From 4fdeb79104e65ba14dcfcdfccf8df7a27e2a61f6 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 24 Aug 2025 10:43:33 +0200 Subject: [PATCH] 5.10-stable patches added patches: dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch gpio-rcar-use-raw_spinlock-to-protect-register-access.patch selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch --- ...ions-for-extended-use-from-dm-zone.c.patch | 220 ++++++++++++++++++ ...-request-to-blk-mq-during-dm-suspend.patch | 45 ++++ ..._spinlock-to-protect-register-access.patch | 171 ++++++++++++++ ...-pm-check-flush-doesn-t-reset-limits.patch | 47 ++++ queue-5.10/series | 7 + ...-memory-leak-in-error-handling-paths.patch | 46 ++++ ...get-suspend-resume-to-avoid-deadlock.patch | 78 +++++++ ...locking-during-gadget-suspend-resume.patch | 64 +++++ 8 files changed, 678 insertions(+) create mode 100644 queue-5.10/dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch create mode 100644 queue-5.10/dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch create mode 100644 queue-5.10/gpio-rcar-use-raw_spinlock-to-protect-register-access.patch create mode 100644 queue-5.10/selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch create mode 100644 queue-5.10/uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch create mode 100644 queue-5.10/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch create mode 100644 queue-5.10/usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch diff --git a/queue-5.10/dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch b/queue-5.10/dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch new file mode 100644 index 0000000000..e7d2a73d29 --- /dev/null +++ b/queue-5.10/dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch @@ -0,0 +1,220 @@ +From e2118b3c3d94289852417f70ec128c25f4833aad Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Wed, 26 May 2021 06:24:59 +0900 +Subject: dm: rearrange core declarations for extended use from dm-zone.c + +From: Damien Le Moal + +commit e2118b3c3d94289852417f70ec128c25f4833aad upstream. + +Move the definitions of struct dm_target_io, struct dm_io and the bits +of the flags field of struct mapped_device from dm.c to dm-core.h to +make them usable from dm-zone.c. For the same reason, declare +dec_pending() in dm-core.h after renaming it to dm_io_dec_pending(). +And for symmetry of the function names, introduce the inline helper +dm_io_inc_pending() instead of directly using atomic_inc() calls. + +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Reviewed-by: Himanshu Madhani +Signed-off-by: Mike Snitzer +[Shivani: Modified to apply on 5.10.y] +Signed-off-by: Shivani Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-core.h | 52 ++++++++++++++++++++++++++++++++++++++++++++ + drivers/md/dm.c | 59 ++++++--------------------------------------------- + 2 files changed, 59 insertions(+), 52 deletions(-) + +--- a/drivers/md/dm-core.h ++++ b/drivers/md/dm-core.h +@@ -124,6 +124,19 @@ struct mapped_device { + struct srcu_struct io_barrier; + }; + ++/* ++ * Bits for the flags field of struct mapped_device. ++ */ ++#define DMF_BLOCK_IO_FOR_SUSPEND 0 ++#define DMF_SUSPENDED 1 ++#define DMF_FROZEN 2 ++#define DMF_FREEING 3 ++#define DMF_DELETING 4 ++#define DMF_NOFLUSH_SUSPENDING 5 ++#define DMF_DEFERRED_REMOVE 6 ++#define DMF_SUSPENDED_INTERNALLY 7 ++#define DMF_POST_SUSPENDING 8 ++ + void disable_discard(struct mapped_device *md); + void disable_write_same(struct mapped_device *md); + void disable_write_zeroes(struct mapped_device *md); +@@ -177,6 +190,45 @@ struct dm_table { + struct dm_md_mempools *mempools; + }; + ++/* ++ * One of these is allocated per clone bio. ++ */ ++#define DM_TIO_MAGIC 7282014 ++struct dm_target_io { ++ unsigned int magic; ++ struct dm_io *io; ++ struct dm_target *ti; ++ unsigned int target_bio_nr; ++ unsigned