--- /dev/null
+From ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 Mon Sep 17 00:00:00 2001
+From: Charan Teja Reddy <quic_charante@quicinc.com>
+Date: Tue, 10 May 2022 01:19:57 +0530
+Subject: dma-buf: call dma_buf_stats_setup after dmabuf is in valid list
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Charan Teja Reddy <quic_charante@quicinc.com>
+
+commit ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 upstream.
+
+When dma_buf_stats_setup() fails, it closes the dmabuf file which
+results into the calling of dma_buf_file_release() where it does
+list_del(&dmabuf->list_node) with out first adding it to the proper
+list. This is resulting into panic in the below path:
+__list_del_entry_valid+0x38/0xac
+dma_buf_file_release+0x74/0x158
+__fput+0xf4/0x428
+____fput+0x14/0x24
+task_work_run+0x178/0x24c
+do_notify_resume+0x194/0x264
+work_pending+0xc/0x5f0
+
+Fix it by moving the dma_buf_stats_setup() after dmabuf is added to the
+list.
+
+Fixes: bdb8d06dfefd ("dmabuf: Add the capability to expose DMA-BUF stats in sysfs")
+Signed-off-by: Charan Teja Reddy <quic_charante@quicinc.com>
+Tested-by: T.J. Mercier <tjmercier@google.com>
+Acked-by: T.J. Mercier <tjmercier@google.com>
+Cc: <stable@vger.kernel.org> # 5.15.x+
+Reviewed-by: Christian König <christian.koenig@amd.com>
+Signed-off-by: Christian König <christian.koenig@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/1652125797-2043-1-git-send-email-quic_charante@quicinc.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/dma-buf/dma-buf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/dma-buf/dma-buf.c
++++ b/drivers/dma-buf/dma-buf.c
+@@ -572,10 +572,6 @@ struct dma_buf *dma_buf_export(const str
+ file->f_mode |= FMODE_LSEEK;
+ dmabuf->file = file;
+
+- ret = dma_buf_stats_setup(dmabuf);
+- if (ret)
+- goto err_sysfs;
+-
+ mutex_init(&dmabuf->lock);
+ INIT_LIST_HEAD(&dmabuf->attachments);
+
+@@ -583,6 +579,10 @@ struct dma_buf *dma_buf_export(const str
+ list_add(&dmabuf->list_node, &db_list.head);
+ mutex_unlock(&db_list.lock);
+
++ ret = dma_buf_stats_setup(dmabuf);
++ if (ret)
++ goto err_sysfs;
++
+ return dmabuf;
+
+ err_sysfs:
--- /dev/null
+From 3059d9b9f6aa433a55b9d0d21b566396d5497c33 Mon Sep 17 00:00:00 2001
+From: Zack Rusin <zackr@vmware.com>
+Date: Wed, 2 Mar 2022 10:24:24 -0500
+Subject: drm/vmwgfx: Initialize drm_mode_fb_cmd2
+
+From: Zack Rusin <zackr@vmware.com>
+
+commit 3059d9b9f6aa433a55b9d0d21b566396d5497c33 upstream.
+
+Transition to drm_mode_fb_cmd2 from drm_mode_fb_cmd left the structure
+unitialized. drm_mode_fb_cmd2 adds a few additional members, e.g. flags
+and modifiers which were never initialized. Garbage in those members
+can cause random failures during the bringup of the fbcon.
+
+Initializing the structure fixes random blank screens after bootup due
+to flags/modifiers mismatches during the fbcon bring up.
