From: Greg Kroah-Hartman Date: Mon, 6 Jun 2022 15:45:48 +0000 (+0200) Subject: 5.18-stable patches X-Git-Tag: v5.10.121~66 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b5b140fe820f12ee8ccd611088c2da3422b76dd8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.18-stable patches added patches: arm-dts-s5pv210-remove-spi-cs-high-on-panel-in-aries.patch arm-pxa-maybe-fix-gpio-lookup-tables.patch arm64-dts-qcom-ipq8074-fix-the-sleep-clock-frequency.patch arm64-tegra-add-missing-dfll-reset-on-tegra210.patch blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch ceph-fix-decoding-of-client-session-messages-flags.patch clk-tegra-add-missing-reset-deassertion.patch coresight-core-fix-coresight-device-probe-failure-issue.patch docs-conf.py-cope-with-removal-of-language-none-in-sphinx-5.0.0.patch dt-bindings-gpio-altera-correct-interrupt-cells.patch gma500-fix-an-incorrect-null-check-on-list-iterator.patch misc-fastrpc-fix-list-iterator-in-fastrpc_req_mem_unmap_impl.patch phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch smb3-ebadf-eio-errors-in-rename-open-caused-by-race-condition-in-smb2_compound_op.patch vdpasim-allow-to-enable-a-vq-repeatedly.patch --- diff --git a/queue-5.18/arm-dts-s5pv210-remove-spi-cs-high-on-panel-in-aries.patch b/queue-5.18/arm-dts-s5pv210-remove-spi-cs-high-on-panel-in-aries.patch new file mode 100644 index 00000000000..77b3fb0c7ef --- /dev/null +++ b/queue-5.18/arm-dts-s5pv210-remove-spi-cs-high-on-panel-in-aries.patch @@ -0,0 +1,33 @@ +From 096f58507374e1293a9e9cff8a1ccd5f37780a20 Mon Sep 17 00:00:00 2001 +From: Jonathan Bakker +Date: Sun, 27 Mar 2022 11:08:50 -0700 +Subject: ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries + +From: Jonathan Bakker + +commit 096f58507374e1293a9e9cff8a1ccd5f37780a20 upstream. + +Since commit 766c6b63aa04 ("spi: fix client driver breakages when using +GPIO descriptors"), the panel has been blank due to an inverted CS GPIO. +In order to correct this, drop the spi-cs-high from the panel SPI device. + +Fixes: 766c6b63aa04 ("spi: fix client driver breakages when using GPIO descriptors") +Cc: +Signed-off-by: Jonathan Bakker +Link: https://lore.kernel.org/r/CY4PR04MB05670C771062570E911AF3B4CB1C9@CY4PR04MB0567.namprd04.prod.outlook.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/s5pv210-aries.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm/boot/dts/s5pv210-aries.dtsi ++++ b/arch/arm/boot/dts/s5pv210-aries.dtsi +@@ -564,7 +564,6 @@ + reset-gpios = <&mp05 5 GPIO_ACTIVE_LOW>; + vdd3-supply = <&ldo7_reg>; + vci-supply = <&ldo17_reg>; +- spi-cs-high; + spi-max-frequency = <1200000>; + + pinctrl-names = "default"; diff --git a/queue-5.18/arm-pxa-maybe-fix-gpio-lookup-tables.patch b/queue-5.18/arm-pxa-maybe-fix-gpio-lookup-tables.patch new file mode 100644 index 00000000000..0e2e0939552 --- /dev/null +++ b/queue-5.18/arm-pxa-maybe-fix-gpio-lookup-tables.patch @@ -0,0 +1,72 @@ +From 2672a4bff6c03a20d5ae460a091f67ee782c3eff Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 11 Sep 2019 22:31:51 +0200 +Subject: ARM: pxa: maybe fix gpio lookup tables + +From: Arnd Bergmann + +commit 2672a4bff6c03a20d5ae460a091f67ee782c3eff upstream. + +From inspection I found a couple of GPIO lookups that are +listed with device "gpio-pxa", but actually have a number +from a different gpio controller. + +Try to rectify that here, with a guess of what the actual +device name is. + +Acked-by: Robert Jarzmik +Reviewed-by: Linus Walleij +Cc: stable@vger.kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-pxa/cm-x300.c | 8 ++++---- + arch/arm/mach-pxa/magician.c | 2 +- + arch/arm/mach-pxa/tosa.c | 4 ++-- + 3 files changed, 7 insertions(+), 7 deletions(-) + +--- a/arch/arm/mach-pxa/cm-x300.c ++++ b/arch/arm/mach-pxa/cm-x300.c +@@ -354,13 +354,13 @@ static struct platform_device cm_x300_sp + static struct gpiod_lookup_table cm_x300_spi_gpiod_table = { + .dev_id = "spi_gpio", + .table = { +- GPIO_LOOKUP("gpio-pxa", GPIO_LCD_SCL, ++ GPIO_LOOKUP("pca9555.1", GPIO_LCD_SCL - GPIO_LCD_BASE, + "sck", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("gpio-pxa", GPIO_LCD_DIN, ++ GPIO_LOOKUP("pca9555.1", GPIO_LCD_DIN - GPIO_LCD_BASE, + "mosi", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("gpio-pxa", GPIO_LCD_DOUT, ++ GPIO_LOOKUP("pca9555.1", GPIO_LCD_DOUT - GPIO_LCD_BASE, + "miso", GPIO_ACTIVE_HIGH), +- GPIO_LOOKUP("gpio-pxa", GPIO_LCD_CS, ++ GPIO_LOOKUP("pca9555.1", GPIO_LCD_CS - GPIO_LCD_BASE, + "cs", GPIO_ACTIVE_HIGH), + { }, + }, +--- a/arch/arm/mach-pxa/magician.c ++++ b/arch/arm/mach-pxa/magician.c +@@ -681,7 +681,7 @@ static struct platform_device bq24022 = + static struct gpiod_lookup_table bq24022_gpiod_table = { + .dev_id = "gpio-regulator", + .table = { +- GPIO_LOOKUP("gpio-pxa", EGPIO_MAGICIAN_BQ24022_ISET2, ++ GPIO_LOOKUP("htc-egpio-0", EGPIO_MAGICIAN_BQ24022_ISET2 - MAGICIAN_EGPIO_BASE, + NULL, GPIO_ACTIVE_HIGH), + GPIO_LOOKUP("gpio-pxa", GPIO30_MAGICIAN_BQ24022_nCHARGE_EN, + "enable", GPIO_ACTIVE_LOW), +--- a/arch/arm/mach-pxa/tosa.c ++++ b/arch/arm/mach-pxa/tosa.c +@@ -296,9 +296,9 @@ static struct gpiod_lookup_table tosa_mc + .table = { + GPIO_LOOKUP("gpio-pxa", TOSA_GPIO_nSD_DETECT, + "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", TOSA_GPIO_SD_WP, ++ GPIO_LOOKUP("sharp-scoop.0", TOSA_GPIO_SD_WP - TOSA_SCOOP_GPIO_BASE, + "wp", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("gpio-pxa", TOSA_GPIO_PWR_ON, ++ GPIO_LOOKUP("sharp-scoop.0", TOSA_GPIO_PWR_ON - TOSA_SCOOP_GPIO_BASE, + "power", GPIO_ACTIVE_HIGH), + { }, + }, diff --git a/queue-5.18/arm64-dts-qcom-ipq8074-fix-the-sleep-clock-frequency.patch b/queue-5.18/arm64-dts-qcom-ipq8074-fix-the-sleep-clock-frequency.patch new file mode 100644 index 00000000000..3180cf8b07a --- /dev/null +++ b/queue-5.18/arm64-dts-qcom-ipq8074-fix-the-sleep-clock-frequency.patch @@ -0,0 +1,33 @@ +From f607dd767f5d6800ffbdce5b99ba81763b023781 Mon Sep 17 00:00:00 2001 +From: Kathiravan T +Date: Fri, 11 Feb 2022 17:44:15 +0530 +Subject: arm64: dts: qcom: ipq8074: fix the sleep clock frequency + +From: Kathiravan T + +commit f607dd767f5d6800ffbdce5b99ba81763b023781 upstream. + +Sleep clock frequency should be 32768Hz. Lets fix it. + +Cc: stable@vger.kernel.org +Fixes: 41dac73e243d ("arm64: dts: Add ipq8074 SoC and HK01 board support") +Link: https://lore.kernel.org/all/e2a447f8-6024-0369-f698-2027b6edcf9e@codeaurora.org/ +Signed-off-by: Kathiravan T +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1644581655-11568-1-git-send-email-quic_kathirav@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/boot/dts/qcom/ipq8074.dtsi ++++ b/arch/arm64/boot/dts/qcom/ipq8074.dtsi +@@ -13,7 +13,7 @@ + clocks { + sleep_clk: sleep_clk { + compatible = "fixed-clock"; +- clock-frequency = <32000>; ++ clock-frequency = <32768>; + #clock-cells = <0>; + }; + diff --git a/queue-5.18/arm64-tegra-add-missing-dfll-reset-on-tegra210.patch b/queue-5.18/arm64-tegra-add-missing-dfll-reset-on-tegra210.patch new file mode 100644 index 00000000000..53534da5666 --- /dev/null +++ b/queue-5.18/arm64-tegra-add-missing-dfll-reset-on-tegra210.patch @@ -0,0 +1,40 @@ +From 0017f2c856e21bb900be88469e15dac4f41f4065 Mon Sep 17 00:00:00 2001 +From: Diogo Ivo +Date: Fri, 29 Apr 2022 13:58:43 +0100 +Subject: arm64: tegra: Add missing DFLL reset on Tegra210 + +From: Diogo Ivo + +commit 0017f2c856e21bb900be88469e15dac4f41f4065 upstream. + +Commit 4782c0a5dd88 ("clk: tegra: Don't deassert reset on enabling +clocks") removed deassertion of reset lines when enabling peripheral +clocks. This breaks the initialization of the DFLL driver which relied +on this behaviour. + +In order to be able to fix this, add the corresponding reset to the DT. +Tested on Google Pixel C. + +Cc: stable@vger.kernel.org +Fixes: 4782c0a5dd88 ("clk: tegra: Don't deassert reset on enabling clocks") +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/nvidia/tegra210.dtsi | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/nvidia/tegra210.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra210.dtsi +@@ -1366,8 +1366,9 @@ + <&tegra_car TEGRA210_CLK_DFLL_REF>, + <&tegra_car TEGRA210_CLK_I2C5>; + clock-names = "soc", "ref", "i2c"; +- resets = <&tegra_car TEGRA210_RST_DFLL_DVCO>; +- reset-names = "dvco"; ++ resets = <&tegra_car TEGRA210_RST_DFLL_DVCO>, ++ <&tegra_car 155>; ++ reset-names = "dvco", "dfll"; + #clock-cells = <0>; + clock-output-names = "dfllCPU_out"; + status = "disabled"; diff --git a/queue-5.18/blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch b/queue-5.18/blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch new file mode 100644 index 00000000000..5e0933fdc15 --- /dev/null +++ b/queue-5.18/blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch @@ -0,0 +1,323 @@ +From 8a177a36da6c54c98b8685d4f914cb3637d53c0d Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 13 May 2022 20:55:45 -1000 +Subject: blk-iolatency: Fix inflight count imbalances and IO hangs on offline + +From: Tejun Heo + +commit 8a177a36da6c54c98b8685d4f914cb3637d53c0d upstream. + +iolatency needs to track the number of inflight IOs per cgroup. As this +tracking can be expensive, it is disabled when no cgroup has iolatency +configured for the device. To ensure that the inflight counters stay +balanced, iolatency_set_limit() freezes the request_queue while manipulating +the enabled counter, which ensures that no IO is in flight and thus all +counters are zero. + +Unfortunately, iolatency_set_limit() isn't the only place where the enabled +counter is manipulated. iolatency_pd_offline() can also dec the counter and +trigger disabling. As this disabling happens without freezing the q, this +can easily happen while some IOs are in flight and thus leak the counts. + +This can be easily demonstrated by turning on iolatency on an one empty +cgroup while IOs are in flight in other cgroups and then removing the +cgroup. Note that iolatency shouldn't have been enabled elsewhere in the +system to ensure that removing the cgroup disables iolatency for the whole +device. + +The following keeps flipping on and off iolatency on sda: + + echo +io > /sys/fs/cgroup/cgroup.subtree_control + while true; do + mkdir -p /sys/fs/cgroup/test + echo '8:0 target=100000' > /sys/fs/cgroup/test/io.latency + sleep 1 + rmdir /sys/fs/cgroup/test + sleep 1 + done + +and there's concurrent fio generating direct rand reads: + + fio --name test --filename=/dev/sda --direct=1 --rw=randread \ + --runtime=600 --time_based --iodepth=256 --numjobs=4 --bs=4k + +while monitoring with the following drgn script: + + while True: + for css in css_for_each_descendant_pre(prog['blkcg_root'].css.address_of_()): + for pos in hlist_for_each(container_of(css, 'struct blkcg', 'css').blkg_list): + blkg = container_of(pos, 'struct blkcg_gq', 'blkcg_node') + pd = blkg.pd[prog['blkcg_policy_iolatency'].plid] + if pd.value_() == 0: + continue + iolat = container_of(pd, 'struct iolatency_grp', 'pd') + inflight = iolat.rq_wait.inflight.counter.value_() + if inflight: + print(f'inflight={inflight} {disk_name(blkg.q.disk).decode("utf-8")} ' + f'{cgroup_path(css.cgroup).decode("utf-8")}') + time.sleep(1) + +The monitoring output looks like the following: + + inflight=1 sda /user.slice + inflight=1 sda /user.slice + ... + inflight=14 sda /user.slice + inflight=13 sda /user.slice + inflight=17 sda /user.slice + inflight=15 sda /user.slice + inflight=18 sda /user.slice + inflight=17 sda /user.slice + inflight=20 sda /user.slice + inflight=19 sda /user.slice <- fio stopped, inflight stuck at 19 + inflight=19 sda /user.slice + inflight=19 sda /user.slice + +If a cgroup with stuck inflight ends up getting throttled, the throttled IOs +will never get issued as there's no completion event to wake it up leading +to an indefinite hang. + +This patch fixes the bug by unifying enable handling into a work item which +is automatically kicked off from iolatency_set_min_lat_nsec() which is +called from both iolatency_set_limit() and iolatency_pd_offline() paths. +Punting to a work item is necessary as iolatency_pd_offline() is called +under spinlocks while freezing a request_queue requires a sleepable context. + +This also simplifies the code reducing LOC sans the comments and avoids the +unnecessary freezes which were happening whenever a cgroup's latency target +is newly set or cleared. + +Signed-off-by: Tejun Heo +Cc: Josef Bacik +Cc: Liu Bo +Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter") +Cc: stable@vger.kernel.org # v5.0+ +Link: https://lore.kernel.org/r/Yn9ScX6Nx2qIiQQi@slm.duckdns.org +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-iolatency.c | 122 ++++++++++++++++++++++++++------------------------ + 1 file changed, 64 insertions(+), 58 deletions(-) + +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -87,7 +87,17 @@ struct iolatency_grp; + struct blk_iolatency { + struct rq_qos rqos; + struct timer_list timer; +- atomic_t enabled; ++ ++ /* ++ * ->enabled is the master enable switch gating the throttling logic and ++ * inflight tracking. The number of cgroups which have iolat enabled is ++ * tracked in ->enable_cnt, and ->enable is flipped on/off accordingly ++ * from ->enable_work with the request_queue frozen. For details, See ++ * blkiolatency_enable_work_fn(). ++ */ ++ bool enabled; ++ atomic_t enable_cnt; ++ struct work_struct enable_work; + }; + + static inline struct blk_iolatency *BLKIOLATENCY(struct rq_qos *rqos) +@@ -95,11 +105,6 @@ static inline struct blk_iolatency *BLKI + return container_of(rqos, struct blk_iolatency, rqos); + } + +-static inline bool blk_iolatency_enabled(struct blk_iolatency *blkiolat) +-{ +- return atomic_read(&blkiolat->enabled) > 0; +-} +- + struct child_latency_info { + spinlock_t lock; + +@@ -464,7 +469,7 @@ static void blkcg_iolatency_throttle(str + struct blkcg_gq *blkg = bio->bi_blkg; + bool issue_as_root = bio_issue_as_root_blkg(bio); + +- if (!blk_iolatency_enabled(blkiolat)) ++ if (!blkiolat->enabled) + return; + + while (blkg && blkg->parent) { +@@ -594,7 +599,6 @@ static void blkcg_iolatency_done_bio(str + u64 window_start; + u64 now; + bool issue_as_root = bio_issue_as_root_blkg(bio); +- bool enabled = false; + int inflight = 0; + + blkg = bio->bi_blkg; +@@ -605,8 +609,7 @@ static void blkcg_iolatency_done_bio(str + if (!iolat) + return; + +- enabled = blk_iolatency_enabled(iolat->blkiolat); +- if (!enabled) ++ if (!iolat->blkiolat->enabled) + return; + + now = ktime_to_ns(ktime_get()); +@@ -645,6 +648,7 @@ static void blkcg_iolatency_exit(struct + struct blk_iolatency *blkiolat = BLKIOLATENCY(rqos); + + del_timer_sync(&blkiolat->timer); ++ flush_work(&blkiolat->enable_work); + blkcg_deactivate_policy(rqos->q, &blkcg_policy_iolatency); + kfree(blkiolat); + } +@@ -716,6 +720,44 @@ next: + rcu_read_unlock(); + } + ++/** ++ * blkiolatency_enable_work_fn - Enable or disable iolatency on the device ++ * @work: enable_work of the blk_iolatency of interest ++ * ++ * iolatency needs to keep track of the number of in-flight IOs per cgroup. This ++ * is relatively expensive as it involves walking up the hierarchy twice for ++ * every IO. Thus, if iolatency is not enabled in any cgroup for the device, we ++ * want to disable the in-flight tracking. ++ * ++ * We have to make sure that the counting is balanced - we don't want to leak ++ * the in-flight counts by disabling accounting in the completion path while IOs ++ * are in flight. This is achieved by ensuring that no IO is in flight by ++ * freezing the queue while flipping ->enabled. As this requires a sleepable ++ * context, ->enabled flipping is punted to this work function. ++ */ ++static void blkiolatency_enable_work_fn(struct work_struct *work) ++{ ++ struct blk_iolatency *blkiolat = container_of(work, struct blk_iolatency, ++ enable_work); ++ bool enabled; ++ ++ /* ++ * There can only be one instance of this function running for @blkiolat ++ * and it's guaranteed to be executed at least once after the latest ++ * ->enabled_cnt modification. Acting on the latest ->enable_cnt is ++ * sufficient. ++ * ++ * Also, we know @blkiolat is safe to access as ->enable_work is flushed ++ * in blkcg_iolatency_exit(). ++ */ ++ enabled = atomic_read(&blkiolat->enable_cnt); ++ if (enabled != blkiolat->enabled) { ++ blk_mq_freeze_queue(blkiolat->rqos.q); ++ blkiolat->enabled = enabled; ++ blk_mq_unfreeze_queue(blkiolat->rqos.q); ++ } ++} ++ + int blk_iolatency_init(struct request_queue *q) + { + struct blk_iolatency *blkiolat; +@@ -741,17 +783,15 @@ int blk_iolatency_init(struct request_qu + } + + timer_setup(&blkiolat->timer, blkiolatency_timer_fn, 0); ++ INIT_WORK(&blkiolat->enable_work, blkiolatency_enable_work_fn); + + return 0; + } + +-/* +- * return 1 for enabling iolatency, return -1 for disabling iolatency, otherwise +- * return 0. +- */ +-static int iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) ++static void iolatency_set_min_lat_nsec(struct blkcg_gq *blkg, u64 val) + { + struct iolatency_grp *iolat = blkg_to_lat(blkg); ++ struct blk_iolatency *blkiolat = iolat->blkiolat; + u64 oldval = iolat->min_lat_nsec; + + iolat->min_lat_nsec = val; +@@ -759,13 +799,15 @@ static int iolatency_set_min_lat_nsec(st + iolat->cur_win_nsec = min_t(u64, iolat->cur_win_nsec, + BLKIOLATENCY_MAX_WIN_SIZE); + +- if (!oldval && val) +- return 1; ++ if (!oldval && val) { ++ if (atomic_inc_return(&blkiolat->enable_cnt) == 1) ++ schedule_work(&blkiolat->enable_work); ++ } + if (oldval && !val) { + blkcg_clear_delay(blkg); +- return -1; ++ if (atomic_dec_return(&blkiolat->enable_cnt) == 0) ++ schedule_work(&blkiolat->enable_work); + } +- return 0; + } + + static void iolatency_clear_scaling(struct blkcg_gq *blkg) +@@ -797,7 +839,6 @@ static ssize_t iolatency_set_limit(struc + u64 lat_val = 0; + u64 oldval; + int ret; +- int enable = 0; + + ret = blkg_conf_prep(blkcg, &blkcg_policy_iolatency, buf, &ctx); + if (ret) +@@ -832,41 +873,12 @@ static ssize_t iolatency_set_limit(struc + blkg = ctx.blkg; + oldval = iolat->min_lat_nsec; + +- enable = iolatency_set_min_lat_nsec(blkg, lat_val); +- if (enable) { +- if (!blk_get_queue(blkg->q)) { +- ret = -ENODEV; +- goto out; +- } +- +- blkg_get(blkg); +- } +- +- if (oldval != iolat->min_lat_nsec) { ++ iolatency_set_min_lat_nsec(blkg, lat_val); ++ if (oldval != iolat->min_lat_nsec) + iolatency_clear_scaling(blkg); +- } +- + ret = 0; + out: + blkg_conf_finish(&ctx); +- if (ret == 0 && enable) { +- struct iolatency_grp *tmp = blkg_to_lat(blkg); +- struct blk_iolatency *blkiolat = tmp->blkiolat; +- +- blk_mq_freeze_queue(blkg->q); +- +- if (enable == 1) +- atomic_inc(&blkiolat->enabled); +- else if (enable == -1) +- atomic_dec(&blkiolat->enabled); +- else +- WARN_ON_ONCE(1); +- +- blk_mq_unfreeze_queue(blkg->q); +- +- blkg_put(blkg); +- blk_put_queue(blkg->q); +- } + return ret ?: nbytes; + } + +@@ -1005,14 +1017,8 @@ static void iolatency_pd_offline(struct + { + struct iolatency_grp *iolat = pd_to_lat(pd); + struct blkcg_gq *blkg = lat_to_blkg(iolat); +- struct blk_iolatency *blkiolat = iolat->blkiolat; +- int ret; + +- ret = iolatency_set_min_lat_nsec(blkg, 0); +- if (ret == 1) +- atomic_inc(&blkiolat->enabled); +- if (ret == -1) +- atomic_dec(&blkiolat->enabled); ++ iolatency_set_min_lat_nsec(blkg, 0); + iolatency_clear_scaling(blkg); + } + diff --git a/queue-5.18/ceph-fix-decoding-of-client-session-messages-flags.patch b/queue-5.18/ceph-fix-decoding-of-client-session-messages-flags.patch new file mode 100644 index 00000000000..d3c5964786a --- /dev/null +++ b/queue-5.18/ceph-fix-decoding-of-client-session-messages-flags.patch @@ -0,0 +1,57 @@ +From ea16567f11018e2f58e72b667b0c803ff92b8153 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Lu=C3=ADs=20Henriques?= +Date: Mon, 23 May 2022 17:09:51 +0100 +Subject: ceph: fix decoding of client session messages flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luís Henriques + +commit ea16567f11018e2f58e72b667b0c803ff92b8153 upstream. + +The cephfs kernel client started to show the message: + + ceph: mds0 session blocklisted + +when mounting a filesystem. This is due to the fact that the session +messages are being incorrectly decoded: the skip needs to take into +account the 'len'. + +While there, fixed some whitespaces too. + +Cc: stable@vger.kernel.org +Fixes: e1c9788cb397 ("ceph: don't rely on error_string to validate blocklisted session.") +Signed-off-by: Luís Henriques +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman +--- + fs/ceph/mds_client.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +--- a/fs/ceph/mds_client.c ++++ b/fs/ceph/mds_client.c +@@ -3375,13 +3375,17 @@ static void handle_session(struct ceph_m + } + + if (msg_version >= 5) { +- u32 flags; +- /* version >= 4, struct_v, struct_cv, len, metric_spec */ +- ceph_decode_skip_n(&p, end, 2 + sizeof(u32) * 2, bad); ++ u32 flags, len; ++ ++ /* version >= 4 */ ++ ceph_decode_skip_16(&p, end, bad); /* struct_v, struct_cv */ ++ ceph_decode_32_safe(&p, end, len, bad); /* len */ ++ ceph_decode_skip_n(&p, end, len, bad); /* metric_spec */ ++ + /* version >= 5, flags */ +- ceph_decode_32_safe(&p, end, flags, bad); ++ ceph_decode_32_safe(&p, end, flags, bad); + if (flags & CEPH_SESSION_BLOCKLISTED) { +- pr_warn("mds%d session blocklisted\n", session->s_mds); ++ pr_warn("mds%d session blocklisted\n", session->s_mds); + blocklisted = true; + } + } diff --git a/queue-5.18/clk-tegra-add-missing-reset-deassertion.patch b/queue-5.18/clk-tegra-add-missing-reset-deassertion.patch new file mode 100644 index 00000000000..6eb2601284f --- /dev/null +++ b/queue-5.18/clk-tegra-add-missing-reset-deassertion.patch @@ -0,0 +1,89 @@ +From 23a43cc437e747473d5f8f98b4fe189fb5c433b7 Mon Sep 17 00:00:00 2001 +From: Diogo Ivo +Date: Fri, 29 Apr 2022 13:58:43 +0100 +Subject: clk: tegra: Add missing reset deassertion + +From: Diogo Ivo + +commit 23a43cc437e747473d5f8f98b4fe189fb5c433b7 upstream. + +Commit 4782c0a5dd88 ("clk: tegra: Don't deassert reset on enabling +clocks") removed deassertion of reset lines when enabling peripheral +clocks. This breaks the initialization of the DFLL driver which relied +on this behaviour. + +Fix this problem by adding explicit deassert/assert requests to the +driver. Tested on Google Pixel C. + +Cc: stable@vger.kernel.org +Fixes: 4782c0a5dd88 ("clk: tegra: Don't deassert reset on enabling clocks") +Signed-off-by: Diogo Ivo +Signed-off-by: Thierry Reding +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/tegra/clk-dfll.