]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.14-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 21 May 2020 05:52:33 +0000 (07:52 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 21 May 2020 05:52:33 +0000 (07:52 +0200)
added patches:
ext4-add-cond_resched-to-ext4_protect_reserved_inode.patch
i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
watchdog-fix-the-race-between-the-release-of-watchdog_core_data-and-cdev.patch

queue-4.14/ext4-add-cond_resched-to-ext4_protect_reserved_inode.patch [new file with mode: 0644]
queue-4.14/i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch [new file with mode: 0644]
queue-4.14/series [new file with mode: 0644]
queue-4.14/watchdog-fix-the-race-between-the-release-of-watchdog_core_data-and-cdev.patch [new file with mode: 0644]
queue-4.19/series [new file with mode: 0644]
queue-5.4/series [new file with mode: 0644]
queue-5.6/series [new file with mode: 0644]

diff --git a/queue-4.14/ext4-add-cond_resched-to-ext4_protect_reserved_inode.patch b/queue-4.14/ext4-add-cond_resched-to-ext4_protect_reserved_inode.patch
new file mode 100644 (file)
index 0000000..4aa68d0
--- /dev/null
@@ -0,0 +1,65 @@
+From af133ade9a40794a37104ecbcc2827c0ea373a3c Mon Sep 17 00:00:00 2001
+From: Shijie Luo <luoshijie1@huawei.com>
+Date: Mon, 10 Feb 2020 20:17:52 -0500
+Subject: ext4: add cond_resched() to ext4_protect_reserved_inode
+
+From: Shijie Luo <luoshijie1@huawei.com>
+
+commit af133ade9a40794a37104ecbcc2827c0ea373a3c upstream.
+
+When journal size is set too big by "mkfs.ext4 -J size=", or when
+we mount a crafted image to make journal inode->i_size too big,
+the loop, "while (i < num)", holds cpu too long. This could cause
+soft lockup.
+
+[  529.357541] Call trace:
+[  529.357551]  dump_backtrace+0x0/0x198
+[  529.357555]  show_stack+0x24/0x30
+[  529.357562]  dump_stack+0xa4/0xcc
+[  529.357568]  watchdog_timer_fn+0x300/0x3e8
+[  529.357574]  __hrtimer_run_queues+0x114/0x358
+[  529.357576]  hrtimer_interrupt+0x104/0x2d8
+[  529.357580]  arch_timer_handler_virt+0x38/0x58
+[  529.357584]  handle_percpu_devid_irq+0x90/0x248
+[  529.357588]  generic_handle_irq+0x34/0x50
+[  529.357590]  __handle_domain_irq+0x68/0xc0
+[  529.357593]  gic_handle_irq+0x6c/0x150
+[  529.357595]  el1_irq+0xb8/0x140
+[  529.357599]  __ll_sc_atomic_add_return_acquire+0x14/0x20
+[  529.357668]  ext4_map_blocks+0x64/0x5c0 [ext4]
+[  529.357693]  ext4_setup_system_zone+0x330/0x458 [ext4]
+[  529.357717]  ext4_fill_super+0x2170/0x2ba8 [ext4]
+[  529.357722]  mount_bdev+0x1a8/0x1e8
+[  529.357746]  ext4_mount+0x44/0x58 [ext4]
+[  529.357748]  mount_fs+0x50/0x170
+[  529.357752]  vfs_kern_mount.part.9+0x54/0x188
+[  529.357755]  do_mount+0x5ac/0xd78
+[  529.357758]  ksys_mount+0x9c/0x118
+[  529.357760]  __arm64_sys_mount+0x28/0x38
+[  529.357764]  el0_svc_common+0x78/0x130
+[  529.357766]  el0_svc_handler+0x38/0x78
+[  529.357769]  el0_svc+0x8/0xc
+[  541.356516] watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [mount:18674]
+
+Link: https://lore.kernel.org/r/20200211011752.29242-1-luoshijie1@huawei.com
+Reviewed-by: Jan Kara <jack@suse.cz>
+Signed-off-by: Shijie Luo <luoshijie1@huawei.com>
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Cc: stable@kernel.org
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ext4/block_validity.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/ext4/block_validity.c
++++ b/fs/ext4/block_validity.c
+@@ -153,6 +153,7 @@ static int ext4_protect_reserved_inode(s
+               return PTR_ERR(inode);
+       num = (inode->i_size + sb->s_blocksize - 1) >> sb->s_blocksize_bits;
+       while (i < num) {
