From: Greg Kroah-Hartman Date: Fri, 19 Jun 2026 09:51:07 +0000 (+0200) Subject: 7.1-stable patches X-Git-Tag: v5.10.259~3 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=234b5d41bf24707e13d73f6427de9b15778c0690;p=thirdparty%2Fkernel%2Fstable-queue.git 7.1-stable patches added patches: drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_get_pages.patch hid-input-add-battery-list-cleanup-with-devm-action.patch --- diff --git a/queue-7.1/drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_get_pages.patch b/queue-7.1/drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_get_pages.patch new file mode 100644 index 0000000000..0f2ff44840 --- /dev/null +++ b/queue-7.1/drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_get_pages.patch @@ -0,0 +1,74 @@ +From 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 Mon Sep 17 00:00:00 2001 +From: Honglei Huang +Date: Fri, 29 May 2026 10:23:17 +0800 +Subject: drm/amdgpu: drop retry loop in amdgpu_hmm_range_get_pages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Honglei Huang + +commit 342981fff32802a819d6fc7cf3c9fedf9f3d9d60 upstream. + +Since commit c08972f55594 ("drm/amdgpu: fix amdgpu_hmm_range_get_pages") +moved mmu_interval_read_begin() out of the per-chunk loop, the +captured notifier_seq is no longer refreshed across retries. As a +result, the existing -EBUSY retry path can never make progress: + + hmm_range_fault() returns -EBUSY only when + mmu_interval_check_retry(notifier, notifier_seq) reports that the + sequence is stale. Once the sequence has advanced, the stored seq + will never match again, so every subsequent call within the same + invocation returns -EBUSY immediately. + +The "goto retry" therefore degenerates into a busy spin that simply +burns CPU for the full HMM_RANGE_DEFAULT_TIMEOUT (~1s) window before +finally bailing out with -EAGAIN. This is pure latency with no chance +of recovery, and it actively hurts the KFD userptr stack: the caller +ends up blocked for a second while holding mmap_lock, only to return +-EAGAIN to the restore worker (or to userspace) which would have +re-driven the operation immediately anyway. + +Drop the retry/timeout entirely and let -EBUSY propagate straight to +out_free_pfns, where it is already translated to -EAGAIN. Recovery is +handled at a higher level: the KFD restore_userptr_worker reschedules +itself, and the userptr ioctl path returns -EAGAIN to userspace. + +No functional regression: the previous behaviour on -EBUSY was already +to fail with -EAGAIN after a 1s stall; we just skip the stall. + +Reviewed-by: Christian König +Signed-off-by: Honglei Huang +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_hmm.c +@@ -174,7 +174,6 @@ int amdgpu_hmm_range_get_pages(struct mm + const u64 max_bytes = SZ_2G; + + struct hmm_range *hmm_range = &range->hmm_range; +- unsigned long timeout; + unsigned long *pfns; + unsigned long end; + int r; +@@ -201,15 +200,9 @@ int amdgpu_hmm_range_get_pages(struct mm + pr_debug("hmm range: start = 0x%lx, end = 0x%lx", + hmm_range->start, hmm_range->end); + +- timeout = jiffies + msecs_to_jiffies(HMM_RANGE_DEFAULT_TIMEOUT); +- +-retry: + r = hmm_range_fault(hmm_range); +- if (unlikely(r)) { +- if (r == -EBUSY && !time_after(jiffies, timeout)) +- goto retry; ++ if (unlikely(r)) + goto out_free_pfns; +- } + + if (hmm_range->end == end) + break; diff --git a/queue-7.1/hid-input-add-battery-list-cleanup-with-devm-action.patch b/queue-7.1/hid-input-add-battery-list-cleanup-with-devm-action.patch new file mode 100644 index 0000000000..63e9bb7715 --- /dev/null +++ b/queue-7.1/hid-input-add-battery-list-cleanup-with-devm-action.patch @@ -0,0 +1,55 @@ +From 426e5846eba75feaf1c9c6c119cb153610192da1 Mon Sep 17 00:00:00 2001 +From: Rafael Passos +Date: Tue, 2 Jun 2026 00:05:19 -0300 +Subject: HID: Input: Add battery list cleanup with devm action + +From: Rafael Passos + +commit 426e5846eba75feaf1c9c6c119cb153610192da1 upstream. + +The batteries list (hdev->batteries) is not cleaned up during +hidinput_disconnect(), but struct hid_battery entries are allocated +with devm_kzalloc. +When a driver is unbound (e.g. during devicereprobe), devm frees those +entries while their list_head nodesremain dangling in hdev->batteries, +which persists across rebinds. + +Link: https://lore.kernel.org/all/20260602011949.2825852-1-rafael@rcpassos.me/ +Fixes: 4a58ae85c3f9 ("HID: input: Add support for multiple batteries per device") +Signed-off-by: Rafael Passos +Acked-by: Lucas Zampieri +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-input.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -519,6 +519,13 @@ static struct hid_battery *hidinput_find + return NULL; + } + ++static void hidinput_cleanup_battery(void *res) ++{ ++ struct hid_battery *bat = res; ++ ++ list_del(&bat->list); ++} ++ + static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, + struct hid_field *field, bool is_percentage) + { +@@ -610,6 +617,12 @@ static int hidinput_setup_battery(struct + + power_supply_powers(bat->ps, &dev->dev); + list_add_tail(&bat->list, &dev->batteries); ++ ++ error = devm_add_action_or_reset(&dev->dev, ++ hidinput_cleanup_battery, bat); ++ if (error) ++ return error; ++ + return 0; + + err_free_name: diff --git a/queue-7.1/series b/queue-7.1/series index b1f21b1653..dae80d6606 100644 --- a/queue-7.1/series +++ b/queue-7.1/series @@ -6,3 +6,5 @@ arm64-cputype-add-c1-premium-definitions.patch arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt-100-cpu.patch +hid-input-add-battery-list-cleanup-with-devm-action.patch +drm-amdgpu-drop-retry-loop-in-amdgpu_hmm_range_get_pages.patch