]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.4
authorSasha Levin <sashal@kernel.org>
Mon, 17 May 2021 03:14:56 +0000 (23:14 -0400)
committerSasha Levin <sashal@kernel.org>
Mon, 17 May 2021 03:14:56 +0000 (23:14 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch [new file with mode: 0644]
queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch [new file with mode: 0644]
queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch [new file with mode: 0644]
queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch [new file with mode: 0644]
queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch [new file with mode: 0644]
queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch [new file with mode: 0644]
queue-5.4/series
queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch [new file with mode: 0644]

diff --git a/queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch b/queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch
new file mode 100644 (file)
index 0000000..7ebee7e
--- /dev/null
@@ -0,0 +1,36 @@
+From 05ed4d372c1e7a0fe4b98f7d05a3829767f41af0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 8 May 2021 09:23:09 +0200
+Subject: ACPI: scan: Fix a memory leak in an error handling path
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit 0c8bd174f0fc131bc9dfab35cd8784f59045da87 ]
+
+If 'acpi_device_set_name()' fails, we must free
+'acpi_device_bus_id->bus_id' or there is a (potential) memory leak.
+
+Fixes: eb50aaf960e3 ("ACPI: scan: Use unique number for instance_no")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/acpi/scan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
+index dbb5919f23e2..95d119ff76b6 100644
+--- a/drivers/acpi/scan.c
++++ b/drivers/acpi/scan.c
+@@ -706,6 +706,7 @@ int acpi_device_add(struct acpi_device *device,
+               result = acpi_device_set_name(device, acpi_device_bus_id);
+               if (result) {
++                      kfree_const(acpi_device_bus_id->bus_id);
+                       kfree(acpi_device_bus_id);
+                       goto err_unlock;
+               }
+-- 
+2.30.2
+
diff --git a/queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch b/queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch
new file mode 100644 (file)
index 0000000..fec52c4
--- /dev/null
@@ -0,0 +1,51 @@
+From 7f5d158289962cfcba7e5c5c1cddee449f487e17 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 13 May 2021 10:15:29 -0700
+Subject: blk-mq: Swap two calls in blk_mq_exit_queue()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+[ Upstream commit 630ef623ed26c18a457cdc070cf24014e50129c2 ]
+
+If a tag set is shared across request queues (e.g. SCSI LUNs) then the
+block layer core keeps track of the number of active request queues in
+tags->active_queues. blk_mq_tag_busy() and blk_mq_tag_idle() update that
+atomic counter if the hctx flag BLK_MQ_F_TAG_QUEUE_SHARED is set. Make
+sure that blk_mq_exit_queue() calls blk_mq_tag_idle() before that flag is
+cleared by blk_mq_del_queue_tag_set().
+
+Cc: Christoph Hellwig <hch@infradead.org>
+Cc: Ming Lei <ming.lei@redhat.com>
+Cc: Hannes Reinecke <hare@suse.com>
+Fixes: 0d2602ca30e4 ("blk-mq: improve support for shared tags maps")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20210513171529.7977-1-bvanassche@acm.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-mq.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 057a634396a9..0674f53c6052 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -2970,10 +2970,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue);
+ /* tags can _not_ be used after returning from blk_mq_exit_queue */
+ void blk_mq_exit_queue(struct request_queue *q)
+ {
+-      struct blk_mq_tag_set   *set = q->tag_set;
++      struct blk_mq_tag_set *set = q->tag_set;
+-      blk_mq_del_queue_tag_set(q);
++      /* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */
+       blk_mq_exit_hw_queues(q, set, set->nr_hw_queues);
++      /* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */
++      blk_mq_del_queue_tag_set(q);
+ }
+ static int __blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set)
+-- 
+2.30.2
+
diff --git a/queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch b/queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch
new file mode 100644 (file)
index 0000000..723ef30
--- /dev/null
@@ -0,0 +1,64 @@
+From 0e53d16b468fb839481c6edb5ab409a38281622f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 29 Apr 2021 10:13:36 -0500
+Subject: hwmon: (occ) Fix poll rate limiting
+
+From: Eddie James <eajames@linux.ibm.com>
+
+[ Upstream commit 5216dff22dc2bbbbe6f00335f9fd2879670e753b ]
+
+The poll rate limiter time was initialized at zero. This breaks the
+comparison in time_after if jiffies is large. Switch to storing the
+next update time rather than the previous time, and initialize the
+time when the device is probed.