++              cond_resched();
+               map.m_lblk = i;
+               map.m_len = num - i;
+               n = ext4_map_blocks(NULL, inode, &map, 0);
diff --git a/queue-4.14/i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch b/queue-4.14/i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
new file mode 100644 (file)
index 0000000..e87e7e0
--- /dev/null
@@ -0,0 +1,184 @@
+From 1413ef638abae4ab5621901cf4d8ef08a4a48ba6 Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Fri, 11 Oct 2019 23:00:14 +0800
+Subject: i2c: dev: Fix the race between the release of i2c_dev and cdev
+
+From: Kevin Hao <haokexin@gmail.com>
+
+commit 1413ef638abae4ab5621901cf4d8ef08a4a48ba6 upstream.
+
+The struct cdev is embedded in the struct i2c_dev. In the current code,
+we would free the i2c_dev struct directly in put_i2c_dev(), but the
+cdev is manged by a kobject, and the release of it is not predictable.
+So it is very possible that the i2c_dev is freed before the cdev is
+entirely released. We can easily get the following call trace with
+CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_DEBUG_OBJECTS_TIMERS enabled.
+  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38
+  WARNING: CPU: 19 PID: 1 at lib/debugobjects.c:325 debug_print_object+0xb0/0xf0
+  Modules linked in:
+  CPU: 19 PID: 1 Comm: swapper/0 Tainted: G        W         5.2.20-yocto-standard+ #120
+  Hardware name: Marvell OcteonTX CN96XX board (DT)
+  pstate: 80c00089 (Nzcv daIf +PAN +UAO)
+  pc : debug_print_object+0xb0/0xf0
+  lr : debug_print_object+0xb0/0xf0
+  sp : ffff00001292f7d0
+  x29: ffff00001292f7d0 x28: ffff800b82151788
+  x27: 0000000000000001 x26: ffff800b892c0000
+  x25: ffff0000124a2558 x24: 0000000000000000
+  x23: ffff00001107a1d8 x22: ffff0000116b5088
+  x21: ffff800bdc6afca8 x20: ffff000012471ae8
+  x19: ffff00001168f2c8 x18: 0000000000000010
+  x17: 00000000fd6f304b x16: 00000000ee79de43
+  x15: ffff800bc0e80568 x14: 79616c6564203a74
+  x13: 6e6968207473696c x12: 5f72656d6974203a
+  x11: ffff0000113f0018 x10: 0000000000000000
+  x9 : 000000000000001f x8 : 0000000000000000
+  x7 : ffff0000101294cc x6 : 0000000000000000
+  x5 : 0000000000000000 x4 : 0000000000000001
+  x3 : 00000000ffffffff x2 : 0000000000000000
+  x1 : 387fc15c8ec0f200 x0 : 0000000000000000
+  Call trace:
+   debug_print_object+0xb0/0xf0
+   __debug_check_no_obj_freed+0x19c/0x228
+   debug_check_no_obj_freed+0x1c/0x28
+   kfree+0x250/0x440
+   put_i2c_dev+0x68/0x78
+   i2cdev_detach_adapter+0x60/0xc8
+   i2cdev_notifier_call+0x3c/0x70
+   notifier_call_chain+0x8c/0xe8
+   blocking_notifier_call_chain+0x64/0x88
+   device_del+0x74/0x380
+   device_unregister+0x54/0x78
+   i2c_del_adapter+0x278/0x2d0
+   unittest_i2c_bus_remove+0x3c/0x80
+   platform_drv_remove+0x30/0x50
+   device_release_driver_internal+0xf4/0x1c0
+   driver_detach+0x58/0xa0
+   bus_remove_driver+0x84/0xd8
+   driver_unregister+0x34/0x60
+   platform_driver_unregister+0x20/0x30
+   of_unittest_overlay+0x8d4/0xbe0
+   of_unittest+0xae8/0xb3c
+   do_one_initcall+0xac/0x450
+   do_initcall_level+0x208/0x224
+   kernel_init_freeable+0x2d8/0x36c
+   kernel_init+0x18/0x108
+   ret_from_fork+0x10/0x1c
+  irq event stamp: 3934661
+  hardirqs last  enabled at (3934661): [<ffff00001009fa04>] debug_exception_exit+0x4c/0x58
+  hardirqs last disabled at (3934660): [<ffff00001009fb14>] debug_exception_enter+0xa4/0xe0
+  softirqs last  enabled at (3934654): [<ffff000010081d94>] __do_softirq+0x46c/0x628
+  softirqs last disabled at (3934649): [<ffff0000100b4a1c>] irq_exit+0x104/0x118
+
+This is a common issue when using cdev embedded in a struct.