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/clk/tegra/clk-dfll.c ++++ b/drivers/clk/tegra/clk-dfll.c +@@ -271,6 +271,7 @@ struct tegra_dfll { + struct clk *ref_clk; + struct clk *i2c_clk; + struct clk *dfll_clk; ++ struct reset_control *dfll_rst; + struct reset_control *dvco_rst; + unsigned long ref_rate; + unsigned long i2c_clk_rate; +@@ -1464,6 +1465,7 @@ static int dfll_init(struct tegra_dfll * + return -EINVAL; + } + ++ reset_control_deassert(td->dfll_rst); + reset_control_deassert(td->dvco_rst); + + ret = clk_prepare(td->ref_clk); +@@ -1509,6 +1511,7 @@ di_err1: + clk_unprepare(td->ref_clk); + + reset_control_assert(td->dvco_rst); ++ reset_control_assert(td->dfll_rst); + + return ret; + } +@@ -1530,6 +1533,7 @@ int tegra_dfll_suspend(struct device *de + } + + reset_control_assert(td->dvco_rst); ++ reset_control_assert(td->dfll_rst); + + return 0; + } +@@ -1548,6 +1552,7 @@ int tegra_dfll_resume(struct device *dev + { + struct tegra_dfll *td = dev_get_drvdata(dev); + ++ reset_control_deassert(td->dfll_rst); + reset_control_deassert(td->dvco_rst); + + pm_runtime_get_sync(td->dev); +@@ -1951,6 +1956,12 @@ int tegra_dfll_register(struct platform_ + + td->soc = soc; + ++ td->dfll_rst = devm_reset_control_get_optional(td->dev, "dfll"); ++ if (IS_ERR(td->dfll_rst)) { ++ dev_err(td->dev, "couldn't get dfll reset\n"); ++ return PTR_ERR(td->dfll_rst); ++ } ++ + td->dvco_rst = devm_reset_control_get(td->dev, "dvco"); + if (IS_ERR(td->dvco_rst)) { + dev_err(td->dev, "couldn't get dvco reset\n"); +@@ -2087,6 +2098,7 @@ struct tegra_dfll_soc_data *tegra_dfll_u + clk_unprepare(td->i2c_clk); + + reset_control_assert(td->dvco_rst); ++ reset_control_assert(td->dfll_rst); + + return td->soc; + } diff --git a/queue-5.18/coresight-core-fix-coresight-device-probe-failure-issue.patch b/queue-5.18/coresight-core-fix-coresight-device-probe-failure-issue.patch new file mode 100644 index 00000000000..a7967fb47c2 --- /dev/null +++ b/queue-5.18/coresight-core-fix-coresight-device-probe-failure-issue.patch @@ -0,0 +1,122 @@ +From 8c1d3f79d9ca48e406b78e90e94cf09a8c076bf2 Mon Sep 17 00:00:00 2001 +From: Mao Jinlong +Date: Wed, 9 Mar 2022 06:22:06 -0800 +Subject: coresight: core: Fix coresight device probe failure issue + +From: Mao Jinlong + +commit 8c1d3f79d9ca48e406b78e90e94cf09a8c076bf2 upstream. + +It is possibe that probe failure issue happens when the device +and its child_device's probe happens at the same time. +In coresight_make_links, has_conns_grp is true for parent, but +has_conns_grp is false for child device as has_conns_grp is set +to true in coresight_create_conns_sysfs_group. The probe of parent +device will fail at this condition. Add has_conns_grp check for +child device before make the links and make the process from +device_register to connection_create be atomic to avoid this +probe failure issue. + +Cc: stable@vger.kernel.org +Suggested-by: Suzuki K Poulose +Suggested-by: Mike Leach +Signed-off-by: Mao Jinlong +Link: https://lore.kernel.org/r/20220309142206.15632-1-quic_jinlmao@quicinc.com +[ Added Cc stable ] +Signed-off-by: Suzuki K Poulose +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwtracing/coresight/coresight-core.c | 33 ++++++++++++++++++--------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -1379,7 +1379,7 @@ static int coresight_fixup_device_conns( + continue; + conn->child_dev = + coresight_find_csdev_by_fwnode(conn->child_fwnode); +- if (conn->child_dev) { ++ if (conn->child_dev && conn->child_dev->has_conns_grp) { + ret = coresight_make_links(csdev, conn, + conn->child_dev); + if (ret) +@@ -1571,6 +1571,7 @@ struct coresight_device *coresight_regis + int nr_refcnts = 1; + atomic_t *refcnts = NULL; + struct coresight_device *csdev; ++ bool registered = false; + + csdev = kzalloc(sizeof(*csdev), GFP_KERNEL); + if (!csdev) { +@@ -1591,7 +1592,8 @@ struct coresight_device *coresight_regis + refcnts = kcalloc(nr_refcnts, sizeof(*refcnts), GFP_KERNEL); + if (!refcnts) { + ret = -ENOMEM; +- goto err_free_csdev; ++ kfree(csdev); ++ goto err_out; + } + + csdev->refcnt = refcnts; +@@ -1616,6 +1618,13 @@ struct coresight_device *coresight_regis + csdev->dev.fwnode = fwnode_handle_get(dev_fwnode(desc->dev)); + dev_set_name(&csdev->dev, "%s", desc->name); + ++ /* ++ * Make sure the device registration and the connection fixup ++ * are synchronised, so that we don't see uninitialised devices ++ * on the coresight bus while trying to resolve the connections. ++ */ ++ mutex_lock(&coresight_mutex); ++ + ret = device_register(&csdev->dev); + if (ret) { + put_device(&csdev->dev); +@@ -1623,7 +1632,7 @@ struct coresight_device *coresight_regis + * All resources are free'd explicitly via + * coresight_device_release(), triggered from put_device(). + */ +- goto err_out; ++ goto out_unlock; + } + + if (csdev->type == CORESIGHT_DEV_TYPE_SINK || +@@ -1638,11 +1647,11 @@ struct coresight_device *coresight_regis + * from put_device(), which is in turn called from + * function device_unregister(). + */ +- goto err_out; ++ goto out_unlock; + } + } +- +- mutex_lock(&coresight_mutex); ++ /* Device is now registered */ ++ registered = true; + + ret = coresight_create_conns_sysfs_group(csdev); + if (!ret) +@@ -1652,16 +1661,18 @@ struct coresight_device *coresight_regis + if (!ret && cti_assoc_ops && cti_assoc_ops->add) + cti_assoc_ops->add(csdev); + ++out_unlock: + mutex_unlock(&coresight_mutex); +- if (ret) { ++ /* Success */ ++ if (!ret) ++ return csdev; ++ ++ /* Unregister the device if needed */ ++ if (registered) { + coresight_unregister(csdev); + return ERR_PTR(ret); + } + +- return csdev; +- +-err_free_csdev: +- kfree(csdev); + err_out: + /* Cleanup the connection information */ + coresight_release_platform_data(NULL, desc->pdata); diff --git a/queue-5.18/docs-conf.py-cope-with-removal-of-language-none-in-sphinx-5.0.0.patch b/queue-5.18/docs-conf.py-cope-with-removal-of-language-none-in-sphinx-5.0.0.patch new file mode 100644 index 00000000000..0f4b1696f7b --- /dev/null +++ b/queue-5.18/docs-conf.py-cope-with-removal-of-language-none-in-sphinx-5.0.0.patch @@ -0,0 +1,48 @@ +From 627f01eab93d8671d4e4afee9b148f9998d20e7c Mon Sep 17 00:00:00 2001 +From: Akira Yokosawa +Date: Wed, 1 Jun 2022 23:34:06 +0900 +Subject: docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 + +From: Akira Yokosawa + +commit 627f01eab93d8671d4e4afee9b148f9998d20e7c upstream. + +One of the changes in Sphinx 5.0.0 [1] says [sic]: + + 5.0.0 final + + - #10474: language does not accept None as it value. + The default value of language becomes to 'en' now. + +[1]: https://www.sphinx-doc.org/en/master/changes.html#release-5-0-0-released-may-30-2022 + +It results in a new warning from Sphinx 5.0.0 [sic]: + + WARNING: Invalid configuration value found: 'language = None'. + Update your configuration to a valid langauge code. Falling + back to 'en' (English). + +Silence the warning by using 'en'. +It works with all the Sphinx versions required for building +kernel documentation (1.7.9 or later). + +Signed-off-by: Akira Yokosawa +Link: https://lore.kernel.org/r/bd0c2ddc-2401-03cb-4526-79ca664e1cbe@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Jonathan Corbet +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/conf.