--- /dev/null
+From 0a3e5cc7bbfcd571a2e53779ef7d7aa3c57d5432 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 20 Jul 2022 15:05:40 +0200
+Subject: blk-mq: fix error handling in __blk_mq_alloc_disk
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 0a3e5cc7bbfcd571a2e53779ef7d7aa3c57d5432 upstream.
+
+To fully clean up the queue if the disk allocation fails we need to
+call blk_mq_destroy_queue and not just blk_put_queue.
+
+Fixes: 6f8191fdf41d ("block: simplify disk shutdown")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20220720130541.1323531-1-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-mq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -3949,7 +3949,7 @@ struct gendisk *__blk_mq_alloc_disk(stru
+
+ disk = __alloc_disk_node(q, set->numa_node, lkclass);
+ if (!disk) {
+- blk_put_queue(q);
++ blk_mq_destroy_queue(q);
+ return ERR_PTR(-ENOMEM);
+ }
+ set_bit(GD_OWNS_QUEUE, &disk->state);
--- /dev/null
+From c5db2cfc6274692d821d33b59acb6ff615e350c1 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Wed, 20 Jul 2022 15:05:41 +0200
+Subject: block: call blk_mq_exit_queue from disk_release for never added disks
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit c5db2cfc6274692d821d33b59acb6ff615e350c1 upstream.
+
+To undo the all initialization from blk_mq_init_allocated_queue in case
+of a probe failure where add_disk is never called we have to call
+blk_mq_exit_queue from put_disk.
+
+This relies on the fact that drivers always call blk_mq_free_tag_set
+after calling put_disk in the probe error path if they have a gendisk
+at all.
+
+We should be doing this in general, but can't do it for the normal
+teardown case (yet) as the tagset can be gone by the time the disk is
+released once it was added. I hope to sort this out properly eventually
+but for now this isolated hack will do it.
+
+Fixes: 6f8191fdf41d ("block: simplify disk shutdown")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20220720130541.1323531-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/genhd.c | 15 +++++++++++++++
+ 1 file changed, 15 insertions(+)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1158,6 +1158,18 @@ static void disk_release(struct device *
+ might_sleep();
+ WARN_ON_ONCE(disk_live(disk));
+
++ /*
++ * To undo the all initialization from blk_mq_init_allocated_queue in
++ * case of a probe failure where add_disk is never called we have to
++ * call blk_mq_exit_queue here. We can't do this for the more common
++ * teardown case (yet) as the tagset can be gone by the time the disk
++ * is released once it was added.
++ */
++ if (queue_is_mq(disk->queue) &&
++ test_bit(GD_OWNS_QUEUE, &disk->state) &&
++ !test_bit(GD_ADDED, &disk->state))
++ blk_mq_exit_queue(disk->queue);
++
+ blkcg_exit_queue(disk->queue);
+
+ disk_release_events(disk);
+@@ -1422,6 +1434,9 @@ EXPORT_SYMBOL(__blk_alloc_disk);
+ * This decrements the refcount for the struct gendisk. When this reaches 0
+ * we'll have disk_release() called.
+ *
++ * Note: for blk-mq disk put_disk must be called before freeing the tag_set
++ * when handling probe errors (that is before add_disk() is called).
++ *
+ * Context: Any context, but the last reference must not be dropped from
+ * atomic context.
+ */
--- /dev/null
+From aa0c680c3aa96a5f9f160d90dd95402ad578e2b0 Mon Sep 17 00:00:00 2001
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+Date: Thu, 11 Aug 2022 20:23:37 -0300
+Subject: block: Do not call blk_put_queue() if gendisk allocation fails
+
+From: Rafael Mendonca <rafaelmendsr@gmail.com>
+
+commit aa0c680c3aa96a5f9f160d90dd95402ad578e2b0 upstream.