+
+Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions")
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Link: https://lore.kernel.org/r/20210429151336.18980-1-eajames@linux.ibm.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/occ/common.c | 5 +++--
+ drivers/hwmon/occ/common.h | 2 +-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c
+index 30e18eb60da7..0b689ccbb793 100644
+--- a/drivers/hwmon/occ/common.c
++++ b/drivers/hwmon/occ/common.c
+@@ -209,9 +209,9 @@ int occ_update_response(struct occ *occ)
+               return rc;
+       /* limit the maximum rate of polling the OCC */
+-      if (time_after(jiffies, occ->last_update + OCC_UPDATE_FREQUENCY)) {
++      if (time_after(jiffies, occ->next_update)) {
+               rc = occ_poll(occ);
+-              occ->last_update = jiffies;
++              occ->next_update = jiffies + OCC_UPDATE_FREQUENCY;
+       } else {
+               rc = occ->last_error;
+       }
+@@ -1089,6 +1089,7 @@ int occ_setup(struct occ *occ, const char *name)
+               return rc;
+       }
++      occ->next_update = jiffies + OCC_UPDATE_FREQUENCY;
+       occ_parse_poll_response(occ);
+       rc = occ_setup_sensor_attrs(occ);
+diff --git a/drivers/hwmon/occ/common.h b/drivers/hwmon/occ/common.h
+index 67e6968b8978..e6df719770e8 100644
+--- a/drivers/hwmon/occ/common.h
++++ b/drivers/hwmon/occ/common.h
+@@ -99,7 +99,7 @@ struct occ {
+       u8 poll_cmd_data;               /* to perform OCC poll command */
+       int (*send_cmd)(struct occ *occ, u8 *cmd);
+-      unsigned long last_update;
++      unsigned long next_update;
+       struct mutex lock;              /* lock OCC access */
+       struct device *hwmon;
+-- 
+2.30.2
+
diff --git a/queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch b/queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch
new file mode 100644 (file)
index 0000000..dba3aa7
--- /dev/null
@@ -0,0 +1,37 @@
+From 35ba043bbf5116badcea75fe822eda6839ffc588 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Apr 2021 13:32:02 +0800
+Subject: iio: proximity: pulsedlight: Fix rumtime PM imbalance on error
+
+From: Dinghao Liu <dinghao.liu@zju.edu.cn>
+
+[ Upstream commit a2fa9242e89f27696515699fe0f0296bf1ac1815 ]
+
+When lidar_write_control() fails, a pairing PM usage counter
+decrement is needed to keep the counter balanced.
+
+Fixes: 4ac4e086fd8c5 ("iio: pulsedlight-lidar-lite: add runtime PM")
+Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Link: https://lore.kernel.org/r/20210412053204.4889-1-dinghao.liu@zju.edu.cn
+Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+index 47af54f14756..67f85268b63d 100644
+--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c
+@@ -158,6 +158,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg)
+       ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE);
+       if (ret < 0) {
+               dev_err(&client->dev, "cannot send start measurement command");
++              pm_runtime_put_noidle(&client->dev);
+               return ret;
+       }
+-- 
+2.30.2
+
diff --git a/queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch b/queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch
new file mode 100644 (file)
index 0000000..c636956
--- /dev/null
@@ -0,0 +1,162 @@
+From feb14273537541e0c4f8fa2465d3581233c61e08 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 10 May 2021 17:05:35 -0700
+Subject: kyber: fix out of bounds access when preempted
+
+From: Omar Sandoval <osandov@fb.com>
+
+[ Upstream commit efed9a3337e341bd0989161b97453b52567bc59d ]
+
+__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and
+passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx
+for the current CPU again and uses that to get the corresponding Kyber
+context in the passed hctx. However, the thread may be preempted between
+the two calls to blk_mq_get_ctx(), and the ctx returned the second time
+may no longer correspond to the passed hctx. This "works" accidentally
+most of the time, but it can cause us to read garbage if the second ctx
+came from an hctx with more ctx's than the first one (i.e., if
+ctx->index_hw[hctx->type] > hctx->nr_ctx).
