--- /dev/null
+From 4a3859ea5240365d21f6053ee219bb240d520895 Mon Sep 17 00:00:00 2001
+From: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Mon, 18 Mar 2024 14:58:47 +0100
+Subject: drm/i915/gt: Reset queue_priority_hint on parking
+
+From: Chris Wilson <chris@chris-wilson.co.uk>
+
+commit 4a3859ea5240365d21f6053ee219bb240d520895 upstream.
+
+Originally, with strict in order execution, we could complete execution
+only when the queue was empty. Preempt-to-busy allows replacement of an
+active request that may complete before the preemption is processed by
+HW. If that happens, the request is retired from the queue, but the
+queue_priority_hint remains set, preventing direct submission until
+after the next CS interrupt is processed.
+
+This preempt-to-busy race can be triggered by the heartbeat, which will
+also act as the power-management barrier and upon completion allow us to
+idle the HW. We may process the completion of the heartbeat, and begin
+parking the engine before the CS event that restores the
+queue_priority_hint, causing us to fail the assertion that it is MIN.
+
+<3>[ 166.210729] __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
+<0>[ 166.210781] Dumping ftrace buffer:
+<0>[ 166.210795] ---------------------------------
+...
+<0>[ 167.302811] drm_fdin-1097 2..s1. 165741070us : trace_ports: 0000:00:02.0 rcs0: promote { ccid:20 1217:2 prio 0 }
+<0>[ 167.302861] drm_fdin-1097 2d.s2. 165741072us : execlists_submission_tasklet: 0000:00:02.0 rcs0: preempting last=1217:2, prio=0, hint=2147483646
+<0>[ 167.302928] drm_fdin-1097 2d.s2. 165741072us : __i915_request_unsubmit: 0000:00:02.0 rcs0: fence 1217:2, current 0
+<0>[ 167.302992] drm_fdin-1097 2d.s2. 165741073us : __i915_request_submit: 0000:00:02.0 rcs0: fence 3:4660, current 4659
+<0>[ 167.303044] drm_fdin-1097 2d.s1. 165741076us : execlists_submission_tasklet: 0000:00:02.0 rcs0: context:3 schedule-in, ccid:40
+<0>[ 167.303095] drm_fdin-1097 2d.s1. 165741077us : trace_ports: 0000:00:02.0 rcs0: submit { ccid:40 3:4660* prio 2147483646 }
+<0>[ 167.303159] kworker/-89 11..... 165741139us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence c90:2, current 2
+<0>[ 167.303208] kworker/-89 11..... 165741148us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:c90 unpin
+<0>[ 167.303272] kworker/-89 11..... 165741159us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 1217:2, current 2
+<0>[ 167.303321] kworker/-89 11..... 165741166us : __intel_context_do_unpin: 0000:00:02.0 rcs0: context:1217 unpin
+<0>[ 167.303384] kworker/-89 11..... 165741170us : i915_request_retire.part.0: 0000:00:02.0 rcs0: fence 3:4660, current 4660
+<0>[ 167.303434] kworker/-89 11d..1. 165741172us : __intel_context_retire: 0000:00:02.0 rcs0: context:1216 retire runtime: { total:56028ns, avg:56028ns }
+<0>[ 167.303484] kworker/-89 11..... 165741198us : __engine_park: 0000:00:02.0 rcs0: parked
+<0>[ 167.303534] <idle>-0 5d.H3. 165741207us : execlists_irq_handler: 0000:00:02.0 rcs0: semaphore yield: 00000040
+<0>[ 167.303583] kworker/-89 11..... 165741397us : __intel_context_retire: 0000:00:02.0 rcs0: context:1217 retire runtime: { total:325575ns, avg:0ns }
+<0>[ 167.303756] kworker/-89 11..... 165741777us : __intel_context_retire: 0000:00:02.0 rcs0: context:c90 retire runtime: { total:0ns, avg:0ns }
+<0>[ 167.303806] kworker/-89 11..... 165742017us : __engine_park: __engine_park:283 GEM_BUG_ON(engine->sched_engine->queue_priority_hint != (-((int)(~0U >> 1)) - 1))
+<0>[ 167.303811] ---------------------------------
+<4>[ 167.304722] ------------[ cut here ]------------
+<2>[ 167.304725] kernel BUG at drivers/gpu/drm/i915/gt/intel_engine_pm.c:283!