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/conf.py ++++ b/Documentation/conf.py +@@ -161,7 +161,7 @@ finally: + # + # This is also used if you do content translation via gettext catalogs. + # Usually you set "language" from the command line for these cases. +-language = None ++language = 'en' + + # There are two options for replacing |today|: either, you set today to some + # non-false value, then it is used: diff --git a/queue-5.18/dt-bindings-gpio-altera-correct-interrupt-cells.patch b/queue-5.18/dt-bindings-gpio-altera-correct-interrupt-cells.patch new file mode 100644 index 00000000000..56e33de6607 --- /dev/null +++ b/queue-5.18/dt-bindings-gpio-altera-correct-interrupt-cells.patch @@ -0,0 +1,40 @@ +From 3a21c3ac93aff7b4522b152399df8f6a041df56d Mon Sep 17 00:00:00 2001 +From: Dinh Nguyen +Date: Wed, 11 May 2022 12:54:46 -0500 +Subject: dt-bindings: gpio: altera: correct interrupt-cells + +From: Dinh Nguyen + +commit 3a21c3ac93aff7b4522b152399df8f6a041df56d upstream. + +update documentation to correctly state the interrupt-cells to be 2. + +Cc: stable@vger.kernel.org +Fixes: 4fd9bbc6e071 ("drivers/gpio: Altera soft IP GPIO driver devicetree binding") +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + Documentation/devicetree/bindings/gpio/gpio-altera.txt | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/Documentation/devicetree/bindings/gpio/gpio-altera.txt ++++ b/Documentation/devicetree/bindings/gpio/gpio-altera.txt +@@ -9,8 +9,9 @@ Required properties: + - The second cell is reserved and is currently unused. + - gpio-controller : Marks the device node as a GPIO controller. + - interrupt-controller: Mark the device node as an interrupt controller +-- #interrupt-cells : Should be 1. The interrupt type is fixed in the hardware. ++- #interrupt-cells : Should be 2. The interrupt type is fixed in the hardware. + - The first cell is the GPIO offset number within the GPIO controller. ++ - The second cell is the interrupt trigger type and level flags. + - interrupts: Specify the interrupt. + - altr,interrupt-type: Specifies the interrupt trigger type the GPIO + hardware is synthesized. This field is required if the Altera GPIO controller +@@ -38,6 +39,6 @@ gpio_altr: gpio@ff200000 { + altr,interrupt-type = ; + #gpio-cells = <2>; + gpio-controller; +- #interrupt-cells = <1>; ++ #interrupt-cells = <2>; + interrupt-controller; + }; diff --git a/queue-5.18/gma500-fix-an-incorrect-null-check-on-list-iterator.patch b/queue-5.18/gma500-fix-an-incorrect-null-check-on-list-iterator.patch new file mode 100644 index 00000000000..dcbc3366a6d --- /dev/null +++ b/queue-5.18/gma500-fix-an-incorrect-null-check-on-list-iterator.patch @@ -0,0 +1,49 @@ +From bdef417d84536715145f6dc9cc3275c46f26295a Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Sun, 27 Mar 2022 13:20:28 +0800 +Subject: gma500: fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +commit bdef417d84536715145f6dc9cc3275c46f26295a upstream. + +The bug is here: + return crtc; + +The list iterator value 'crtc' will *always* be set and non-NULL by +list_for_each_entry(), so it is incorrect to assume that the iterator +value will be NULL if the list is empty or no element is found. + +To fix the bug, return 'crtc' when found, otherwise return NULL. + +Cc: stable@vger.kernel.org +fixes: 89c78134cc54d ("gma500: Add Poulsbo support") +Signed-off-by: Xiaomeng Tong +Signed-off-by: Patrik Jakobsson +Link: https://patchwork.freedesktop.org/patch/msgid/20220327052028.2013-1-xiam0nd.tong@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/gma500/psb_intel_display.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/gma500/psb_intel_display.c ++++ b/drivers/gpu/drm/gma500/psb_intel_display.c +@@ -535,14 +535,15 @@ void psb_intel_crtc_init(struct drm_devi + + struct drm_crtc *psb_intel_get_crtc_from_pipe(struct drm_device *dev, int pipe) + { +- struct drm_crtc *crtc = NULL; ++ struct drm_crtc *crtc; + + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { + struct gma_crtc *gma_crtc = to_gma_crtc(crtc); ++ + if (gma_crtc->pipe == pipe) +- break; ++ return crtc; + } +- return crtc; ++ return NULL; + } + + int gma_connector_clones(struct drm_device *dev, int type_mask) diff --git a/queue-5.18/misc-fastrpc-fix-list-iterator-in-fastrpc_req_mem_unmap_impl.patch b/queue-5.18/misc-fastrpc-fix-list-iterator-in-fastrpc_req_mem_unmap_impl.patch new file mode 100644 index 00000000000..ee64ecf20a8 --- /dev/null +++ b/queue-5.18/misc-fastrpc-fix-list-iterator-in-fastrpc_req_mem_unmap_impl.patch @@ -0,0 +1,75 @@ +From c5c07c5958cf0c9af6e76813e6de15d42ee49822 Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Wed, 18 May 2022 16:23:53 +0100 +Subject: misc: fastrpc: fix list iterator in fastrpc_req_mem_unmap_impl + +From: Srinivas Kandagatla + +commit c5c07c5958cf0c9af6e76813e6de15d42ee49822 upstream. + +This is another instance of incorrect use of list iterator and +checking it for NULL. + +The list iterator value 'map' will *always* be set and non-NULL +by list_for_each_entry(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty (in this case, the +check 'if (!map) {' will always be false and never exit as expected). + +To fix the bug, use a new variable 'iter' as the list iterator, +while use the original variable 'map' as a dedicated pointer to +point to the found element. + +Without this patch, Kernel crashes with below trace: + +Unable to handle kernel access to user memory outside uaccess routines + at virtual address 0000ffff7fb03750 +... +Call trace: + fastrpc_map_create+0x70/0x290 [fastrpc] + fastrpc_req_mem_map+0xf0/0x2dc [fastrpc] + fastrpc_device_ioctl+0x138/0xc60 [fastrpc] + __arm64_sys_ioctl+0xa8/0xec + invoke_syscall+0x48/0x114 + el0_svc_common.constprop.0+0xd4/0xfc + do_el0_svc+0x28/0x90 + el0_svc+0x3c/0x130 + el0t_64_sync_handler+0xa4/0x130 + el0t_64_sync+0x18c/0x190 +Code: 14000016 f94000a5 eb05029f 54000260 (b94018a6) +---[ end trace 0000000000000000 ]--- + +Fixes: 5c1b97c7d7b7 ("misc: fastrpc: add support for FASTRPC_IOCTL_MEM_MAP/UNMAP") +Cc: stable@vger.kernel.org +Reported-by: Jan Jablonsky +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220518152353.13058-1-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/fastrpc.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/misc/fastrpc.c ++++ b/drivers/misc/fastrpc.c +@@ -1747,17 +1747,18 @@ err_invoke: + static int fastrpc_req_mem_unmap_impl(struct fastrpc_user *fl, struct fastrpc_mem_unmap *req) + { + struct fastrpc_invoke_args args[1] = { [0] = { 0 } }; +- struct fastrpc_map *map = NULL, *m; ++ struct fastrpc_map *map = NULL, *iter, *m; + struct fastrpc_mem_unmap_req_msg req_msg = { 0 }; + int err = 0; + u32 sc; + struct device *dev = fl->sctx->dev; + + spin_lock(&fl->lock); +- list_for_each_entry_safe(map, m, &fl->maps, node) { +- if ((req->fd < 0 || map->fd == req->fd) && (map->raddr == req->vaddr)) ++ list_for_each_entry_safe(iter, m, &fl->maps, node) { ++ if ((req->fd < 0 || iter->fd == req->fd) && (iter->raddr == req->vaddr)) { ++ map = iter; + break; +- map = NULL; ++ } + } + + spin_unlock(&fl->lock); diff --git a/queue-5.18/phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch b/queue-5.18/phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch new file mode 100644 index 00000000000..cb1dbca1051 --- /dev/null +++ b/queue-5.18/phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch @@ -0,0 +1,54 @@ +From 4d2900f20edfe541f75756a00deeb2ffe7c66bc1 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Apr 2022 08:32:42 +0200 +Subject: phy: qcom-qmp: fix reset-controller leak on probe errors + +From: Johan Hovold + +commit 4d2900f20edfe541f75756a00deeb2ffe7c66bc1 upstream. + +Make sure to release the lane reset controller in case of a late probe +error (e.g. probe deferral). + +Note that due to the reset controller being defined in devicetree in +"lane" child nodes, devm_reset_control_get_exclusive() cannot be used +directly. + +Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") +Cc: stable@vger.kernel.org # 4.12 +Cc: Vivek Gautam +Reviewed-by: Philipp Zabel +Signed-off-by: Johan Hovold +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220427063243.32576-3-johan+linaro@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/qualcomm/phy-qcom-qmp.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +--- a/drivers/phy/qualcomm/phy-qcom-qmp.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c +@@ -5818,6 +5818,11 @@ static const struct phy_ops qcom_qmp_pci + .owner = THIS_MODULE, + }; + ++static void qcom_qmp_reset_control_put(void *data) ++{ ++ reset_control_put(data); ++} ++ + static + int qcom_qmp_phy_create(struct device *dev, struct device_node *np, int id, + void __iomem *serdes, const struct qmp_phy_cfg *cfg) +@@ -5912,6 +5917,10 @@ int qcom_qmp_phy_create(struct device *d + dev_err(dev, "failed to get lane%d reset\n", id); + return PTR_ERR(qphy->lane_rst); + } ++ ret = devm_add_action_or_reset(dev, qcom_qmp_reset_control_put, ++ qphy->lane_rst); ++ if (ret) ++ return ret; + } + + if (cfg->type == PHY_TYPE_UFS || cfg->type == PHY_TYPE_PCIE) diff --git a/queue-5.18/phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch b/queue-5.18/phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch new file mode 100644 index 00000000000..1cd4b5091dc --- /dev/null +++ b/queue-5.18/phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch @@ -0,0 +1,35 @@ +From f0a4bc38a12f5a0cc5ad68670d9480e91e6a94df Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Wed, 27 Apr 2022 08:32:41 +0200 +Subject: phy: qcom-qmp: fix struct clk leak on probe errors + +From: Johan Hovold + +commit f0a4bc38a12f5a0cc5ad68670d9480e91e6a94df upstream. + +Make sure to release the pipe clock reference in case of a late probe +error (e.g. probe deferral). + +Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets") +Cc: stable@vger.kernel.org # 4.12 +Cc: Vivek Gautam +Reviewed-by: Bjorn Andersson +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20220427063243.32576-2-johan+linaro@kernel.org +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/phy/qualcomm/phy-qcom-qmp.