+Fortunately, we already have a mechanism to solve this kind of issue.
+Please see commit 233ed09d7fda ("chardev: add helper function to
+register char devs with a struct device") for more detail.
+
+In this patch, we choose to embed the struct device into the i2c_dev,
+and use the API provided by the commit 233ed09d7fda to make sure that
+the release of i2c_dev and cdev are in sequence.
+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Cc: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/i2c-dev.c |   48 ++++++++++++++++++++++++++----------------------
+ 1 file changed, 26 insertions(+), 22 deletions(-)
+
+--- a/drivers/i2c/i2c-dev.c
++++ b/drivers/i2c/i2c-dev.c
+@@ -47,7 +47,7 @@
+ struct i2c_dev {
+       struct list_head list;
+       struct i2c_adapter *adap;
+-      struct device *dev;
++      struct device dev;
+       struct cdev cdev;
+ };
+@@ -91,12 +91,14 @@ static struct i2c_dev *get_free_i2c_dev(
+       return i2c_dev;
+ }
+-static void put_i2c_dev(struct i2c_dev *i2c_dev)
++static void put_i2c_dev(struct i2c_dev *i2c_dev, bool del_cdev)
+ {
+       spin_lock(&i2c_dev_list_lock);
+       list_del(&i2c_dev->list);
+       spin_unlock(&i2c_dev_list_lock);
+-      kfree(i2c_dev);
++      if (del_cdev)
++              cdev_device_del(&i2c_dev->cdev, &i2c_dev->dev);
++      put_device(&i2c_dev->dev);
+ }
+ static ssize_t name_show(struct device *dev,
+@@ -542,6 +544,14 @@ static const struct file_operations i2cd
+ static struct class *i2c_dev_class;
++static void i2cdev_dev_release(struct device *dev)
++{
++      struct i2c_dev *i2c_dev;
++
++      i2c_dev = container_of(dev, struct i2c_dev, dev);
++      kfree(i2c_dev);
++}
++
+ static int i2cdev_attach_adapter(struct device *dev, void *dummy)
+ {
+       struct i2c_adapter *adap;
+@@ -558,27 +568,23 @@ static int i2cdev_attach_adapter(struct
+       cdev_init(&i2c_dev->cdev, &i2cdev_fops);
+       i2c_dev->cdev.owner = THIS_MODULE;
+-      res = cdev_add(&i2c_dev->cdev, MKDEV(I2C_MAJOR, adap->nr), 1);
+-      if (res)
+-              goto error_cdev;
+-
+-      /* register this i2c device with the driver core */
+-      i2c_dev->dev = device_create(i2c_dev_class, &adap->dev,
+-                                   MKDEV(I2C_MAJOR, adap->nr), NULL,
+-                                   "i2c-%d", adap->nr);
+-      if (IS_ERR(i2c_dev->dev)) {
+-              res = PTR_ERR(i2c_dev->dev);
+-              goto error;
++
++      device_initialize(&i2c_dev->dev);