+<4>[ 167.304731] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
+<4>[ 167.304734] CPU: 11 PID: 89 Comm: kworker/11:1 Tainted: G W 6.8.0-rc2-CI_DRM_14193-gc655e0fd2804+ #1
+<4>[ 167.304736] Hardware name: Intel Corporation Rocket Lake Client Platform/RocketLake S UDIMM 6L RVP, BIOS RKLSFWI1.R00.3173.A03.2204210138 04/21/2022
+<4>[ 167.304738] Workqueue: i915-unordered retire_work_handler [i915]
+<4>[ 167.304839] RIP: 0010:__engine_park+0x3fd/0x680 [i915]
+<4>[ 167.304937] Code: 00 48 c7 c2 b0 e5 86 a0 48 8d 3d 00 00 00 00 e8 79 48 d4 e0 bf 01 00 00 00 e8 ef 0a d4 e0 31 f6 bf 09 00 00 00 e8 03 49 c0 e0 <0f> 0b 0f 0b be 01 00 00 00 e8 f5 61 fd ff 31 c0 e9 34 fd ff ff 48
+<4>[ 167.304940] RSP: 0018:ffffc9000059fce0 EFLAGS: 00010246
+<4>[ 167.304942] RAX: 0000000000000200 RBX: 0000000000000000 RCX: 0000000000000006
+<4>[ 167.304944] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000009
+<4>[ 167.304946] RBP: ffff8881330ca1b0 R08: 0000000000000001 R09: 0000000000000001
+<4>[ 167.304947] R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881330ca000
+<4>[ 167.304948] R13: ffff888110f02aa0 R14: ffff88812d1d0205 R15: ffff88811277d4f0
+<4>[ 167.304950] FS: 0000000000000000(0000) GS:ffff88844f780000(0000) knlGS:0000000000000000
+<4>[ 167.304952] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+<4>[ 167.304953] CR2: 00007fc362200c40 CR3: 000000013306e003 CR4: 0000000000770ef0
+<4>[ 167.304955] PKRU: 55555554
+<4>[ 167.304957] Call Trace:
+<4>[ 167.304958] <TASK>
+<4>[ 167.305573] ____intel_wakeref_put_last+0x1d/0x80 [i915]
+<4>[ 167.305685] i915_request_retire.part.0+0x34f/0x600 [i915]
+<4>[ 167.305800] retire_requests+0x51/0x80 [i915]
+<4>[ 167.305892] intel_gt_retire_requests_timeout+0x27f/0x700 [i915]
+<4>[ 167.305985] process_scheduled_works+0x2db/0x530
+<4>[ 167.305990] worker_thread+0x18c/0x350
+<4>[ 167.305993] kthread+0xfe/0x130
+<4>[ 167.305997] ret_from_fork+0x2c/0x50
+<4>[ 167.306001] ret_from_fork_asm+0x1b/0x30
+<4>[ 167.306004] </TASK>
+
+It is necessary for the queue_priority_hint to be lower than the next
+request submission upon waking up, as we rely on the hint to decide when
+to kick the tasklet to submit that first request.
