From: Greg Kroah-Hartman Date: Tue, 4 Nov 2025 05:29:50 +0000 (+0900) Subject: 6.1-stable patches X-Git-Tag: v6.12.58~32 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c76f8e5a59cc0abc76958dbd86fff826b40dc118;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: drm-sched-fix-race-in-drm_sched_entity_select_rq.patch drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch usb-gadget-f_fs-fix-epfile-null-pointer-access-after-ep-enable.patch --- diff --git a/queue-6.1/drm-sched-fix-race-in-drm_sched_entity_select_rq.patch b/queue-6.1/drm-sched-fix-race-in-drm_sched_entity_select_rq.patch new file mode 100644 index 0000000000..eb3b202eb8 --- /dev/null +++ b/queue-6.1/drm-sched-fix-race-in-drm_sched_entity_select_rq.patch @@ -0,0 +1,44 @@ +From stable+bounces-192220-greg=kroah.com@vger.kernel.org Tue Nov 4 00:22:31 2025 +From: Sasha Levin +Date: Mon, 3 Nov 2025 10:06:29 -0500 +Subject: drm/sched: Fix race in drm_sched_entity_select_rq() +To: stable@vger.kernel.org +Cc: Philipp Stanner , Tvrtko Ursulin , Sasha Levin +Message-ID: <20251103150629.4044990-1-sashal@kernel.org> + +From: Philipp Stanner + +[ Upstream commit d25e3a610bae03bffc5c14b5d944a5d0cd844678 ] + +In a past bug fix it was forgotten that entity access must be protected +by the entity lock. That's a data race and potentially UB. + +Move the spin_unlock() to the appropriate position. + +Cc: stable@vger.kernel.org # v5.13+ +Fixes: ac4eb83ab255 ("drm/sched: select new rq even if there is only one v3") +Reviewed-by: Tvrtko Ursulin +Signed-off-by: Philipp Stanner +Link: https://patch.msgid.link/20251022063402.87318-2-phasta@kernel.org +[ adapted lock field name from entity->lock to entity->rq_lock ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/scheduler/sched_entity.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/scheduler/sched_entity.c ++++ b/drivers/gpu/drm/scheduler/sched_entity.c +@@ -471,10 +471,11 @@ void drm_sched_entity_select_rq(struct d + drm_sched_rq_remove_entity(entity->rq, entity); + entity->rq = rq; + } +- spin_unlock(&entity->rq_lock); + + if (entity->num_sched_list == 1) + entity->sched_list = NULL; ++ ++ spin_unlock(&entity->rq_lock); + } + + /** diff --git a/queue-6.1/drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch b/queue-6.1/drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch new file mode 100644 index 0000000000..617ac79660 --- /dev/null +++ b/queue-6.1/drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch @@ -0,0 +1,55 @@ +From stable+bounces-192216-greg=kroah.com@vger.kernel.org Tue Nov 4 00:37:33 2025 +From: Sasha Levin +Date: Mon, 3 Nov 2025 09:59:11 -0500 +Subject: drm/sysfb: Do not dereference NULL pointer in plane reset +To: stable@vger.kernel.org +Cc: Thomas Zimmermann , Dan Carpenter , Melissa Wen , Maarten Lankhorst , Maxime Ripard , David Airlie , Simona Vetter , dri-devel@lists.freedesktop.org, Javier Martinez Canillas , Sasha Levin +Message-ID: <20251103145911.4040590-1-sashal@kernel.org> + +From: Thomas Zimmermann + +[ Upstream commit 14e02ed3876f4ab0ed6d3f41972175f8b8df3d70 ] + +The plane state in __drm_gem_reset_shadow_plane() can be NULL. Do not +deref that pointer, but forward NULL to the other plane-reset helpers. +Clears plane->state to NULL. + +v2: +- fix typo in commit description (Javier) + +Signed-off-by: Thomas Zimmermann +Fixes: b71565022031 ("drm/gem: Export implementation of shadow-plane helpers") +Reported-by: Dan Carpenter +Closes: https://lore.kernel.org/dri-devel/aPIDAsHIUHp_qSW4@stanley.mountain/ +Cc: Thomas Zimmermann +Cc: Melissa Wen +Cc: Maarten Lankhorst +Cc: Maxime Ripard +Cc: David Airlie +Cc: Simona Vetter +Cc: dri-devel@lists.freedesktop.org +Cc: # v5.15+ +Reviewed-by: Javier Martinez Canillas +Link: https://patch.msgid.link/20251017091407.58488-1-tzimmermann@suse.de +[ removed drm_format_conv_state_init() call ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_gem_atomic_helper.