+
+This manifested as this UBSAN array index out of bounds error reported
+by Jakub:
+
+UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9
+index 13106 is out of range for type 'long unsigned int [128]'
+Call Trace:
+ dump_stack+0xa4/0xe5
+ ubsan_epilogue+0x5/0x40
+ __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34
+ queued_spin_lock_slowpath+0x476/0x480
+ do_raw_spin_lock+0x1c2/0x1d0
+ kyber_bio_merge+0x112/0x180
+ blk_mq_submit_bio+0x1f5/0x1100
+ submit_bio_noacct+0x7b0/0x870
+ submit_bio+0xc2/0x3a0
+ btrfs_map_bio+0x4f0/0x9d0
+ btrfs_submit_data_bio+0x24e/0x310
+ submit_one_bio+0x7f/0xb0
+ submit_extent_page+0xc4/0x440
+ __extent_writepage_io+0x2b8/0x5e0
+ __extent_writepage+0x28d/0x6e0
+ extent_write_cache_pages+0x4d7/0x7a0
+ extent_writepages+0xa2/0x110
+ do_writepages+0x8f/0x180
+ __writeback_single_inode+0x99/0x7f0
+ writeback_sb_inodes+0x34e/0x790
+ __writeback_inodes_wb+0x9e/0x120
+ wb_writeback+0x4d2/0x660
+ wb_workfn+0x64d/0xa10
+ process_one_work+0x53a/0xa80
+ worker_thread+0x69/0x5b0
+ kthread+0x20b/0x240
+ ret_from_fork+0x1f/0x30
+
+Only Kyber uses the hctx, so fix it by passing the request_queue to
+->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can
+map the queues itself to avoid the mismatch.
+
+Fixes: a6088845c2bf ("block: kyber: make kyber more friendly with merging")
+Reported-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Omar Sandoval <osandov@fb.com>
+Link: https://lore.kernel.org/r/c7598605401a48d5cfeadebb678abd10af22b83f.1620691329.git.osandov@fb.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/bfq-iosched.c      | 3 +--
+ block/blk-mq-sched.c     | 8 +++++---
+ block/kyber-iosched.c    | 5 +++--
+ block/mq-deadline.c      | 3 +--
+ include/linux/elevator.h | 2 +-
+ 5 files changed, 11 insertions(+), 10 deletions(-)
+
+diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c
+index c19006d59b79..136232a01f71 100644
+--- a/block/bfq-iosched.c
++++ b/block/bfq-iosched.c
+@@ -2210,10 +2210,9 @@ static void bfq_remove_request(struct request_queue *q,
+ }
+-static bool bfq_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio,
++static bool bfq_bio_merge(struct request_queue *q, struct bio *bio,
+               unsigned int nr_segs)
+ {
+-      struct request_queue *q = hctx->queue;
+       struct bfq_data *bfqd = q->elevator->elevator_data;
+       struct request *free = NULL;
+       /*
+diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c
+index 7620734d5542..f422c7feea7e 100644
+--- a/block/blk-mq-sched.c
++++ b/block/blk-mq-sched.c
+@@ -334,14 +334,16 @@ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio,
+               unsigned int nr_segs)
+ {
+       struct elevator_queue *e = q->elevator;
+-      struct blk_mq_ctx *ctx = blk_mq_get_ctx(q);
+-      struct blk_mq_hw_ctx *hctx = blk_mq_map_queue(q, bio->bi_opf, ctx);
++      struct blk_mq_ctx *ctx;
++      struct blk_mq_hw_ctx *hctx;
+       bool ret = false;
+       enum hctx_type type;
+       if (e && e->type->ops.bio_merge)
+-              return e->type->ops.bio_merge(hctx, bio, nr_segs);
++              return e->type->ops.bio_merge(q, bio, nr_segs);
++      ctx = blk_mq_get_ctx(q);
++      hctx = blk_mq_map_queue(q, bio->bi_opf, ctx);
+       type = hctx->type;
+       if ((hctx->flags & BLK_MQ_F_SHOULD_MERGE) &&
+                       !list_empty_careful(&ctx->rq_lists[type])) {
+diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c
+index 34dcea0ef637..77a0fcebdc77 100644
+--- a/block/kyber-iosched.c
++++ b/block/kyber-iosched.c
+@@ -562,11 +562,12 @@ static void kyber_limit_depth(unsigned int op, struct blk_mq_alloc_data *data)
+       }
+ }
+-static bool kyber_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio,
++static bool kyber_bio_merge(struct request_queue *q, struct bio *bio,
+               unsigned int nr_segs)
+ {
++      struct blk_mq_ctx *ctx = blk_mq_get_ctx(q);
++      struct blk_mq_hw_ctx *hctx = blk_mq_map_queue(q, bio->bi_opf, ctx);
+       struct kyber_hctx_data *khd = hctx->sched_data;
+-      struct blk_mq_ctx *ctx = blk_mq_get_ctx(hctx->queue);
+       struct kyber_ctx_queue *kcq = &khd->kcqs[ctx->index_hw[hctx->type]];
+       unsigned int sched_domain = kyber_sched_domain(bio->bi_opf);
+       struct list_head *rq_list = &kcq->rq_list[sched_domain];
+diff --git a/block/mq-deadline.c b/block/mq-deadline.c
