From b7e6ff6d40936873fe486743c3ed4f7602a8e1de Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 25 Sep 2022 10:41:09 +0200 Subject: [PATCH] 5.19-stable patches added patches: blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch drm-i915-display-fix-handling-of-enable_psr-parameter.patch --- ...rror-handling-in-__blk_mq_alloc_disk.patch | 33 +++++++++ ...m-disk_release-for-never-added-disks.patch | 63 ++++++++++++++++ ...ut_queue-if-gendisk-allocation-fails.patch | 74 +++++++++++++++++++ ...fix-handling-of-enable_psr-parameter.patch | 64 ++++++++++++++++ queue-5.19/series | 4 + 5 files changed, 238 insertions(+) create mode 100644 queue-5.19/blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch create mode 100644 queue-5.19/block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch create mode 100644 queue-5.19/block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch create mode 100644 queue-5.19/drm-i915-display-fix-handling-of-enable_psr-parameter.patch diff --git a/queue-5.19/blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch b/queue-5.19/blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch new file mode 100644 index 00000000000..dd67637bd48 --- /dev/null +++ b/queue-5.19/blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch @@ -0,0 +1,33 @@ +From 0a3e5cc7bbfcd571a2e53779ef7d7aa3c57d5432 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 20 Jul 2022 15:05:40 +0200 +Subject: blk-mq: fix error handling in __blk_mq_alloc_disk + +From: Christoph Hellwig + +commit 0a3e5cc7bbfcd571a2e53779ef7d7aa3c57d5432 upstream. + +To fully clean up the queue if the disk allocation fails we need to +call blk_mq_destroy_queue and not just blk_put_queue. + +Fixes: 6f8191fdf41d ("block: simplify disk shutdown") +Signed-off-by: Christoph Hellwig +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220720130541.1323531-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-mq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3949,7 +3949,7 @@ struct gendisk *__blk_mq_alloc_disk(stru + + disk = __alloc_disk_node(q, set->numa_node, lkclass); + if (!disk) { +- blk_put_queue(q); ++ blk_mq_destroy_queue(q); + return ERR_PTR(-ENOMEM); + } + set_bit(GD_OWNS_QUEUE, &disk->state); diff --git a/queue-5.19/block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch b/queue-5.19/block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch new file mode 100644 index 00000000000..ab604c3c1de --- /dev/null +++ b/queue-5.19/block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch @@ -0,0 +1,63 @@ +From c5db2cfc6274692d821d33b59acb6ff615e350c1 Mon Sep 17 00:00:00 2001 +From: Christoph Hellwig +Date: Wed, 20 Jul 2022 15:05:41 +0200 +Subject: block: call blk_mq_exit_queue from disk_release for never added disks + +From: Christoph Hellwig + +commit c5db2cfc6274692d821d33b59acb6ff615e350c1 upstream. + +To undo the all initialization from blk_mq_init_allocated_queue in case +of a probe failure where add_disk is never called we have to call +blk_mq_exit_queue from put_disk. + +This relies on the fact that drivers always call blk_mq_free_tag_set +after calling put_disk in the probe error path if they have a gendisk +at all. + +We should be doing this in general, but can't do it for the normal +teardown case (yet) as the tagset can be gone by the time the disk is +released once it was added. I hope to sort this out properly eventually +but for now this isolated hack will do it. + +Fixes: 6f8191fdf41d ("block: simplify disk shutdown") +Signed-off-by: Christoph Hellwig +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220720130541.1323531-2-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/genhd.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1158,6 +1158,18 @@ static void disk_release(struct device * + might_sleep(); + WARN_ON_ONCE(disk_live(disk)); + ++ /* ++ * To undo the all initialization from blk_mq_init_allocated_queue in ++ * case of a probe failure where add_disk is never called we have to ++ * call blk_mq_exit_queue here. We can't do this for the more common ++ * teardown case (yet) as the tagset can be gone by the time the disk ++ * is released once it was added. ++ */ ++ if (queue_is_mq(disk->queue) && ++ test_bit(GD_OWNS_QUEUE, &disk->state) && ++ !test_bit(GD_ADDED, &disk->state)) ++ blk_mq_exit_queue(disk->queue); ++ + blkcg_exit_queue(disk->queue); + + disk_release_events(disk); +@@ -1422,6 +1434,9 @@ EXPORT_SYMBOL(__blk_alloc_disk); + * This decrements the refcount for the struct gendisk. When this reaches 0 + * we'll have disk_release() called. + * ++ * Note: for blk-mq disk put_disk must be called before freeing the tag_set ++ * when handling probe errors (that is before add_disk() is called). ++ * + * Context: Any context, but the last reference must not be dropped from + * atomic context. + */ diff --git a/queue-5.19/block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch b/queue-5.19/block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch new file mode 100644 index 00000000000..53616655abf --- /dev/null +++ b/queue-5.19/block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch @@ -0,0 +1,74 @@ +From aa0c680c3aa96a5f9f160d90dd95402ad578e2b0 Mon Sep 17 00:00:00 2001 +From: Rafael Mendonca +Date: Thu, 11 Aug 2022 20:23:37 -0300 +Subject: block: Do not call blk_put_queue() if gendisk