From: Greg Kroah-Hartman Date: Mon, 16 May 2022 08:36:39 +0000 (+0200) Subject: 5.17-stable patches X-Git-Tag: v4.9.315~24 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d6a74b9f92dc9a6ee8f8ebab11ff904ef335e9e8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.17-stable patches added patches: dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch --- diff --git a/queue-5.17/dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch b/queue-5.17/dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch new file mode 100644 index 00000000000..6ce003dbf83 --- /dev/null +++ b/queue-5.17/dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch @@ -0,0 +1,64 @@ +From ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 Mon Sep 17 00:00:00 2001 +From: Charan Teja Reddy +Date: Tue, 10 May 2022 01:19:57 +0530 +Subject: dma-buf: call dma_buf_stats_setup after dmabuf is in valid list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Charan Teja Reddy + +commit ef3a6b70507a2add2cd2e01f5eb9b54d561bacb9 upstream. + +When dma_buf_stats_setup() fails, it closes the dmabuf file which +results into the calling of dma_buf_file_release() where it does +list_del(&dmabuf->list_node) with out first adding it to the proper +list. This is resulting into panic in the below path: +__list_del_entry_valid+0x38/0xac +dma_buf_file_release+0x74/0x158 +__fput+0xf4/0x428 +____fput+0x14/0x24 +task_work_run+0x178/0x24c +do_notify_resume+0x194/0x264 +work_pending+0xc/0x5f0 + +Fix it by moving the dma_buf_stats_setup() after dmabuf is added to the +list. + +Fixes: bdb8d06dfefd ("dmabuf: Add the capability to expose DMA-BUF stats in sysfs") +Signed-off-by: Charan Teja Reddy +Tested-by: T.J. Mercier +Acked-by: T.J. Mercier +Cc: # 5.15.x+ +Reviewed-by: Christian König +Signed-off-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/1652125797-2043-1-git-send-email-quic_charante@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/dma-buf/dma-buf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -543,10 +543,6 @@ struct dma_buf *dma_buf_export(const str + file->f_mode |= FMODE_LSEEK; + dmabuf->file = file; + +- ret = dma_buf_stats_setup(dmabuf); +- if (ret) +- goto err_sysfs; +- + mutex_init(&dmabuf->lock); + INIT_LIST_HEAD(&dmabuf->attachments); + +@@ -554,6 +550,10 @@ struct dma_buf *dma_buf_export(const str + list_add(&dmabuf->list_node, &db_list.head); + mutex_unlock(&db_list.lock); + ++ ret = dma_buf_stats_setup(dmabuf); ++ if (ret) ++ goto err_sysfs; ++ + return dmabuf; + + err_sysfs: diff --git a/queue-5.17/drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch b/queue-5.17/drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch new file mode 100644 index 00000000000..5dc49071227 --- /dev/null +++ b/queue-5.17/drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch @@ -0,0 +1,40 @@ +From 3059d9b9f6aa433a55b9d0d21b566396d5497c33 Mon Sep 17 00:00:00 2001 +From: Zack Rusin +Date: Wed, 2 Mar 2022 10:24:24 -0500 +Subject: drm/vmwgfx: Initialize drm_mode_fb_cmd2 + +From: Zack Rusin + +commit 3059d9b9f6aa433a55b9d0d21b566396d5497c33 upstream. + +Transition to drm_mode_fb_cmd2 from drm_mode_fb_cmd left the structure +unitialized. drm_mode_fb_cmd2 adds a few additional members, e.g. flags +and modifiers which were never initialized. Garbage in those members +can cause random failures during the bringup of the fbcon. + +Initializing the structure fixes random blank screens after bootup due +to flags/modifiers mismatches during the fbcon bring up. + +Fixes: dabdcdc9822a ("drm/vmwgfx: Switch to mode_cmd2") +Signed-off-by: Zack Rusin +Cc: Daniel Vetter +Cc: # v4.10+ +Reviewed-by: Martin Krastev +Reviewed-by: Maaz Mombasawala +Link: https://patchwork.freedesktop.org/patch/msgid/20220302152426.885214-7-zack@kde.