+
+Fixes: 22b7a426bbe1 ("drm/i915/execlists: Preempt-to-busy")
+Closes: https://gitlab.freedesktop.org/drm/intel/issues/10154
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Cc: Mika Kuoppala <mika.kuoppala@linux.intel.com>
+Cc: <stable@vger.kernel.org> # v5.4+
+Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
+Signed-off-by: Andi Shyti <andi.shyti@linux.intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20240318135906.716055-2-janusz.krzysztofik@linux.intel.com
+(cherry picked from commit 98850e96cf811dc2d0a7d0af491caff9f5d49c1e)
+Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
+Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/gt/intel_engine_pm.c | 3 ---
+ drivers/gpu/drm/i915/gt/intel_lrc.c | 3 +++
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpu/drm/i915/gt/intel_engine_pm.c
++++ b/drivers/gpu/drm/i915/gt/intel_engine_pm.c
+@@ -145,9 +145,6 @@ static int __engine_park(struct intel_wa
+ intel_engine_disarm_breadcrumbs(engine);
+ intel_engine_pool_park(&engine->pool);
+
+- /* Must be reset upon idling, or we may miss the busy wakeup. */
+- GEM_BUG_ON(engine->execlists.queue_priority_hint != INT_MIN);
+-
+ if (engine->park)
+ engine->park(engine);
+
+--- a/drivers/gpu/drm/i915/gt/intel_lrc.c
++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c
+@@ -2992,6 +2992,9 @@ static u32 *gen11_emit_fini_breadcrumb_r
+ static void execlists_park(struct intel_engine_cs *engine)
+ {
+ del_timer(&engine->execlists.timer);
++
++ /* Reset upon idling, or we may delay the busy wakeup. */
++ WRITE_ONCE(engine->execlists.queue_priority_hint, INT_MIN);
+ }
+
+ void intel_execlists_set_default_submission(struct intel_engine_cs *engine)
--- /dev/null
+From guomengqi3@huawei.com Thu Apr 11 09:41:35 2024
+From: Guo Mengqi <guomengqi3@huawei.com>
+Date: Tue, 9 Apr 2024 10:26:47 +0800
+Subject: drm/vkms: call drm_atomic_helper_shutdown before drm_dev_put()
+To: <airlied@linux.ie>, <dri-devel@lists.freedesktop.org>, <stable@vger.kernel.org>, <xuqiang36@huawei.com>, <zhangchangzhong@huawei.com>, <greg@kroah.com>
+Cc: <guomengqi3@huawei.com>
+Message-ID: <20240409022647.1821-1-guomengqi3@huawei.com>
+
+From: Guo Mengqi <guomengqi3@huawei.com>
+
+commit 73a82b22963d ("drm/atomic: Fix potential use-after-free
+in nonblocking commits") introduced drm_dev_get/put() to
+drm_atomic_helper_shutdown(). And this cause problem in vkms driver exit
+process.
+
+vkms_exit()
+ drm_dev_put()
+ vkms_release()
+ drm_atomic_helper_shutdown()
+ drm_dev_get()
+ drm_dev_put()
+ vkms_release() ------ use after free
+
+Using 5.4 stable x86 image on qemu, below stacktrace can be triggered by
+load and unload vkms.ko.
+
+root:~ # insmod vkms.ko
+[ 76.957802] [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
+[ 76.961490] [drm] Driver supports precise vblank timestamp query.
+[ 76.964416] [drm] Initialized vkms 1.0.0 20180514 for vkms on minor 0
+root:~ # rmmod vkms.ko
+[ 79.650202] refcount_t: addition on 0; use-after-free.
+[ 79.650249] WARNING: CPU: 2 PID: 3533 at ../lib/refcount.c:25 refcount_warn_saturate+0xcf/0xf0
+[ 79.654241] Modules linked in: vkms(-)
+[ 79.654249] CPU: 2 PID: 3533 Comm: rmmod Not tainted 5.4.273 #4
+[ 79.654251] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
+[ 79.654262] RIP: 0010:refcount_warn_saturate+0xcf/0xf0
+...
+[ 79.654296] Call Trace:
+[ 79.654462] ? __warn+0x80/0xd0
+[ 79.654473] ? refcount_warn_saturate+0xcf/0xf0
+[ 79.654481] ? report_bug+0xb6/0x130
+[ 79.654484] ? refcount_warn_saturate+0xcf/0xf0
+[ 79.654489] ? fixup_bug.part.12+0x13/0x30
+[ 79.654492] ? do_error_trap+0x90/0xb0
+[ 79.654495] ? do_invalid_op+0x31/0x40
+[ 79.654497] ? refcount_warn_saturate+0xcf/0xf0
+[ 79.654504] ? invalid_op+0x1e/0x30
+[ 79.654508] ? refcount_warn_saturate+0xcf/0xf0
+[ 79.654516] drm_atomic_state_init+0x68/0xb0
+[ 79.654543] drm_atomic_state_alloc+0x43/0x60
+[ 79.654551] drm_atomic_helper_disable_all+0x13/0x180
+[ 79.654562] drm_atomic_helper_shutdown+0x5f/0xb0
+[ 79.654571] vkms_release+0x18/0x40 [vkms]
+[ 79.654575] vkms_exit+0x29/0xc00 [vkms]
+[ 79.654582] __x64_sys_delete_module+0x155/0x220
+[ 79.654592] do_syscall_64+0x43/0x120
+[ 79.654603] entry_SYSCALL_64_after_hwframe+0x5c/0xc1
+[ 79.654619] ---[ end trace ce0c02f57ea6bf73 ]---
+
+It seems that the proper unload sequence is:
+ drm_atomic_helper_shutdown();
+ drm_dev_put();
+
+Just put drm_atomic_helper_shutdown() before drm_dev_put()
+should solve the problem.
