From 8da4beba6bbab147a55d4ed91251a94d03fffd2e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 23 Jul 2019 12:24:59 +0200 Subject: [PATCH] 5.1-stable patches added patches: alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch alsa-hda-hdmi-remove-duplicated-define.patch alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch asoc-core-adapt-for-debugfs-api-change.patch asoc-dapm-adapt-for-debugfs-api-change.patch ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch media-videobuf2-dma-sg-prevent-size-from-overflowing.patch nfsv4-handle-the-special-linux-file-open-access-mode.patch pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch --- ...t-resume-forcibly-i915-hdmi-dp-codec.patch | 93 ++++++ ...mi-fix-i915-reverse-port-pin-mapping.patch | 69 +++++ ...sa-hda-hdmi-remove-duplicated-define.patch | 31 ++ ...91-headset-fixup-to-one-dell-machine.patch | 34 +++ ...ne-mic-can-t-record-on-dell-platform.patch | 37 +++ ...long-mutex-context-in-the-write-loop.patch | 73 +++++ ...rupt-tracing-in-the-presence-of-nmis.patch | 210 +++++++++++++ ...oc-core-adapt-for-debugfs-api-change.patch | 66 ++++ ...oc-dapm-adapt-for-debugfs-api-change.patch | 72 +++++ ...t-in-truncate_inode_pages_range-call.patch | 43 +++ ...-sg-offset-is-greater-than-page_size.patch | 57 ++++ ...unbalanced-and-unneeded-mutex-unlock.patch | 36 +++ ...-of-cfg-type-in-v4l2_ctrl_new_custom.patch | 47 +++ ...-alignment-wrapping-buffer-size-to-0.patch | 38 +++ ...dma-sg-prevent-size-from-overflowing.patch | 40 +++ ...-special-linux-file-open-access-mode.patch | 49 +++ ...usly-start-doing-i-o-through-the-mds.patch | 33 ++ ...ferences-in-ff_layout_track_ds_error.patch | 32 ++ ...part-job-after-adding-journal-device.patch | 56 ++++ ...imization-by-cache-mechanism-memleak.patch | 288 ++++++++++++++++++ queue-5.1/series | 21 ++ ...et-when-we-re-encode-the-rpc-request.patch | 63 ++++ 22 files changed, 1488 insertions(+) create mode 100644 queue-5.1/alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch create mode 100644 queue-5.1/alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch create mode 100644 queue-5.1/alsa-hda-hdmi-remove-duplicated-define.patch create mode 100644 queue-5.1/alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch create mode 100644 queue-5.1/alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch create mode 100644 queue-5.1/alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch create mode 100644 queue-5.1/arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch create mode 100644 queue-5.1/asoc-core-adapt-for-debugfs-api-change.patch create mode 100644 queue-5.1/asoc-dapm-adapt-for-debugfs-api-change.patch create mode 100644 queue-5.1/ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch create mode 100644 queue-5.1/lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch create mode 100644 queue-5.1/media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch create mode 100644 queue-5.1/media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch create mode 100644 queue-5.1/media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch create mode 100644 queue-5.1/media-videobuf2-dma-sg-prevent-size-from-overflowing.patch create mode 100644 queue-5.1/nfsv4-handle-the-special-linux-file-open-access-mode.patch create mode 100644 queue-5.1/pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch create mode 100644 queue-5.1/pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch create mode 100644 queue-5.1/raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch create mode 100644 queue-5.1/revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch create mode 100644 queue-5.1/sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch diff --git a/queue-5.1/alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch b/queue-5.1/alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch new file mode 100644 index 00000000000..7ca44dcacab --- /dev/null +++ b/queue-5.1/alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch @@ -0,0 +1,93 @@ +From 4914da2fb0c89205790503f20dfdde854f3afdd8 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 16 Jul 2019 08:56:51 +0200 +Subject: ALSA: hda - Don't resume forcibly i915 HDMI/DP codec + +From: Takashi Iwai + +commit 4914da2fb0c89205790503f20dfdde854f3afdd8 upstream. + +We apply the codec resume forcibly at system resume callback for +updating and syncing the jack detection state that may have changed +during sleeping. This is, however, superfluous for the codec like +Intel HDMI/DP, where the jack detection is managed via the audio +component notification; i.e. the jack state change shall be reported +sooner or later from the graphics side at mode change. + +This patch changes the codec resume callback to avoid the forcible +resume conditionally with a new flag, codec->relaxed_resume, for +reducing the resume time. The flag is set in the codec probe. + +Although this doesn't fix the entire bug mentioned in the bugzilla +entry below, it's still a good optimization and some improvements are +seen. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=201901 +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + include/sound/hda_codec.h | 2 ++ + sound/pci/hda/hda_codec.c | 8 ++++++-- + sound/pci/hda/patch_hdmi.c | 6 +++++- + 3 files changed, 13 insertions(+), 3 deletions(-) + +--- a/include/sound/hda_codec.h ++++ b/include/sound/hda_codec.h +@@ -262,6 +262,8 @@ struct hda_codec { + unsigned int auto_runtime_pm:1; /* enable automatic codec runtime pm */ + unsigned int force_pin_prefix:1; /* Add location prefix */ + unsigned int link_down_at_suspend:1; /* link down at runtime suspend */ ++ unsigned int relaxed_resume:1; /* don't resume forcibly for jack */ ++ + #ifdef CONFIG_PM + unsigned long power_on_acct; + unsigned long power_off_acct; +--- a/sound/pci/hda/hda_codec.c ++++ b/sound/pci/hda/hda_codec.c +@@ -2955,15 +2955,19 @@ static int hda_codec_runtime_resume(stru + #ifdef CONFIG_PM_SLEEP + static int hda_codec_force_resume(struct device *dev) + { ++ struct hda_codec *codec = dev_to_hda_codec(dev); ++ bool forced_resume = !codec->relaxed_resume; + int ret; + + /* The get/put pair below enforces the runtime resume even if the + * device hasn't been used at suspend time. This trick is needed to + * update the jack state change during the sleep. + */ +- pm_runtime_get_noresume(dev); ++ if (forced_resume) ++ pm_runtime_get_noresume(dev); + ret = pm_runtime_force_resume(dev); +- pm_runtime_put(dev); ++ if (forced_resume) ++ pm_runtime_put(dev); + return ret; + } + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2304,8 +2304,10 @@ static void generic_hdmi_free(struct hda + struct hdmi_spec *spec = codec->spec; + int pin_idx, pcm_idx; + +- if (codec_has_acomp(codec)) ++ if (codec_has_acomp(codec)) { + snd_hdac_acomp_register_notifier(&codec->bus->core, NULL); ++ codec->relaxed_resume = 0; ++ } + + for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) { + struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx); +@@ -2578,6 +2580,8 @@ static void register_i915_notifier(struc + spec->drm_audio_ops.pin_eld_notify = intel_pin_eld_notify; + snd_hdac_acomp_register_notifier(&codec->bus->core, + &spec->drm_audio_ops); ++ /* no need for forcible resume for jack check thanks to notifier */ ++ codec->relaxed_resume = 1; + } + + /* setup_stream ops override for HSW+ */ diff --git a/queue-5.1/alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch b/queue-5.1/alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch new file mode 100644 index 00000000000..b7d54ea3478 --- /dev/null +++ b/queue-5.1/alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch @@ -0,0 +1,69 @@ +From 3140aafb22edeab0cc41f15f53b12a118c0ac215 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 15 Jul 2019 23:14:53 +0200 +Subject: ALSA: hda/hdmi - Fix i915 reverse port/pin mapping + +From: Takashi Iwai + +commit 3140aafb22edeab0cc41f15f53b12a118c0ac215 upstream. + +The recent fix for Icelake HDMI codec introduced the mapping from pin +NID to the i915 gfx port number. However, it forgot the reverse +mapping from the port number to the pin NID that is used in the ELD +notifier callback. As a result, it's processed to a wrong widget and +gives a warning like + snd_hda_codec_hdmi hdaudioC0D2: HDMI: pin nid 5 not registered + +This patch corrects it with a proper reverse mapping function. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=204133 +Fixes: b0d8bc50b9f2 ("ALSA: hda: hdmi - add Icelake support") +Reviewed-by: Kai Vehmanen +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2538,18 +2538,32 @@ static int intel_pin2port(void *audio_pt + return -1; + } + ++static int intel_port2pin(struct hda_codec *codec, int port) ++{ ++ struct hdmi_spec *spec = codec->spec; ++ ++ if (!spec->port_num) { ++ /* we assume only from port-B to port-D */ ++ if (port < 1 || port > 3) ++ return 0; ++ /* intel port is 1-based */ ++ return port + intel_base_nid(codec) - 1; ++ } ++ ++ if (port < 1 || port > spec->port_num) ++ return 0; ++ return spec->port_map[port - 1]; ++} ++ + static void intel_pin_eld_notify(void *audio_ptr, int port, int pipe) + { + struct hda_codec *codec = audio_ptr; + int pin_nid; + int dev_id = pipe; + +- /* we assume only from port-B to port-D */ +- if (port < 1 || port > 3) ++ pin_nid = intel_port2pin(codec, port); ++ if (!pin_nid) + return; +- +- pin_nid = port + intel_base_nid(codec) - 1; /* intel port is 1-based */ +- + /* skip notification during system suspend (but not in runtime PM); + * the state will be updated at resume + */ diff --git a/queue-5.1/alsa-hda-hdmi-remove-duplicated-define.patch b/queue-5.1/alsa-hda-hdmi-remove-duplicated-define.patch new file mode 100644 index 00000000000..42779914984 --- /dev/null +++ b/queue-5.1/alsa-hda-hdmi-remove-duplicated-define.patch @@ -0,0 +1,31 @@ +From eb4177116bf568a413c544eca3f4446cb4064be9 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 15 Jul 2019 23:12:13 +0200 +Subject: ALSA: hda/hdmi - Remove duplicated define + +From: Takashi Iwai + +commit eb4177116bf568a413c544eca3f4446cb4064be9 upstream. + +INTEL_GET_VENDOR_VERB is defined twice identically. +Let's remove a superfluous line. + +Fixes: b0d8bc50b9f2 ("ALSA: hda: hdmi - add Icelake support") +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_hdmi.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2431,7 +2431,6 @@ static void intel_haswell_fixup_connect_ + } + + #define INTEL_GET_VENDOR_VERB 0xf81 +-#define INTEL_GET_VENDOR_VERB 0xf81 + #define INTEL_SET_VENDOR_VERB 0x781 + #define INTEL_EN_DP12 0x02 /* enable DP 1.2 features */ + #define INTEL_EN_ALL_PIN_CVTS 0x01 /* enable 2nd & 3rd pins and convertors */ diff --git a/queue-5.1/alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch b/queue-5.1/alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch new file mode 100644 index 00000000000..f8e63bbcb71 --- /dev/null +++ b/queue-5.1/alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch @@ -0,0 +1,34 @@ +From 4b4e0e32e4b09274dbc9d173016c1a026f44608c Mon Sep 17 00:00:00 2001 +From: Hui Wang +Date: Tue, 16 Jul 2019 15:21:34 +0800 +Subject: ALSA: hda/realtek: apply ALC891 headset fixup to one Dell machine + +From: Hui Wang + +commit 4b4e0e32e4b09274dbc9d173016c1a026f44608c upstream. + +Without this patch, the headset-mic and headphone-mic don't work. + +Cc: +Signed-off-by: Hui Wang +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -8754,6 +8754,11 @@ static const struct snd_hda_pin_quirk al + {0x18, 0x01a19030}, + {0x1a, 0x01813040}, + {0x21, 0x01014020}), ++ SND_HDA_PIN_QUIRK(0x10ec0867, 0x1028, "Dell", ALC891_FIXUP_DELL_MIC_NO_PRESENCE, ++ {0x16, 0x01813030}, ++ {0x17, 0x02211010}, ++ {0x18, 0x01a19040}, ++ {0x21, 0x01014020}), + SND_HDA_PIN_QUIRK(0x10ec0662, 0x1028, "Dell", ALC662_FIXUP_DELL_MIC_NO_PRESENCE, + {0x14, 0x01014010}, + {0x18, 0x01a19020}, diff --git a/queue-5.1/alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch b/queue-5.1/alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch new file mode 100644 index 00000000000..41fc7f9a4d1 --- /dev/null +++ b/queue-5.1/alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch @@ -0,0 +1,37 @@ +From fbc571290d9f7bfe089c50f4ac4028dd98ebfe98 Mon Sep 17 00:00:00 2001 +From: Kailang Yang +Date: Mon, 15 Jul 2019 10:41:50 +0800 +Subject: ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform + +From: Kailang Yang + +commit fbc571290d9f7bfe089c50f4ac4028dd98ebfe98 upstream. + +It assigned to wrong model. So, The headphone Mic can't work. + +Fixes: 3f640970a414 ("ALSA: hda - Fix headset mic detection problem for several Dell laptops") +Signed-off-by: Kailang Yang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/hda/patch_realtek.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7614,9 +7614,12 @@ static const struct snd_hda_pin_quirk al + {0x12, 0x90a60130}, + {0x17, 0x90170110}, + {0x21, 0x03211020}), +- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, + {0x14, 0x90170110}, + {0x21, 0x04211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, ++ {0x14, 0x90170110}, ++ {0x21, 0x04211030}), + SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC295_STANDARD_PINS, + {0x17, 0x21014020}, diff --git a/queue-5.1/alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch b/queue-5.1/alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch new file mode 100644 index 00000000000..e05601c61b1 --- /dev/null +++ b/queue-5.1/alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch @@ -0,0 +1,73 @@ +From ede34f397ddb063b145b9e7d79c6026f819ded13 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 15 Jul 2019 22:50:27 +0200 +Subject: ALSA: seq: Break too long mutex context in the write loop + +From: Takashi Iwai + +commit ede34f397ddb063b145b9e7d79c6026f819ded13 upstream. + +The fix for the racy writes and ioctls to sequencer widened the +application of client->ioctl_mutex to the whole write loop. Although +it does unlock/relock for the lengthy operation like the event dup, +the loop keeps the ioctl_mutex for the whole time in other +situations. This may take quite long time if the user-space would +give a huge buffer, and this is a likely cause of some weird behavior +spotted by syzcaller fuzzer. + +This patch puts a simple workaround, just adding a mutex break in the +loop when a large number of events have been processed. This +shouldn't hit any performance drop because the threshold is set high +enough for usual operations. + +Fixes: 7bd800915677 ("ALSA: seq: More protection for concurrent write and ioctl races") +Reported-by: syzbot+97aae04ce27e39cbfca9@syzkaller.appspotmail.com +Reported-by: syzbot+4c595632b98bb8ffcc66@syzkaller.appspotmail.com +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/seq/seq_clientmgr.