int *len_ptr; ++ bool inside_dm_io; ++ struct bio clone; ++}; ++ ++/* ++ * One of these is allocated per original bio. ++ * It contains the first clone used for that original. ++ */ ++#define DM_IO_MAGIC 5191977 ++struct dm_io { ++ unsigned int magic; ++ struct mapped_device *md; ++ blk_status_t status; ++ atomic_t io_count; ++ struct bio *orig_bio; ++ unsigned long start_time; ++ spinlock_t endio_lock; ++ struct dm_stats_aux stats_aux; ++ /* last member of dm_target_io is 'struct bio' */ ++ struct dm_target_io tio; ++}; ++ ++static inline void dm_io_inc_pending(struct dm_io *io) ++{ ++ atomic_inc(&io->io_count); ++} ++ ++void dm_io_dec_pending(struct dm_io *io, blk_status_t error); ++ + static inline struct completion *dm_get_completion_from_kobject(struct kobject *kobj) + { + return &container_of(kobj, struct dm_kobject_holder, kobj)->completion; +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -73,38 +73,6 @@ struct clone_info { + unsigned sector_count; + }; + +-/* +- * One of these is allocated per clone bio. +- */ +-#define DM_TIO_MAGIC 7282014 +-struct dm_target_io { +- unsigned magic; +- struct dm_io *io; +- struct dm_target *ti; +- unsigned target_bio_nr; +- unsigned *len_ptr; +- bool inside_dm_io; +- struct bio clone; +-}; +- +-/* +- * One of these is allocated per original bio. +- * It contains the first clone used for that original. +- */ +-#define DM_IO_MAGIC 5191977 +-struct dm_io { +- unsigned magic; +- struct mapped_device *md; +- blk_status_t status; +- atomic_t io_count; +- struct bio *orig_bio; +- unsigned long start_time; +- spinlock_t endio_lock; +- struct dm_stats_aux stats_aux; +- /* last member of dm_target_io is 'struct bio' */ +- struct dm_target_io tio; +-}; +- + void *dm_per_bio_data(struct bio *bio, size_t data_size) + { + struct dm_target_io *tio = container_of(bio, struct dm_target_io, clone); +@@ -132,19 +100,6 @@ EXPORT_SYMBOL_GPL(dm_bio_get_target_bio_ + + #define MINOR_ALLOCED ((void *)-1) + +-/* +- * Bits for the md->flags field. +- */ +-#define DMF_BLOCK_IO_FOR_SUSPEND 0 +-#define DMF_SUSPENDED 1 +-#define DMF_FROZEN 2 +-#define DMF_FREEING 3 +-#define DMF_DELETING 4 +-#define DMF_NOFLUSH_SUSPENDING 5 +-#define DMF_DEFERRED_REMOVE 6 +-#define DMF_SUSPENDED_INTERNALLY 7 +-#define DMF_POST_SUSPENDING 8 +- + #define DM_NUMA_NODE NUMA_NO_NODE + static int dm_numa_node = DM_NUMA_NODE; + +@@ -897,7 +852,7 @@ static int __noflush_suspending(struct m + * Decrements the number of outstanding ios that a bio has been + * cloned into, completing the original io if necc. + */ +-static void dec_pending(struct dm_io *io, blk_status_t error) ++void dm_io_dec_pending(struct dm_io *io, blk_status_t error) + { + unsigned long flags; + blk_status_t io_error; +@@ -1041,7 +996,7 @@ static void clone_endio(struct bio *bio) + } + + free_tio(tio); +- dec_pending(io, error); ++ dm_io_dec_pending(io, error); + } + + /* +@@ -1309,7 +1264,7 @@ static blk_qc_t __map_bio(struct dm_targ + * anything, the target has assumed ownership of + * this io. + */ +- atomic_inc(&io->io_count); ++ dm_io_inc_pending(io); + sector = clone->bi_iter.bi_sector; + + if (unlikely(swap_bios_limit(ti, clone))) { +@@ -1336,7 +1291,7 @@ static blk_qc_t __map_bio(struct dm_targ + up(&md->swap_bios_semaphore); + } + free_tio(tio); +- dec_pending(io, BLK_STS_IOERR); ++ dm_io_dec_pending(io, BLK_STS_IOERR); + break; + case DM_MAPIO_REQUEUE: + if (unlikely(swap_bios_limit(ti, clone))) { +@@ -1344,7 +1299,7 @@ static blk_qc_t __map_bio(struct dm_targ + up(&md->swap_bios_semaphore); + } + free_tio(tio); +- dec_pending(io, BLK_STS_DM_REQUEUE); ++ dm_io_dec_pending(io, BLK_STS_DM_REQUEUE); + break; + default: + DMWARN("unimplemented target map return value: %d", r); +@@ -1640,7 +1595,7 @@ static blk_qc_t __split_and_process_bio( + + if (bio->bi_opf & REQ_PREFLUSH) { + error = __send_empty_flush(&ci); +- /* dec_pending submits any data associated with flush */ ++ /* dm_io_dec_pending submits any data associated with flush */ + } else if (op_is_zone_mgmt(bio_op(bio))) { + ci.bio = bio; + ci.sector_count = 0; +@@ -1684,7 +1639,7 @@ static blk_qc_t __split_and_process_bio( + } + + /* drop the extra reference count */ +- dec_pending(ci.io, errno_to_blk_status(error)); ++ dm_io_dec_pending(ci.io, errno_to_blk_status(error)); + return ret; + } + diff --git a/queue-5.10/dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch b/queue-5.10/dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch new file mode 100644 index 0000000000..c03309ddcb --- /dev/null +++ b/queue-5.10/dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch @@ -0,0 +1,45 @@ +From b4459b11e84092658fa195a2587aff3b9637f0e7 Mon Sep 17 00:00:00 2001 +From: Ming Lei +Date: Thu, 23 Sep 2021 17:11:31 +0800 +Subject: dm rq: don't queue request to blk-mq during DM suspend + +From: Ming Lei + +commit b4459b11e84092658fa195a2587aff3b9637f0e7 upstream. + +DM uses blk-mq's quiesce/unquiesce to stop/start device mapper queue. + +But blk-mq's unquiesce may come from outside events, such as elevator +switch, updating nr_requests or others, and request may come during +suspend, so simply ask for blk-mq to requeue it. + +Fixes one kernel panic issue when running updating nr_requests and +dm-mpath suspend/resume stress test. + +Cc: stable@vger.kernel.org +Signed-off-by: Ming Lei +Signed-off-by: Mike Snitzer +[Shivani: Modified to apply on 5.10.y] +Signed-off-by: Shivani Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/dm-rq.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -490,6 +490,14 @@ static blk_status_t dm_mq_queue_rq(struc + struct mapped_device *md = tio->md; + struct dm_target *ti = md->immutable_target; + ++ /* ++ * blk-mq's unquiesce may come from outside events, such as ++ * elevator switch, updating nr_requests or others, and request may ++ * come during suspend, so simply ask for blk-mq to requeue it. ++ */ ++ if (unlikely(test_bit(DMF_BLOCK_IO_FOR_SUSPEND, &md->flags))) ++ return BLK_STS_RESOURCE; ++ + if (unlikely(!ti)) { + int srcu_idx; + struct dm_table *map; diff --git a/queue-5.10/gpio-rcar-use-raw_spinlock-to-protect-register-access.patch b/queue-5.10/gpio-rcar-use-raw_spinlock-to-protect-register-access.patch new file mode 100644 index 0000000000..5198865b34 --- /dev/null +++ b/queue-5.10/gpio-rcar-use-raw_spinlock-to-protect-register-access.patch @@ -0,0 +1,171 @@ +From f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Niklas=20S=C3=B6derlund?= + +Date: Tue, 21 Jan 2025 14:58:33 +0100 +Subject: gpio: rcar: Use raw_spinlock to protect register access +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +commit f02c41f87cfe61440c18bf77d1ef0a884b9ee2b5 upstream. + +Use raw_spinlock in order to fix spurious messages about invalid context +when spinlock debugging is enabled. The lock is only used to serialize +register access. + + [ 4.239592] ============================= + [ 4.239595] [ BUG: Invalid wait context ] + [ 4.239599] 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 Not tainted + [ 4.239603] ----------------------------- + [ 4.239606] kworker/u8:5/76 is trying to lock: + [ 4.239609] ffff0000091898a0 (&p->lock){....}-{3:3}, at: gpio_rcar_config_interrupt_input_mode+0x34/0x164 + [ 4.239641] other info that might help us debug this: + [ 4.239643] context-{5:5} + [ 4.239646] 5 locks held by kworker/u8:5/76: + [ 4.239651] #0: ffff0000080fb148 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x190/0x62c + [ 4.250180] OF: /soc/sound@ec500000/ports/port@0/endpoint: Read of boolean property 'frame-master' with a value. + [ 4.254094] #1: ffff80008299bd80 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1b8/0x62c + [ 4.254109] #2: ffff00000920c8f8 + [ 4.258345] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'bitclock-master' with a value. + [ 4.264803] (&dev->mutex){....