From: Sasha Levin Date: Tue, 10 Jan 2023 15:19:31 +0000 (-0500) Subject: Fixes for 6.1 X-Git-Tag: v5.15.87~24^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=24919fd9067e42d62aa6639811db860d59a88d48;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 6.1 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/btrfs-handle-case-when-repair-happens-with-dev-repla.patch b/queue-6.1/btrfs-handle-case-when-repair-happens-with-dev-repla.patch new file mode 100644 index 00000000000..426b88b5464 --- /dev/null +++ b/queue-6.1/btrfs-handle-case-when-repair-happens-with-dev-repla.patch @@ -0,0 +1,115 @@ +From c9f6cb0646007e395bb9d2cfea56cb5eb53608d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Jan 2023 09:02:21 +0800 +Subject: btrfs: handle case when repair happens with dev-replace +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qu Wenruo + +[ Upstream commit d73a27b86fc722c28a26ec64002e3a7dc86d1c07 ] + +[BUG] +There is a bug report that a BUG_ON() in btrfs_repair_io_failure() +(originally repair_io_failure() in v6.0 kernel) got triggered when +replacing a unreliable disk: + + BTRFS warning (device sda1): csum failed root 257 ino 2397453 off 39624704 csum 0xb0d18c75 expected csum 0x4dae9c5e mirror 3 + kernel BUG at fs/btrfs/extent_io.c:2380! + invalid opcode: 0000 [#1] PREEMPT SMP NOPTI + CPU: 9 PID: 3614331 Comm: kworker/u257:2 Tainted: G OE 6.0.0-5-amd64 #1 Debian 6.0.10-2 + Hardware name: Micro-Star International Co., Ltd. MS-7C60/TRX40 PRO WIFI (MS-7C60), BIOS 2.70 07/01/2021 + Workqueue: btrfs-endio btrfs_end_bio_work [btrfs] + RIP: 0010:repair_io_failure+0x24a/0x260 [btrfs] + Call Trace: + + clean_io_failure+0x14d/0x180 [btrfs] + end_bio_extent_readpage+0x412/0x6e0 [btrfs] + ? __switch_to+0x106/0x420 + process_one_work+0x1c7/0x380 + worker_thread+0x4d/0x380 + ? rescuer_thread+0x3a0/0x3a0 + kthread+0xe9/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + +[CAUSE] + +Before the BUG_ON(), we got some read errors from the replace target +first, note the mirror number (3, which is beyond RAID1 duplication, +thus it's read from the replace target device). + +Then at the BUG_ON() location, we are trying to writeback the repaired +sectors back the failed device. + +The check looks like this: + + ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, logical, + &map_length, &bioc, mirror_num); + if (ret) + goto out_counter_dec; + BUG_ON(mirror_num != bioc->mirror_num); + +But inside btrfs_map_block(), we can modify bioc->mirror_num especially +for dev-replace: + + if (dev_replace_is_ongoing && mirror_num == map->num_stripes + 1 && + !need_full_stripe(op) && dev_replace->tgtdev != NULL) { + ret = get_extra_mirror_from_replace(fs_info, logical, *length, + dev_replace->srcdev->devid, + &mirror_num, + &physical_to_patch_in_first_stripe); + patch_the_first_stripe_for_dev_replace = 1; + } + +Thus if we're repairing the replace target device, we're going to +trigger that BUG_ON(). + +But in reality, the read failure from the replace target device may be +that, our replace hasn't reached the range we're reading, thus we're +reading garbage, but with replace running, the range would be properly +filled later. + +Thus in that case, we don't need to do anything but let the replace +routine to handle it. + +[FIX] +Instead of a BUG_ON(), just skip the repair if we're repairing the +device replace target device. + +Reported-by: 小太 +Link: https://lore.kernel.org/linux-btrfs/CACsxjPYyJGQZ+yvjzxA1Nn2LuqkYqTCcUH43S=+wXhyf8S00Ag@mail.gmail.com/ +CC: stable@vger.kernel.org # 6.0+ +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent_io.