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -1004,7 +1004,7 @@ static ssize_t snd_seq_write(struct file + { + struct snd_seq_client *client = file->private_data; + int written = 0, len; +- int err; ++ int err, handled; + struct snd_seq_event event; + + if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT)) +@@ -1017,6 +1017,8 @@ static ssize_t snd_seq_write(struct file + if (!client->accept_output || client->pool == NULL) + return -ENXIO; + ++ repeat: ++ handled = 0; + /* allocate the pool now if the pool is not allocated yet */ + mutex_lock(&client->ioctl_mutex); + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +@@ -1076,12 +1078,19 @@ static ssize_t snd_seq_write(struct file + 0, 0, &client->ioctl_mutex); + if (err < 0) + break; ++ handled++; + + __skip_event: + /* Update pointers and counts */ + count -= len; + buf += len; + written += len; ++ ++ /* let's have a coffee break if too many events are queued */ ++ if (++handled >= 200) { ++ mutex_unlock(&client->ioctl_mutex); ++ goto repeat; ++ } + } + + out: diff --git a/queue-5.1/arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch b/queue-5.1/arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch new file mode 100644 index 00000000000..906ba073461 --- /dev/null +++ b/queue-5.1/arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch @@ -0,0 +1,210 @@ +From 17ce302f3117e9518395847a3120c8a108b587b8 Mon Sep 17 00:00:00 2001 +From: Julien Thierry +Date: Tue, 11 Jun 2019 10:38:09 +0100 +Subject: arm64: Fix interrupt tracing in the presence of NMIs + +From: Julien Thierry + +commit 17ce302f3117e9518395847a3120c8a108b587b8 upstream. + +In the presence of any form of instrumentation, nmi_enter() should be +done before calling any traceable code and any instrumentation code. + +Currently, nmi_enter() is done in handle_domain_nmi(), which is much +too late as instrumentation code might get called before. Move the +nmi_enter/exit() calls to the arch IRQ vector handler. + +On arm64, it is not possible to know if the IRQ vector handler was +called because of an NMI before acknowledging the interrupt. However, It +is possible to know whether normal interrupts could be taken in the +interrupted context (i.e. if taking an NMI in that context could +introduce a potential race condition). + +When interrupting a context with IRQs disabled, call nmi_enter() as soon +as possible. In contexts with IRQs enabled, defer this to the interrupt +controller, which is in a better position to know if an interrupt taken +is an NMI. + +Fixes: bc3c03ccb464 ("arm64: Enable the support of pseudo-NMIs") +Cc: # 5.1.x- +Cc: Will Deacon +Cc: Thomas Gleixner +Cc: Jason Cooper +Cc: Mark Rutland +Reviewed-by: Marc Zyngier +Signed-off-by: Julien Thierry +Signed-off-by: Catalin Marinas +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/kernel/entry.S | 44 ++++++++++++++++++++++++++++++++----------- + arch/arm64/kernel/irq.c | 17 ++++++++++++++++ + drivers/irqchip/irq-gic-v3.c | 7 ++++++ + kernel/irq/irqdesc.c | 8 +++++-- + 4 files changed, 63 insertions(+), 13 deletions(-) + +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -420,6 +420,20 @@ tsk .req x28 // current thread_info + irq_stack_exit + .endm + ++#ifdef CONFIG_ARM64_PSEUDO_NMI ++ /* ++ * Set res to 0 if irqs were unmasked in interrupted context. ++ * Otherwise set res to non-0 value. ++ */ ++ .macro test_irqs_unmasked res:req, pmr:req ++alternative_if ARM64_HAS_IRQ_PRIO_MASKING ++ sub \res, \pmr, #GIC_PRIO_IRQON ++alternative_else ++ mov \res, xzr ++alternative_endif ++ .endm ++#endif ++ + .text + + /* +@@ -616,19 +630,19 @@ ENDPROC(el1_sync) + el1_irq: + kernel_entry 1 + enable_da_f +-#ifdef CONFIG_TRACE_IRQFLAGS ++ + #ifdef CONFIG_ARM64_PSEUDO_NMI + alternative_if ARM64_HAS_IRQ_PRIO_MASKING + ldr x20, [sp, #S_PMR_SAVE] +-alternative_else +- mov x20, #GIC_PRIO_IRQON +-alternative_endif +- cmp x20, #GIC_PRIO_IRQOFF +- /* Irqs were disabled, don't trace */ +- b.ls 1f ++alternative_else_nop_endif ++ test_irqs_unmasked res=x0, pmr=x20 ++ cbz x0, 1f ++ bl asm_nmi_enter ++1: + #endif ++ ++#ifdef CONFIG_TRACE_IRQFLAGS + bl trace_hardirqs_off +-1: + #endif + + irq_handler +@@ -647,14 +661,22 @@ alternative_else_nop_endif + bl preempt_schedule_irq // irq en/disable is done inside + 1: + #endif +-#ifdef CONFIG_TRACE_IRQFLAGS ++ + #ifdef CONFIG_ARM64_PSEUDO_NMI + /* + * if IRQs were disabled when we received the interrupt, we have an NMI + * and we are not re-enabling interrupt upon eret. Skip tracing. + */ +- cmp x20, #GIC_PRIO_IRQOFF +- b.ls 1f ++ test_irqs_unmasked res=x0, pmr=x20 ++ cbz x0, 1f ++ bl asm_nmi_exit ++1: ++#endif ++ ++#ifdef CONFIG_TRACE_IRQFLAGS ++#ifdef CONFIG_ARM64_PSEUDO_NMI ++ test_irqs_unmasked res=x0, pmr=x20 ++ cbnz x0, 1f + #endif + bl trace_hardirqs_on + 1: +--- a/arch/arm64/kernel/irq.c ++++ b/arch/arm64/kernel/irq.c +@@ -27,8 +27,10 @@ + #include + #include + #include ++#include + #include + #include ++#include + #include + + unsigned long irq_err_count; +@@ -76,3 +78,18 @@ void __init init_IRQ(void) + if (!handle_arch_irq) + panic("No interrupt controller found."); + } ++ ++/* ++ * Stubs to make nmi_enter/exit() code callable from ASM ++ */ ++asmlinkage void notrace asm_nmi_enter(void) ++{ ++ nmi_enter(); ++} ++NOKPROBE_SYMBOL(asm_nmi_enter); ++ ++asmlinkage void notrace asm_nmi_exit(void) ++{ ++ nmi_exit(); ++} ++NOKPROBE_SYMBOL(asm_nmi_exit); +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -472,8 +472,12 @@ static void gic_deactivate_unhandled(u32 + + static inline void gic_handle_nmi(u32 irqnr, struct pt_regs *regs) + { ++ bool irqs_enabled = interrupts_enabled(regs); + int err; + ++ if (irqs_enabled) ++ nmi_enter(); ++ + if (static_branch_likely(&supports_deactivate_key)) + gic_write_eoir(irqnr); + /* +@@ -485,6 +489,9 @@ static inline void gic_handle_nmi(u32 ir + err = handle_domain_nmi(gic_data.domain, irqnr, regs); + if (err) + gic_deactivate_unhandled(irqnr); ++ ++ if (irqs_enabled) ++ nmi_exit(); + } + + static asmlinkage void __exception_irq_entry gic_handle_irq(struct pt_regs *regs) +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -679,6 +679,8 @@ int __handle_domain_irq(struct irq_domai + * @hwirq: The HW irq number to convert to a logical one + * @regs: Register file coming from the low-level handling code + * ++ * This function must be called from an NMI context. ++ * + * Returns: 