}-{4:4}, at: __device_attach_async_helper+0x3c/0xdc + [ 4.264820] #3: ffff00000a50ca40 (request_class#2){+.+.}-{4:4}, at: __setup_irq+0xa0/0x690 + [ 4.264840] #4: + [ 4.268872] OF: /soc/sound@ec500000/ports/port@1/endpoint: Read of boolean property 'frame-master' with a value. + [ 4.273275] ffff00000a50c8c8 (lock_class){....}-{2:2}, at: __setup_irq+0xc4/0x690 + [ 4.296130] renesas_sdhi_internal_dmac ee100000.mmc: mmc1 base at 0x00000000ee100000, max clock rate 200 MHz + [ 4.304082] stack backtrace: + [ 4.304086] CPU: 1 UID: 0 PID: 76 Comm: kworker/u8:5 Not tainted 6.13.0-rc7-arm64-renesas-05496-gd088502a519f #35 + [ 4.304092] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT) + [ 4.304097] Workqueue: async async_run_entry_fn + [ 4.304106] Call trace: + [ 4.304110] show_stack+0x14/0x20 (C) + [ 4.304122] dump_stack_lvl+0x6c/0x90 + [ 4.304131] dump_stack+0x14/0x1c + [ 4.304138] __lock_acquire+0xdfc/0x1584 + [ 4.426274] lock_acquire+0x1c4/0x33c + [ 4.429942] _raw_spin_lock_irqsave+0x5c/0x80 + [ 4.434307] gpio_rcar_config_interrupt_input_mode+0x34/0x164 + [ 4.440061] gpio_rcar_irq_set_type+0xd4/0xd8 + [ 4.444422] __irq_set_trigger+0x5c/0x178 + [ 4.448435] __setup_irq+0x2e4/0x690 + [ 4.452012] request_threaded_irq+0xc4/0x190 + [ 4.456285] devm_request_threaded_irq+0x7c/0xf4 + [ 4.459398] ata1: link resume succeeded after 1 retries + [ 4.460902] mmc_gpiod_request_cd_irq+0x68/0xe0 + [ 4.470660] mmc_start_host+0x50/0xac + [ 4.474327] mmc_add_host+0x80/0xe4 + [ 4.477817] tmio_mmc_host_probe+0x2b0/0x440 + [ 4.482094] renesas_sdhi_probe+0x488/0x6f4 + [ 4.486281] renesas_sdhi_internal_dmac_probe+0x60/0x78 + [ 4.491509] platform_probe+0x64/0xd8 + [ 4.495178] really_probe+0xb8/0x2a8 + [ 4.498756] __driver_probe_device+0x74/0x118 + [ 4.503116] driver_probe_device+0x3c/0x154 + [ 4.507303] __device_attach_driver+0xd4/0x160 + [ 4.511750] bus_for_each_drv+0x84/0xe0 + [ 4.515588] __device_attach_async_helper+0xb0/0xdc + [ 4.520470] async_run_entry_fn+0x30/0xd8 + [ 4.524481] process_one_work+0x210/0x62c + [ 4.528494] worker_thread+0x1ac/0x340 + [ 4.532245] kthread+0x10c/0x110 + [ 4.535476] ret_from_fork+0x10/0x20 + +Signed-off-by: Niklas Söderlund +Reviewed-by: Geert Uytterhoeven +Tested-by: Geert Uytterhoeven +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20250121135833.3769310-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Bartosz Golaszewski +[PL: manullay applied the changes] +Signed-off-by: Lad Prabhakar +Reviewed-by: Pavel Machek # for 5.10-stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpio/gpio-rcar.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +--- a/drivers/gpio/gpio-rcar.c ++++ b/drivers/gpio/gpio-rcar.c +@@ -34,7 +34,7 @@ struct gpio_rcar_bank_info { + + struct gpio_rcar_priv { + void __iomem *base; +- spinlock_t lock; ++ raw_spinlock_t lock; + struct device *dev; + struct gpio_chip gpio_chip; + struct irq_chip irq_chip; +@@ -114,7 +114,7 @@ static void gpio_rcar_config_interrupt_i + * "Setting Level-Sensitive Interrupt Input Mode" + */ + +- spin_lock_irqsave(&p->lock, flags); ++ raw_spin_lock_irqsave(&p->lock, flags); + + /* Configure positive or negative logic in POSNEG */ + gpio_rcar_modify_bit(p, POSNEG, hwirq, !active_high_rising_edge); +@@ -133,7 +133,7 @@ static void gpio_rcar_config_interrupt_i + if (!level_trigger) + gpio_rcar_write(p, INTCLR, BIT(hwirq)); + +- spin_unlock_irqrestore(&p->lock, flags); ++ raw_spin_unlock_irqrestore(&p->lock, flags); + } + + static int gpio_rcar_irq_set_type(struct irq_data *d, unsigned int type) +@@ -226,7 +226,7 @@ static void gpio_rcar_config_general_inp + * "Setting General Input Mode" + */ + +- spin_lock_irqsave(&p->lock, flags); ++ raw_spin_lock_irqsave(&p->lock, flags); + + /* Configure positive logic in POSNEG */ + gpio_rcar_modify_bit(p, POSNEG, gpio, false); +@@ -241,7 +241,7 @@ static void gpio_rcar_config_general_inp + if (p->has_outdtsel && output) + gpio_rcar_modify_bit(p, OUTDTSEL, gpio, false); + +- spin_unlock_irqrestore(&p->lock, flags); ++ raw_spin_unlock_irqrestore(&p->lock, flags); + } + + static int gpio_rcar_request(struct gpio_chip *chip, unsigned offset) +@@ -310,9 +310,9 @@ static void gpio_rcar_set(struct gpio_ch + struct gpio_rcar_priv *p = gpiochip_get_data(chip); + unsigned long flags; + +- spin_lock_irqsave(&p->lock, flags); ++ raw_spin_lock_irqsave(&p->lock, flags); + gpio_rcar_modify_bit(p, OUTDT, offset, value); +- spin_unlock_irqrestore(&p->lock, flags); ++ raw_spin_unlock_irqrestore(&p->lock, flags); + } + + static void gpio_rcar_set_multiple(struct gpio_chip *chip, unsigned long *mask, +@@ -329,12 +329,12 @@ static void gpio_rcar_set_multiple(struc + if (!bankmask) + return; + +- spin_lock_irqsave(&p->lock, flags); ++ raw_spin_lock_irqsave(&p->lock, flags); + val = gpio_rcar_read(p, OUTDT); + val &= ~bankmask; + val |= (bankmask & bits[0]); + gpio_rcar_write(p, OUTDT, val); +- spin_unlock_irqrestore(&p->lock, flags); ++ raw_spin_unlock_irqrestore(&p->lock, flags); + } + + static int gpio_rcar_direction_output(struct gpio_chip *chip, unsigned offset, +@@ -454,7 +454,7 @@ static int gpio_rcar_probe(struct platfo + return -ENOMEM; + + p->dev = dev; +- spin_lock_init(&p->lock); ++ raw_spin_lock_init(&p->lock); + + /* Get device configuration from DT node */ + ret = gpio_rcar_parse_dt(p, &npins); diff --git a/queue-5.10/selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch b/queue-5.10/selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch new file mode 100644 index 0000000000..697c985db1 --- /dev/null +++ b/queue-5.10/selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch @@ -0,0 +1,47 @@ +From 452690be7de2f91cc0de68cb9e95252875b33503 Mon Sep 17 00:00:00 2001 +From: "Matthieu Baerts (NGI0)" +Date: Fri, 15 Aug 2025 19:28:21 +0200 +Subject: selftests: mptcp: pm: check flush doesn't reset limits + +From: Matthieu Baerts (NGI0) + +commit 452690be7de2f91cc0de68cb9e95252875b33503 upstream. + +This modification is linked to the parent commit where the received +ADD_ADDR limit was accidentally reset when the endpoints were flushed. + +To validate that, the test is now flushing endpoints after having set +new limits, and before checking them. + +The 'Fixes' tag here below is the same as the one from the previous +commit: this patch here is not fixing anything wrong in the selftests, +but it validates the previous fix for an issue introduced by this commit +ID. + +Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") +Cc: stable@vger.kernel.org +Reviewed-by: Mat Martineau +Signed-off-by: Matthieu Baerts (NGI0) +Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-3-521fe9957892@kernel.org +Signed-off-by: Jakub Kicinski +[ Conflicts in pm_netlink.sh, because some refactoring have been done + later on: commit 3188309c8ceb ("selftests: mptcp: netlink: + add 'limits' helpers") and commit c99d57d0007a ("selftests: mptcp: use + pm_nl endpoint ops") are not in this version. The same operation can + still be done at the same place, without using the new helper. ] +Signed-off-by: Matthieu Baerts (NGI0) +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/net/mptcp/pm_netlink.sh | 1 + + 1 file changed, 1 insertion(+) + +--- a/tools/testing/selftests/net/mptcp/pm_netlink.sh ++++ b/tools/testing/selftests/net/mptcp/pm_netlink.sh +@@ -130,6 +130,7 @@ ip netns exec $ns1 ./pm_nl_ctl limits 1 + check "ip netns exec $ns1 ./pm_nl_ctl limits" "$default_limits" "subflows above hard limit" + + ip netns exec $ns1 ./pm_nl_ctl limits 8 8 ++ip netns exec $ns1 ./pm_nl_ctl flush + check "ip netns exec $ns1 ./pm_nl_ctl limits" "accept 8 + subflows 8" "set limits" + diff --git a/queue-5.10/series b/queue-5.10/series index ca02c6efca..0108193c9b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -491,3 +491,10 @@ drm-dp-change-aux-dpcd-probe-address-from-dpcd_rev-to-lane0_1_status.patch media-qcom-camss-cleanup-media-device-allocated-resource-on-error-path.patch f2fs-fix-to-avoid-out-of-boundary-access-in-dnode-page.patch media-venus-vdec-clamp-param-smaller-than-1fps-and-bigger-than-240.patch +uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch +dm-rearrange-core-declarations-for-extended-use-from-dm-zone.c.patch +dm-rq-don-t-queue-request-to-blk-mq-during-dm-suspend.patch +usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch +usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch +gpio-rcar-use-raw_spinlock-to-protect-register-access.patch +selftests-mptcp-pm-check-flush-doesn-t-reset-limits.patch diff --git a/queue-5.10/uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch b/queue-5.10/uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch new file mode 100644 index 0000000000..7a121d0154 --- /dev/null +++ b/queue-5.10/uio_hv_generic-fix-another-memory-leak-in-error-handling-paths.patch @@ -0,0 +1,46 @@ +From 0b0226be3a52dadd965644bc52a807961c2c26df Mon Sep 17 00:00:00 2001 +From: Christophe JAILLET +Date: Sun, 9 May 2021 09:13:12 +0200 +Subject: uio_hv_generic: Fix another memory leak in error handling paths + +From: Christophe JAILLET + +commit 0b0226be3a52dadd965644bc52a807961c2c26df upstream. + +Memory allocated by 'vmbus_alloc_ring()' at the beginning of the probe +function is never freed in the error handling path. + +Add the missing 'vmbus_free_ring()' call. + +Note that it is already freed in the .remove function. + +Fixes: cdfa835c6e5e ("uio_hv_generic: defer opening vmbus until first use") +Cc: stable +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0d86027b8eeed8e6360bc3d52bcdb328ff9bdca1.1620544055.git.christophe.jaillet@wanadoo.fr +[Shivani: Modified to apply on 5.10.y] +Signed-off-by: Shivani Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/uio/uio_hv_generic.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -306,7 +306,7 @@ hv_uio_probe(struct hv_device *dev, + pdata->recv_buf = vzalloc(RECV_BUFFER_SIZE); + if (pdata->recv_buf == NULL) { + ret = -ENOMEM; +- goto fail_close; ++ goto fail_free_ring; + } + + ret = vmbus_establish_gpadl(channel, pdata->recv_buf, +@@ -366,6 +366,8 @@ hv_uio_probe(struct hv_device *dev, + + fail_close: + hv_uio_cleanup(dev, pdata); ++fail_free_ring: ++ vmbus_free_ring(dev->channel); + + return ret; + } diff --git a/queue-5.10/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch b/queue-5.10/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch new file mode 100644 index 0000000000..658c76b55d --- /dev/null +++ b/queue-5.10/usb-dwc3-core-remove-lock-of-otg-mode-during-gadget-suspend-resume-to-avoid-deadlock.patch @@ -0,0 +1,78 @@ +From 7838de15bb700c2898a7d741db9b1f3cbc86c136 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Tue, 18 Jun 2024 11:19:18 +0800 +Subject: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock + +From: Meng Li + +commit 7838de15bb700c2898a7d741db9b1f3cbc86c136 upstream. + +When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system +to enter suspend status with below command: +echo mem > /sys/power/state +There will be a deadlock issue occurring. Detailed invoking path as +below: +dwc3_suspend_common() + spin_lock_irqsave(&dwc->lock, flags); <-- 1st + dwc3_gadget_suspend(dwc); + dwc3_gadget_soft_disconnect(dwc); + spin_lock_irqsave(&dwc->lock, flags); <-- 2nd +This issue is exposed by commit c7ebd8149ee5 ("usb: dwc3: gadget: Fix +NULL pointer dereference in dwc3_gadget_suspend") that removes the code +of checking whether dwc->gadget_driver is NULL