+index b490f47fd553..19c6922e85f1 100644
+--- a/block/mq-deadline.c
++++ b/block/mq-deadline.c
+@@ -459,10 +459,9 @@ static int dd_request_merge(struct request_queue *q, struct request **rq,
+       return ELEVATOR_NO_MERGE;
+ }
+-static bool dd_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio,
++static bool dd_bio_merge(struct request_queue *q, struct bio *bio,
+               unsigned int nr_segs)
+ {
+-      struct request_queue *q = hctx->queue;
+       struct deadline_data *dd = q->elevator->elevator_data;
+       struct request *free = NULL;
+       bool ret;
+diff --git a/include/linux/elevator.h b/include/linux/elevator.h
+index 901bda352dcb..7b4d5face204 100644
+--- a/include/linux/elevator.h
++++ b/include/linux/elevator.h
+@@ -34,7 +34,7 @@ struct elevator_mq_ops {
+       void (*depth_updated)(struct blk_mq_hw_ctx *);
+       bool (*allow_merge)(struct request_queue *, struct request *, struct bio *);
+-      bool (*bio_merge)(struct blk_mq_hw_ctx *, struct bio *, unsigned int);
++      bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int);
+       int (*request_merge)(struct request_queue *q, struct request **, struct bio *);
+       void (*request_merged)(struct request_queue *, struct request *, enum elv_merge);
+       void (*requests_merged)(struct request_queue *, struct request *, struct request *);
+-- 
+2.30.2
+
diff --git a/queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch b/queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch
new file mode 100644 (file)
index 0000000..a9e71a0
--- /dev/null
@@ -0,0 +1,86 @@
+From df713e302e9d6e0e8b07e3a53834e41473a47fd0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 12 May 2021 19:43:30 +0800
+Subject: nbd: Fix NULL pointer in flush_workqueue
+
+From: Sun Ke <sunke32@huawei.com>
+
+[ Upstream commit 79ebe9110fa458d58f1fceb078e2068d7ad37390 ]
+
+Open /dev/nbdX first, the config_refs will be 1 and
+the pointers in nbd_device are still null. Disconnect
+/dev/nbdX, then reference a null recv_workq. The
+protection by config_refs in nbd_genl_disconnect is useless.
+
+[  656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020
+[  656.368943] #PF: supervisor write access in kernel mode
+[  656.369844] #PF: error_code(0x0002) - not-present page
+[  656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0
+[  656.371693] Oops: 0002 [#1] SMP
+[  656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1
+[  656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014
+[  656.375904] RIP: 0010:mutex_lock+0x29/0x60
+[  656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 <f0> 48 0f b1 55 d
+[  656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246
+[  656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
+[  656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020
+[  656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318
+[  656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40
+[  656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00
+[  656.382166] FS:  00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000
+[  656.382806] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0
+[  656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+[  656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+[  656.384927] Call Trace:
+[  656.385111]  flush_workqueue+0x92/0x6c0
+[  656.385395]  nbd_disconnect_and_put+0x81/0xd0
+[  656.385716]  nbd_genl_disconnect+0x125/0x2a0
+[  656.386034]  genl_family_rcv_msg_doit.isra.0+0x102/0x1b0
+[  656.386422]  genl_rcv_msg+0xfc/0x2b0
+[  656.386685]  ? nbd_ioctl+0x490/0x490
+[  656.386954]  ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0
+[  656.387354]  netlink_rcv_skb+0x62/0x180
+[  656.387638]  genl_rcv+0x34/0x60
+[  656.387874]  netlink_unicast+0x26d/0x590
+[  656.388162]  netlink_sendmsg+0x398/0x6c0
+[  656.388451]  ? netlink_rcv_skb+0x180/0x180
+[  656.388750]  ____sys_sendmsg+0x1da/0x320
+[  656.389038]  ? ____sys_recvmsg+0x130/0x220
+[  656.389334]  ___sys_sendmsg+0x8e/0xf0
+[  656.389605]  ? ___sys_recvmsg+0xa2/0xf0
+[  656.389889]  ? handle_mm_fault+0x1671/0x21d0
+[  656.390201]  __sys_sendmsg+0x6d/0xe0
+[  656.390464]  __x64_sys_sendmsg+0x23/0x30
+[  656.390751]  do_syscall_64+0x45/0x70
+[  656.391017]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+To fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put().
