From: Greg Kroah-Hartman Date: Sun, 23 Jan 2022 16:14:42 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v4.4.300~128 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7733ca5b2f2c6124c4a21d445be0d2063735db15;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch md-move-alloc-free-acct-bioset-in-to-personality.patch mfd-tps65910-set-pwr_off-bit-during-driver-probe.patch rpmsg-core-clean-up-resources-on-announce_create-failure.patch spi-uniphier-fix-a-bug-that-doesn-t-point-to-private-data-correctly.patch tpm-fix-npe-on-probe-for-missing-device.patch tpm-fix-potential-null-pointer-access-in-tpm_del_char_device.patch ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch xen-gntdev-fix-unmap-notification-order.patch --- diff --git a/queue-5.15/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch b/queue-5.15/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch new file mode 100644 index 00000000000..4d38775cbde --- /dev/null +++ b/queue-5.15/crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch @@ -0,0 +1,57 @@ +From efd21e10fc3bf4c6da122470a5ae89ec4ed8d180 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Mon, 1 Nov 2021 11:13:53 +0800 +Subject: crypto: caam - replace this_cpu_ptr with raw_cpu_ptr +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Meng Li + +commit efd21e10fc3bf4c6da122470a5ae89ec4ed8d180 upstream. + +When enable the kernel debug config, there is below calltrace detected: +BUG: using smp_processor_id() in preemptible [00000000] code: cryptomgr_test/339 +caller is debug_smp_processor_id+0x20/0x30 +CPU: 9 PID: 339 Comm: cryptomgr_test Not tainted 5.10.63-yocto-standard #1 +Hardware name: NXP Layerscape LX2160ARDB (DT) +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xf0/0x13c + check_preemption_disabled+0x100/0x110 + debug_smp_processor_id+0x20/0x30 + dpaa2_caam_enqueue+0x10c/0x25c + ...... + cryptomgr_test+0x38/0x60 + kthread+0x158/0x164 + ret_from_fork+0x10/0x38 +According to the comment in commit ac5d15b4519f("crypto: caam/qi2 + - use affine DPIOs "), because preemption is no longer disabled +while trying to enqueue an FQID, it might be possible to run the +enqueue on a different CPU(due to migration, when in process context), +however this wouldn't be a functionality issue. But there will be +above calltrace when enable kernel debug config. So, replace this_cpu_ptr +with raw_cpu_ptr to avoid above call trace. + +Fixes: ac5d15b4519f ("crypto: caam/qi2 - use affine DPIOs") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Reviewed-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/caam/caamalg_qi2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/caam/caamalg_qi2.c ++++ b/drivers/crypto/caam/caamalg_qi2.c +@@ -5470,7 +5470,7 @@ int dpaa2_caam_enqueue(struct device *de + dpaa2_fd_set_len(&fd, dpaa2_fl_get_len(&req->fd_flt[1])); + dpaa2_fd_set_flc(&fd, req->flc_dma); + +- ppriv = this_cpu_ptr(priv->ppriv); ++ ppriv = raw_cpu_ptr(priv->ppriv); + for (i = 0; i < (priv->dpseci_attr.num_tx_queues << 1); i++) { + err = dpaa2_io_service_enqueue_fq(ppriv->dpio, ppriv->req_fqid, + &fd); diff --git a/queue-5.15/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch b/queue-5.15/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch new file mode 100644 index 00000000000..cfdf882d1ca --- /dev/null +++ b/queue-5.15/crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch @@ -0,0 +1,34 @@ +From c2aec59be093bd44627bc4f6bc67e4614a93a7b6 Mon Sep 17 00:00:00 2001 +From: Heiner Kallweit +Date: Fri, 17 Dec 2021 10:03:30 +0100 +Subject: crypto: omap-aes - Fix broken pm_runtime_and_get() usage + +From: Heiner Kallweit + +commit c2aec59be093bd44627bc4f6bc67e4614a93a7b6 upstream. + +This fix is basically the same as 3d6b661330a7 ("crypto: stm32 - +Revert broken pm_runtime_resume_and_get changes"), just for the omap +driver. If the return value isn't used, then pm_runtime_get_sync() +has to be used for ensuring that the usage count is balanced. + +Fixes: 1f34cc4a8da3 ("crypto: omap-aes - Fix PM reference leak on omap-aes.c") +Cc: stable@vger.kernel.org +Signed-off-by: Heiner Kallweit +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/omap-aes.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -1302,7 +1302,7 @@ static int omap_aes_suspend(struct devic + + static int omap_aes_resume(struct device *dev) + { +- pm_runtime_resume_and_get(dev); ++ pm_runtime_get_sync(dev); + return 0; + } + #endif diff --git a/queue-5.15/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch b/queue-5.15/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch new file mode 100644 index 00000000000..c47da203523 --- /dev/null +++ b/queue-5.15/crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch @@ -0,0 +1,64 @@ +From 29009604ad4e3ef784fd9b9fef6f23610ddf633d Mon Sep 17 00:00:00 2001 +From: Marek Vasut +Date: Mon, 20 Dec 2021 20:50:22 +0100 +Subject: crypto: stm32/crc32 - Fix kernel BUG triggered in probe() + +From: Marek Vasut + +commit 29009604ad4e3ef784fd9b9fef6f23610ddf633d upstream. + +The include/linux/crypto.h struct crypto_alg field cra_driver_name description +states "Unique name of the transformation provider. " ... " this contains the +name of the chip or provider and the name of the transformation algorithm." + +In case of the stm32-crc driver, field cra_driver_name is identical for all +registered transformation providers and set to the name of the driver itself, +which is incorrect. This patch fixes it by assigning a unique cra_driver_name +to each registered transformation provider. + +The kernel crash is