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c +@@ -5890,7 +5890,7 @@ int qcom_qmp_phy_create(struct device *d + * all phys that don't need this. + */ + snprintf(prop_name, sizeof(prop_name), "pipe%d", id); +- qphy->pipe_clk = of_clk_get_by_name(np, prop_name); ++ qphy->pipe_clk = devm_get_clk_from_child(dev, np, prop_name); + if (IS_ERR(qphy->pipe_clk)) { + if (cfg->type == PHY_TYPE_PCIE || + cfg->type == PHY_TYPE_USB3) { diff --git a/queue-5.18/series b/queue-5.18/series index 3b0a808d526..435a7173a20 100644 --- a/queue-5.18/series +++ b/queue-5.18/series @@ -843,3 +843,19 @@ bcache-remove-incremental-dirty-sector-counting-for-bch_sectors_dirty_init.patch bcache-avoid-journal-no-space-deadlock-by-reserving-1-journal-bucket.patch serial-pch-don-t-overwrite-xmit-buf-by-x_char.patch tilcdc-tilcdc_external-fix-an-incorrect-null-check-on-list-iterator.patch +gma500-fix-an-incorrect-null-check-on-list-iterator.patch +arm64-dts-qcom-ipq8074-fix-the-sleep-clock-frequency.patch +arm64-tegra-add-missing-dfll-reset-on-tegra210.patch +clk-tegra-add-missing-reset-deassertion.patch +phy-qcom-qmp-fix-struct-clk-leak-on-probe-errors.patch +arm-dts-s5pv210-remove-spi-cs-high-on-panel-in-aries.patch +arm-pxa-maybe-fix-gpio-lookup-tables.patch +ceph-fix-decoding-of-client-session-messages-flags.patch +misc-fastrpc-fix-list-iterator-in-fastrpc_req_mem_unmap_impl.patch +smb3-ebadf-eio-errors-in-rename-open-caused-by-race-condition-in-smb2_compound_op.patch +docs-conf.py-cope-with-removal-of-language-none-in-sphinx-5.0.0.patch +dt-bindings-gpio-altera-correct-interrupt-cells.patch +vdpasim-allow-to-enable-a-vq-repeatedly.patch +blk-iolatency-fix-inflight-count-imbalances-and-io-hangs-on-offline.patch +coresight-core-fix-coresight-device-probe-failure-issue.patch +phy-qcom-qmp-fix-reset-controller-leak-on-probe-errors.patch diff --git a/queue-5.18/smb3-ebadf-eio-errors-in-rename-open-caused-by-race-condition-in-smb2_compound_op.patch b/queue-5.18/smb3-ebadf-eio-errors-in-rename-open-caused-by-race-condition-in-smb2_compound_op.patch new file mode 100644 index 00000000000..b0e99f3155e --- /dev/null +++ b/queue-5.18/smb3-ebadf-eio-errors-in-rename-open-caused-by-race-condition-in-smb2_compound_op.patch @@ -0,0 +1,68 @@ +From 0a55cf74ffb5d004b93647e4389096880ce37d6b Mon Sep 17 00:00:00 2001 +From: Steve French +Date: Thu, 12 May 2022 10:18:00 -0500 +Subject: SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steve French + +commit 0a55cf74ffb5d004b93647e4389096880ce37d6b upstream. + +There is a race condition in smb2_compound_op: + +after_close: + num_rqst++; + + if (cfile) { + cifsFileInfo_put(cfile); // sends SMB2_CLOSE to the server + cfile = NULL; + +This is triggered by smb2_query_path_info operation that happens during +revalidate_dentry. In smb2_query_path_info, get_readable_path is called to +load the cfile, increasing the reference counter. If in the meantime, this +reference becomes the very last, this call to cifsFileInfo_put(cfile) will +trigger a SMB2_CLOSE request sent to the server just before sending this compound +request – and so then the compound request fails either with EBADF/EIO depending +on the timing at the server, because the handle is already closed. + +In the first scenario, the race seems to be happening between smb2_query_path_info +triggered by the rename operation, and between “cleanup” of asynchronous writes – while +fsync(fd) likely waits for the asynchronous writes to complete, releasing the writeback +structures can happen after the close(fd) call. So the EBADF/EIO errors will pop up if +the timing is such that: +1) There are still outstanding references after close(fd) in the writeback structures +2) smb2_query_path_info successfully fetches the cfile, increasing the refcounter by 1 +3) All writeback structures release the same cfile, reducing refcounter to 1 +4) smb2_compound_op is called with that cfile + +In the second scenario, the race seems to be similar – here open triggers the +smb2_query_path_info operation, and if all other threads in the meantime decrease the +refcounter to 1 similarly to the first scenario, again SMB2_CLOSE will be sent to the +server just before issuing the compound request. This case is harder to reproduce. + +See https://bugzilla.samba.org/show_bug.cgi?id=15051 + +Cc: stable@vger.kernel.org +Fixes: 8de9e86c67ba ("cifs: create a helper to find a writeable handle by path name") +Signed-off-by: Ondrej Hubsch +Reviewed-by: Ronnie Sahlberg +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/smb2inode.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -362,8 +362,6 @@ smb2_compound_op(const unsigned int xid, + num_rqst++; + + if (cfile) { +- cifsFileInfo_put(cfile); +- cfile = NULL; + rc = compound_send_recv(xid, ses, server, + flags, num_rqst - 2, + &rqst[1], &resp_buftype[1], diff --git a/queue-5.18/vdpasim-allow-to-enable-a-vq-repeatedly.patch b/queue-5.18/vdpasim-allow-to-enable-a-vq-repeatedly.patch new file mode 100644 index 00000000000..a72ec7b05ee --- /dev/null +++ b/queue-5.18/vdpasim-allow-to-enable-a-vq-repeatedly.patch @@ -0,0 +1,48 @@ +From 242436973831aa97e8ce19533c6c912ea8def31b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Eugenio=20P=C3=A9rez?= +Date: Thu, 19 May 2022 16:59:19 +0200 +Subject: vdpasim: allow to enable a vq repeatedly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Eugenio Pérez + +commit 242436973831aa97e8ce19533c6c912ea8def31b upstream. + +Code must be resilient to enable a queue many times. + +At the moment the queue is resetting so it's definitely not the expected +behavior. + +v2: set vq->ready = 0 at disable. + +Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") +Cc: stable@vger.kernel.org +Signed-off-by: Eugenio Pérez +Message-Id: <20220519145919.772896-1-eperezma@redhat.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefano Garzarella +Signed-off-by: Greg Kroah-Hartman +--- + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c ++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c +@@ -353,11 +353,14 @@ static void vdpasim_set_vq_ready(struct + { + struct vdpasim *vdpasim = vdpa_to_sim(vdpa); + struct vdpasim_virtqueue *vq = &vdpasim->vqs[idx]; ++ bool old_ready; + + spin_lock(&vdpasim->lock); ++ old_ready = vq->ready; + vq->ready = ready; +- if (vq->ready) ++ if (vq->ready && !old_ready) { + vdpasim_queue_ready(vdpasim, idx); ++ } + spin_unlock(&vdpasim->lock); + } +