

if (!aconnector->dc_link) @@ -7541,6 +7545,9 @@ static void amdgpu_dm_commit_audio(struct drm_device *dev, continue;

notify: + if (connector->connector_type == DRM_MODE_CONNECTOR_WRITEBACK) + continue; + aconnector = to_amdgpu_dm_connector(connector);

mutex_lock(&adev->dm.audio_lock);