++      i2c_dev->dev.devt = MKDEV(I2C_MAJOR, adap->nr);
++      i2c_dev->dev.class = i2c_dev_class;
++      i2c_dev->dev.parent = &adap->dev;
++      i2c_dev->dev.release = i2cdev_dev_release;
++      dev_set_name(&i2c_dev->dev, "i2c-%d", adap->nr);
++
++      res = cdev_device_add(&i2c_dev->cdev, &i2c_dev->dev);
++      if (res) {
++              put_i2c_dev(i2c_dev, false);
++              return res;
+       }
+       pr_debug("i2c-dev: adapter [%s] registered as minor %d\n",
+                adap->name, adap->nr);
+       return 0;
+-error:
+-      cdev_del(&i2c_dev->cdev);
+-error_cdev:
+-      put_i2c_dev(i2c_dev);
+-      return res;
+ }
+ static int i2cdev_detach_adapter(struct device *dev, void *dummy)
+@@ -594,9 +600,7 @@ static int i2cdev_detach_adapter(struct
+       if (!i2c_dev) /* attach_adapter must have failed */
+               return 0;
+-      cdev_del(&i2c_dev->cdev);
+-      put_i2c_dev(i2c_dev);
+-      device_destroy(i2c_dev_class, MKDEV(I2C_MAJOR, adap->nr));
++      put_i2c_dev(i2c_dev, true);
+       pr_debug("i2c-dev: adapter [%s] unregistered\n", adap->name);
+       return 0;
diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..f185785
--- /dev/null
@@ -0,0 +1,3 @@
+ext4-add-cond_resched-to-ext4_protect_reserved_inode.patch
+watchdog-fix-the-race-between-the-release-of-watchdog_core_data-and-cdev.patch
+i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
diff --git a/queue-4.14/watchdog-fix-the-race-between-the-release-of-watchdog_core_data-and-cdev.patch b/queue-4.14/watchdog-fix-the-race-between-the-release-of-watchdog_core_data-and-cdev.patch
new file mode 100644 (file)
index 0000000..04a9d32
--- /dev/null
@@ -0,0 +1,277 @@
+From 2351c88f8296ef95e1ceda815c229e57ac33ea64 Mon Sep 17 00:00:00 2001
+From: Kevin Hao <haokexin@gmail.com>
+Date: Tue, 8 Oct 2019 19:29:34 +0800
+Subject: watchdog: Fix the race between the release of watchdog_core_data and cdev
+
+From: Kevin Hao <haokexin@gmail.com>
+
+commit 72139dfa2464e43957d330266994740bb7be2535 upstream.
+
+The struct cdev is embedded in the struct watchdog_core_data. In the
+current code, we manage the watchdog_core_data with a kref, but the
+cdev is manged by a kobject. There is no any relationship between
+this kref and kobject. So it is possible that the watchdog_core_data is
+freed before the cdev is entirely released. We can easily get the
+following call trace with CONFIG_DEBUG_KOBJECT_RELEASE and
+CONFIG_DEBUG_OBJECTS_TIMERS enabled.