triggered when the driver calls crypto_register_shashes() +which calls crypto_register_shash(), which calls crypto_register_alg(), which +calls __crypto_register_alg(), which returns -EEXIST, which is propagated +back through this call chain. Upon -EEXIST from crypto_register_shash(), the +crypto_register_shashes() starts unregistering the providers back, and calls +crypto_unregister_shash(), which calls crypto_unregister_alg(), and this is +where the BUG() triggers due to incorrect cra_refcnt. + +Fixes: b51dbe90912a ("crypto: stm32 - Support for STM32 CRC32 crypto module") +Signed-off-by: Marek Vasut +Cc: # 4.12+ +Cc: Alexandre Torgue +Cc: Fabien Dessenne +Cc: Herbert Xu +Cc: Lionel Debieve +Cc: Nicolas Toromanoff +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-crypto@vger.kernel.org +Acked-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/stm32/stm32-crc32.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/stm32/stm32-crc32.c ++++ b/drivers/crypto/stm32/stm32-crc32.c +@@ -279,7 +279,7 @@ static struct shash_alg algs[] = { + .digestsize = CHKSUM_DIGEST_SIZE, + .base = { + .cra_name = "crc32", +- .cra_driver_name = DRIVER_NAME, ++ .cra_driver_name = "stm32-crc32-crc32", + .cra_priority = 200, + .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, + .cra_blocksize = CHKSUM_BLOCK_SIZE, +@@ -301,7 +301,7 @@ static struct shash_alg algs[] = { + .digestsize = CHKSUM_DIGEST_SIZE, + .base = { + .cra_name = "crc32c", +- .cra_driver_name = DRIVER_NAME, ++ .cra_driver_name = "stm32-crc32-crc32c", + .cra_priority = 200, + .cra_flags = CRYPTO_ALG_OPTIONAL_KEY, + .cra_blocksize = CHKSUM_BLOCK_SIZE, diff --git a/queue-5.15/ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch b/queue-5.15/ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch new file mode 100644 index 00000000000..e0a20e356ab --- /dev/null +++ b/queue-5.15/ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch @@ -0,0 +1,217 @@ +From 0f420c383a2bb414ebccedf9289b5b815f1295fe Mon Sep 17 00:00:00 2001 +From: Zhu Lingshan +Date: Wed, 1 Dec 2021 16:12:55 +0800 +Subject: ifcvf/vDPA: fix misuse virtio-net device config size for blk dev + +From: Zhu Lingshan + +commit 0f420c383a2bb414ebccedf9289b5b815f1295fe upstream. + +This commit fixes a misuse of virtio-net device config size issue +for virtio-block devices. + +A new member config_size in struct ifcvf_hw is introduced and would +be initialized through vdpa_dev_add() to record correct device +config size. + +To be more generic, rename ifcvf_hw.net_config to ifcvf_hw.dev_config, +the helpers ifcvf_read/write_net_config() to ifcvf_read/write_dev_config() + +Signed-off-by: Zhu Lingshan +Reported-and-suggested-by: Stefano Garzarella +Reviewed-by: Stefano Garzarella +Fixes: 6ad31d162a4e ("vDPA/ifcvf: enable Intel C5000X-PL virtio-block for vDPA") +Cc: +Link: https://lore.kernel.org/r/20211201081255.60187-1-lingshan.zhu@intel.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vdpa/ifcvf/ifcvf_base.c | 41 ++++++++++++++++++++++++++++++---------- + drivers/vdpa/ifcvf/ifcvf_base.h | 9 +++++--- + drivers/vdpa/ifcvf/ifcvf_main.c | 24 +++-------------------- + 3 files changed, 41 insertions(+), 33 deletions(-) + +--- a/drivers/vdpa/ifcvf/ifcvf_base.c ++++ b/drivers/vdpa/ifcvf/ifcvf_base.c +@@ -143,8 +143,8 @@ int ifcvf_init_hw(struct ifcvf_hw *hw, s + IFCVF_DBG(pdev, "hw->isr = %p\n", hw->isr); + break; + case VIRTIO_PCI_CAP_DEVICE_CFG: +- hw->net_cfg = get_cap_addr(hw, &cap); +- IFCVF_DBG(pdev, "hw->net_cfg = %p\n", hw->net_cfg); ++ hw->dev_cfg = get_cap_addr(hw, &cap); ++ IFCVF_DBG(pdev, "hw->dev_cfg = %p\n", hw->dev_cfg); + break; + } + +@@ -153,7 +153,7 @@ next: + } + + if (hw->common_cfg == NULL || hw->notify_base == NULL || +- hw->isr == NULL || hw->net_cfg == NULL) { ++ hw->isr == NULL || hw->dev_cfg == NULL) { + IFCVF_ERR(pdev, "Incomplete PCI capabilities\n"); + return -EIO; + } +@@ -174,7 +174,7 @@ next: + IFCVF_DBG(pdev, + "PCI capability mapping: common cfg: %p, notify base: %p\n, isr cfg: %p, device cfg: %p, multiplier: %u\n", + hw->common_cfg, hw->notify_base, hw->isr, +- hw->net_cfg, hw->notify_off_multiplier); ++ hw->dev_cfg, hw->notify_off_multiplier); + + return 0; + } +@@ -242,33 +242,54 @@ int ifcvf_verify_min_features(struct ifc + return 0; + } + +-void ifcvf_read_net_config(struct ifcvf_hw *hw, u64 offset, ++u32 ifcvf_get_config_size(struct ifcvf_hw *hw) ++{ ++ struct ifcvf_adapter *adapter; ++ u32 config_size; ++ ++ adapter = vf_to_adapter(hw); ++ switch (hw->dev_type) { ++ case VIRTIO_ID_NET: ++ config_size = sizeof(struct virtio_net_config); ++ break; ++ case VIRTIO_ID_BLOCK: ++ config_size = sizeof(struct virtio_blk_config); ++ break; ++ default: ++ config_size = 0; ++ IFCVF_ERR(adapter->pdev, "VIRTIO ID %u not supported\n", hw->dev_type); ++ } ++ ++ return config_size; ++} ++ ++void ifcvf_read_dev_config(struct ifcvf_hw *hw, u64 offset, + void *dst, int length) + { + u8 old_gen, new_gen, *p; + int i; + +- WARN_ON(offset + length > sizeof(struct virtio_net_config)); ++ WARN_ON(offset + length > hw->config_size); + do { + old_gen = ifc_ioread8(&hw->common_cfg->config_generation); + p = dst; + for (i = 0; i < length; i++) +- *p++ = ifc_ioread8(hw->net_cfg + offset + i); ++ *p++ = ifc_ioread8(hw->dev_cfg + offset + i); + + new_gen = ifc_ioread8(&hw->common_cfg->config_generation); + } while (old_gen != new_gen); + } + +-void ifcvf_write_net_config(struct ifcvf_hw *hw, u64 offset, ++void ifcvf_write_dev_config(struct ifcvf_hw *hw, u64 offset, + const void *src, int length) + { + const u8 *p; + int i; + + p = src; +- WARN_ON(offset + length > sizeof(struct virtio_net_config)); ++ WARN_ON(offset + length > hw->config_size); + for (i = 0; i < length; i++) +- ifc_iowrite8(*p++, hw->net_cfg + offset + i); ++ ifc_iowrite8(*p++, hw->dev_cfg + offset + i); + } + + static void ifcvf_set_features(struct ifcvf_hw *hw, u64 features) +--- a/drivers/vdpa/ifcvf/ifcvf_base.h ++++ b/drivers/vdpa/ifcvf/ifcvf_base.h +@@ -71,12 +71,14 @@ struct ifcvf_hw { + u64 hw_features; + u32 dev_type; + struct virtio_pci_common_cfg __iomem *common_cfg; +- void __iomem *net_cfg; ++ void __iomem *dev_cfg; + struct vring_info vring[IFCVF_MAX_QUEUES]; + void __iomem * const *base; + char config_msix_name[256]; + struct vdpa_callback config_cb; + unsigned int config_irq; ++ /* virtio-net or virtio-blk device config size */ ++ u32 config_size; + }; + + struct ifcvf_adapter { +@@ -105,9 +107,9 @@ int ifcvf_init_hw(struct ifcvf_hw *hw, s + int ifcvf_start_hw(struct ifcvf_hw *hw); + void ifcvf_stop_hw(struct ifcvf_hw *hw); + void ifcvf_notify_queue(struct ifcvf_hw *hw, u16 qid); +-void ifcvf_read_net_config(struct ifcvf_hw *hw, u64 offset, ++void ifcvf_read_dev_config(struct ifcvf_hw *hw, u64 offset, + void *dst, int length); +-void ifcvf_write_net_config(struct ifcvf_hw *hw, u64 offset, ++void ifcvf_write_dev_config(struct ifcvf_hw *hw, u64 offset, + const void *src, int length); + u8 ifcvf_get_status(struct ifcvf_hw *hw); + void ifcvf_set_status(struct ifcvf_hw *hw, u8 status); +@@ -120,4 +122,5 @@ u16 ifcvf_get_vq_state(struct ifcvf_hw * + int ifcvf_set_vq_state(struct ifcvf_hw *hw, u16 qid, u16 num); + struct ifcvf_adapter *vf_to_adapter(struct ifcvf_hw *hw); + int ifcvf_probed_virtio_net(struct ifcvf_hw *hw); ++u32 ifcvf_get_config_size(struct ifcvf_hw *hw); + #endif /* _IFCVF_H_ */ +--- a/drivers/vdpa/ifcvf/ifcvf_main.c ++++ b/drivers/vdpa/ifcvf/ifcvf_main.c +@@ -366,24 +366,9 @@ static u32 ifcvf_vdpa_get_vq_align(struc + + static size_t ifcvf_vdpa_get_config_size(struct vdpa_device *vdpa_dev) + { +- struct ifcvf_adapter *adapter = vdpa_to_adapter(vdpa_dev); + struct ifcvf_hw *vf = vdpa_to_vf(vdpa_dev); +- struct pci_dev *pdev = adapter->pdev; +- size_t size; + +- switch (vf->dev_type) { +- case VIRTIO_ID_NET: +- size = sizeof(struct virtio_net_config); +- break; +- case VIRTIO_ID_BLOCK: +- size = sizeof(struct virtio_blk_config); +- break; +- default: +- size = 0; +- IFCVF_ERR(pdev, "VIRTIO ID %u not supported\n", vf->dev_type); +- } +- +- return size; ++ return vf->config_size; + } + + static void ifcvf_vdpa_get_config(struct vdpa_device *vdpa_dev, +@@ -392,8 +377,7 @@ static void ifcvf_vdpa_get_config(struct + { + struct ifcvf_hw *vf = vdpa_to_vf(vdpa_dev); + +- WARN_ON(offset + len > sizeof(struct virtio_net_config)); +- ifcvf_read_net_config(vf, offset, buf, len); ++ ifcvf_read_dev_config(vf, offset, buf, len); + } + + static void ifcvf_vdpa_set_config(struct vdpa_device *vdpa_dev, +@@ -402,8 +386,7 @@ static void ifcvf_vdpa_set_config(struct + { + struct ifcvf_hw *vf = vdpa_to_vf(vdpa_dev); + +- WARN_ON(offset + len > sizeof(struct virtio_net_config)); +- ifcvf_write_net_config(vf, offset, buf, len); ++ ifcvf_write_dev_config(vf, offset, buf, len); + } + + static void ifcvf_vdpa_set_config_cb(struct vdpa_device *vdpa_dev, +@@ -541,6 +524,7 @@ static int ifcvf_vdpa_dev_add(struct vdp + vf->vring[i].irq = -EINVAL; + + vf->hw_features = ifcvf_get_hw_features(vf); ++ vf->config_size = ifcvf_get_config_size(vf); + + adapter->vdpa.mdev = &ifcvf_mgmt_dev->mdev; + ret = _vdpa_register_device(&adapter->vdpa, vf->nr_vring); diff --git a/queue-5.15/md-move-alloc-free-acct-bioset-in-to-personality.patch b/queue-5.15/md-move-alloc-free-acct-bioset-in-to-personality.patch new file mode 100644 index 00000000000..3aaa9a52cab --- /dev/null +++ b/queue-5.15/md-move-alloc-free-acct-bioset-in-to-personality.patch @@ -0,0 +1,336 @@ +From 0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 Mon Sep 17 00:00:00 2001 +From: Xiao Ni +Date: Fri, 10 Dec 2021 17:31:15 +0800 +Subject: md: Move alloc/free acct bioset in to personality + +From: Xiao Ni + +commit 0c031fd37f69deb0cd8c43bbfcfccd62ebd7e952 upstream. + +bioset acct is only needed for raid0 and raid5. Therefore, md_run only +allocates it for raid0 and raid5. However, this does not cover +personality takeover, which may cause uninitialized bioset. For example, +the following repro steps: + + mdadm -CR /dev/md0 -l1 -n2 /dev/loop0 /dev/loop1 + mdadm --wait /dev/md0 + mkfs.xfs /dev/md0 + mdadm /dev/md0 --grow -l5 + mount /dev/md0 /mnt + +causes panic like: + +[ 225.933939] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[ 225.934903] #PF: supervisor instruction fetch in kernel mode +[ 225.935639] #PF: error_code(0x0010) - not-present page +[ 225.936361] PGD 0 P4D 0 +[ 225.936677] Oops: 0010 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN PTI +[ 225.937525] CPU: 27 PID: 1133 Comm: mount Not tainted 5.16.0-rc3+ #706 +[ 225.938416] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-2.module_el8.4.0+547+a85d02ba 04/01/2014 +[ 225.939922] RIP: 0010:0x0 +[ 225.940289] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. +[ 225.941196] RSP: 0018:ffff88815897eff0 EFLAGS: 00010246 +[ 225.941897] RAX: 0000000000000000 RBX: 0000000000092800 RCX: ffffffff81370a39 +[ 225.942813] RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000092800 +[ 225.943772] RBP: 1ffff1102b12fe04 R08: fffffbfff0b43c01 R09: fffffbfff0b43c01 +[ 225.944807] R10: ffffffff85a1e007 R11: fffffbfff0b43c00 R12: ffff88810eaaaf58 +[ 225.945757] R13: 0000000000000000 R14: ffff88810eaaafb8 R15: ffff88815897f040 +[ 225.946709] FS: 00007ff3f2505080(0000) GS:ffff888fb5e00000(0000) knlGS:0000000000000000 +[ 225.947814] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 225.948556] CR2: ffffffffffffffd6 CR3: 000000015aa5a006 CR4: 0000000000370ee0 +[ 225.949537] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 225.950455] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 225.951414] Call Trace: +[ 225.951787] +[ 225.952120] mempool_alloc+0xe5/0x250 +[ 225.952625] ? mempool_resize+0x370/0x370 +[ 225.953187] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 225.953862] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 225.954464] ? sched_clock_cpu+0x15/0x120 +[ 225.955019] ? find_held_lock+0xac/0xd0 +[ 225.955564] bio_alloc_bioset+0x1ed/0x2a0 +[ 225.956080] ? lock_downgrade+0x3a0/0x3a0 +[ 225.956644] ? bvec_alloc+0xc0/0xc0 +[ 225.957135] bio_clone_fast+0x19/0x80 +[ 225.957651] raid5_make_request+0x1370/0x1b70 +[ 225.958286] ? sched_clock_cpu+0x15/0x120 +[ 225.958797] ? __lock_acquire+0x8b2/0x3510 +[ 225.959339] ? raid5_get_active_stripe+0xce0/0xce0 +[ 225.959986] ? lock_is_held_type+0xd8/0x130 +[ 225.960528] ? rcu_read_lock_sched_held+0xa1/0xd0 +[ 225.961135] ? rcu_read_lock_bh_held+0xb0/0xb0 +[ 225.961703] ? sched_clock_cpu+0x15/0x120 +[ 225.962232] ? lock_release+0x27a/0x6c0 +[ 225.962746] ? do_wait_intr_irq+0x130/0x130 +[ 225.963302] ? lock_downgrade+0x3a0/0x3a0 +[ 225.963815] ? lock_release+0x6c0/0x6c0 +[ 225.964348] md_handle_request+0x342/0x530 +[ 225.964888] ? set_in_sync+0x170/0x170 +[ 225.965397] ? blk_queue_split+0x133/0x150 +[ 225.965988] ? __blk_queue_split+0x8b0/0x8b0 +[ 225.966524] ? submit_bio_checks+0x3b2/0x9d0 +[ 225.967069] md_submit_bio+0x127/0x1c0 +[...] + +Fix this by moving alloc/free of acct bioset to pers->run and pers->free. + +While we are on this, properly handle md_integrity_register() error in +raid0_run(). + +Fixes: daee2024715d (md: check level before create and exit io_acct_set) +Cc: stable@vger.kernel.org +Acked-by: Guoqing Jiang +Signed-off-by: Xiao Ni +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/md.c | 27 +++++++++++++++++---------- + drivers/md/md.h | 2 ++ + drivers/md/raid0.c | 38 ++++++++++++++++++++++++++++---------- + drivers/md/raid5.c | 41 ++++++++++++++++++++++++++++++----------- + 4 files changed, 77 insertions(+), 31 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -5872,13 +5872,6 @@ int md_run(struct mddev *mddev) + if (err) + goto exit_bio_set; + } +- if (mddev->level != 1 && mddev->level != 10 && +- !bioset_initialized(&mddev->io_acct_set)) { +- err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, +- offsetof(struct md_io_acct, bio_clone), 0); +- if (err) +- goto exit_sync_set; +- } + + spin_lock(&pers_lock); + pers = find_pers(mddev->level, mddev->clevel); +@@ -6055,9 +6048,6 @@ bitmap_abort: + module_put(pers->owner); + md_bitmap_destroy(mddev); + abort: +- if (mddev->level != 1 && mddev->level != 10) +- bioset_exit(&mddev->io_acct_set); +-exit_sync_set: + bioset_exit(&mddev->sync_set); + exit_bio_set: + bioset_exit(&mddev->bio_set); +@@ -8590,6 +8580,23 @@ void md_submit_discard_bio(struct mddev + } + EXPORT_SYMBOL_GPL(md_submit_discard_bio); + ++int acct_bioset_init(struct mddev *mddev) ++{ ++ int err = 0; ++ ++ if (!bioset_initialized(&mddev->io_acct_set)) ++ err = bioset_init(&mddev->io_acct_set, BIO_POOL_SIZE, ++ offsetof(struct md_io_acct, bio_clone), 0); ++ return err; ++} ++EXPORT_SYMBOL_GPL(acct_bioset_init); ++ ++void acct_bioset_exit(struct mddev *mddev) ++{ ++ bioset_exit(&mddev->io_acct_set); ++} ++EXPORT_SYMBOL_GPL(acct_bioset_exit); ++ + static void md_end_io_acct(struct bio *bio) + { + struct md_io_acct *md_io_acct = bio->bi_private; +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -721,6 +721,8 @@ extern void md_error(struct mddev *mddev + extern void md_finish_reshape(struct mddev *mddev); + void md_submit_discard_bio(struct mddev *mddev, struct md_rdev *rdev, + struct bio *bio, sector_t start, sector_t size); ++int acct_bioset_init(struct mddev *mddev); ++void acct_bioset_exit(struct mddev *mddev); + void md_account_bio(struct mddev *mddev, struct bio **bio); + + extern bool __must_check md_flush_request(struct mddev *mddev, struct bio *bio); +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -356,7 +356,21 @@ static sector_t raid0_size(struct mddev + return array_sectors; + } + +-static void raid0_free(struct mddev *mddev, void *priv); ++static void free_conf(struct mddev *mddev, struct r0conf *conf) ++{ ++ kfree(conf->strip_zone); ++ kfree(conf->devlist); ++ kfree(conf); ++ mddev->private = NULL; ++} ++ ++static void raid0_free(struct mddev *mddev, void *priv) ++{ ++ struct r0conf *conf = priv; ++ ++ free_conf(mddev, conf); ++ acct_bioset_exit(mddev); ++} + + static int raid0_run(struct mddev *mddev) + { +@@ -370,11 +384,16 @@ static int raid0_run(struct mddev *mddev + if (md_check_no_bitmap(mddev)) + return -EINVAL; + ++ if (acct_bioset_init(mddev)) { ++ pr_err("md/raid0:%s: alloc acct bioset failed.