+
+Note that vkms exit code is refactored by commit 53d77aaa3f76
+("drm/vkms: Use devm_drm_dev_alloc") in tags/v5.10-rc1.
+
+So this bug only exists on 4.19 and 5.4.
+
+Fixes: 380c7ceabdde ("drm/atomic: Fix potential use-after-free in nonblocking commits")
+Fixes: 2ead1be54b22 ("drm/vkms: Fix connector leak at the module removal")
+Signed-off-by: Guo Mengqi <guomengqi3@huawei.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vkms/vkms_drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vkms/vkms_drv.c
++++ b/drivers/gpu/drm/vkms/vkms_drv.c
+@@ -60,7 +60,6 @@ static void vkms_release(struct drm_devi
+ struct vkms_device *vkms = container_of(dev, struct vkms_device, drm);
+
+ platform_device_unregister(vkms->platform);
+- drm_atomic_helper_shutdown(&vkms->drm);
+ drm_mode_config_cleanup(&vkms->drm);
+ drm_dev_fini(&vkms->drm);
+ destroy_workqueue(vkms->output.composer_workq);
+@@ -194,6 +193,7 @@ static void __exit vkms_exit(void)
+ }
+
+ drm_dev_unregister(&vkms_device->drm);
++ drm_atomic_helper_shutdown(&vkms_device->drm);
+ drm_dev_put(&vkms_device->drm);
+
+ kfree(vkms_device);
netfilter-nf_tables-release-mutex-after-nft_gc_seq_e.patch
netfilter-nf_tables-discard-table-flag-update-with-p.patch
tty-n_gsm-require-cap_net_admin-to-attach-n_gsm0710-ldisc.patch
+drm-vkms-call-drm_atomic_helper_shutdown-before-drm_dev_put.patch
+virtio-reenable-config-if-freezing-device-failed.patch
+x86-mm-pat-fix-vm_pat-handling-in-cow-mappings.patch
+drm-i915-gt-reset-queue_priority_hint-on-parking.patch
+x86-alternative-don-t-call-text_poke-in-lazy-tlb-mode.patch
--- /dev/null
+From 310227f42882c52356b523e2f4e11690eebcd2ab Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Tue, 13 Feb 2024 14:54:25 +0100
+Subject: virtio: reenable config if freezing device failed
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 310227f42882c52356b523e2f4e11690eebcd2ab upstream.
+
+Currently, we don't reenable the config if freezing the device failed.
+
+For example, virtio-mem currently doesn't support suspend+resume, and
+trying to freeze the device will always fail. Afterwards, the device
+will no longer respond to resize requests, because it won't get notified
+about config changes.
+
+Let's fix this by re-enabling the config if freezing fails.
+
+Fixes: 22b7050a024d ("virtio: defer config changed notifications")
+Cc: <stable@kernel.org>
+Cc: "Michael S. Tsirkin" <mst@redhat.com>
+Cc: Jason Wang <jasowang@redhat.com>
+Cc: Xuan Zhuo <xuanzhuo@linux.alibaba.com>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Message-Id: <20240213135425.795001-1-david@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/virtio/virtio.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/virtio/virtio.c
++++ b/drivers/virtio/virtio.c
+@@ -381,13 +381,19 @@ EXPORT_SYMBOL_GPL(unregister_virtio_devi
+ int virtio_device_freeze(struct virtio_device *dev)
+ {
+ struct virtio_driver *drv = drv_to_virtio(dev->dev.driver);
++ int ret;
+
+ virtio_config_disable(dev);
+
+ dev->failed = dev->config->get_status(dev) & VIRTIO_CONFIG_S_FAILED;
+
+- if (drv && drv->freeze)
+- return drv->freeze(dev);
++ if (drv && drv->freeze) {
++ ret = drv->freeze(dev);
++ if (ret) {
++ virtio_config_enable(dev);
++ return ret;
++ }
++ }
+
+ return 0;
+ }
--- /dev/null
+From abee7c494d8c41bb388839bccc47e06247f0d7de Mon Sep 17 00:00:00 2001
+From: Juergen Gross <jgross@suse.com>
+Date: Fri, 9 Oct 2020 16:42:25 +0200
+Subject: x86/alternative: Don't call text_poke() in lazy TLB mode
+
+From: Juergen Gross <jgross@suse.com>
+
+commit abee7c494d8c41bb388839bccc47e06247f0d7de upstream.