0 on success, or -EINVAL if conversion has failed + */ + int handle_domain_nmi(struct irq_domain *domain, unsigned int hwirq, +@@ -688,7 +690,10 @@ int handle_domain_nmi(struct irq_domain + unsigned int irq; + int ret = 0; + +- nmi_enter(); ++ /* ++ * NMI context needs to be setup earlier in order to deal with tracing. ++ */ ++ WARN_ON(!in_nmi()); + + irq = irq_find_mapping(domain, hwirq); + +@@ -701,7 +706,6 @@ int handle_domain_nmi(struct irq_domain + else + ret = -EINVAL; + +- nmi_exit(); + set_irq_regs(old_regs); + return ret; + } diff --git a/queue-5.1/asoc-core-adapt-for-debugfs-api-change.patch b/queue-5.1/asoc-core-adapt-for-debugfs-api-change.patch new file mode 100644 index 00000000000..9fc9e34865a --- /dev/null +++ b/queue-5.1/asoc-core-adapt-for-debugfs-api-change.patch @@ -0,0 +1,66 @@ +From c2c928c93173f220955030e8440517b87ec7df92 Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Fri, 21 Jun 2019 12:33:56 +0100 +Subject: ASoC: core: Adapt for debugfs API change + +From: Mark Brown + +commit c2c928c93173f220955030e8440517b87ec7df92 upstream. + +Back in ff9fb72bc07705c (debugfs: return error values, not NULL) the +debugfs APIs were changed to return error pointers rather than NULL +pointers on error, breaking the error checking in ASoC. Update the +code to use IS_ERR() and log the codes that are returned as part of +the error messages. + +Fixes: ff9fb72bc07705c (debugfs: return error values, not NULL) +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-core.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -158,9 +158,10 @@ static void soc_init_component_debugfs(s + component->card->debugfs_card_root); + } + +- if (!component->debugfs_root) { ++ if (IS_ERR(component->debugfs_root)) { + dev_warn(component->dev, +- "ASoC: Failed to create component debugfs directory\n"); ++ "ASoC: Failed to create component debugfs directory: %ld\n", ++ PTR_ERR(component->debugfs_root)); + return; + } + +@@ -212,18 +213,21 @@ static void soc_init_card_debugfs(struct + + card->debugfs_card_root = debugfs_create_dir(card->name, + snd_soc_debugfs_root); +- if (!card->debugfs_card_root) { ++ if (IS_ERR(card->debugfs_card_root)) { + dev_warn(card->dev, +- "ASoC: Failed to create card debugfs directory\n"); ++ "ASoC: Failed to create card debugfs directory: %ld\n", ++ PTR_ERR(card->debugfs_card_root)); ++ card->debugfs_card_root = NULL; + return; + } + + card->debugfs_pop_time = debugfs_create_u32("dapm_pop_time", 0644, + card->debugfs_card_root, + &card->pop_time); +- if (!card->debugfs_pop_time) ++ if (IS_ERR(card->debugfs_pop_time)) + dev_warn(card->dev, +- "ASoC: Failed to create pop time debugfs file\n"); ++ "ASoC: Failed to create pop time debugfs file: %ld\n", ++ PTR_ERR(card->debugfs_pop_time)); + } + + static void soc_cleanup_card_debugfs(struct snd_soc_card *card) diff --git a/queue-5.1/asoc-dapm-adapt-for-debugfs-api-change.patch b/queue-5.1/asoc-dapm-adapt-for-debugfs-api-change.patch new file mode 100644 index 00000000000..5e0f0698a7b --- /dev/null +++ b/queue-5.1/asoc-dapm-adapt-for-debugfs-api-change.patch @@ -0,0 +1,72 @@ +From ceaea851b9ea75f9ea2bbefb53ff0d4b27cd5a6e Mon Sep 17 00:00:00 2001 +From: Mark Brown +Date: Fri, 21 Jun 2019 12:33:57 +0100 +Subject: ASoC: dapm: Adapt for debugfs API change + +From: Mark Brown + +commit ceaea851b9ea75f9ea2bbefb53ff0d4b27cd5a6e upstream. + +Back in ff9fb72bc07705c (debugfs: return error values, not NULL) the +debugfs APIs were changed to return error pointers rather than NULL +pointers on error, breaking the error checking in ASoC. Update the +code to use IS_ERR() and log the codes that are returned as part of +the error messages. + +Fixes: ff9fb72bc07705c (debugfs: return error values, not NULL) +Signed-off-by: Mark Brown +Cc: stable@vger.kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2154,23 +2154,25 @@ void snd_soc_dapm_debugfs_init(struct sn + { + struct dentry *d; + +- if (!parent) ++ if (!parent || IS_ERR(parent)) + return; + + dapm->debugfs_dapm = debugfs_create_dir("dapm", parent); + +- if (!dapm->debugfs_dapm) { ++ if (IS_ERR(dapm->debugfs_dapm)) { + dev_warn(dapm->dev, +- "ASoC: Failed to create DAPM debugfs directory\n"); ++ "ASoC: Failed to create DAPM debugfs directory %ld\n", ++ PTR_ERR(dapm->debugfs_dapm)); + return; + } + + d = debugfs_create_file("bias_level", 0444, + dapm->debugfs_dapm, dapm, + &dapm_bias_fops); +- if (!d) ++ if (IS_ERR(d)) + dev_warn(dapm->dev, +- "ASoC: Failed to create bias level debugfs file\n"); ++ "ASoC: Failed to create bias level debugfs file: %ld\n", ++ PTR_ERR(d)); + } + + static void dapm_debugfs_add_widget(struct snd_soc_dapm_widget *w) +@@ -2184,10 +2186,10 @@ static void dapm_debugfs_add_widget(stru + d = debugfs_create_file(w->name, 0444, + dapm->debugfs_dapm, w, + &dapm_widget_power_fops); +- if (!d) ++ if (IS_ERR(d)) + dev_warn(w->dapm->dev, +- "ASoC: Failed to create %s debugfs file\n", +- w->name); ++ "ASoC: Failed to create %s debugfs file: %ld\n", ++ w->name, PTR_ERR(d)); + } + + static void dapm_debugfs_cleanup(struct snd_soc_dapm_context *dapm) diff --git a/queue-5.1/ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch b/queue-5.1/ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch new file mode 100644 index 00000000000..1005fac407e --- /dev/null +++ b/queue-5.1/ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch @@ -0,0 +1,43 @@ +From d31d07b97a5e76f41e00eb81dcca740e84aa7782 Mon Sep 17 00:00:00 2001 +From: Luis Henriques +Date: Mon, 1 Jul 2019 18:16:34 +0100 +Subject: ceph: fix end offset in truncate_inode_pages_range call + +From: Luis Henriques + +commit d31d07b97a5e76f41e00eb81dcca740e84aa7782 upstream. + +Commit e450f4d1a5d6 ("ceph: pass inclusive lend parameter to +filemap_write_and_wait_range()") fixed the end offset parameter used to +call filemap_write_and_wait_range and invalidate_inode_pages2_range. +Unfortunately it missed truncate_inode_pages_range, introducing a +regression that is easily detected by xfstest generic/130. + +The problem is that when doing direct IO it is possible that an extra page +is truncated from the page cache when the end offset is page aligned. +This can cause data loss if that page hasn't been sync'ed to the OSDs. + +While there, change code to use PAGE_ALIGN macro instead. + +Cc: stable@vger.kernel.org +Fixes: e450f4d1a5d6 ("ceph: pass inclusive lend parameter to filemap_write_and_wait_range()") +Signed-off-by: Luis Henriques +Reviewed-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ceph/file.