\n", mdname(mddev)); ++ return -ENOMEM; ++ } ++ + /* if private is not null, we are here after takeover */ + if (mddev->private == NULL) { + ret = create_strip_zones(mddev, &conf); + if (ret < 0) +- return ret; ++ goto exit_acct_set; + mddev->private = conf; + } + conf = mddev->private; +@@ -413,17 +432,16 @@ static int raid0_run(struct mddev *mddev + dump_zones(mddev); + + ret = md_integrity_register(mddev); ++ if (ret) ++ goto free; + + return ret; +-} + +-static void raid0_free(struct mddev *mddev, void *priv) +-{ +- struct r0conf *conf = priv; +- +- kfree(conf->strip_zone); +- kfree(conf->devlist); +- kfree(conf); ++free: ++ free_conf(mddev, conf); ++exit_acct_set: ++ acct_bioset_exit(mddev); ++ return ret; + } + + static void raid0_handle_discard(struct mddev *mddev, struct bio *bio) +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7446,12 +7446,19 @@ static int raid5_run(struct mddev *mddev + struct md_rdev *rdev; + struct md_rdev *journal_dev = NULL; + sector_t reshape_offset = 0; +- int i; ++ int i, ret = 0; + long long min_offset_diff = 0; + int first = 1; + +- if (mddev_init_writes_pending(mddev) < 0) ++ if (acct_bioset_init(mddev)) { ++ pr_err("md/raid456:%s: alloc acct bioset failed.\n", mdname(mddev)); + return -ENOMEM; ++ } ++ ++ if (mddev_init_writes_pending(mddev) < 0) { ++ ret = -ENOMEM; ++ goto exit_acct_set; ++ } + + if (mddev->recovery_cp != MaxSector) + pr_notice("md/raid:%s: not clean -- starting background reconstruction\n", +@@ -7482,7 +7489,8 @@ static int raid5_run(struct mddev *mddev + (mddev->bitmap_info.offset || mddev->bitmap_info.file)) { + pr_notice("md/raid:%s: array cannot have both journal and bitmap\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + + if (mddev->reshape_position != MaxSector) { +@@ -7507,13 +7515,15 @@ static int raid5_run(struct mddev *mddev + if (journal_dev) { + pr_warn("md/raid:%s: don't support reshape with journal - aborting.\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + + if (mddev->new_level != mddev->level) { + pr_warn("md/raid:%s: unsupported reshape required - aborting.\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + old_disks = mddev->raid_disks - mddev->delta_disks; + /* reshape_position must be on a new-stripe boundary, and one +@@ -7529,7 +7539,8 @@ static int raid5_run(struct mddev *mddev + if (sector_div(here_new, chunk_sectors * new_data_disks)) { + pr_warn("md/raid:%s: reshape_position not on a stripe boundary\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + reshape_offset = here_new * chunk_sectors; + /* here_new is the stripe we will write to */ +@@ -7551,7 +7562,8 @@ static int raid5_run(struct mddev *mddev + else if (mddev->ro == 0) { + pr_warn("md/raid:%s: in-place reshape must be started in read-only mode - aborting\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + } else if (mddev->reshape_backwards + ? (here_new * chunk_sectors + min_offset_diff <= +@@ -7561,7 +7573,8 @@ static int raid5_run(struct mddev *mddev + /* Reading from the same stripe as writing to - bad */ + pr_warn("md/raid:%s: reshape_position too early for auto-recovery - aborting.\n", + mdname(mddev)); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit_acct_set; + } + pr_debug("md/raid:%s: reshape will continue\n", mdname(mddev)); + /* OK, we should be able to continue; */ +@@ -7585,8 +7598,10 @@ static int raid5_run(struct mddev *mddev + else + conf = mddev->private; + +- if (IS_ERR(conf)) +- return PTR_ERR(conf); ++ if (IS_ERR(conf)) { ++ ret = PTR_ERR(conf); ++ goto exit_acct_set; ++ } + + if (test_bit(MD_HAS_JOURNAL, &mddev->flags)) { + if (!journal_dev) { +@@ -7786,7 +7801,10 @@ abort: + free_conf(conf); + mddev->private = NULL; + pr_warn("md/raid:%s: failed to run raid set.\n", mdname(mddev)); +- return -EIO; ++ ret = -EIO; ++exit_acct_set: ++ acct_bioset_exit(mddev); ++ return ret; + } + + static void raid5_free(struct mddev *mddev, void *priv) +@@ -7794,6 +7812,7 @@ static void raid5_free(struct mddev *mdd + struct r5conf *conf = priv; + + free_conf(conf); ++ acct_bioset_exit(mddev); + mddev->to_remove = &raid5_attrs_group; + } + diff --git a/queue-5.15/mfd-tps65910-set-pwr_off-bit-during-driver-probe.patch b/queue-5.15/mfd-tps65910-set-pwr_off-bit-during-driver-probe.patch new file mode 100644 index 00000000000..ee134528bb8 --- /dev/null +++ b/queue-5.15/mfd-tps65910-set-pwr_off-bit-during-driver-probe.patch @@ -0,0 +1,62 @@ +From 7620ad0bdfac1efff4a1228cd36ae62a9d8206b0 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Wed, 24 Nov 2021 22:01:04 +0300 +Subject: mfd: tps65910: Set PWR_OFF bit during driver probe + +From: Dmitry Osipenko + +commit 7620ad0bdfac1efff4a1228cd36ae62a9d8206b0 upstream. + +The PWR_OFF bit needs to be set in order to power off properly, without +hanging PMIC. This bit needs to be set early in order to allow thermal +protection of NVIDIA Terga SoCs to power off hardware properly, otherwise +a battery re-plug may be needed on some devices to recover after the hang. + +Cc: +Signed-off-by: Dmitry Osipenko +Tested-by: Svyatoslav Ryhel # ASUS TF201 +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20211124190104.23554-1-digetx@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mfd/tps65910.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +--- a/drivers/mfd/tps65910.c ++++ b/drivers/mfd/tps65910.c +@@ -436,15 +436,6 @@ static void tps65910_power_off(void) + + tps65910 = dev_get_drvdata(&tps65910_i2c_client->dev); + +- /* +- * The PWR_OFF bit needs to be set separately, before transitioning +- * to the OFF state. It enables the "sequential" power-off mode on +- * TPS65911, it's a NO-OP on TPS65910. +- */ +- if (regmap_set_bits(tps65910->regmap, TPS65910_DEVCTRL, +- DEVCTRL_PWR_OFF_MASK) < 0) +- return; +- + regmap_update_bits(tps65910->regmap, TPS65910_DEVCTRL, + DEVCTRL_DEV_OFF_MASK | DEVCTRL_DEV_ON_MASK, + DEVCTRL_DEV_OFF_MASK); +@@ -504,6 +495,19 @@ static int tps65910_i2c_probe(struct i2c + tps65910_sleepinit(tps65910, pmic_plat_data); + + if (pmic_plat_data->pm_off && !pm_power_off) { ++ /* ++ * The PWR_OFF bit needs to be set