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/drm_gem_atomic_helper.c ++++ b/drivers/gpu/drm/drm_gem_atomic_helper.c +@@ -330,7 +330,11 @@ EXPORT_SYMBOL(drm_gem_destroy_shadow_pla + void __drm_gem_reset_shadow_plane(struct drm_plane *plane, + struct drm_shadow_plane_state *shadow_plane_state) + { +- __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base); ++ if (shadow_plane_state) { ++ __drm_atomic_helper_plane_reset(plane, &shadow_plane_state->base); ++ } else { ++ __drm_atomic_helper_plane_reset(plane, NULL); ++ } + } + EXPORT_SYMBOL(__drm_gem_reset_shadow_plane); + diff --git a/queue-6.1/s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch b/queue-6.1/s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch new file mode 100644 index 0000000000..e54e520b41 --- /dev/null +++ b/queue-6.1/s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch @@ -0,0 +1,120 @@ +From stable+bounces-192144-greg=kroah.com@vger.kernel.org Mon Nov 3 12:05:13 2025 +From: Sasha Levin +Date: Sun, 2 Nov 2025 22:05:03 -0500 +Subject: s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump +To: stable@vger.kernel.org +Cc: Gerd Bayer , Niklas Schnelle , Heiko Carstens , Sasha Levin +Message-ID: <20251103030503.3825433-1-sashal@kernel.org> + +From: Gerd Bayer + +[ Upstream commit 0fd20f65df6aa430454a0deed8f43efa91c54835 ] + +Do not block PCI config accesses through pci_cfg_access_lock() when +executing the s390 variant of PCI error recovery: Acquire just +device_lock() instead of pci_dev_lock() as powerpc's EEH and +generig PCI AER processing do. + +During error recovery testing a pair of tasks was reported to be hung: + +mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working +INFO: task kmcheck:72 blocked for more than 122 seconds. + Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 +Call Trace: + [<000000065256f030>] __schedule+0x2a0/0x590 + [<000000065256f356>] schedule+0x36/0xe0 + [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 + [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 + [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] + [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] + [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 + [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 +INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. + Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 +Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] +Call Trace: + [<000000065256f030>] __schedule+0x2a0/0x590 + [<000000065256f356>] schedule+0x36/0xe0 + [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 + [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 + [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] + [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] + [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] + [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 + [<0000000652513212>] devlink_health_report+0x19a/0x230 + [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] + +No kernel log of the exact same error with an upstream kernel is +available - but the very same deadlock situation can be constructed there, +too: + +- task: kmcheck + mlx5_unload_one() tries to acquire devlink lock while the PCI error + recovery code has set pdev->block_cfg_access by way of + pci_cfg_access_lock() +- task: kworker + mlx5_crdump_collect() tries to set block_cfg_access through + pci_cfg_access_lock() while devlink_health_report() had acquired + the devlink lock. + +A similar deadlock situation can be reproduced by requesting a +crdump with + > devlink health dump show pci/ reporter fw_fatal + +while PCI error recovery is executed on the same physical function +by mlx5_core's pci_error_handlers. On s390 this can be injected with + > zpcictl --reset-fw + +Tests with this patch failed to reproduce that second deadlock situation, +the devlink command is rejected with "kernel answers: Permission denied" - +and we get a kernel log message of: + +mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 + +because the config read of VSC_SEMAPHORE is rejected by the underlying +hardware. + +Two prior attempts to address this issue have been discussed and +ultimately rejected [see link], with the primary argument that s390's +implementation of PCI error recovery is imposing restrictions that +neither powerpc's EEH nor PCI AER handling need. Tests show that PCI +error recovery on s390 is running to completion even without blocking +access to PCI config space. + +Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/ +Cc: stable@vger.kernel.org +Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") +Reviewed-by: Niklas Schnelle +Signed-off-by: Gerd Bayer +Signed-off-by: Heiko Carstens +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/pci/pci_event.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/s390/pci/pci_event.c ++++ b/arch/s390/pci/pci_event.c +@@ -173,7 +173,7 @@ static pci_ers_result_t zpci_event_attem + * is unbound or probed and that userspace can't access its + * configuration space while we perform recovery. + */ +- pci_dev_lock(pdev); ++ device_lock(&pdev->dev); + if (pdev->error_state == pci_channel_io_perm_failure) { + ers_res = PCI_ERS_RESULT_DISCONNECT; + goto out_unlock; +@@ -221,7 +221,7 @@ static pci_ers_result_t zpci_event_attem + if (driver->err_handler->resume) + driver->err_handler->resume(pdev); + out_unlock: +- pci_dev_unlock(pdev); ++ device_unlock(&pdev->dev); + + return ers_res; + } diff --git a/queue-6.1/series b/queue-6.1/series index 3d0c4de805..15d02175eb 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -80,3 +80,7 @@ direct_write_fallback-on-error-revert-the-ki_pos-update-from-buffered-write.patc block-open-code-__generic_file_write_iter-for-blkdev-writes.patch block-fix-race-between-set_blocksize-and-read-paths.patch nilfs2-fix-deadlock-warnings-caused-by-lock-dependency-in-init_nilfs.patch +usb-gadget-f_fs-fix-epfile-null-pointer-access-after-ep-enable.patch +drm-sysfb-do-not-dereference-null-pointer-in-plane-reset.patch +drm-sched-fix-race-in-drm_sched_entity_select_rq.patch +s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-crdump.patch diff --git a/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after-ep-enable.patch b/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after-ep-enable.patch new file mode 100644 index 0000000000..120b853f85 --- /dev/null +++ b/queue-6.1/usb-gadget-f_fs-fix-epfile-null-pointer-access-after-ep-enable.patch @@ -0,0 +1,54 @@ +From cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 Mon Sep 17 00:00:00 2001 +From: Owen Gu +Date: Mon, 15 Sep 2025 17:29:07 +0800 +Subject: usb: gadget: f_fs: Fix epfile null pointer access after ep enable. + +From: Owen Gu + +commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream. + +A race condition occurs when ffs_func_eps_enable() runs concurrently +with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset() +sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading +to a NULL pointer dereference when accessing epfile->ep in +ffs_func_eps_enable() after successful usb_ep_enable(). + +The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and +ffs_data_close() functions, and its modification is protected by the +spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function +is also protected by ffs->eps_lock. + +Thus, add NULL pointer handling for ffs->epfiles in the +ffs_func_eps_enable() function to fix issues + +Signed-off-by: Owen Gu +Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/function/f_fs.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -2005,7 +2005,12 @@ static int ffs_func_eps_enable(struct ff + ep = func->eps; + epfile = ffs->epfiles; + count = ffs->eps_count; +- while(count--) { ++ if (!epfile) { ++ ret = -ENOMEM; ++ goto done; ++ } ++ ++ while (count--) { + ep->ep->driver_data = ep; + + ret = config_ep_by_speed(func->gadget, &func->function, ep->ep); +@@ -2029,6 +2034,7 @@ static int ffs_func_eps_enable(struct ff + } + + wake_up_interruptible(&ffs->wait); ++done: + spin_unlock_irqrestore(&func->ffs->eps_lock, flags); + + return ret;