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -1006,7 +1006,7 @@ ceph_direct_read_write(struct kiocb *ioc + * may block. + */ + truncate_inode_pages_range(inode->i_mapping, pos, +- (pos+len) | (PAGE_SIZE - 1)); ++ PAGE_ALIGN(pos + len) - 1); + + req->r_mtime = mtime; + } diff --git a/queue-5.1/lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch b/queue-5.1/lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch new file mode 100644 index 00000000000..465a26fed4c --- /dev/null +++ b/queue-5.1/lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch @@ -0,0 +1,57 @@ +From aeb87246537a83c2aff482f3f34a2e0991e02cbc Mon Sep 17 00:00:00 2001 +From: Christophe Leroy +Date: Mon, 24 Jun 2019 07:20:14 +0000 +Subject: lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGE_SIZE + +From: Christophe Leroy + +commit aeb87246537a83c2aff482f3f34a2e0991e02cbc upstream. + +All mapping iterator logic is based on the assumption that sg->offset +is always lower than PAGE_SIZE. + +But there are situations where sg->offset is such that the SG item +is on the second page. In that case sg_copy_to_buffer() fails +properly copying the data into the buffer. One of the reason is +that the data will be outside the kmapped area used to access that +data. + +This patch fixes the issue by adjusting the mapping iterator +offset and pgoffset fields such that offset is always lower than +PAGE_SIZE. + +Signed-off-by: Christophe Leroy +Fixes: 4225fc8555a9 ("lib/scatterlist: use page iterator in the mapping iterator") +Cc: stable@vger.kernel.org +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman + +--- + lib/scatterlist.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/lib/scatterlist.c ++++ b/lib/scatterlist.c +@@ -678,17 +678,18 @@ static bool sg_miter_get_next_page(struc + { + if (!miter->__remaining) { + struct scatterlist *sg; +- unsigned long pgoffset; + + if (!__sg_page_iter_next(&miter->piter)) + return false; + + sg = miter->piter.sg; +- pgoffset = miter->piter.sg_pgoffset; + +- miter->__offset = pgoffset ? 0 : sg->offset; ++ miter->__offset = miter->piter.sg_pgoffset ? 0 : sg->offset; ++ miter->piter.sg_pgoffset += miter->__offset >> PAGE_SHIFT; ++ miter->__offset &= PAGE_SIZE - 1; + miter->__remaining = sg->offset + sg->length - +- (pgoffset << PAGE_SHIFT) - miter->__offset; ++ (miter->piter.sg_pgoffset << PAGE_SHIFT) - ++ miter->__offset; + miter->__remaining = min_t(unsigned long, miter->__remaining, + PAGE_SIZE - miter->__offset); + } diff --git a/queue-5.1/media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch b/queue-5.1/media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch new file mode 100644 index 00000000000..44ec52cf777 --- /dev/null +++ b/queue-5.1/media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch @@ -0,0 +1,36 @@ +From 766b9b168f6c75c350dd87c3e0bc6a9b322f0013 Mon Sep 17 00:00:00 2001 +From: Ezequiel Garcia +Date: Thu, 2 May 2019 18:00:43 -0400 +Subject: media: coda: Remove unbalanced and unneeded mutex unlock + +From: Ezequiel Garcia + +commit 766b9b168f6c75c350dd87c3e0bc6a9b322f0013 upstream. + +The mutex unlock in the threaded interrupt handler is not paired +with any mutex lock. Remove it. + +This bug has been here for a really long time, so it applies +to any stable repo. + +Reviewed-by: Philipp Zabel +Signed-off-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Cc: stable@vger.kernel.org +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/platform/coda/coda-bit.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/media/platform/coda/coda-bit.c ++++ b/drivers/media/platform/coda/coda-bit.c +@@ -2314,7 +2314,6 @@ irqreturn_t coda_irq_handler(int irq, vo + if (ctx == NULL) { + v4l2_err(&dev->v4l2_dev, + "Instance released before the end of transaction\n"); +- mutex_unlock(&dev->coda_mutex); + return IRQ_HANDLED; + } + diff --git a/queue-5.1/media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch b/queue-5.1/media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch new file mode 100644 index 00000000000..079f8bfa94a --- /dev/null +++ b/queue-5.1/media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch @@ -0,0 +1,47 @@ +From 07d89227a983df957a6a7c56f7c040cde9ac571f Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Wed, 19 Jun 2019 05:21:33 -0400 +Subject: media: v4l2: Test type instead of cfg->type in v4l2_ctrl_new_custom() + +From: Boris Brezillon + +commit 07d89227a983df957a6a7c56f7c040cde9ac571f upstream. + +cfg->type can be overridden by v4l2_ctrl_fill() and the new value is +stored in the local type var. Fix the tests to use this local var. + +Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework") +Cc: +Signed-off-by: Boris Brezillon +[hverkuil-cisco@xs4all.nl: change to !qmenu and !qmenu_int (checkpatch)] +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/v4l2-core/v4l2-ctrls.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/media/v4l2-core/v4l2-ctrls.c ++++ b/drivers/media/v4l2-core/v4l2-ctrls.c +@@ -2365,16 +2365,15 @@ struct v4l2_ctrl *v4l2_ctrl_new_custom(s + v4l2_ctrl_fill(cfg->id, &name, &type, &min, &max, &step, + &def, &flags); + +- is_menu = (cfg->type == V4L2_CTRL_TYPE_MENU || +- cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU); ++ is_menu = (type == V4L2_CTRL_TYPE_MENU || ++ type == V4L2_CTRL_TYPE_INTEGER_MENU); + if (is_menu) + WARN_ON(step); + else + WARN_ON(cfg->menu_skip_mask); +- if (cfg->type == V4L2_CTRL_TYPE_MENU && qmenu == NULL) ++ if (type == V4L2_CTRL_TYPE_MENU && !qmenu) { + qmenu = v4l2_ctrl_get_menu(cfg->id); +- else if (cfg->type == V4L2_CTRL_TYPE_INTEGER_MENU && +- qmenu_int == NULL) { ++ } else if (type == V4L2_CTRL_TYPE_INTEGER_MENU && !qmenu_int) { + handler_set_err(hdl, -EINVAL); + return NULL; + } diff --git a/queue-5.1/media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch b/queue-5.1/media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch new file mode 100644 index 00000000000..c7cc99428c8 --- /dev/null +++ b/queue-5.1/media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch @@ -0,0 +1,38 @@ +From defcdc5d89ced780fb45196d539d6570ec5b1ba5 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 12 Dec 2018 07:27:10 -0500 +Subject: media: videobuf2-core: Prevent size alignment wrapping buffer size to 0 + +From: Sakari Ailus + +commit defcdc5d89ced780fb45196d539d6570ec5b1ba5 upstream. + +PAGE_ALIGN() may wrap the buffer size around to 0. Prevent this by +checking that the aligned value is not smaller than the unaligned one. + +Note on backporting to stable: the file used to be under +drivers/media/v4l2-core, it was moved to the current location after 4.14. + +Signed-off-by: Sakari Ailus +Cc: stable@vger.kernel.org +Reviewed-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/videobuf2/videobuf2-core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -207,6 +207,10 @@ static int __vb2_buf_mem_alloc(struct vb + for (plane = 0; plane < vb->num_planes; ++plane) { + unsigned long size = PAGE_ALIGN(vb->planes[plane].length); + ++ /* Did it wrap around? */ ++ if (size < vb->planes[plane].length) ++ goto free; ++ + mem_priv = call_ptr_memop(vb, alloc, + q->alloc_devs[plane] ? : q->dev, + q->dma_attrs, size, q->dma_dir, q->gfp_flags); diff --git a/queue-5.1/media-videobuf2-dma-sg-prevent-size-from-overflowing.patch b/queue-5.1/media-videobuf2-dma-sg-prevent-size-from-overflowing.patch new file mode 100644 index 00000000000..f1cd52b2911 --- /dev/null +++ b/queue-5.1/media-videobuf2-dma-sg-prevent-size-from-overflowing.patch @@ -0,0 +1,40 @@ +From 14f28f5cea9e3998442de87846d1907a531b6748 Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Wed, 12 Dec 2018 07:44:14 -0500 +Subject: media: videobuf2-dma-sg: Prevent size from overflowing + +From: Sakari Ailus + +commit 14f28f5cea9e3998442de87846d1907a531b6748 upstream. + +buf->size is an unsigned long; casting that to int will lead to an +overflow if buf->size exceeds INT_MAX. + +Fix this by changing the type to unsigned long instead. This is possible +as the buf->size is always aligned to PAGE_SIZE, and therefore the size +will never have values lesser than 0. + +Note on backporting to stable: the file used to be under +drivers/media/v4l2-core, it was moved to the current location after 4.14. + +Signed-off-by: Sakari Ailus +Cc: stable@vger.kernel.org +Reviewed-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/media/common/videobuf2/videobuf2-dma-sg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/common/videobuf2/videobuf2-dma-sg.c ++++ b/drivers/media/common/videobuf2/videobuf2-dma-sg.c +@@ -59,7 +59,7 @@ static int vb2_dma_sg_alloc_compacted(st + gfp_t gfp_flags) + { + unsigned int last_page = 0; +- int size = buf->size; ++ unsigned long size = buf->size; + + while (size > 0) { + struct page *pages; diff --git a/queue-5.1/nfsv4-handle-the-special-linux-file-open-access-mode.patch b/queue-5.1/nfsv4-handle-the-special-linux-file-open-access-mode.patch new file mode 100644 index 00000000000..c235c40abbc --- /dev/null +++ b/queue-5.1/nfsv4-handle-the-special-linux-file-open-access-mode.patch @@ -0,0 +1,49 @@ +From 44942b4e457beda00981f616402a1a791e8c616e Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Thu, 27 Jun 2019 06:41:45 -0400 +Subject: NFSv4: Handle the special Linux file open access mode + +From: Trond Myklebust + +commit 44942b4e457beda00981f616402a1a791e8c616e upstream. + +According to the open() manpage, Linux reserves the access mode 3 +to mean "check for read and write permission on the file and return +a file descriptor that can't be used for reading or writing." + +Currently, the NFSv4 code will ask the server to open the file, +and will use an incorrect share access mode of 0. Since it has +an incorrect share access mode, the client later forgets to send +a corresponding close, meaning it can leak stateids on the server. + +Fixes: ce4ef7c0a8a05 ("NFS: Split out NFS v4 file operations") +Cc: stable@vger.kernel.org # 3.6+ +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/inode.c | 1 + + fs/nfs/nfs4file.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1094,6 +1094,7 @@ int nfs_open(struct inode *inode, struct + nfs_fscache_open_file(inode, filp); + return 0; + } ++EXPORT_SYMBOL_GPL(nfs_open); + + /* + * This function is called whenever some part of NFS notices that +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -49,7 +49,7 @@ nfs4_file_open(struct inode *inode, stru + return err; + + if ((openflags & O_ACCMODE) == 3) +- openflags--; ++ return nfs_open(inode, filp); + + /* We can't create new files here */ + openflags &= ~(O_CREAT|O_EXCL); diff --git a/queue-5.1/pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch b/queue-5.1/pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch new file mode 100644 index 00000000000..de38d0fe5f0 --- /dev/null +++ b/queue-5.1/pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch @@ -0,0 +1,33 @@ +From 58bbeab425c6c5e318f5b6ae31d351331ddfb34b Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Thu, 18 Jul 2019 15:33:42 -0400 +Subject: pnfs: Fix a problem where we gratuitously start doing I/O through the MDS + +From: Trond Myklebust + +commit 58bbeab425c6c5e318f5b6ae31d351331ddfb34b upstream. + +If the client has to stop in pnfs_update_layout() to wait for another +layoutget to complete, it currently exits and defaults to I/O through +the MDS if the layoutget was successful. + +Fixes: d03360aaf5cc ("pNFS: Ensure we return the error if someone kills...") +Signed-off-by: Trond Myklebust +Cc: stable@vger.kernel.org # v4.20+ +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/pnfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1890,7 +1890,7 @@ lookup_again: + spin_unlock(&ino->i_lock); + lseg = ERR_PTR(wait_var_event_killable(&lo->plh_outstanding, + !atomic_read(&lo->plh_outstanding))); +- if (IS_ERR(lseg) || !list_empty(&lo->plh_segs)) ++ if (IS_ERR(lseg)) + goto out_put_layout_hdr; + pnfs_put_layout_hdr(lo); + goto lookup_again; diff --git a/queue-5.1/pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch b/queue-5.1/pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch new file mode 100644 index 00000000000..1cd40beeb6e --- /dev/null +++ b/queue-5.1/pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch @@ -0,0 +1,32 @@ +From 8e04fdfadda75a849c649f7e50fe7d97772e1fcb Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 17 Jul 2019 13:57:44 -0400 +Subject: pnfs/flexfiles: Fix PTR_ERR() dereferences in ff_layout_track_ds_error + +From: Trond Myklebust + +commit 8e04fdfadda75a849c649f7e50fe7d97772e1fcb upstream. + +mirror->mirror_ds can be NULL if uninitialised, but can contain +a PTR_ERR() if call to GETDEVICEINFO failed. + +Fixes: 65990d1afbd2 ("pNFS/flexfiles: Fix a deadlock on LAYOUTGET") +Signed-off-by: Trond Myklebust +Cc: stable@vger.kernel.org # 4.10+ +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/flexfilelayout/flexfilelayoutdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c ++++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c +@@ -257,7 +257,7 @@ int ff_layout_track_ds_error(struct nfs4 + if (status == 0) + return 0; + +- if (mirror->mirror_ds == NULL) ++ if (IS_ERR_OR_NULL(mirror->mirror_ds)) + return -EINVAL; + + dserr = kmalloc(sizeof(*dserr), gfp_flags); diff --git a/queue-5.1/raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch b/queue-5.1/raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch new file mode 100644 index 00000000000..97b9af6405c --- /dev/null +++ b/queue-5.1/raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch @@ -0,0 +1,56 @@ +From d9771f5ec46c282d518b453c793635dbdc3a2a94 Mon Sep 17 00:00:00 2001 +From: Xiao Ni +Date: Fri, 14 Jun 2019 15:41:05 -0700 +Subject: raid5-cache: Need to do start() part job after adding journal device + +From: Xiao Ni + +commit d9771f5ec46c282d518b453c793635dbdc3a2a94 upstream. + +commit d5d885fd514f ("md: introduce new personality funciton start()") +splits the init job to two parts. The first part run() does the jobs that +do not require the md threads. The second part start() does the jobs that +require the md threads. + +Now it just does run() in adding new journal device. It needs to do the +second part start() too. + +Fixes: d5d885fd514f ("md: introduce new personality funciton start()") +Cc: stable@vger.kernel.org #v4.9+ +Reported-by: Michal Soltys +Signed-off-by: Xiao Ni +Signed-off-by: Song Liu +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid5.