+
+When running in lazy TLB mode the currently active page tables might
+be the ones of a previous process, e.g. when running a kernel thread.
+
+This can be problematic in case kernel code is being modified via
+text_poke() in a kernel thread, and on another processor exit_mmap()
+is active for the process which was running on the first cpu before
+the kernel thread.
+
+As text_poke() is using a temporary address space and the former
+address space (obtained via cpu_tlbstate.loaded_mm) is restored
+afterwards, there is a race possible in case the cpu on which
+exit_mmap() is running wants to make sure there are no stale
+references to that address space on any cpu active (this e.g. is
+required when running as a Xen PV guest, where this problem has been
+observed and analyzed).
+
+In order to avoid that, drop off TLB lazy mode before switching to the
+temporary address space.
+
+Fixes: cefa929c034eb5d ("x86/mm: Introduce temporary mm structs")
+Signed-off-by: Juergen Gross <jgross@suse.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20201009144225.12019-1-jgross@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/include/asm/mmu_context.h | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/arch/x86/include/asm/mmu_context.h
++++ b/arch/x86/include/asm/mmu_context.h
+@@ -379,6 +379,15 @@ static inline temp_mm_state_t use_tempor
+ temp_mm_state_t temp_state;
+
+ lockdep_assert_irqs_disabled();
++
++ /*
++ * Make sure not to be in TLB lazy mode, as otherwise we'll end up
++ * with a stale address space WITHOUT being in lazy mode after
++ * restoring the previous mm.
++ */
++ if (this_cpu_read(cpu_tlbstate.is_lazy))
++ leave_mm(smp_processor_id());
++
+ temp_state.mm = this_cpu_read(cpu_tlbstate.loaded_mm);
+ switch_mm_irqs_off(NULL, mm, current);
+
--- /dev/null
+From 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <david@redhat.com>
+Date: Wed, 3 Apr 2024 23:21:30 +0200
+Subject: x86/mm/pat: fix VM_PAT handling in COW mappings
+
+From: David Hildenbrand <david@redhat.com>
+
+commit 04c35ab3bdae7fefbd7c7a7355f29fa03a035221 upstream.
+
+PAT handling won't do the right thing in COW mappings: the first PTE (or,
+in fact, all PTEs) can be replaced during write faults to point at anon
+folios. Reliably recovering the correct PFN and cachemode using
+follow_phys() from PTEs will not work in COW mappings.
+
+Using follow_phys(), we might just get the address+protection of the anon
+folio (which is very wrong), or fail on swap/nonswap entries, failing
+follow_phys() and triggering a WARN_ON_ONCE() in untrack_pfn() and
+track_pfn_copy(), not properly calling free_pfn_range().
+
+In free_pfn_range(), we either wouldn't call memtype_free() or would call
+it with the wrong range, possibly leaking memory.
+
+To fix that, let's update follow_phys() to refuse returning anon folios,
+and fallback to using the stored PFN inside vma->vm_pgoff for COW mappings
+if we run into that.
+
+We will now properly handle untrack_pfn() with COW mappings, where we
+don't need the cachemode. We'll have to fail fork()->track_pfn_copy() if
+the first page was replaced by an anon folio, though: we'd have to store
+the cachemode in the VMA to make this work, likely growing the VMA size.
+
+For now, lets keep it simple and let track_pfn_copy() just fail in that
+case: it would have failed in the past with swap/nonswap entries already,
+and it would have done the wrong thing with anon folios.