+
+Fixes: dabdcdc9822a ("drm/vmwgfx: Switch to mode_cmd2")
+Signed-off-by: Zack Rusin <zackr@vmware.com>
+Cc: Daniel Vetter <daniel.vetter@intel.com>
+Cc: <stable@vger.kernel.org> # v4.10+
+Reviewed-by: Martin Krastev <krastevm@vmware.com>
+Reviewed-by: Maaz Mombasawala <mombasawalam@vmware.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220302152426.885214-7-zack@kde.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -490,7 +490,7 @@ static int vmw_fb_kms_detach(struct vmw_
+
+ static int vmw_fb_kms_framebuffer(struct fb_info *info)
+ {
+- struct drm_mode_fb_cmd2 mode_cmd;
++ struct drm_mode_fb_cmd2 mode_cmd = {0};
+ struct vmw_fb_par *par = info->par;
+ struct fb_var_screeninfo *var = &info->var;
+ struct drm_framebuffer *cur_fb;
--- /dev/null
+From 1825b93b626e99eb9a0f9f50342c7b2fa201b387 Mon Sep 17 00:00:00 2001
+From: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Date: Thu, 28 Apr 2022 23:14:44 -0700
+Subject: mm/hwpoison: use pr_err() instead of dump_page() in get_any_page()
+
+From: Naoya Horiguchi <naoya.horiguchi@nec.com>
+
+commit 1825b93b626e99eb9a0f9f50342c7b2fa201b387 upstream.
+
+The following VM_BUG_ON_FOLIO() is triggered when memory error event
+happens on the (thp/folio) pages which are about to be freed:
+
+ [ 1160.232771] page:00000000b36a8a0f refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
+ [ 1160.236916] page:00000000b36a8a0f refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000
+ [ 1160.240684] flags: 0x57ffffc0800000(hwpoison|node=1|zone=2|lastcpupid=0x1fffff)
+ [ 1160.243458] raw: 0057ffffc0800000 dead000000000100 dead000000000122 0000000000000000
+ [ 1160.246268] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
+ [ 1160.249197] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio))
+ [ 1160.251815] ------------[ cut here ]------------
+ [ 1160.253438] kernel BUG at include/linux/mm.h:788!
+ [ 1160.256162] invalid opcode: 0000 [#1] PREEMPT SMP PTI
+ [ 1160.258172] CPU: 2 PID: 115368 Comm: mceinj.sh Tainted: G E 5.18.0-rc1-v5.18-rc1-220404-2353-005-g83111+ #3
+ [ 1160.262049] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014
+ [ 1160.265103] RIP: 0010:dump_page.cold+0x27e/0x2bd
+ [ 1160.266757] Code: fe ff ff 48 c7 c6 81 f1 5a 98 e9 4c fe ff ff 48 c7 c6 a1 95 59 98 e9 40 fe ff ff 48 c7 c6 50 bf 5a 98 48 89 ef e8 9d 04 6d ff <0f> 0b 41 f7 c4 ff 0f 00 00 0f 85 9f fd ff ff 49 8b 04 24 a9 00 00
+ [ 1160.273180] RSP: 0018:ffffaa2c4d59fd18 EFLAGS: 00010292
+ [ 1160.274969] RAX: 000000000000003e RBX: 0000000000000001 RCX: 0000000000000000
+ [ 1160.277263] RDX: 0000000000000001 RSI: ffffffff985995a1 RDI: 00000000ffffffff
+ [ 1160.279571] RBP: ffffdc9c45a80000 R08: 0000000000000000 R09: 00000000ffffdfff
+ [ 1160.281794] R10: ffffaa2c4d59fb08 R11: ffffffff98940d08 R12: ffffdc9c45a80000
+ [ 1160.283920] R13: ffffffff985b6f94 R14: 0000000000000000 R15: ffffdc9c45a80000
+ [ 1160.286641] FS: 00007eff54ce1740(0000) GS:ffff99c67bd00000(0000) knlGS:0000000000000000
+ [ 1160.289498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [ 1160.291106] CR2: 00005628381a5f68 CR3: 0000000104712003 CR4: 0000000000170ee0
+ [ 1160.293031] Call Trace:
+ [ 1160.293724] <TASK>
+ [ 1160.294334] get_hwpoison_page+0x47d/0x570
+ [ 1160.295474] memory_failure+0x106/0xaa0
+ [ 1160.296474] ? security_capable+0x36/0x50
+ [ 1160.297524] hard_offline_page_store+0x43/0x80
+ [ 1160.298684] kernfs_fop_write_iter+0x11c/0x1b0
+ [ 1160.299829] new_sync_write+0xf9/0x160
+ [ 1160.300810] vfs_write+0x209/0x290
+ [ 1160.301835] ksys_write+0x4f/0xc0
+ [ 1160.302718] do_syscall_64+0x3b/0x90
+ [ 1160.303664] entry_SYSCALL_64_after_hwframe+0x44/0xae
+ [ 1160.304981] RIP: 0033:0x7eff54b018b7
+
+As shown in the RIP address, this VM_BUG_ON in folio_entire_mapcount() is
+called from dump_page("hwpoison: unhandlable page") in get_any_page().