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 4dcf22e051ff..acb3c5c3b025 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -580,7 +580,16 @@ static int repair_io_failure(struct btrfs_fs_info *fs_info, u64 ino, u64 start, + &map_length, &bioc, mirror_num); + if (ret) + goto out_counter_dec; +- BUG_ON(mirror_num != bioc->mirror_num); ++ /* ++ * This happens when dev-replace is also running, and the ++ * mirror_num indicates the dev-replace target. ++ * ++ * In this case, we don't need to do anything, as the read ++ * error just means the replace progress hasn't reached our ++ * read range, and later replace routine would handle it well. ++ */ ++ if (mirror_num != bioc->mirror_num) ++ goto out_counter_dec; + } + + sector = bioc->stripes[bioc->mirror_num - 1].physical >> 9; +-- +2.35.1 + diff --git a/queue-6.1/drm-amd-display-add-check-for-det-fetch-latency-hidi.patch b/queue-6.1/drm-amd-display-add-check-for-det-fetch-latency-hidi.patch new file mode 100644 index 00000000000..027765e3226 --- /dev/null +++ b/queue-6.1/drm-amd-display-add-check-for-det-fetch-latency-hidi.patch @@ -0,0 +1,223 @@ +From d12d63c7f614ce5caed503577b3a6d529600dd93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Nov 2022 18:45:33 -0500 +Subject: drm/amd/display: Add check for DET fetch latency hiding for dcn32 + +From: Dillon Varone + +[ Upstream commit 6d4727c80947de0e6fad58b196a9d215e3b32608 ] + +[WHY?] +Some configurations are constructed with very marginal DET buffers relative to +the worst possible time required to fetch a swath. + +[HOW?] +Add a check to see that the DET buffer allocated for each pipe can hide the +latency for all pipes to fetch at least one swath. + +Reviewed-by: Alvin Lee +Reviewed-by: Jun Lei +Acked-by: Brian Chang +Signed-off-by: Dillon Varone +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Stable-dep-of: f3c23bea598a ("drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at DPM1 and not DPM0") +Signed-off-by: Sasha Levin +--- + .../dc/dml/dcn32/display_mode_vba_32.c | 39 +++++++++++ + .../dc/dml/dcn32/display_mode_vba_util_32.c | 69 +++++++++++++++++++ + .../dc/dml/dcn32/display_mode_vba_util_32.h | 18 +++++ + .../drm/amd/display/dc/dml/display_mode_vba.h | 2 + + 4 files changed, 128 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +index 9afd9ba23fb2..820042f6aaca 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_32.c +@@ -670,6 +670,25 @@ static void DISPCLKDPPCLKDCFCLKDeepSleepPrefetchParametersWatermarksAndPerforman + v->cursor_bw[k] = mode_lib->vba.NumberOfCursors[k] * mode_lib->vba.CursorWidth[k][0] * mode_lib->vba.CursorBPP[k][0] / 8 / (mode_lib->vba.HTotal[k] / mode_lib->vba.PixelClock[k]) * mode_lib->vba.VRatio[k]; + } + ++ v->NotEnoughDETSwathFillLatencyHiding = dml32_CalculateDETSwathFillLatencyHiding( ++ mode_lib->vba.NumberOfActiveSurfaces, ++ mode_lib->vba.ReturnBW, ++ v->UrgentLatency, ++ mode_lib->vba.SwathHeightY, ++ mode_lib->vba.SwathHeightC, ++ v->swath_width_luma_ub, ++ v->swath_width_chroma_ub, ++ v->BytePerPixelDETY, ++ v->BytePerPixelDETC, ++ mode_lib->vba.DETBufferSizeY, ++ mode_lib->vba.DETBufferSizeC, ++ mode_lib->vba.DPPPerPlane, ++ mode_lib->vba.HTotal, ++ mode_lib->vba.PixelClock, ++ mode_lib->vba.VRatio, ++ mode_lib->vba.VRatioChroma, ++ mode_lib->vba.UsesMALLForPStateChange); ++ + for (k = 0; k < mode_lib->vba.NumberOfActiveSurfaces; ++k) { + v->MaxVStartupLines[k] = ((mode_lib->vba.Interlace[k] && + !mode_lib->vba.ProgressiveToInterlaceUnitInOPP) ? +@@ -1664,6 +1683,7 @@ static void mode_support_configuration(struct vba_vars_st *v, + && mode_lib->vba.PTEBufferSizeNotExceeded[i][j] == true + && mode_lib->vba.DCCMetaBufferSizeNotExceeded[i][j] == true + && mode_lib->vba.NonsupportedDSCInputBPC == false ++ && mode_lib->vba.NotEnoughDETSwathFillLatencyHidingPerState[i][j] == false + && !mode_lib->vba.ExceededMALLSize + && ((mode_lib->vba.HostVMEnable == false + && !mode_lib->vba.ImmediateFlipRequiredFinal) +@@ -3158,6 +3178,25 @@ void dml32_ModeSupportAndSystemConfigurationFull(struct display_mode_lib *mode_l + mode_lib->vba.UrgentBurstFactorChroma, + mode_lib->vba.UrgentBurstFactorCursor); + ++ mode_lib->vba.NotEnoughDETSwathFillLatencyHidingPerState[i][j] = dml32_CalculateDETSwathFillLatencyHiding( ++ mode_lib->vba.NumberOfActiveSurfaces, ++ mode_lib->vba.ReturnBWPerState[i][j], ++ mode_lib->vba.UrgLatency[i], ++ mode_lib->vba.SwathHeightYThisState, ++ mode_lib->vba.SwathHeightCThisState, ++ mode_lib->vba.swath_width_luma_ub_this_state, ++ mode_lib->vba.swath_width_chroma_ub_this_state, ++ mode_lib->vba.BytePerPixelInDETY, ++ mode_lib->vba.BytePerPixelInDETC, ++ mode_lib->vba.DETBufferSizeYThisState, ++ mode_lib->vba.DETBufferSizeCThisState, ++ mode_lib->vba.NoOfDPPThisState, ++ mode_lib->vba.HTotal, ++ mode_lib->vba.PixelClock, ++ mode_lib->vba.VRatio, ++ mode_lib->vba.VRatioChroma, ++ mode_lib->vba.UsesMALLForPStateChange); ++ + v->dummy_vars.dml32_ModeSupportAndSystemConfigurationFull.VMDataOnlyReturnBWPerState = dml32_get_return_bw_mbps_vm_only(&mode_lib->vba.soc, i, + mode_lib->vba.DCFCLKState[i][j], mode_lib->vba.FabricClockPerState[i], + mode_lib->vba.DRAMSpeedPerState[i]); +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +index debe46b24a3e..5af601cff1a0 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +@@ -6228,3 +6228,72 @@ void dml32_CalculateImmediateFlipBandwithSupport(unsigned int NumberOfActiveSurf + *ImmediateFlipBandwidthSupport = (*TotalBandwidth <= ReturnBW); + *FractionOfUrgentBandwidth = *TotalBandwidth / ReturnBW; + } ++ ++bool dml32_CalculateDETSwathFillLatencyHiding(unsigned int NumberOfActiveSurfaces, ++ double ReturnBW, ++ double UrgentLatency, ++ unsigned int SwathHeightY[], ++ unsigned int SwathHeightC[], ++ unsigned int SwathWidthY[], ++ unsigned int SwathWidthC[], ++ double BytePerPixelInDETY[], ++ double BytePerPixelInDETC[], ++ unsigned int DETBufferSizeY[], ++ unsigned int DETBufferSizeC[], ++ unsigned int NumOfDPP[], ++ unsigned int HTotal[], ++ double PixelClock[], ++ double VRatioY[], ++ double VRatioC[], ++ enum dm_use_mall_for_pstate_change_mode UsesMALLForPStateChange[DC__NUM_DPP__MAX]) ++{ ++ int k; ++ double SwathSizeAllSurfaces = 0; ++ double SwathSizeAllSurfacesInFetchTimeUs; ++ double DETSwathLatencyHidingUs; ++ double DETSwathLatencyHidingYUs; ++ double DETSwathLatencyHidingCUs; ++ double SwathSizePerSurfaceY[DC__NUM_DPP__MAX]; ++ double SwathSizePerSurfaceC[DC__NUM_DPP__MAX]; ++ bool NotEnoughDETSwathFillLatencyHiding = false; ++ ++ /* calculate sum of single swath size for all pipes in bytes*/ ++ for (k = 0; k < NumberOfActiveSurfaces; k++) { ++ SwathSizePerSurfaceY[k] += SwathHeightY[k] * SwathWidthY[k] * BytePerPixelInDETY[k] * NumOfDPP[k]; ++ ++ if (SwathHeightC[k] != 0) ++ SwathSizePerSurfaceC[k] += SwathHeightC[k] * SwathWidthC[k] * BytePerPixelInDETC[k] * NumOfDPP[k]; ++ else ++ SwathSizePerSurfaceC[k] = 0; ++ ++ SwathSizeAllSurfaces += SwathSizePerSurfaceY[k] + SwathSizePerSurfaceC[k]; ++ } ++ ++ SwathSizeAllSurfacesInFetchTimeUs = SwathSizeAllSurfaces / ReturnBW + UrgentLatency; ++ ++ /* ensure all DET - 1 swath can hide a fetch for all surfaces */ ++ for (k = 0; k < NumberOfActiveSurfaces; k++) { ++ double LineTime = HTotal[k] / PixelClock[k]; ++ ++ /* only care if surface is not phantom */ ++ if (UsesMALLForPStateChange[k] != dm_use_mall_pstate_change_phantom_pipe) { ++ DETSwathLatencyHidingYUs = (dml_floor(DETBufferSizeY[k] / BytePerPixelInDETY[k] / SwathWidthY[k], 1.0) - SwathHeightY[k]) / VRatioY[k] * LineTime; ++ ++ if (SwathHeightC[k] != 0) { ++ DETSwathLatencyHidingCUs = (dml_floor(DETBufferSizeC[k] / BytePerPixelInDETC[k] / SwathWidthC[k], 1.0) - SwathHeightC[k]) / VRatioC[k] * LineTime; ++ ++ DETSwathLatencyHidingUs = dml_min(DETSwathLatencyHidingYUs, DETSwathLatencyHidingCUs); ++ } else { ++ DETSwathLatencyHidingUs = DETSwathLatencyHidingYUs; ++ } ++ ++ /* DET must be able to hide time to fetch 1 swath for each surface */ ++ if (DETSwathLatencyHidingUs < SwathSizeAllSurfacesInFetchTimeUs) { ++ NotEnoughDETSwathFillLatencyHiding = true; ++ break; ++ } ++ } ++ } ++ ++ return NotEnoughDETSwathFillLatencyHiding; ++} +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h +index 3989c2a28fae..779c6805f599 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.h +@@ -1141,4 +1141,22 @@ void dml32_CalculateImmediateFlipBandwithSupport(unsigned int NumberOfActiveSurf + double *FractionOfUrgentBandwidth, + bool *ImmediateFlipBandwidthSupport); + ++bool dml32_CalculateDETSwathFillLatencyHiding(unsigned int NumberOfActiveSurfaces, ++ double ReturnBW, ++ double UrgentLatency, ++ unsigned int SwathHeightY[], ++ unsigned int SwathHeightC[], ++ unsigned int SwathWidthY[], ++ unsigned int SwathWidthC[], ++ double BytePerPixelInDETY[], ++ double BytePerPixelInDETC[], ++ unsigned int DETBufferSizeY[], ++ unsigned int DETBufferSizeC[], ++ unsigned int NumOfDPP[], ++ unsigned int HTotal[], ++ double PixelClock[], ++ double VRatioY[], ++ double VRatioC[], ++ enum dm_use_mall_for_pstate_change_mode UsesMALLForPStateChange[DC__NUM_DPP__MAX]); ++ + #endif +diff --git a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h +index a0207a8f8756..2b34b02dbd45 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h ++++ b/drivers/gpu/drm/amd/display/dc/dml/display_mode_vba.h +@@ -1041,6 +1041,7 @@ struct vba_vars_st { + double MinFullDETBufferingTime; + double AverageReadBandwidthGBytePerSecond; + bool FirstMainPlane; ++ bool NotEnoughDETSwathFillLatencyHiding; + + unsigned int ViewportWidthChroma[DC__NUM_DPP__MAX]; + unsigned int ViewportHeightChroma[DC__NUM_DPP__MAX]; +@@ -1224,6 +1225,7 @@ struct vba_vars_st { + unsigned int BlockWidthC[DC__NUM_DPP__MAX]; + unsigned int SubViewportLinesNeededInMALL[DC__NUM_DPP__MAX]; + bool VActiveBandwithSupport[DC__VOLTAGE_STATES][2]; ++ bool NotEnoughDETSwathFillLatencyHidingPerState[DC__VOLTAGE_STATES][2]; + struct dummy_vars dummy_vars; + }; + +-- +2.35.1 + diff --git a/queue-6.1/drm-amd-display-uninitialized-variables-causing-4k60.patch b/queue-6.1/drm-amd-display-uninitialized-variables-causing-4k60.patch new file mode 100644 index 00000000000..de218a3c2e0 --- /dev/null +++ b/queue-6.1/drm-amd-display-uninitialized-variables-causing-4k60.patch @@ -0,0 +1,51 @@ +From 76cb7dc726e88b229d539ba1fafcd7edbe6a83df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Dec 2022 11:08:40 -0500 +Subject: drm/amd/display: Uninitialized variables causing 4k60 UCLK to stay at + DPM1 and not DPM0 + +From: Samson Tam + +[ Upstream commit f3c23bea598ab7e8e4b8c5ca66598921310f718e ] + +[Why] +SwathSizePerSurfaceY[] and SwathSizePerSurfaceC[] values are uninitialized + because we are using += instead of = operator. + +[How] +Assign values in loop with = operator. + +Acked-by: Aurabindo Pillai +Signed-off-by: Samson Tam +Reviewed-by: Aric Cyr +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 6.0.x, 6.1.x +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +index 5af601cff1a0..b53feeaf5cf1 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c ++++ b/drivers/gpu/drm/amd/display/dc/dml/dcn32/display_mode_vba_util_32.c +@@ -6257,12 +6257,12 @@ bool dml32_CalculateDETSwathFillLatencyHiding(unsigned int NumberOfActiveSurface + double SwathSizePerSurfaceC[DC__NUM_DPP__MAX]; + bool NotEnoughDETSwathFillLatencyHiding = false; + +- /* calculate sum of single swath size for all pipes in bytes*/ ++ /* calculate sum of single swath size for all pipes in bytes */ + for (k = 0; k < NumberOfActiveSurfaces; k++) { +- SwathSizePerSurfaceY[k] += SwathHeightY[k] * SwathWidthY[k] * BytePerPixelInDETY[k] * NumOfDPP[k]; ++ SwathSizePerSurfaceY[k] = SwathHeightY[k] * SwathWidthY[k] * BytePerPixelInDETY[k] * NumOfDPP[k]; + + if (SwathHeightC[k] != 0) +- SwathSizePerSurfaceC[k] += SwathHeightC[k] * SwathWidthC[k] * BytePerPixelInDETC[k] * NumOfDPP[k]; ++ SwathSizePerSurfaceC[k] = SwathHeightC[k] * SwathWidthC[k] * BytePerPixelInDETC[k] * NumOfDPP[k]; + else + SwathSizePerSurfaceC[k] = 0; + +-- +2.35.1 + diff --git a/queue-6.1/series b/queue-6.1/series index 381edf4c08a..12414bca955 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -153,3 +153,8 @@ drm-plane-helper-add-the-missing-declaration-of-drm_atomic_state.patch drm-amdkfd-fix-kernel-warning-during-topology-setup.patch drm-i915-gvt-fix-gvt-debugfs-destroy.patch drm-i915-gvt-fix-vgpu-debugfs-clean-in-remove.patch +virtio-blk-use-a-helper-to-handle-request-queuing-er.patch +virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch +drm-amd-display-add-check-for-det-fetch-latency-hidi.patch +drm-amd-display-uninitialized-variables-causing-4k60.patch +btrfs-handle-case-when-repair-happens-with-dev-repla.patch diff --git a/queue-6.1/virtio-blk-use-a-helper-to-handle-request-queuing-er.patch b/queue-6.1/virtio-blk-use-a-helper-to-handle-request-queuing-er.patch new file mode 100644 index 00000000000..45fae81e0fa --- /dev/null +++ b/queue-6.1/virtio-blk-use-a-helper-to-handle-request-queuing-er.patch @@ -0,0 +1,78 @@ +From bc6abb72bfab9a3bd0fad018c8c7be7f0b720fe1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Oct 2022 23:41:26 -0400 +Subject: virtio-blk: use a helper to handle request queuing errors + +From: Dmitry Fomichev + +[ Upstream commit 258896fcc786b4e7db238eba26f6dd080e0ff41e ] + +Define a new helper function, virtblk_fail_to_queue(), to +clean up the error handling code in virtio_queue_rq(). + +Signed-off-by: Dmitry Fomichev +Message-Id: <20221016034127.330942-2-dmitry.fomichev@wdc.com> +Signed-off-by: Michael S. Tsirkin +Stable-dep-of: a26116c1e740 ("virtio_blk: Fix signedness