+
+Simple reproducer to trigger the WARN_ON_ONCE() in untrack_pfn():
+
+<--- C reproducer --->
+ #include <stdio.h>
+ #include <sys/mman.h>
+ #include <unistd.h>
+ #include <liburing.h>
+
+ int main(void)
+ {
+ struct io_uring_params p = {};
+ int ring_fd;
+ size_t size;
+ char *map;
+
+ ring_fd = io_uring_setup(1, &p);
+ if (ring_fd < 0) {
+ perror("io_uring_setup");
+ return 1;
+ }
+ size = p.sq_off.array + p.sq_entries * sizeof(unsigned);
+
+ /* Map the submission queue ring MAP_PRIVATE */
+ map = mmap(0, size, PROT_READ | PROT_WRITE, MAP_PRIVATE,
+ ring_fd, IORING_OFF_SQ_RING);
+ if (map == MAP_FAILED) {
+ perror("mmap");
+ return 1;
+ }
+
+ /* We have at least one page. Let's COW it. */
+ *map = 0;
+ pause();
+ return 0;
+ }
+<--- C reproducer --->
+
+On a system with 16 GiB RAM and swap configured:
+ # ./iouring &
+ # memhog 16G
+ # killall iouring
+[ 301.552930] ------------[ cut here ]------------
+[ 301.553285] WARNING: CPU: 7 PID: 1402 at arch/x86/mm/pat/memtype.c:1060 untrack_pfn+0xf4/0x100
+[ 301.553989] Modules linked in: binfmt_misc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_g
+[ 301.558232] CPU: 7 PID: 1402 Comm: iouring Not tainted 6.7.5-100.fc38.x86_64 #1
+[ 301.558772] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebu4
+[ 301.559569] RIP: 0010:untrack_pfn+0xf4/0x100
+[ 301.559893] Code: 75 c4 eb cf 48 8b 43 10 8b a8 e8 00 00 00 3b 6b 28 74 b8 48 8b 7b 30 e8 ea 1a f7 000
+[ 301.561189] RSP: 0018:ffffba2c0377fab8 EFLAGS: 00010282
+[ 301.561590] RAX: 00000000ffffffea RBX: ffff9208c8ce9cc0 RCX: 000000010455e047
+[ 301.562105] RDX: 07fffffff0eb1e0a RSI: 0000000000000000 RDI: ffff9208c391d200
+[ 301.562628] RBP: 0000000000000000 R08: ffffba2c0377fab8 R09: 0000000000000000
+[ 301.563145] R10: ffff9208d2292d50 R11: 0000000000000002 R12: 00007fea890e0000
+[ 301.563669] R13: 0000000000000000 R14: ffffba2c0377fc08 R15: 0000000000000000
+[ 301.564186] FS: 0000000000000000(0000) GS:ffff920c2fbc0000(0000) knlGS:0000000000000000
+[ 301.564773] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 301.565197] CR2: 00007fea88ee8a20 CR3: 00000001033a8000 CR4: 0000000000750ef0
+[ 301.565725] PKRU: 55555554
+[ 301.565944] Call Trace:
+[ 301.566148] <TASK>
+[ 301.566325] ? untrack_pfn+0xf4/0x100
+[ 301.566618] ? __warn+0x81/0x130
+[ 301.566876] ? untrack_pfn+0xf4/0x100
+[ 301.567163] ? report_bug+0x171/0x1a0
+[ 301.567466] ? handle_bug+0x3c/0x80
+[ 301.567743] ? exc_invalid_op+0x17/0x70
+[ 301.568038] ? asm_exc_invalid_op+0x1a/0x20
+[ 301.568363] ? untrack_pfn+0xf4/0x100
+[ 301.568660] ? untrack_pfn+0x65/0x100
+[ 301.568947] unmap_single_vma+0xa6/0xe0
+[ 301.569247] unmap_vmas+0xb5/0x190
+[ 301.569532] exit_mmap+0xec/0x340
+[ 301.569801] __mmput+0x3e/0x130
+[ 301.570051] do_exit+0x305/0xaf0
+...
