5.10-stable patches

added patches:
	rdma-hns-fix-deadlock-on-srq-async-events.patch
	vmalloc-fix-accounting-with-i915.patch

diff --git a/queue-5.10/rdma-hns-fix-deadlock-on-srq-async-events.patch b/queue-5.10/rdma-hns-fix-deadlock-on-srq-async-events.patch
new file mode 100644 (file)
index 0000000..4af3521
--- /dev/null
+++ b/queue-5.10/rdma-hns-fix-deadlock-on-srq-async-events.patch
@@ -0,0 +1,62 @@
+From b46494b6f9c19f141114a57729e198698f40af37 Mon Sep 17 00:00:00 2001
+From: Chengchang Tang <tangchengchang@huawei.com>
+Date: Fri, 12 Apr 2024 17:16:10 +0800
+Subject: RDMA/hns: Fix deadlock on SRQ async events.
+
+From: Chengchang Tang <tangchengchang@huawei.com>
+
+commit b46494b6f9c19f141114a57729e198698f40af37 upstream.
+
+xa_lock for SRQ table may be required in AEQ. Use xa_store_irq()/
+xa_erase_irq() to avoid deadlock.
+
+Fixes: 81fce6291d99 ("RDMA/hns: Add SRQ asynchronous event support")
+Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
+Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
+Link: https://lore.kernel.org/r/20240412091616.370789-5-huangjunxian6@hisilicon.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/hw/hns/hns_roce_main.c |    1 +
+ drivers/infiniband/hw/hns/hns_roce_srq.c  |    6 +++---
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/hns/hns_roce_main.c
++++ b/drivers/infiniband/hw/hns/hns_roce_main.c
+@@ -37,6 +37,7 @@
+ #include <rdma/ib_smi.h>
+ #include <rdma/ib_user_verbs.h>
+ #include <rdma/ib_cache.h>
++#include "hnae3.h"
+ #include "hns_roce_common.h"
+ #include "hns_roce_device.h"
+ #include <rdma/hns-abi.h>
+--- a/drivers/infiniband/hw/hns/hns_roce_srq.c
++++ b/drivers/infiniband/hw/hns/hns_roce_srq.c
+@@ -120,7 +120,7 @@ static int alloc_srqc(struct hns_roce_de
+               goto err_out;
+       }
+ 
+-      ret = xa_err(xa_store(&srq_table->xa, srq->srqn, srq, GFP_KERNEL));
++      ret = xa_err(xa_store_irq(&srq_table->xa, srq->srqn, srq, GFP_KERNEL));
+       if (ret) {
+               ibdev_err(ibdev, "failed to store SRQC, ret = %d.\n", ret);
+               goto err_put;
+@@ -149,7 +149,7 @@ static int alloc_srqc(struct hns_roce_de
+       return ret;
+ 
+ err_xa:
+-      xa_erase(&srq_table->xa, srq->srqn);
++      xa_erase_irq(&srq_table->xa, srq->srqn);
+ 
+ err_put:
+       hns_roce_table_put(hr_dev, &srq_table->table, srq->srqn);
+@@ -169,7 +169,7 @@ static void free_srqc(struct hns_roce_de
+               dev_err(hr_dev->dev, "DESTROY_SRQ failed (%d) for SRQN %06lx\n",
+                       ret, srq->srqn);
+ 
+-      xa_erase(&srq_table->xa, srq->srqn);
++      xa_erase_irq(&srq_table->xa, srq->srqn);
+ 
+       if (atomic_dec_and_test(&srq->refcount))
+               complete(&srq->free);

diff --git a/queue-5.10/series b/queue-5.10/series
index 7472eda8184f4606eee434d9c8c7b7beefccfa43..820ff2c5fb940080703179bd59b6ad679d9b530e 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -113,3 +113,5 @@ iio-imu-inv_icm42600-fix-spi-burst-write-not-supported.patch
 iio-imu-inv_icm42600-fix-timestamps-after-suspend-if-sensor-is-on.patch
 iio-adc-rockchip_saradc-fix-information-leak-in-triggered-buffer.patch
 drm-radeon-check-bo_va-bo-is-non-null-before-using-it.patch
+vmalloc-fix-accounting-with-i915.patch
+rdma-hns-fix-deadlock-on-srq-async-events.patch

diff --git a/queue-5.10/vmalloc-fix-accounting-with-i915.patch b/queue-5.10/vmalloc-fix-accounting-with-i915.patch
new file mode 100644 (file)
index 0000000..7f0d597
--- /dev/null
+++ b/queue-5.10/vmalloc-fix-accounting-with-i915.patch
@@ -0,0 +1,47 @@
+From 5728a1d6247dea6c96c980d96cb147dd893f3daa Mon Sep 17 00:00:00 2001
+From: "Matthew Wilcox (Oracle)" <willy@infradead.org>
+Date: Mon, 23 Dec 2024 20:18:00 +0000
+Subject: vmalloc: fix accounting with i915
+
+From: Matthew Wilcox (Oracle) <willy@infradead.org>
+
+[ Upstream commit a2e740e216f5bf49ccb83b6d490c72a340558a43 ]
+
+If the caller of vmap() specifies VM_MAP_PUT_PAGES (currently only the
+i915 driver), we will decrement nr_vmalloc_pages and MEMCG_VMALLOC in
+vfree().  These counters are incremented by vmalloc() but not by vmap() so
+this will cause an underflow.  Check the VM_MAP_PUT_PAGES flag before
+decrementing either counter.
+
+Link: https://lkml.kernel.org/r/20241211202538.168311-1-willy@infradead.org
+Fixes: b944afc9d64d ("mm: add a VM_MAP_PUT_PAGES flag for vmap")
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Acked-by: Johannes Weiner <hannes@cmpxchg.org>
+Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
+Reviewed-by: Balbir Singh <balbirs@nvidia.com>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Cc: Christoph Hellwig <hch@lst.de>
+Cc: Muchun Song <muchun.song@linux.dev>
+Cc: Roman Gushchin <roman.gushchin@linux.dev>
+Cc: "Uladzislau Rezki (Sony)" <urezki@gmail.com>
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ mm/vmalloc.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -2269,7 +2269,8 @@ static void __vunmap(const void *addr, i
+                       BUG_ON(!page);
+                       __free_pages(page, 0);
+               }
+-              atomic_long_sub(area->nr_pages, &nr_vmalloc_pages);
++              if (!(area->flags & VM_MAP_PUT_PAGES))
++                      atomic_long_sub(area->nr_pages, &nr_vmalloc_pages);
+ 
+               kvfree(area->pages);
+       }