bug in virtblk_prep_rq()") +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 29 ++++++++++++++++------------- + 1 file changed, 16 insertions(+), 13 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 19da5defd734..3efe3da5f8c2 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -315,6 +315,19 @@ static void virtio_commit_rqs(struct blk_mq_hw_ctx *hctx) + virtqueue_notify(vq->vq); + } + ++static blk_status_t virtblk_fail_to_queue(struct request *req, int rc) ++{ ++ virtblk_cleanup_cmd(req); ++ switch (rc) { ++ case -ENOSPC: ++ return BLK_STS_DEV_RESOURCE; ++ case -ENOMEM: ++ return BLK_STS_RESOURCE; ++ default: ++ return BLK_STS_IOERR; ++ } ++} ++ + static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx, + struct virtio_blk *vblk, + struct request *req, +@@ -327,10 +340,8 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx, + return status; + + vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr); +- if (unlikely(vbr->sg_table.nents < 0)) { +- virtblk_cleanup_cmd(req); +- return BLK_STS_RESOURCE; +- } ++ if (unlikely(vbr->sg_table.nents < 0)) ++ return virtblk_fail_to_queue(req, -ENOMEM); + + blk_mq_start_request(req); + +@@ -364,15 +375,7 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, + blk_mq_stop_hw_queue(hctx); + spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags); + virtblk_unmap_data(req, vbr); +- virtblk_cleanup_cmd(req); +- switch (err) { +- case -ENOSPC: +- return BLK_STS_DEV_RESOURCE; +- case -ENOMEM: +- return BLK_STS_RESOURCE; +- default: +- return BLK_STS_IOERR; +- } ++ return virtblk_fail_to_queue(req, err); + } + + if (bd->last && virtqueue_kick_prepare(vblk->vqs[qid].vq)) +-- +2.35.1 + diff --git a/queue-6.1/virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch b/queue-6.1/virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch new file mode 100644 index 00000000000..6e01f3b712f --- /dev/null +++ b/queue-6.1/virtio_blk-fix-signedness-bug-in-virtblk_prep_rq.patch @@ -0,0 +1,53 @@ +From cbb2e59e1d2b68825db8b13c94ffd89686df44ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Oct 2022 17:41:26 -0300 +Subject: virtio_blk: Fix signedness bug in virtblk_prep_rq() + +From: Rafael Mendonca + +[ Upstream commit a26116c1e74028914f281851488546c91cbae57d ] + +The virtblk_map_data() function returns negative error codes, however, the +'nents' field of vbr->sg_table is an unsigned int, which causes the error +handling not to work correctly. + +Cc: stable@vger.kernel.org +Fixes: 0e9911fa768f ("virtio-blk: support mq_ops->queue_rqs()") +Signed-off-by: Rafael Mendonca +Message-Id: <20221021204126.927603-1-rafaelmendsr@gmail.com> +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefano Garzarella +Reviewed-by: Suwan Kim +Reviewed-by: Stefan Hajnoczi +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 3efe3da5f8c2..a7697027ce43 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -334,14 +334,16 @@ static blk_status_t virtblk_prep_rq(struct blk_mq_hw_ctx *hctx, + struct virtblk_req *vbr) + { + blk_status_t status; ++ int num; + + status = virtblk_setup_cmd(vblk->vdev, req, vbr); + if (unlikely(status)) + return status; + +- vbr->sg_table.nents = virtblk_map_data(hctx, req, vbr); +- if (unlikely(vbr->sg_table.nents < 0)) ++ num = virtblk_map_data(hctx, req, vbr); ++ if (unlikely(num < 0)) + return virtblk_fail_to_queue(req, -ENOMEM); ++ vbr->sg_table.nents = num; + + blk_mq_start_request(req); + +-- +2.35.1 +