+
+Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs")
+Signed-off-by: Sun Ke <sunke32@huawei.com>
+Reviewed-by: Josef Bacik <josef@toxicpanda.com>
+Link: https://lore.kernel.org/r/20210512114331.1233964-2-sunke32@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/block/nbd.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index e11fddcb73b9..839364371f9a 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -2016,7 +2016,8 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd)
+        * config ref and try to destroy the workqueue from inside the work
+        * queue.
+        */
+-      flush_workqueue(nbd->recv_workq);
++      if (nbd->recv_workq)
++              flush_workqueue(nbd->recv_workq);
+       if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF,
+                              &nbd->config->runtime_flags))
+               nbd_config_put(nbd);
+-- 
+2.30.2
+
index 1aa9aaeaab1e2f0f7811db43aa85d51670bf9cc6..732b6d883f26cb11d5f331de9af8d2db0a54597b 100644 (file)
@@ -102,3 +102,10 @@ userfaultfd-release-page-in-error-path-to-avoid-bug_on.patch
 mm-hugetlb-fix-f_seal_future_write.patch
 drm-radeon-dpm-disable-sclk-switching-on-oland-when-two-4k-60hz-monitors-are-connected.patch
 drm-i915-avoid-div-by-zero-on-gen2.patch
+iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch
+usb-fotg210-hcd-fix-an-error-message.patch
+hwmon-occ-fix-poll-rate-limiting.patch
+acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch
+kyber-fix-out-of-bounds-access-when-preempted.patch
+nbd-fix-null-pointer-in-flush_workqueue.patch
+blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch
diff --git a/queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch b/queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch
new file mode 100644 (file)
index 0000000..88d29ee
--- /dev/null
@@ -0,0 +1,53 @@
+From f11d07f707777ea4cc2e172476d03dcb401edfaf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 6 May 2021 22:39:10 +0200
+Subject: usb: fotg210-hcd: Fix an error message
+
+From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+
+[ Upstream commit a60a34366e0d09ca002c966dd7c43a68c28b1f82 ]
+
+'retval' is known to be -ENODEV here.
+This is a hard-coded default error code which is not useful in the error
+message. Moreover, another error message is printed at the end of the
+error handling path. The corresponding error code (-ENOMEM) is more
+informative.
+
+So remove simplify the first error message.
+
+While at it, also remove the useless initialization of 'retval'.
+
+Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
+Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
+Link: https://lore.kernel.org/r/94531bcff98e46d4f9c20183a90b7f47f699126c.1620333419.git.christophe.jaillet@wanadoo.fr
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/host/fotg210-hcd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c
+index 9e0c98d6bdb0..c3f74d6674e1 100644
+--- a/drivers/usb/host/fotg210-hcd.c
++++ b/drivers/usb/host/fotg210-hcd.c
+@@ -5571,7 +5571,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
+       struct usb_hcd *hcd;
+       struct resource *res;
+       int irq;
+-      int retval = -ENODEV;
++      int retval;
+       struct fotg210_hcd *fotg210;
+       if (usb_disabled())
+@@ -5591,7 +5591,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev)
+       hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev,
+                       dev_name(dev));
+       if (!hcd) {
+-              dev_err(dev, "failed to create hcd with err %d\n", retval);
++              dev_err(dev, "failed to create hcd\n");
+               retval = -ENOMEM;
+               goto fail_create_hcd;
+       }
+-- 
+2.30.2
+