+The below explains the mechanism of the race:
+
+ CPU 0 CPU 1
+
+ memory_failure
+ get_hwpoison_page
+ get_any_page
+ dump_page
+ compound = PageCompound
+ free_pages_prepare
+ page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP
+ folio_entire_mapcount
+ VM_BUG_ON_FOLIO(!folio_test_large(folio))
+
+So replace dump_page() with safer one, pr_err().
+
+Link: https://lkml.kernel.org/r/20220427053220.719866-1-naoya.horiguchi@linux.dev
+Fixes: 74e8ee4708a8 ("mm: Turn head_compound_mapcount() into folio_entire_mapcount()")
+Signed-off-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
+Reviewed-by: John Hubbard <jhubbard@nvidia.com>
+Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
+Cc: Matthew Wilcox <willy@infradead.org>
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Jason Gunthorpe <jgg@nvidia.com>
+Cc: William Kucharski <william.kucharski@oracle.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/memory-failure.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1217,7 +1217,7 @@ try_again:
+ }
+ out:
+ if (ret == -EIO)
+- dump_page(p, "hwpoison: unhandlable page");
++ pr_err("Memory failure: %#lx: unhandlable page.\n", page_to_pfn(p));
+
+ return ret;
+ }
--- /dev/null
+From a56f445f807b0276fc0660c330bf93a9ea78e8ea Mon Sep 17 00:00:00 2001
+From: Alex Deucher <alexander.deucher@amd.com>
+Date: Tue, 10 May 2022 09:37:06 -0400
+Subject: Revert "drm/amd/pm: keep the BACO feature enabled for suspend"
+
+From: Alex Deucher <alexander.deucher@amd.com>
+
+commit a56f445f807b0276fc0660c330bf93a9ea78e8ea upstream.
+
+This reverts commit eaa090538e8d21801c6d5f94590c3799e6a528b5.
+
+Commit ebc002e3ee78 ("drm/amdgpu: don't use BACO for reset in S3")
+stops using BACO for reset during suspend, so it's no longer
+necessary to leave BACO enabled during suspend. This fixes
+resume from suspend on the navy flounder dGPU in the ASUS ROG
+Strix G513QY.
+
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2008
+Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1982
+Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
+Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +-------
+ 1 file changed, 1 insertion(+), 7 deletions(-)
+
+--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+@@ -1386,14 +1386,8 @@ static int smu_disable_dpms(struct smu_c
+ {
+ struct amdgpu_device *adev = smu->adev;
+ int ret = 0;
+- /*
+- * TODO: (adev->in_suspend && !adev->in_s0ix) is added to pair
+- * the workaround which always reset the asic in suspend.
+- * It's likely that workaround will be dropped in the future.
+- * Then the change here should be dropped together.
+- */
+ bool use_baco = !smu->is_apu &&
+- (((amdgpu_in_reset(adev) || (adev->in_suspend && !adev->in_s0ix)) &&
++ ((amdgpu_in_reset(adev) &&
+ (amdgpu_asic_reset_method(adev) == AMD_RESET_METHOD_BACO)) ||
+ ((adev->in_runpm || adev->in_s4) && amdgpu_asic_supports_baco(adev)));
+
net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch
net-phy-micrel-pass-.probe-for-ks8737.patch
sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch
+drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch
+revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch
+dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch
+mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