+
+Link: https://lkml.kernel.org/r/20240403212131.929421-3-david@redhat.com
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Reported-by: Wupeng Ma <mawupeng1@huawei.com>
+Closes: https://lkml.kernel.org/r/20240227122814.3781907-1-mawupeng1@huawei.com
+Fixes: b1a86e15dc03 ("x86, pat: remove the dependency on 'vm_pgoff' in track/untrack pfn vma routines")
+Fixes: 5899329b1910 ("x86: PAT: implement track/untrack of pfnmap regions for x86 - v3")
+Acked-by: Ingo Molnar <mingo@kernel.org>
+Cc: Dave Hansen <dave.hansen@linux.intel.com>
+Cc: Andy Lutomirski <luto@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Borislav Petkov <bp@alien8.de>
+Cc: "H. Peter Anvin" <hpa@zytor.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: David Hildenbrand <david@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/pat.c | 50 ++++++++++++++++++++++++++++++++++++--------------
+ mm/memory.c | 4 ++++
+ 2 files changed, 40 insertions(+), 14 deletions(-)
+
+--- a/arch/x86/mm/pat.c
++++ b/arch/x86/mm/pat.c
+@@ -34,6 +34,7 @@
+
+ #include "pat_internal.h"
+ #include "mm_internal.h"
++#include "../../mm/internal.h" /* is_cow_mapping() */
+
+ #undef pr_fmt
+ #define pr_fmt(fmt) "" fmt
+@@ -955,6 +956,38 @@ static void free_pfn_range(u64 paddr, un
+ free_memtype(paddr, paddr + size);
+ }
+
++static int get_pat_info(struct vm_area_struct *vma, resource_size_t *paddr,
++ pgprot_t *pgprot)
++{
++ unsigned long prot;
++
++ VM_WARN_ON_ONCE(!(vma->vm_flags & VM_PAT));
++
++ /*
++ * We need the starting PFN and cachemode used for track_pfn_remap()
++ * that covered the whole VMA. For most mappings, we can obtain that
++ * information from the page tables. For COW mappings, we might now
++ * suddenly have anon folios mapped and follow_phys() will fail.
++ *
++ * Fallback to using vma->vm_pgoff, see remap_pfn_range_notrack(), to
++ * detect the PFN. If we need the cachemode as well, we're out of luck
++ * for now and have to fail fork().
++ */
++ if (!follow_phys(vma, vma->vm_start, 0, &prot, paddr)) {
++ if (pgprot)
++ *pgprot = __pgprot(prot);
++ return 0;
++ }
++ if (is_cow_mapping(vma->vm_flags)) {
++ if (pgprot)
++ return -EINVAL;
++ *paddr = (resource_size_t)vma->vm_pgoff << PAGE_SHIFT;
++ return 0;
++ }
++ WARN_ON_ONCE(1);
++ return -EINVAL;
++}
++
+ /*
+ * track_pfn_copy is called when vma that is covering the pfnmap gets
+ * copied through copy_page_range().
+@@ -965,20 +998,13 @@ static void free_pfn_range(u64 paddr, un
+ int track_pfn_copy(struct vm_area_struct *vma)
+ {
+ resource_size_t paddr;
+- unsigned long prot;
+ unsigned long vma_size = vma->vm_end - vma->vm_start;
+ pgprot_t pgprot;
+
+ if (vma->vm_flags & VM_PAT) {
+- /*
+- * reserve the whole chunk covered by vma. We need the
+- * starting address and protection from pte.
+- */
+- if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
+- WARN_ON_ONCE(1);
++ if (get_pat_info(vma, &paddr, &pgprot))
+ return -EINVAL;
+- }
+- pgprot = __pgprot(prot);
++ /* reserve the whole chunk covered by vma. */
+ return reserve_pfn_range(paddr, vma_size, &pgprot, 1);
+ }
+
+@@ -1053,7 +1079,6 @@ void untrack_pfn(struct vm_area_struct *
+ unsigned long size)
+ {
+ resource_size_t paddr;
+- unsigned long prot;
+
+ if (vma && !(vma->vm_flags & VM_PAT))
+ return;
+@@ -1061,11 +1086,8 @@ void untrack_pfn(struct vm_area_struct *
+ /* free the chunk starting from pfn or the whole chunk */
+ paddr = (resource_size_t)pfn << PAGE_SHIFT;
+ if (!paddr && !size) {
+- if (follow_phys(vma, vma->vm_start, 0, &prot, &paddr)) {
+- WARN_ON_ONCE(1);
++ if (get_pat_info(vma, &paddr, NULL))
+ return;
+- }
+-
+ size = vma->vm_end - vma->vm_start;
+ }
+ free_pfn_range(paddr, size);
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -4428,6 +4428,10 @@ int follow_phys(struct vm_area_struct *v
+ goto out;
+ pte = *ptep;
+
++ /* Never return PFNs of anon folios in COW mappings. */
++ if (vm_normal_page(vma, address, pte))
++ goto unlock;
++
+ if ((flags & FOLL_WRITE) && !pte_write(pte))
+ goto unlock;
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
