From: Greg Kroah-Hartman Date: Thu, 6 Mar 2025 09:31:18 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v6.6.81~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b08e9014f867cd8aca5bd05200aefb1603f9c039;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: scsi-ufs-core-cancel-rtc-work-during-ufshcd_remove.patch scsi-ufs-core-fix-another-deadlock-during-rtc-update.patch scsi-ufs-core-fix-deadlock-during-rtc-update.patch scsi-ufs-core-start-the-rtc-update-work-later.patch x86-microcode-amd-fix-a-wsometimes-uninitialized-clang-false-positive.patch --- diff --git a/queue-6.6/scsi-ufs-core-cancel-rtc-work-during-ufshcd_remove.patch b/queue-6.6/scsi-ufs-core-cancel-rtc-work-during-ufshcd_remove.patch new file mode 100644 index 0000000000..834a136f9d --- /dev/null +++ b/queue-6.6/scsi-ufs-core-cancel-rtc-work-during-ufshcd_remove.patch @@ -0,0 +1,52 @@ +From 1695c4361d35b7bdadd7b34f99c9c07741e181e5 Mon Sep 17 00:00:00 2001 +From: Manivannan Sadhasivam +Date: Mon, 11 Nov 2024 23:18:30 +0530 +Subject: scsi: ufs: core: Cancel RTC work during ufshcd_remove() + +From: Manivannan Sadhasivam + +commit 1695c4361d35b7bdadd7b34f99c9c07741e181e5 upstream. + +Currently, RTC work is only cancelled during __ufshcd_wl_suspend(). When +ufshcd is removed in ufshcd_remove(), RTC work is not cancelled. Due to +this, any further trigger of the RTC work after ufshcd_remove() would +result in a NULL pointer dereference as below: + +Unable to handle kernel NULL pointer dereference at virtual address 00000000000002a4 +Workqueue: events ufshcd_rtc_work +Call trace: + _raw_spin_lock_irqsave+0x34/0x8c + pm_runtime_get_if_active+0x24/0xb4 + ufshcd_rtc_work+0x124/0x19c + process_scheduled_works+0x18c/0x2d8 + worker_thread+0x144/0x280 + kthread+0x11c/0x128 + ret_from_fork+0x10/0x20 + +Since RTC work accesses the ufshcd internal structures, it should be cancelled +when ufshcd is removed. So do that in ufshcd_remove(), as per the order in +ufshcd_init(). + +Cc: stable@vger.kernel.org # 6.8 +Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20241111-ufs_bug_fix-v1-1-45ad8b62f02e@linaro.org +Reviewed-by: Peter Wang +Reviewed-by: Bean Huo +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufshcd.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -10259,6 +10259,7 @@ void ufshcd_remove(struct ufs_hba *hba) + ufs_hwmon_remove(hba); + ufs_bsg_remove(hba); + ufs_sysfs_remove_nodes(hba->dev); ++ cancel_delayed_work_sync(&hba->ufs_rtc_update_work); + blk_mq_destroy_queue(hba->tmf_queue); + blk_put_queue(hba->tmf_queue); + blk_mq_free_tag_set(&hba->tmf_tag_set); diff --git a/queue-6.6/scsi-ufs-core-fix-another-deadlock-during-rtc-update.patch b/queue-6.6/scsi-ufs-core-fix-another-deadlock-during-rtc-update.patch new file mode 100644 index 0000000000..30d256a5a8 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-another-deadlock-during-rtc-update.patch @@ -0,0 +1,38 @@ +From cb7e509c4e0197f63717fee54fb41c4990ba8d3a Mon Sep 17 00:00:00 2001 +From: Peter Wang +Date: Thu, 24 Oct 2024 09:54:53 +0800 +Subject: scsi: ufs: core: Fix another deadlock during RTC update + +From: Peter Wang + +commit cb7e509c4e0197f63717fee54fb41c4990ba8d3a upstream. + +If ufshcd_rtc_work calls ufshcd_rpm_put_sync() and the pm's usage_count +is 0, we will enter the runtime suspend callback. However, the runtime +suspend callback will wait to flush ufshcd_rtc_work, causing a deadlock. + +Replace ufshcd_rpm_put_sync() with ufshcd_rpm_put() to avoid the +deadlock. + +Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") +Cc: stable@vger.kernel.org #6.11.x +Signed-off-by: Peter Wang +Link: https://lore.kernel.org/r/20241024015453.21684-1-peter.wang@mediatek.com +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufshcd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8185,7 +8185,7 @@ static void ufshcd_update_rtc(struct ufs + + err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_WRITE_ATTR, QUERY_ATTR_IDN_SECONDS_PASSED, + 0, 0, &val); +- ufshcd_rpm_put_sync(hba); ++ ufshcd_rpm_put(hba); + + if (err) + dev_err(hba->dev, "%s: Failed to update rtc %d\n", __func__, err); diff --git a/queue-6.6/scsi-ufs-core-fix-deadlock-during-rtc-update.patch b/queue-6.6/scsi-ufs-core-fix-deadlock-during-rtc-update.patch new file mode 100644 index 0000000000..de3687b6aa --- /dev/null +++ b/queue-6.6/scsi-ufs-core-fix-deadlock-during-rtc-update.patch @@ -0,0 +1,83 @@ +From 3911af778f208e5f49d43ce739332b91e26bc48e Mon Sep 17 00:00:00 2001 +From: Peter Wang +Date: Mon, 15 Jul 2024 14:38:31 +0800 +Subject: scsi: ufs: core: Fix deadlock during RTC update + +From: Peter Wang + +commit 3911af778f208e5f49d43ce739332b91e26bc48e upstream. + +There is a deadlock when runtime suspend waits for the flush of RTC work, +and the RTC work calls ufshcd_rpm_get_sync() to wait for runtime resume. + +Here is deadlock backtrace: + +kworker/0:1 D 4892.876354 10 10971 4859 0x4208060 0x8 10 0 120 670730152367 +ptr f0ffff80c2e40000 0 1 0x00000001 0x000000ff 0x000000ff 0x000000ff + __switch_to+0x1a8/0x2d4 + __schedule+0x684/0xa98 + schedule+0x48/0xc8 + schedule_timeout+0x48/0x170 + do_wait_for_common+0x108/0x1b0 + wait_for_completion+0x44/0x60 + __flush_work+0x39c/0x424 + __cancel_work_sync+0xd8/0x208 + cancel_delayed_work_sync+0x14/0x28 + __ufshcd_wl_suspend+0x19c/0x480 + ufshcd_wl_runtime_suspend+0x3c/0x1d4 + scsi_runtime_suspend+0x78/0xc8 + __rpm_callback+0x94/0x3e0 + rpm_suspend+0x2d4/0x65c + __pm_runtime_suspend+0x80/0x114 + scsi_runtime_idle+0x38/0x6c + rpm_idle+0x264/0x338 + __pm_runtime_idle+0x80/0x110 + ufshcd_rtc_work+0x128/0x1e4 + process_one_work+0x26c/0x650 + worker_thread+0x260/0x3d8 + kthread+0x110/0x134 + ret_from_fork+0x10/0x20 + +Skip updating RTC if RPM state is not RPM_ACTIVE. + +Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") +Cc: stable@vger.kernel.org # 6.9.x +Signed-off-by: Peter Wang +Link: https://lore.kernel.org/r/20240715063831.29792-1-peter.wang@mediatek.com +Reviewed-by: Bean Huo +Reviewed-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufshcd-priv.h | 5 +++++ + drivers/ufs/core/ufshcd.c | 5 ++++- + 2 files changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/ufs/core/ufshcd-priv.h ++++ b/drivers/ufs/core/ufshcd-priv.h +@@ -324,6 +324,11 @@ static inline int ufshcd_rpm_get_sync(st + return pm_runtime_get_sync(&hba->ufs_device_wlun->sdev_gendev); + } + ++static inline int ufshcd_rpm_get_if_active(struct ufs_hba *hba) ++{ ++ return pm_runtime_get_if_active(&hba->ufs_device_wlun->sdev_gendev); ++} ++ + static inline int ufshcd_rpm_put_sync(struct ufs_hba *hba) + { + return pm_runtime_put_sync(&hba->ufs_device_wlun->sdev_gendev); +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8179,7 +8179,10 @@ static void ufshcd_update_rtc(struct ufs + */ + val = ts64.tv_sec - hba->dev_info.rtc_time_baseline; + +- ufshcd_rpm_get_sync(hba); ++ /* Skip update RTC if RPM state is not RPM_ACTIVE */ ++ if (ufshcd_rpm_get_if_active(hba) <= 0) ++ return; ++ + err = ufshcd_query_attr(hba, UPIU_QUERY_OPCODE_WRITE_ATTR, QUERY_ATTR_IDN_SECONDS_PASSED, + 0, 0, &val); + ufshcd_rpm_put_sync(hba); diff --git a/queue-6.6/scsi-ufs-core-start-the-rtc-update-work-later.patch b/queue-6.6/scsi-ufs-core-start-the-rtc-update-work-later.patch new file mode 100644 index 0000000000..80b11d2b96 --- /dev/null +++ b/queue-6.6/scsi-ufs-core-start-the-rtc-update-work-later.patch @@ -0,0 +1,68 @@ +From 54c814c8b23bc7617be3d46abdb896937695dbfa Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Thu, 31 Oct 2024 14:26:24 -0700 +Subject: scsi: ufs: core: Start the RTC update work later + +From: Bart Van Assche + +commit 54c814c8b23bc7617be3d46abdb896937695dbfa upstream. + +The RTC update work involves runtime resuming the UFS controller. Hence, +only start the RTC update work after runtime power management in the UFS +driver has been fully initialized. This patch fixes the following kernel +crash: + +Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP +Workqueue: events ufshcd_rtc_work +Call trace: + _raw_spin_lock_irqsave+0x34/0x8c (P) + pm_runtime_get_if_active+0x24/0x9c (L) + pm_runtime_get_if_active+0x24/0x9c + ufshcd_rtc_work+0x138/0x1b4 + process_one_work+0x148/0x288 + worker_thread+0x2cc/0x3d4 + kthread+0x110/0x114 + ret_from_fork+0x10/0x20 + +Reported-by: Neil Armstrong +Closes: https://lore.kernel.org/linux-scsi/0c0bc528-fdc2-4106-bc99-f23ae377f6f5@linaro.org/ +Fixes: 6bf999e0eb41 ("scsi: ufs: core: Add UFS RTC support") +Cc: Bean Huo +Cc: stable@vger.kernel.org +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20241031212632.2799127-1-bvanassche@acm.org +Reviewed-by: Peter Wang +Reviewed-by: Bean Huo +Tested-by: Neil Armstrong # on SM8650-HDK +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ufs/core/ufshcd.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/ufs/core/ufshcd.c ++++ b/drivers/ufs/core/ufshcd.c +@@ -8678,6 +8678,14 @@ static int ufshcd_add_lus(struct ufs_hba + ufshcd_init_clk_scaling_sysfs(hba); + } + ++ /* ++ * The RTC update code accesses the hba->ufs_device_wlun->sdev_gendev ++ * pointer and hence must only be started after the WLUN pointer has ++ * been initialized by ufshcd_scsi_add_wlus(). ++ */ ++ schedule_delayed_work(&hba->ufs_rtc_update_work, ++ msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); ++ + ufs_bsg_probe(hba); + scsi_scan_host(hba->host); + +@@ -8837,8 +8845,6 @@ static int ufshcd_device_init(struct ufs + ufshcd_force_reset_auto_bkops(hba); + + ufshcd_set_timestamp_attr(hba); +- schedule_delayed_work(&hba->ufs_rtc_update_work, +- msecs_to_jiffies(UFS_RTC_UPDATE_INTERVAL_MS)); + + /* Gear up to HS gear if supported */ + if (hba->max_pwr_info.is_valid) { diff --git a/queue-6.6/series b/queue-6.6/series index 4de9be1a11..2cf669455c 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -140,3 +140,8 @@ x86-microcode-amd-merge-early_apply_microcode-into-its-single-callsite.patch x86-microcode-amd-get-rid-of-the-_load_microcode_amd-forward-declaration.patch x86-microcode-amd-add-get_patch_level.patch x86-microcode-amd-load-only-sha256-checksummed-patches.patch +scsi-ufs-core-fix-deadlock-during-rtc-update.patch +x86-microcode-amd-fix-a-wsometimes-uninitialized-clang-false-positive.patch +scsi-ufs-core-fix-another-deadlock-during-rtc-update.patch +scsi-ufs-core-start-the-rtc-update-work-later.patch +scsi-ufs-core-cancel-rtc-work-during-ufshcd_remove.patch diff --git a/queue-6.6/x86-microcode-amd-fix-a-wsometimes-uninitialized-clang-false-positive.patch b/queue-6.6/x86-microcode-amd-fix-a-wsometimes-uninitialized-clang-false-positive.patch new file mode 100644 index 0000000000..5da9d41ab4 --- /dev/null +++ b/queue-6.6/x86-microcode-amd-fix-a-wsometimes-uninitialized-clang-false-positive.patch @@ -0,0 +1,39 @@ +From 5343558a868e7e635b40baa2e46bf53df1a2d131 Mon Sep 17 00:00:00 2001 +From: "Borislav Petkov (AMD)" +Date: Tue, 30 Jul 2024 09:52:43 +0200 +Subject: x86/microcode/AMD: Fix a -Wsometimes-uninitialized clang false positive + +From: Borislav Petkov (AMD) + +commit 5343558a868e7e635b40baa2e46bf53df1a2d131 upstream. + +Initialize equiv_id in order to shut up: + + arch/x86/kernel/cpu/microcode/amd.c:714:6: warning: variable 'equiv_id' is \ + used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized] + if (x86_family(bsp_cpuid_1_eax) < 0x17) { + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +because clang doesn't do interprocedural analysis for warnings to see +that this variable won't be used uninitialized. + +Fixes: 94838d230a6c ("x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID") +Reported-by: kernel test robot +Closes: https://lore.kernel.org/oe-kbuild-all/202407291815.gJBST0P3-lkp@intel.com/ +Signed-off-by: Borislav Petkov (AMD) +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kernel/cpu/microcode/amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -813,7 +813,7 @@ static void free_cache(void) + static struct ucode_patch *find_patch(unsigned int cpu) + { + struct ucode_cpu_info *uci = ucode_cpu_info + cpu; +- u16 equiv_id; ++ u16 equiv_id = 0; + + uci->cpu_sig.rev = get_patch_level(); +