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/vmwgfx/vmwgfx_fb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c +@@ -483,7 +483,7 @@ static int vmw_fb_kms_detach(struct vmw_ + + static int vmw_fb_kms_framebuffer(struct fb_info *info) + { +- struct drm_mode_fb_cmd2 mode_cmd; ++ struct drm_mode_fb_cmd2 mode_cmd = {0}; + struct vmw_fb_par *par = info->par; + struct fb_var_screeninfo *var = &info->var; + struct drm_framebuffer *cur_fb; diff --git a/queue-5.17/mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch b/queue-5.17/mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch new file mode 100644 index 00000000000..bd6dacc65d2 --- /dev/null +++ b/queue-5.17/mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch @@ -0,0 +1,93 @@ +From 1825b93b626e99eb9a0f9f50342c7b2fa201b387 Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Thu, 28 Apr 2022 23:14:44 -0700 +Subject: mm/hwpoison: use pr_err() instead of dump_page() in get_any_page() + +From: Naoya Horiguchi + +commit 1825b93b626e99eb9a0f9f50342c7b2fa201b387 upstream. + +The following VM_BUG_ON_FOLIO() is triggered when memory error event +happens on the (thp/folio) pages which are about to be freed: + + [ 1160.232771] page:00000000b36a8a0f refcount:1 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000 + [ 1160.236916] page:00000000b36a8a0f refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x16a000 + [ 1160.240684] flags: 0x57ffffc0800000(hwpoison|node=1|zone=2|lastcpupid=0x1fffff) + [ 1160.243458] raw: 0057ffffc0800000 dead000000000100 dead000000000122 0000000000000000 + [ 1160.246268] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000 + [ 1160.249197] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio)) + [ 1160.251815] ------------[ cut here ]------------ + [ 1160.253438] kernel BUG at include/linux/mm.h:788! + [ 1160.256162] invalid opcode: 0000 [#1] PREEMPT SMP PTI + [ 1160.258172] CPU: 2 PID: 115368 Comm: mceinj.sh Tainted: G E 5.18.0-rc1-v5.18-rc1-220404-2353-005-g83111+ #3 + [ 1160.262049] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1.fc35 04/01/2014 + [ 1160.265103] RIP: 0010:dump_page.cold+0x27e/0x2bd + [ 1160.266757] Code: fe ff ff 48 c7 c6 81 f1 5a 98 e9 4c fe ff ff 48 c7 c6 a1 95 59 98 e9 40 fe ff ff 48 c7 c6 50 bf 5a 98 48 89 ef e8 9d 04 6d ff <0f> 0b 41 f7 c4 ff 0f 00 00 0f 85 9f fd ff ff 49 8b 04 24 a9 00 00 + [ 1160.273180] RSP: 0018:ffffaa2c4d59fd18 EFLAGS: 00010292 + [ 1160.274969] RAX: 000000000000003e RBX: 0000000000000001 RCX: 0000000000000000 + [ 1160.277263] RDX: 0000000000000001 RSI: ffffffff985995a1 RDI: 00000000ffffffff + [ 1160.279571] RBP: ffffdc9c45a80000 R08: 0000000000000000 R09: 00000000ffffdfff + [ 1160.281794] R10: ffffaa2c4d59fb08 R11: ffffffff98940d08 R12: ffffdc9c45a80000 + [ 1160.283920] R13: ffffffff985b6f94 R14: 0000000000000000 R15: ffffdc9c45a80000 + [ 1160.286641] FS: 00007eff54ce1740(0000) GS:ffff99c67bd00000(0000) knlGS:0000000000000000 + [ 1160.289498] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [ 1160.291106] CR2: 00005628381a5f68 CR3: 0000000104712003 CR4: 0000000000170ee0 + [ 1160.293031] Call Trace: + [ 1160.293724] + [ 1160.294334] get_hwpoison_page+0x47d/0x570 + [ 1160.295474] memory_failure+0x106/0xaa0 + [ 1160.296474] ? security_capable+0x36/0x50 + [ 1160.297524] hard_offline_page_store+0x43/0x80 + [ 1160.298684] kernfs_fop_write_iter+0x11c/0x1b0 + [ 1160.299829] new_sync_write+0xf9/0x160 + [ 1160.300810] vfs_write+0x209/0x290 + [ 1160.301835] ksys_write+0x4f/0xc0 + [ 1160.302718] do_syscall_64+0x3b/0x90 + [ 1160.303664] entry_SYSCALL_64_after_hwframe+0x44/0xae + [ 1160.304981] RIP: 