+
+Commit 6f8191fdf41d ("block: simplify disk shutdown") removed the call
+to blk_get_queue() during gendisk allocation but missed to remove the
+corresponding cleanup code blk_put_queue() for it. Thus, if the gendisk
+allocation fails, the request_queue refcount gets decremented and
+reaches 0, causing blk_mq_release() to be called with a hctx still
+alive. That triggers a WARNING report, as found by syzkaller:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 23016 at block/blk-mq.c:3881
+blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881
+[...] stripped
+RIP: 0010:blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881
+[...] stripped
+Call Trace:
+ <TASK>
+ blk_release_queue+0x153/0x270 block/blk-sysfs.c:780
+ kobject_cleanup lib/kobject.c:673 [inline]
+ kobject_release lib/kobject.c:704 [inline]
+ kref_put include/linux/kref.h:65 [inline]
+ kobject_put+0x1c8/0x540 lib/kobject.c:721
+ __alloc_disk_node+0x4f7/0x610 block/genhd.c:1388
+ __blk_mq_alloc_disk+0x13b/0x1f0 block/blk-mq.c:3961
+ loop_add+0x3e2/0xaf0 drivers/block/loop.c:1978
+ loop_control_ioctl+0x133/0x620 drivers/block/loop.c:2150
+ vfs_ioctl fs/ioctl.c:51 [inline]
+ __do_sys_ioctl fs/ioctl.c:870 [inline]
+ __se_sys_ioctl fs/ioctl.c:856 [inline]
+ __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856
+ do_syscall_x64 arch/x86/entry/common.c:50 [inline]
+ do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
+ entry_SYSCALL_64_after_hwframe+0x63/0xcd
+[...] stripped
+
+Fixes: 6f8191fdf41d ("block: simplify disk shutdown")
+Reported-by: syzbot+31c9594f6e43b9289b25@syzkaller.appspotmail.com
+Suggested-by: Hillf Danton <hdanton@sina.com>
+Signed-off-by: Rafael Mendonca <rafaelmendsr@gmail.com>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20220811232338.254673-1-rafaelmendsr@gmail.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/genhd.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1359,7 +1359,7 @@ struct gendisk *__alloc_disk_node(struct
+
+ disk = kzalloc_node(sizeof(struct gendisk), GFP_KERNEL, node_id);
+ if (!disk)
+- goto out_put_queue;
++ return NULL;
+
+ disk->bdi = bdi_alloc(node_id);
+ if (!disk->bdi)
+@@ -1403,8 +1403,6 @@ out_free_bdi:
+ bdi_put(disk->bdi);
+ out_free_disk:
+ kfree(disk);
+-out_put_queue:
+- blk_put_queue(q);
+ return NULL;
+ }
+
--- /dev/null
+From 5c57c099f442acab13129c9e15ad2a0c31151c98 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= <jose.souza@intel.com>
+Date: Wed, 8 Jun 2022 13:33:44 -0700
+Subject: drm/i915/display: Fix handling of enable_psr parameter
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: José Roberto de Souza <jose.souza@intel.com>
+
+commit 5c57c099f442acab13129c9e15ad2a0c31151c98 upstream.
+
+Commit 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs.
+global parts") cause PSR to be disabled when enable_psr has the
+default value and there is at least one DP port that do not supports
+PSR.
+
+That was happening because intel_psr_init() is called for every DP
+port and then enable_psr is globaly set to 0 based on the PSR support
+of the DP port.
+
+Here dropping the enable_psr overwritten and using the VBT PSR value
+when enable_psr is set as default.
+
+Fixes: 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. global parts")
+Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
+Cc: Jani Nikula <jani.nikula@intel.com>
+Cc: Jouni Högander <jouni.hogander@intel.com>
+Cc: Mika Kahola <mika.kahola@intel.com>
+Signed-off-by: José Roberto de Souza <jose.souza@intel.com>
+Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20220608203344.513082-1-jose.souza@intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/i915/display/intel_psr.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/display/intel_psr.c
++++ b/drivers/gpu/drm/i915/display/intel_psr.c
+@@ -86,10 +86,13 @@
+
+ static bool psr_global_enabled(struct intel_dp *intel_dp)
+ {
++ struct intel_connector *connector = intel_dp->attached_connector;
+ struct drm_i915_private *i915 = dp_to_i915(intel_dp);
+
+ switch (intel_dp->psr.debug & I915_PSR_DEBUG_MODE_MASK) {
+ case I915_PSR_DEBUG_DEFAULT:
++ if (i915->params.enable_psr == -1)
++ return connector->panel.vbt.psr.enable;
+ return i915->params.enable_psr;
+ case I915_PSR_DEBUG_DISABLE:
+ return false;
+@@ -2371,10 +2374,6 @@ void intel_psr_init(struct intel_dp *int
+
+ intel_dp->psr.source_support = true;
+
+- if (dev_priv->params.enable_psr == -1)
+- if (!connector->panel.vbt.psr.enable)
+- dev_priv->params.enable_psr = 0;
+-
+ /* Set link_standby x link_off defaults */
+ if (DISPLAY_VER(dev_priv) < 12)
+ /* For new platforms up to TGL let's respect VBT back again */
cgroup-cgroup_get_from_id-must-check-the-looked-up-kn-is-a-directory.patch
phy-marvell-phy-mvebu-a3700-comphy-remove-broken-reset-support.patch
s390-dasd-fix-oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup.patch
+drm-i915-display-fix-handling-of-enable_psr-parameter.patch
+blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch
+block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch
+block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