separately, before ++ * transitioning to the OFF state. It enables the "sequential" ++ * power-off mode on TPS65911, it's a NO-OP on TPS65910. ++ */ ++ ret = regmap_set_bits(tps65910->regmap, TPS65910_DEVCTRL, ++ DEVCTRL_PWR_OFF_MASK); ++ if (ret) { ++ dev_err(&i2c->dev, "failed to set power-off mode: %d\n", ++ ret); ++ return ret; ++ } ++ + tps65910_i2c_client = i2c; + pm_power_off = tps65910_power_off; + } diff --git a/queue-5.15/rpmsg-core-clean-up-resources-on-announce_create-failure.patch b/queue-5.15/rpmsg-core-clean-up-resources-on-announce_create-failure.patch new file mode 100644 index 00000000000..ee9e8f75c97 --- /dev/null +++ b/queue-5.15/rpmsg-core-clean-up-resources-on-announce_create-failure.patch @@ -0,0 +1,57 @@ +From 8066c615cb69b7da8a94f59379847b037b3a5e46 Mon Sep 17 00:00:00 2001 +From: Arnaud Pouliquen +Date: Mon, 6 Dec 2021 20:07:58 +0100 +Subject: rpmsg: core: Clean up resources on announce_create failure. + +From: Arnaud Pouliquen + +commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream. + +During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an +error, the rpmsg device and default endpoint should be freed before +exiting the function. + +Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend") +Suggested-by: Bjorn Andersson +Signed-off-by: Arnaud Pouliquen +Reviewed-by: Bjorn Andersson +Cc: stable +Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com +Signed-off-by: Mathieu Poirier +Signed-off-by: Greg Kroah-Hartman +--- + drivers/rpmsg/rpmsg_core.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -519,13 +519,25 @@ static int rpmsg_dev_probe(struct device + err = rpdrv->probe(rpdev); + if (err) { + dev_err(dev, "%s: failed: %d\n", __func__, err); +- if (ept) +- rpmsg_destroy_ept(ept); +- goto out; ++ goto destroy_ept; + } + +- if (ept && rpdev->ops->announce_create) ++ if (ept && rpdev->ops->announce_create) { + err = rpdev->ops->announce_create(rpdev); ++ if (err) { ++ dev_err(dev, "failed to announce creation\n"); ++ goto remove_rpdev; ++ } ++ } ++ ++ return 0; ++ ++remove_rpdev: ++ if (rpdrv->remove) ++ rpdrv->remove(rpdev); ++destroy_ept: ++ if (ept) ++ rpmsg_destroy_ept(ept); + out: + return err; + } diff --git a/queue-5.15/series b/queue-5.15/series index 6bb47ef1bc2..7f6d674a2cc 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -664,3 +664,15 @@ mailbox-change-mailbox-mpfs-compatible-string.patch seg6-export-get_srh-for-icmp-handling.patch icmp-icmpv6-examine-invoking-packet-for-segment-rout.patch udp6-use-segment-routing-header-for-dest-address-if-.patch +rpmsg-core-clean-up-resources-on-announce_create-failure.patch +ifcvf-vdpa-fix-misuse-virtio-net-device-config-size-for-blk-dev.patch +crypto-omap-aes-fix-broken-pm_runtime_and_get-usage.patch +crypto-stm32-crc32-fix-kernel-bug-triggered-in-probe.patch +crypto-caam-replace-this_cpu_ptr-with-raw_cpu_ptr.patch +ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch +tpm-fix-potential-null-pointer-access-in-tpm_del_char_device.patch +tpm-fix-npe-on-probe-for-missing-device.patch +mfd-tps65910-set-pwr_off-bit-during-driver-probe.patch +spi-uniphier-fix-a-bug-that-doesn-t-point-to-private-data-correctly.patch +xen-gntdev-fix-unmap-notification-order.patch +md-move-alloc-free-acct-bioset-in-to-personality.patch diff --git a/queue-5.15/spi-uniphier-fix-a-bug-that-doesn-t-point-to-private-data-correctly.patch b/queue-5.15/spi-uniphier-fix-a-bug-that-doesn-t-point-to-private-data-correctly.patch new file mode 100644 index 00000000000..9ec07717aec --- /dev/null +++ b/queue-5.15/spi-uniphier-fix-a-bug-that-doesn-t-point-to-private-data-correctly.patch @@ -0,0 +1,46 @@ +From 80bb73a9fbcde4ecc55e12f10c73fabbe68a24d1 Mon Sep 17 00:00:00 2001 +From: Kunihiko Hayashi +Date: Wed, 22 Dec 2021 13:48:12 +0900 +Subject: spi: uniphier: Fix a bug that doesn't point to private data correctly + +From: Kunihiko Hayashi + +commit 80bb73a9fbcde4ecc55e12f10c73fabbe68a24d1 upstream. + +In uniphier_spi_remove(), there is a wrong code to get private data from +the platform device, so the driver can't be removed properly. + +The driver should get spi_master from the platform device and retrieve +the private data from it. + +Cc: +Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/1640148492-32178-1-git-send-email-hayashi.kunihiko@socionext.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + drivers/spi/spi-uniphier.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +--- a/drivers/spi/spi-uniphier.c ++++ b/drivers/spi/spi-uniphier.c +@@ -767,12 +767,13 @@ out_master_put: + + static int uniphier_spi_remove(struct platform_device *pdev) + { +- struct uniphier_spi_priv *priv = platform_get_drvdata(pdev); ++ struct spi_master *master = platform_get_drvdata(pdev); ++ struct uniphier_spi_priv *priv = spi_master_get_devdata(master); + +- if (priv->master->dma_tx) +- dma_release_channel(priv->master->dma_tx); +- if (priv->master->dma_rx) +- dma_release_channel(priv->master->dma_rx); ++ if (master->dma_tx) ++ dma_release_channel(master->dma_tx); ++ if (master->dma_rx) ++ dma_release_channel(master->dma_rx); + + clk_disable_unprepare(priv->clk); + diff --git a/queue-5.15/tpm-fix-npe-on-probe-for-missing-device.patch b/queue-5.15/tpm-fix-npe-on-probe-for-missing-device.patch new file mode 100644 index 00000000000..ef619514df6 --- /dev/null +++ b/queue-5.15/tpm-fix-npe-on-probe-for-missing-device.patch @@ -0,0 +1,58 @@ +From 84cc69589700b90a4c8d27b481a51fce8cca6051 Mon Sep 17 00:00:00 2001 +From: Patrick Williams +Date: Thu, 23 Dec 2021 09:49:31 -0600 +Subject: tpm: fix