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -7674,7 +7674,7 @@ abort: + static int raid5_add_disk(struct mddev *mddev, struct md_rdev *rdev) + { + struct r5conf *conf = mddev->private; +- int err = -EEXIST; ++ int ret, err = -EEXIST; + int disk; + struct disk_info *p; + int first = 0; +@@ -7689,7 +7689,14 @@ static int raid5_add_disk(struct mddev * + * The array is in readonly mode if journal is missing, so no + * write requests running. We should be safe + */ +- log_init(conf, rdev, false); ++ ret = log_init(conf, rdev, false); ++ if (ret) ++ return ret; ++ ++ ret = r5l_start(conf->log); ++ if (ret) ++ return ret; ++ + return 0; + } + if (mddev->recovery_disabled == conf->recovery_disabled) diff --git a/queue-5.1/revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch b/queue-5.1/revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch new file mode 100644 index 00000000000..2a1a34b3bf4 --- /dev/null +++ b/queue-5.1/revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch @@ -0,0 +1,288 @@ +From db531db951f950b86d274cc8ed7b21b9e2240036 Mon Sep 17 00:00:00 2001 +From: Max Kellermann +Date: Fri, 12 Jul 2019 16:18:06 +0200 +Subject: Revert "NFS: readdirplus optimization by cache mechanism" (memleak) + +From: Max Kellermann + +commit db531db951f950b86d274cc8ed7b21b9e2240036 upstream. + +This reverts commit be4c2d4723a4a637f0d1b4f7c66447141a4b3564. + +That commit caused a severe memory leak in nfs_readdir_make_qstr(). + +When listing a directory with more than 100 files (this is how many +struct nfs_cache_array_entry elements fit in one 4kB page), all +allocated file name strings past those 100 leak. + +The root of the leakage is that those string pointers are managed in +pages which are never linked into the page cache. + +fs/nfs/dir.c puts pages into the page cache by calling +read_cache_page(); the callback function nfs_readdir_filler() will +then fill the given page struct which was passed to it, which is +already linked in the page cache (by do_read_cache_page() calling +add_to_page_cache_lru()). + +Commit be4c2d4723a4 added another (local) array of allocated pages, to +be filled with more data, instead of discarding excess items received +from the NFS server. Those additional pages can be used by the next +nfs_readdir_filler() call (from within the same nfs_readdir() call). + +The leak happens when some of those additional pages are never used +(copied to the page cache using copy_highpage()). The pages will be +freed by nfs_readdir_free_pages(), but their contents will not. The +commit did not invoke nfs_readdir_clear_array() (and doing so would +have been dangerous, because it did not track which of those pages +were already copied to the page cache, risking double free bugs). + +How to reproduce the leak: + +- Use a kernel with CONFIG_SLUB_DEBUG_ON. + +- Create a directory on a NFS mount with more than 100 files with + names long enough to use the "kmalloc-32" slab (so we can easily + look up the allocation counts): + + for i in `seq 110`; do touch ${i}_0123456789abcdef; done + +- Drop all caches: + + echo 3 >/proc/sys/vm/drop_caches + +- Check the allocation counter: + + grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls + 30564391 nfs_readdir_add_to_array+0x73/0xd0 age=534558/4791307/6540952 pid=370-1048386 cpus=0-47 nodes=0-1 + +- Request a directory listing and check the allocation counters again: + + ls + [...] + grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls + 30564511 nfs_readdir_add_to_array+0x73/0xd0 age=207/4792999/6542663 pid=370-1048386 cpus=0-47 nodes=0-1 + +There are now 120 new allocations. + +- Drop all caches and check the counters again: + + echo 3 >/proc/sys/vm/drop_caches + grep nfs_readdir /sys/kernel/slab/kmalloc-32/alloc_calls + 30564401 nfs_readdir_add_to_array+0x73/0xd0 age=735/4793524/6543176 pid=370-1048386 cpus=0-47 nodes=0-1 + +110 allocations are gone, but 10 have leaked and will never be freed. + +Unhelpfully, those allocations are explicitly excluded from KMEMLEAK, +that's why my initial attempts with KMEMLEAK were not successful: + + /* + * Avoid a kmemleak false positive. The pointer to the name is stored + * in a page cache page which kmemleak does not scan. + */ + kmemleak_not_leak(string->name); + +It would be possible to solve this bug without reverting the whole +commit: + +- keep track of which pages were not used, and call + nfs_readdir_clear_array() on them, or +- manually link those pages into the page cache + +But for now I have decided to just revert the commit, because the real +fix would require complex considerations, risking more dangerous +(crash) bugs, which may seem unsuitable for the stable branches. + +Signed-off-by: Max Kellermann +Cc: stable@vger.kernel.org # v5.1+ +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/dir.c | 90 +++--------------------------------------------------- + fs/nfs/internal.h | 3 - + 2 files changed, 7 insertions(+), 86 deletions(-) + +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -139,19 +139,12 @@ struct nfs_cache_array { + struct nfs_cache_array_entry array[0]; + }; + +-struct readdirvec { +- unsigned long nr; +- unsigned long index; +- struct page *pages[NFS_MAX_READDIR_RAPAGES]; +-}; +- + typedef int (*decode_dirent_t)(struct xdr_stream *, struct nfs_entry *, bool); + typedef struct { + struct file *file; + struct page *page; + struct dir_context *ctx; + unsigned long page_index; +- struct readdirvec pvec; + u64 *dir_cookie; + u64 last_cookie; + loff_t current_index; +@@ -531,10 +524,6 @@ int nfs_readdir_page_filler(nfs_readdir_ + struct nfs_cache_array *array; + unsigned int count = 0; + int status; +- int max_rapages = NFS_MAX_READDIR_RAPAGES; +- +- desc->pvec.index = desc->page_index; +- desc->pvec.nr = 0; + + scratch = alloc_page(GFP_KERNEL); + if (scratch == NULL) +@@ -559,40 +548,20 @@ int nfs_readdir_page_filler(nfs_readdir_ + if (desc->plus) + nfs_prime_dcache(file_dentry(desc->file), entry); + +- status = nfs_readdir_add_to_array(entry, desc->pvec.pages[desc->pvec.nr]); +- if (status == -ENOSPC) { +- desc->pvec.nr++; +- if (desc->pvec.nr == max_rapages) +- break; +- status = nfs_readdir_add_to_array(entry, desc->pvec.pages[desc->pvec.nr]); +- } ++ status = nfs_readdir_add_to_array(entry, page); + if (status != 0) + break; + } while (!entry->eof); + +- /* +- * page and desc->pvec.pages[0] are valid, don't need to check +- * whether or not to be NULL. +- */ +- copy_highpage(page, desc->pvec.pages[0]); +- + out_nopages: + if (count == 0 || (status == -EBADCOOKIE && entry->eof != 0)) { +- array = kmap_atomic(desc->pvec.pages[desc->pvec.nr]); ++ array = kmap(page); + array->eof_index = array->size; + status = 0; +- kunmap_atomic(array); ++ kunmap(page); + } + + put_page(scratch); +- +- /* +- * desc->pvec.nr > 0 means at least one page was completely filled, +- * we should return -ENOSPC. Otherwise function +- * nfs_readdir_xdr_to_array will enter infinite loop. +- */ +- if (desc->pvec.nr > 0) +- return -ENOSPC; + return status; + } + +@@ -626,24 +595,6 @@ out_freepages: + return -ENOMEM; + } + +-/* +- * nfs_readdir_rapages_init initialize rapages by nfs_cache_array structure. +- */ +-static +-void nfs_readdir_rapages_init(nfs_readdir_descriptor_t *desc) +-{ +- struct nfs_cache_array *array; +- int max_rapages = NFS_MAX_READDIR_RAPAGES; +- int index; +- +- for (index = 0; index < max_rapages; index++) { +- array = kmap_atomic(desc->pvec.pages[index]); +- memset(array, 0, sizeof(struct nfs_cache_array)); +- array->eof_index = -1; +- kunmap_atomic(array); +- } +-} +- + static + int nfs_readdir_xdr_to_array(nfs_readdir_descriptor_t *desc, struct page *page, struct inode *inode) + { +@@ -654,12 +605,6 @@ int nfs_readdir_xdr_to_array(nfs_readdir + int status = -ENOMEM; + unsigned int array_size = ARRAY_SIZE(pages); + +- /* +- * This means we hit readdir rdpages miss, the preallocated rdpages +- * are useless, the preallocate rdpages should be reinitialized. +- */ +- nfs_readdir_rapages_init(desc); +- + entry.prev_cookie = 0; + entry.cookie = desc->last_cookie; + entry.eof = 0; +@@ -719,24 +664,9 @@ int nfs_readdir_filler(nfs_readdir_descr + struct inode *inode = file_inode(desc->file); + int ret; + +- /* +- * If desc->page_index in range desc->pvec.index and +- * desc->pvec.index + desc->pvec.nr, we get readdir cache hit. +- */ +- if (desc->page_index >= desc->pvec.index && +- desc->page_index < (desc->pvec.index + desc->pvec.nr)) { +- /* +- * page and desc->pvec.pages[x] are valid, don't need to check +- * whether or not to be NULL. +- */ +- copy_highpage(page, desc->pvec.pages[desc->page_index - desc->pvec.index]); +- ret = 0; +- } else { +- ret = nfs_readdir_xdr_to_array(desc, page, inode); +- if (ret < 0) +- goto error; +- } +- ++ ret = nfs_readdir_xdr_to_array(desc, page, inode); ++ if (ret < 0) ++ goto error; + SetPageUptodate(page); + + if (invalidate_inode_pages2_range(inode->i_mapping, page->index + 1, -1) < 0) { +@@ -901,7 +831,6 @@ static int nfs_readdir(struct file *file + *desc = &my_desc; + struct nfs_open_dir_context *dir_ctx = file->private_data; + int res = 0; +- int max_rapages = NFS_MAX_READDIR_RAPAGES; + + dfprintk(FILE, "NFS: readdir(%pD2) starting at cookie %llu\n", + file, (long long)ctx->pos); +@@ -921,12 +850,6 @@ static int nfs_readdir(struct file *file + desc->decode = NFS_PROTO(inode)->decode_dirent; + desc->plus = nfs_use_readdirplus(inode, ctx); + +- res = nfs_readdir_alloc_pages(desc->pvec.pages, max_rapages); +- if (res < 0) +- return -ENOMEM; +- +- nfs_readdir_rapages_init(desc); +- + if (ctx->pos == 0 || nfs_attribute_cache_expired(inode)) + res = nfs_revalidate_mapping(inode, file->f_mapping); + if (res < 0) +@@ -962,7 +885,6 @@ static int nfs_readdir(struct file *file + break; + } while (!desc->eof); + out: +- nfs_readdir_free_pages(desc->pvec.pages, max_rapages); + if (res > 0) + res = 0; + dfprintk(FILE, "NFS: readdir(%pD2) returns %d\n", file, res); +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -69,8 +69,7 @@ struct nfs_clone_mount { + * Maximum number of pages that readdir can use for creating + * a vmapped array of pages. + */ +-#define NFS_MAX_READDIR_PAGES 64 +-#define NFS_MAX_READDIR_RAPAGES 8 ++#define NFS_MAX_READDIR_PAGES 8 + + struct nfs_client_initdata { + unsigned long init_flags; diff --git a/queue-5.1/series b/queue-5.1/series index fd1278e0695..799c1dbd8ce 100644 --- a/queue-5.1/series +++ b/queue-5.1/series @@ -274,3 +274,24 @@ iwlwifi-fix-rf-kill-interrupt-while-fw-load-for-gen2-devices.patch iwlwifi-mvm-delay-gtk-setting-in-fw-in-ap-mode.patch iwlwifi-mvm-clear-rfkill_safe_init_done-when-we-start-the-firmware.patch opp-don-t-use-is_err-on-invalid-supplies.patch +arm64-fix-interrupt-tracing-in-the-presence-of-nmis.patch +nfsv4-handle-the-special-linux-file-open-access-mode.patch +revert-nfs-readdirplus-optimization-by-cache-mechanism-memleak.patch +pnfs-flexfiles-fix-ptr_err-dereferences-in-ff_layout_track_ds_error.patch +pnfs-fix-a-problem-where-we-gratuitously-start-doing-i-o-through-the-mds.patch +sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch +lib-scatterlist-fix-mapping-iterator-when-sg-offset-is-greater-than-page_size.patch +asoc-dapm-adapt-for-debugfs-api-change.patch +asoc-core-adapt-for-debugfs-api-change.patch +raid5-cache-need-to-do-start-part-job-after-adding-journal-device.patch +alsa-seq-break-too-long-mutex-context-in-the-write-loop.patch +alsa-hda-don-t-resume-forcibly-i915-hdmi-dp-codec.patch +alsa-hda-realtek-fixed-headphone-mic-can-t-record-on-dell-platform.patch +alsa-hda-realtek-apply-alc891-headset-fixup-to-one-dell-machine.patch +alsa-hda-hdmi-remove-duplicated-define.patch +alsa-hda-hdmi-fix-i915-reverse-port-pin-mapping.patch +ceph-fix-end-offset-in-truncate_inode_pages_range-call.patch +media-v4l2-test-type-instead-of-cfg-type-in-v4l2_ctrl_new_custom.patch +media-coda-remove-unbalanced-and-unneeded-mutex-unlock.patch +media-videobuf2-core-prevent-size-alignment-wrapping-buffer-size-to-0.patch +media-videobuf2-dma-sg-prevent-size-from-overflowing.patch diff --git a/queue-5.1/sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch b/queue-5.1/sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch new file mode 100644 index 00000000000..0ed9e00b98f --- /dev/null +++ b/queue-5.1/sunrpc-ensure-the-bvecs-are-reset-when-we-re-encode-the-rpc-request.patch @@ -0,0 +1,63 @@ +From 75369089820473eac45e9ddd970081901a373c08 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Wed, 17 Jul 2019 21:22:38 -0400 +Subject: SUNRPC: Ensure the bvecs are reset when we re-encode the RPC request + +From: Trond Myklebust + +commit 75369089820473eac45e9ddd970081901a373c08 upstream. + +The bvec tracks the list of pages, so if the number of pages changes +due to a re-encode, we need to reset the bvec as well. + +Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching...") +Signed-off-by: Trond Myklebust +Cc: stable@vger.kernel.org # v4.20+ +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/clnt.c | 3 +-- + net/sunrpc/xprt.c | 2 ++ + net/sunrpc/xprtsock.c | 1 + + 3 files changed, 4 insertions(+), 2 deletions(-) + +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -1767,6 +1767,7 @@ rpc_xdr_encode(struct rpc_task *task) + req->rq_snd_buf.head[0].iov_len = 0; + xdr_init_encode(&xdr, &req->rq_snd_buf, + req->rq_snd_buf.head[0].iov_base, req); ++ xdr_free_bvec(&req->rq_snd_buf); + if (rpc_encode_header(task, &xdr)) + return; + +@@ -1799,8 +1800,6 @@ call_encode(struct rpc_task *task) + rpc_exit(task, task->tk_status); + } + return; +- } else { +- xprt_request_prepare(task->tk_rqstp); + } + + /* Add task to reply queue before transmission to avoid races */ +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1006,6 +1006,8 @@ xprt_request_enqueue_receive(struct rpc_ + + if (!xprt_request_need_enqueue_receive(task, req)) + return; ++ ++ xprt_request_prepare(task->tk_rqstp); + spin_lock(&xprt->queue_lock); + + /* Update the softirq receive buffer */ +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -909,6 +909,7 @@ static int xs_nospace(struct rpc_rqst *r + static void + xs_stream_prepare_request(struct rpc_rqst *req) + { ++ xdr_free_bvec(&req->rq_rcv_buf); + req->rq_task->tk_status = xdr_alloc_bvec(&req->rq_rcv_buf, GFP_KERNEL); + } + -- 2.47.2