0033:0x7eff54b018b7 + +As shown in the RIP address, this VM_BUG_ON in folio_entire_mapcount() is +called from dump_page("hwpoison: unhandlable page") in get_any_page(). +The below explains the mechanism of the race: + + CPU 0 CPU 1 + + memory_failure + get_hwpoison_page + get_any_page + dump_page + compound = PageCompound + free_pages_prepare + page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP + folio_entire_mapcount + VM_BUG_ON_FOLIO(!folio_test_large(folio)) + +So replace dump_page() with safer one, pr_err(). + +Link: https://lkml.kernel.org/r/20220427053220.719866-1-naoya.horiguchi@linux.dev +Fixes: 74e8ee4708a8 ("mm: Turn head_compound_mapcount() into folio_entire_mapcount()") +Signed-off-by: Naoya Horiguchi +Reviewed-by: John Hubbard +Reviewed-by: Miaohe Lin +Cc: Matthew Wilcox +Cc: Christoph Hellwig +Cc: Jason Gunthorpe +Cc: William Kucharski +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + mm/memory-failure.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -1275,7 +1275,7 @@ try_again: + } + out: + if (ret == -EIO) +- dump_page(p, "hwpoison: unhandlable page"); ++ pr_err("Memory failure: %#lx: unhandlable page.\n", page_to_pfn(p)); + + return ret; + } diff --git a/queue-5.17/revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch b/queue-5.17/revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch new file mode 100644 index 00000000000..550587b3d86 --- /dev/null +++ b/queue-5.17/revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch @@ -0,0 +1,46 @@ +From a56f445f807b0276fc0660c330bf93a9ea78e8ea Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 10 May 2022 09:37:06 -0400 +Subject: Revert "drm/amd/pm: keep the BACO feature enabled for suspend" + +From: Alex Deucher + +commit a56f445f807b0276fc0660c330bf93a9ea78e8ea upstream. + +This reverts commit eaa090538e8d21801c6d5f94590c3799e6a528b5. + +Commit ebc002e3ee78 ("drm/amdgpu: don't use BACO for reset in S3") +stops using BACO for reset during suspend, so it's no longer +necessary to leave BACO enabled during suspend. This fixes +resume from suspend on the navy flounder dGPU in the ASUS ROG +Strix G513QY. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2008 +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1982 +Reviewed-by: Lijo Lazar +Reviewed-by: Mario Limonciello +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -1405,14 +1405,8 @@ static int smu_disable_dpms(struct smu_c + { + struct amdgpu_device *adev = smu->adev; + int ret = 0; +- /* +- * TODO: (adev->in_suspend && !adev->in_s0ix) is added to pair +- * the workaround which always reset the asic in suspend. +- * It's likely that workaround will be dropped in the future. +- * Then the change here should be dropped together. +- */ + bool use_baco = !smu->is_apu && +- (((amdgpu_in_reset(adev) || (adev->in_suspend && !adev->in_s0ix)) && ++ ((amdgpu_in_reset(adev) && + (amdgpu_asic_reset_method(adev) == AMD_RESET_METHOD_BACO)) || + ((adev->in_runpm || adev->in_s4) && amdgpu_asic_supports_baco(adev))); + diff --git a/queue-5.17/series b/queue-5.17/series index be6fea4af91..e3364cb64cb 100644 --- a/queue-5.17/series +++ b/queue-5.17/series @@ -107,3 +107,7 @@ arm-memremap-don-t-abuse-pfn_valid-to-ensure-presence-of-linear-map.patch net-phy-micrel-do-not-use-kszphy_suspend-resume-for-ksz8061.patch net-phy-micrel-pass-.probe-for-ks8737.patch sunrpc-ensure-that-the-gssproxy-client-can-start-in-a-connected-state.patch +drm-vmwgfx-initialize-drm_mode_fb_cmd2.patch +revert-drm-amd-pm-keep-the-baco-feature-enabled-for-suspend.patch +dma-buf-call-dma_buf_stats_setup-after-dmabuf-is-in-valid-list.patch +mm-hwpoison-use-pr_err-instead-of-dump_page-in-get_any_page.patch