or not. It causes the +following code is executed and deadlock occurs when trying to get the +spinlock. In fact, the root cause is the commit 5265397f9442("usb: dwc3: +Remove DWC3 locking during gadget suspend/resume") that forgot to remove +the lock of otg mode. So, remove the redundant lock of otg mode during +gadget suspend/resume. + +Fixes: 5265397f9442 ("usb: dwc3: Remove DWC3 locking during gadget suspend/resume") +Cc: Xu Yang +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Acked-by: Thinh Nguyen +Link: https://lore.kernel.org/r/20240618031918.2585799-1-Meng.Li@windriver.com +Signed-off-by: Selvarasu Ganesan +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 6 ------ + 1 file changed, 6 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1735,7 +1735,6 @@ assert_reset: + + static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + u32 reg; + + switch (dwc->current_dr_role) { +@@ -1773,9 +1772,7 @@ static int dwc3_suspend_common(struct dw + break; + + if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + synchronize_irq(dwc->irq_gadget); + } + +@@ -1792,7 +1789,6 @@ static int dwc3_suspend_common(struct dw + + static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg) + { +- unsigned long flags; + int ret; + u32 reg; + +@@ -1841,9 +1837,7 @@ static int dwc3_resume_common(struct dwc + if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) { + dwc3_otg_host_init(dwc); + } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) { +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_resume(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + } + + break; diff --git a/queue-5.10/usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch b/queue-5.10/usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch new file mode 100644 index 0000000000..dcdd01244a --- /dev/null +++ b/queue-5.10/usb-dwc3-remove-dwc3-locking-during-gadget-suspend-resume.patch @@ -0,0 +1,64 @@ +From 5265397f94424eaea596026fd34dc7acf474dcec Mon Sep 17 00:00:00 2001 +From: Wesley Cheng +Date: Thu, 1 Sep 2022 12:36:22 -0700 +Subject: usb: dwc3: Remove DWC3 locking during gadget suspend/resume + +From: Wesley Cheng + +commit 5265397f94424eaea596026fd34dc7acf474dcec upstream. + +Remove the need for making dwc3_gadget_suspend() and dwc3_gadget_resume() +to be called in a spinlock, as dwc3_gadget_run_stop() could potentially +take some time to complete. + +Signed-off-by: Wesley Cheng +Link: https://lore.kernel.org/r/20220901193625.8727-3-quic_wcheng@quicinc.com +Signed-off-by: Selvarasu Ganesan +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/core.c | 4 ---- + drivers/usb/dwc3/gadget.c | 5 +++++ + 2 files changed, 5 insertions(+), 4 deletions(-) + +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -1742,9 +1742,7 @@ static int dwc3_suspend_common(struct dw + case DWC3_GCTL_PRTCAP_DEVICE: + if (pm_runtime_suspended(dwc->dev)) + break; +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_suspend(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + synchronize_irq(dwc->irq_gadget); + dwc3_core_exit(dwc); + break; +@@ -1805,9 +1803,7 @@ static int dwc3_resume_common(struct dwc + return ret; + + dwc3_set_prtcap(dwc, DWC3_GCTL_PRTCAP_DEVICE); +- spin_lock_irqsave(&dwc->lock, flags); + dwc3_gadget_resume(dwc); +- spin_unlock_irqrestore(&dwc->lock, flags); + break; + case DWC3_GCTL_PRTCAP_HOST: + if (!PMSG_IS_AUTO(msg)) { +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -4115,12 +4115,17 @@ void dwc3_gadget_exit(struct dwc3 *dwc) + + int dwc3_gadget_suspend(struct dwc3 *dwc) + { ++ unsigned long flags; ++ + if (!dwc->gadget_driver) + return 0; + + dwc3_gadget_run_stop(dwc, false, false); ++ ++ spin_lock_irqsave(&dwc->lock, flags); + dwc3_disconnect_gadget(dwc); + __dwc3_gadget_stop(dwc); ++ spin_unlock_irqrestore(&dwc->lock, flags); + + return 0; + } -- 2.47.3