allocation fails + +From: Rafael Mendonca + +commit aa0c680c3aa96a5f9f160d90dd95402ad578e2b0 upstream. + +Commit 6f8191fdf41d ("block: simplify disk shutdown") removed the call +to blk_get_queue() during gendisk allocation but missed to remove the +corresponding cleanup code blk_put_queue() for it. Thus, if the gendisk +allocation fails, the request_queue refcount gets decremented and +reaches 0, causing blk_mq_release() to be called with a hctx still +alive. That triggers a WARNING report, as found by syzkaller: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 23016 at block/blk-mq.c:3881 +blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881 +[...] stripped +RIP: 0010:blk_mq_release+0xf8/0x3e0 block/blk-mq.c:3881 +[...] stripped +Call Trace: + + blk_release_queue+0x153/0x270 block/blk-sysfs.c:780 + kobject_cleanup lib/kobject.c:673 [inline] + kobject_release lib/kobject.c:704 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0x1c8/0x540 lib/kobject.c:721 + __alloc_disk_node+0x4f7/0x610 block/genhd.c:1388 + __blk_mq_alloc_disk+0x13b/0x1f0 block/blk-mq.c:3961 + loop_add+0x3e2/0xaf0 drivers/block/loop.c:1978 + loop_control_ioctl+0x133/0x620 drivers/block/loop.c:2150 + vfs_ioctl fs/ioctl.c:51 [inline] + __do_sys_ioctl fs/ioctl.c:870 [inline] + __se_sys_ioctl fs/ioctl.c:856 [inline] + __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +[...] stripped + +Fixes: 6f8191fdf41d ("block: simplify disk shutdown") +Reported-by: syzbot+31c9594f6e43b9289b25@syzkaller.appspotmail.com +Suggested-by: Hillf Danton +Signed-off-by: Rafael Mendonca +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220811232338.254673-1-rafaelmendsr@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/genhd.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -1359,7 +1359,7 @@ struct gendisk *__alloc_disk_node(struct + + disk = kzalloc_node(sizeof(struct gendisk), GFP_KERNEL, node_id); + if (!disk) +- goto out_put_queue; ++ return NULL; + + disk->bdi = bdi_alloc(node_id); + if (!disk->bdi) +@@ -1403,8 +1403,6 @@ out_free_bdi: + bdi_put(disk->bdi); + out_free_disk: + kfree(disk); +-out_put_queue: +- blk_put_queue(q); + return NULL; + } + diff --git a/queue-5.19/drm-i915-display-fix-handling-of-enable_psr-parameter.patch b/queue-5.19/drm-i915-display-fix-handling-of-enable_psr-parameter.patch new file mode 100644 index 00000000000..134e62d568d --- /dev/null +++ b/queue-5.19/drm-i915-display-fix-handling-of-enable_psr-parameter.patch @@ -0,0 +1,64 @@ +From 5c57c099f442acab13129c9e15ad2a0c31151c98 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jos=C3=A9=20Roberto=20de=20Souza?= +Date: Wed, 8 Jun 2022 13:33:44 -0700 +Subject: drm/i915/display: Fix handling of enable_psr parameter +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Roberto de Souza + +commit 5c57c099f442acab13129c9e15ad2a0c31151c98 upstream. + +Commit 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. +global parts") cause PSR to be disabled when enable_psr has the +default value and there is at least one DP port that do not supports +PSR. + +That was happening because intel_psr_init() is called for every DP +port and then enable_psr is globaly set to 0 based on the PSR support +of the DP port. + +Here dropping the enable_psr overwritten and using the VBT PSR value +when enable_psr is set as default. + +Fixes: 3cf050762534 ("drm/i915/bios: Split VBT data into per-panel vs. global parts") +Cc: Ville Syrjälä +Cc: Jani Nikula +Cc: Jouni Högander +Cc: Mika Kahola +Signed-off-by: José Roberto de Souza +Reviewed-by: Jouni Högander +Link: https://patchwork.freedesktop.org/patch/msgid/20220608203344.513082-1-jose.souza@intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/display/intel_psr.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -86,10 +86,13 @@ + + static bool psr_global_enabled(struct intel_dp *intel_dp) + { ++ struct intel_connector *connector = intel_dp->attached_connector; + struct drm_i915_private *i915 = dp_to_i915(intel_dp); + + switch (intel_dp->psr.debug & I915_PSR_DEBUG_MODE_MASK) { + case I915_PSR_DEBUG_DEFAULT: ++ if (i915->params.enable_psr == -1) ++ return connector->panel.vbt.psr.enable; + return i915->params.enable_psr; + case I915_PSR_DEBUG_DISABLE: + return false; +@@ -2371,10 +2374,6 @@ void intel_psr_init(struct intel_dp *int + + intel_dp->psr.source_support = true; + +- if (dev_priv->params.enable_psr == -1) +- if (!connector->panel.vbt.psr.enable) +- dev_priv->params.enable_psr = 0; +- + /* Set link_standby x link_off defaults */ + if (DISPLAY_VER(dev_priv) < 12) + /* For new platforms up to TGL let's respect VBT back again */ diff --git a/queue-5.19/series b/queue-5.19/series index 2f6b9a475fa..0f74c6872d9 100644 --- a/queue-5.19/series +++ b/queue-5.19/series @@ -164,3 +164,7 @@ serial-tegra-tcu-use-uart_xmit_advance-fixes-icount.tx-accounting.patch cgroup-cgroup_get_from_id-must-check-the-looked-up-kn-is-a-directory.patch phy-marvell-phy-mvebu-a3700-comphy-remove-broken-reset-support.patch s390-dasd-fix-oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup.patch +drm-i915-display-fix-handling-of-enable_psr-parameter.patch +blk-mq-fix-error-handling-in-__blk_mq_alloc_disk.patch +block-call-blk_mq_exit_queue-from-disk_release-for-never-added-disks.patch +block-do-not-call-blk_put_queue-if-gendisk-allocation-fails.patch -- 2.47.3