NPE on probe for missing device + +From: Patrick Williams + +commit 84cc69589700b90a4c8d27b481a51fce8cca6051 upstream. + +When using the tpm_tis-spi driver on a system missing the physical TPM, +a null pointer exception was observed. + + [ 0.938677] Unable to handle kernel NULL pointer dereference at virtual address 00000004 + [ 0.939020] pgd = 10c753cb + [ 0.939237] [00000004] *pgd=00000000 + [ 0.939808] Internal error: Oops: 5 [#1] SMP ARM + [ 0.940157] CPU: 0 PID: 48 Comm: kworker/u4:1 Not tainted 5.15.10-dd1e40c #1 + [ 0.940364] Hardware name: Generic DT based system + [ 0.940601] Workqueue: events_unbound async_run_entry_fn + [ 0.941048] PC is at tpm_tis_remove+0x28/0xb4 + [ 0.941196] LR is at tpm_tis_core_init+0x170/0x6ac + +This is due to an attempt in 'tpm_tis_remove' to use the drvdata, which +was not initialized in 'tpm_tis_core_init' prior to the first error. + +Move the initialization of drvdata earlier so 'tpm_tis_remove' has +access to it. + +Signed-off-by: Patrick Williams +Fixes: 79ca6f74dae0 ("tpm: fix Atmel TPM crash caused by too frequent queries") +Cc: stable@vger.kernel.org +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm_tis_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -950,6 +950,8 @@ int tpm_tis_core_init(struct device *dev + priv->timeout_max = TPM_TIMEOUT_USECS_MAX; + priv->phy_ops = phy_ops; + ++ dev_set_drvdata(&chip->dev, priv); ++ + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &vendor); + if (rc < 0) + return rc; +@@ -962,8 +964,6 @@ int tpm_tis_core_init(struct device *dev + priv->timeout_max = TIS_TIMEOUT_MAX_ATML; + } + +- dev_set_drvdata(&chip->dev, priv); +- + if (is_bsw()) { + priv->ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR, + ILB_REMAP_SIZE); diff --git a/queue-5.15/tpm-fix-potential-null-pointer-access-in-tpm_del_char_device.patch b/queue-5.15/tpm-fix-potential-null-pointer-access-in-tpm_del_char_device.patch new file mode 100644 index 00000000000..70c63a01919 --- /dev/null +++ b/queue-5.15/tpm-fix-potential-null-pointer-access-in-tpm_del_char_device.patch @@ -0,0 +1,64 @@ +From eabad7ba2c752392ae50f24a795093fb115b686d Mon Sep 17 00:00:00 2001 +From: Lino Sanfilippo +Date: Mon, 20 Dec 2021 16:06:35 +0100 +Subject: tpm: fix potential NULL pointer access in tpm_del_char_device + +From: Lino Sanfilippo + +commit eabad7ba2c752392ae50f24a795093fb115b686d upstream. + +Some SPI controller drivers unregister the controller in the shutdown +handler (e.g. BCM2835). If such a controller is used with a TPM 2 slave +chip->ops may be accessed when it is already NULL: + +At system shutdown the pre-shutdown handler tpm_class_shutdown() shuts down +TPM 2 and sets chip->ops to NULL. Then at SPI controller unregistration +tpm_tis_spi_remove() is called and eventually calls tpm_del_char_device() +which tries to shut down TPM 2 again. Thereby it accesses chip->ops again: +(tpm_del_char_device calls tpm_chip_start which calls tpm_clk_enable which +calls chip->ops->clk_enable). + +Avoid the NULL pointer access by testing if chip->ops is valid and skipping +the TPM 2 shutdown procedure in case it is NULL. + +Cc: stable@vger.kernel.org +Signed-off-by: Lino Sanfilippo +Fixes: 39d0099f9439 ("powerpc/pseries: Add shutdown() to vio_driver and vio_bus") +Reviewed-by: Stefan Berger +Tested-by: Stefan Berger +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm-chip.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -474,13 +474,21 @@ static void tpm_del_char_device(struct t + + /* Make the driver uncallable. */ + down_write(&chip->ops_sem); +- if (chip->flags & TPM_CHIP_FLAG_TPM2) { +- if (!tpm_chip_start(chip)) { +- tpm2_shutdown(chip, TPM2_SU_CLEAR); +- tpm_chip_stop(chip); ++ ++ /* ++ * Check if chip->ops is still valid: In case that the controller ++ * drivers shutdown handler unregisters the controller in its ++ * shutdown handler we are called twice and chip->ops to NULL. ++ */ ++ if (chip->ops) { ++ if (chip->flags & TPM_CHIP_FLAG_TPM2) { ++ if (!tpm_chip_start(chip)) { ++ tpm2_shutdown(chip, TPM2_SU_CLEAR); ++ tpm_chip_stop(chip); ++ } + } ++ chip->ops = NULL; + } +- chip->ops = NULL; + up_write(&chip->ops_sem); + } + diff --git a/queue-5.15/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch b/queue-5.15/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch new file mode 100644 index 00000000000..241b99f65db --- /dev/null +++ b/queue-5.15/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch @@ -0,0 +1,105 @@ +From 3fea4d9d160186617ff40490ae01f4f4f36b28ff Mon Sep 17 00:00:00 2001 +From: Petr Cvachoucek +Date: Mon, 30 Aug 2021 21:20:37 +0200 +Subject: ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers + +From: Petr Cvachoucek + +commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream. + +it seems freeing the write buffers in the error path of the +ubifs_remount_rw() is wrong. It leads later to a kernel oops like this: + +[10016.431274] UBIFS (ubi0:0): start fixing up free space +[10090.810042] UBIFS (ubi0:0): free space fixup complete +[10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot +spawn "ubifs_bgt0_0", error -4 +[10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started, +PID 517 +[10105.275498] Unable to handle kernel NULL pointer dereference at +virtual address 0000000000000030 +[10105.284352] Mem abort info: +[10105.287160] ESR = 0x96000006 +[10105.290252] EC = 0x25: DABT (current EL), IL = 32 bits +[10105.295592] SET = 0, FnV = 0 +[10105.298652] EA = 0, S1PTW = 0 +[10105.301848] Data abort info: +[10105.304723] ISV = 0, ISS = 0x00000006 +[10105.308573] CM = 0, WnR = 0 +[10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000f03d1000 +[10105.318034] [0000000000000030] pgd=00000000f6cee003, +pud=00000000f4884003, pmd=0000000000000000 +[10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP +[10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211 +libarc4 cfg80211 nvme nvme_core cryptodev(O) +[10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G O +5.4.3 #1 +[10105.349517] Hardware name: HYPEX CPU (DT) +[10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO) +[10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 +[10105.364596] lr : mutex_lock+0x1c/0x34 +[10105.368253] sp : ffff000075633aa0 +[10105.371563] x29: ffff000075633aa0 x28: 0000000000000001 +[10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004 +[10105.382185] x25: 0000000000000030 x24: 0000000000000000 +[10105.387495] x23: 0000000000000000 x22: 0000000000000038 +[10105.392807] x21: 000000000000000c x20: ffff000076fa80c8 +[10105.398119] x19: ffff000076fa8000 x18: 0000000000000000 +[10105.403429] x17: 0000000000000000 x16: 0000000000000000 +[10105.408741] x15: 0000000000000000 x14: fefefefefefefeff +[10105.414052] x13: 0000000000000000 x12: 0000000000000fe0 +[10105.419364] x11: 0000000000000fe0 x10: ffff000076709020 +[10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0 +[10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030 +[10105.435297] x5 : 0000000000000000 x4 : 0000000000000000 +[10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040 +[10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030 +[10105.451232] Call trace: +[10105.453676] atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34 +[10105.459600] ubifs_garbage_collect+0xb4/0x334 +[10105.463956] ubifs_budget_space+0x398/0x458 +[10105.468139] ubifs_create+0x50/0x180 +[10105.471712] path_openat+0x6a0/0x9b0 +[10105.475284] do_filp_open+0x34/0x7c +[10105.478771] do_sys_open+0x78/0xe4 +[10105.482170] __arm64_sys_openat+0x1c/0x24 +[10105.486180] el0_svc_handler+0x84/0xc8 +[10105.489928] el0_svc+0x8/0xc +[10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05) +[10105.498903] ---[ end trace 46b721d93267a586 ]--- + +To reproduce the problem: + +1. Filesystem initially mounted read-only, free space fixup flag set. + +2. mount -o remount,rw + +3. it takes some time (free space fixup running) + ... try to terminate running mount by CTRL-C + ... does not respond, only after free space fixup is complete + ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4" + +4. mount -o remount,rw + ... now finished instantly (fixup already done). + +5. Create file or just unmount the filesystem and we get the oops. + +Cc: +Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode") +Signed-off-by: Petr Cvachoucek +Signed-off-by: Richard Weinberger +Signed-off-by: Greg Kroah-Hartman +--- + fs/ubifs/super.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1853,7 +1853,6 @@ out: + kthread_stop(c->bgt); + c->bgt = NULL; + } +- free_wbufs(c); + kfree(c->write_reserve_buf); + c->write_reserve_buf = NULL; + vfree(c->ileb_buf); diff --git a/queue-5.15/xen-gntdev-fix-unmap-notification-order.patch b/queue-5.15/xen-gntdev-fix-unmap-notification-order.patch new file mode 100644 index 00000000000..6b123790f65 --- /dev/null +++ b/queue-5.15/xen-gntdev-fix-unmap-notification-order.patch @@ -0,0 +1,62 @@ +From ce2f46f3531a03781181b7f4bd1ff9f8c5086e7e Mon Sep 17 00:00:00 2001 +From: Oleksandr Andrushchenko +Date: Fri, 10 Dec 2021 11:28:17 +0200 +Subject: xen/gntdev: fix unmap notification order + +From: Oleksandr Andrushchenko + +commit ce2f46f3531a03781181b7f4bd1ff9f8c5086e7e upstream. + +While working with Xen's libxenvchan library I have faced an issue with +unmap notifications sent in wrong order if both UNMAP_NOTIFY_SEND_EVENT +and UNMAP_NOTIFY_CLEAR_BYTE were requested: first we send an event channel +notification and then clear the notification byte which renders in the below +inconsistency (cli_live is the byte which was requested to be cleared on unmap): + +[ 444.514243] gntdev_put_map UNMAP_NOTIFY_SEND_EVENT map->notify.event 6 +libxenvchan_is_open cli_live 1 +[ 444.515239] __unmap_grant_pages UNMAP_NOTIFY_CLEAR_BYTE at 14 + +Thus it is not possible to reliably implement the checks like +- wait for the notification (UNMAP_NOTIFY_SEND_EVENT) +- check the variable (UNMAP_NOTIFY_CLEAR_BYTE) +because it is possible that the variable gets checked before it is cleared +by the kernel. + +To fix that we need to re-order the notifications, so the variable is first +gets cleared and then the event channel notification is sent. +With this fix I can see the correct order of execution: + +[ 54.522611] __unmap_grant_pages UNMAP_NOTIFY_CLEAR_BYTE at 14 +[ 54.537966] gntdev_put_map UNMAP_NOTIFY_SEND_EVENT map->notify.event 6 +libxenvchan_is_open cli_live 0 + +Cc: stable@vger.kernel.org +Signed-off-by: Oleksandr Andrushchenko +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20211210092817.580718-1-andr2000@gmail.com +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/gntdev.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -250,13 +250,13 @@ void gntdev_put_map(struct gntdev_priv * + if (!refcount_dec_and_test(&map->users)) + return; + ++ if (map->pages && !use_ptemod) ++ unmap_grant_pages(map, 0, map->count); ++ + if (map->notify.flags & UNMAP_NOTIFY_SEND_EVENT) { + notify_remote_via_evtchn(map->notify.event); + evtchn_put(map->notify.event); + } +- +- if (map->pages && !use_ptemod) +- unmap_grant_pages(map, 0, map->count); + gntdev_free_map(map); + } +