+  ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x38
+  WARNING: CPU: 23 PID: 1028 at lib/debugobjects.c:481 debug_print_object+0xb0/0xf0
+  Modules linked in: softdog(-) deflate ctr twofish_generic twofish_common camellia_generic serpent_generic blowfish_generic blowfish_common cast5_generic cast_common cmac xcbc af_key sch_fq_codel openvswitch nsh nf_conncount nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4
+  CPU: 23 PID: 1028 Comm: modprobe Not tainted 5.3.0-next-20190924-yoctodev-standard+ #180
+  Hardware name: Marvell OcteonTX CN96XX board (DT)
+  pstate: 00400009 (nzcv daif +PAN -UAO)
+  pc : debug_print_object+0xb0/0xf0
+  lr : debug_print_object+0xb0/0xf0
+  sp : ffff80001cbcfc70
+  x29: ffff80001cbcfc70 x28: ffff800010ea2128
+  x27: ffff800010bad000 x26: 0000000000000000
+  x25: ffff80001103c640 x24: ffff80001107b268
+  x23: ffff800010bad9e8 x22: ffff800010ea2128
+  x21: ffff000bc2c62af8 x20: ffff80001103c600
+  x19: ffff800010e867d8 x18: 0000000000000060
+  x17: 0000000000000000 x16: 0000000000000000
+  x15: ffff000bd7240470 x14: 6e6968207473696c
+  x13: 5f72656d6974203a x12: 6570797420746365
+  x11: 6a626f2029302065 x10: 7461747320657669
+  x9 : 7463612820657669 x8 : 3378302f3078302b
+  x7 : 0000000000001d7a x6 : ffff800010fd5889
+  x5 : 0000000000000000 x4 : 0000000000000000
+  x3 : 0000000000000000 x2 : ffff000bff948548
+  x1 : 276a1c9e1edc2300 x0 : 0000000000000000
+  Call trace:
+   debug_print_object+0xb0/0xf0
+   debug_check_no_obj_freed+0x1e8/0x210
+   kfree+0x1b8/0x368
+   watchdog_cdev_unregister+0x88/0xc8
+   watchdog_dev_unregister+0x38/0x48
+   watchdog_unregister_device+0xa8/0x100
+   softdog_exit+0x18/0xfec4 [softdog]
+   __arm64_sys_delete_module+0x174/0x200
+   el0_svc_handler+0xd0/0x1c8
+   el0_svc+0x8/0xc
+
+This is a common issue when using cdev embedded in a struct.
+Fortunately, we already have a mechanism to solve this kind of issue.
+Please see commit 233ed09d7fda ("chardev: add helper function to
+register char devs with a struct device") for more detail.
+
+In this patch, we choose to embed the struct device into the
+watchdog_core_data, and use the API provided by the commit 233ed09d7fda
+to make sure that the release of watchdog_core_data and cdev are
+in sequence.
+
+Signed-off-by: Kevin Hao <haokexin@gmail.com>
+Reviewed-by: Guenter Roeck <linux@roeck-us.net>
+Link: https://lore.kernel.org/r/20191008112934.29669-1-haokexin@gmail.com
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
+[bwh: Backported to 4.14:
+ - There's no reboot notifier here
+ - Adjust context]
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/watchdog/watchdog_dev.c |   67 +++++++++++++++++-----------------------
+ 1 file changed, 30 insertions(+), 37 deletions(-)
+
+--- a/drivers/watchdog/watchdog_dev.c
++++ b/drivers/watchdog/watchdog_dev.c
+@@ -38,7 +38,6 @@
+ #include <linux/init.h>               /* For __init/__exit/... */
+ #include <linux/jiffies.h>    /* For timeout functions */
+ #include <linux/kernel.h>     /* For printk/panic/... */
+-#include <linux/kref.h>               /* For data references */
+ #include <linux/miscdevice.h> /* For handling misc devices */
+ #include <linux/module.h>     /* For module stuff/... */
+ #include <linux/mutex.h>      /* For mutexes */
+@@ -53,14 +52,14 @@
+ /*
+  * struct watchdog_core_data - watchdog core internal data
+- * @kref:     Reference count.
++ * @dev:      The watchdog's internal device
+  * @cdev:     The watchdog's Character device.
+  * @wdd:      Pointer to watchdog device.
+  * @lock:     Lock for watchdog core.
+  * @status:   Watchdog core internal status bits.
+  */
+ struct watchdog_core_data {
+-      struct kref kref;
++      struct device dev;
+       struct cdev cdev;
+       struct watchdog_device *wdd;
+       struct mutex lock;
+@@ -802,7 +801,7 @@ static int watchdog_open(struct inode *i
+       file->private_data = wd_data;
+       if (!hw_running)
+-              kref_get(&wd_data->kref);
++              get_device(&wd_data->dev);
+       /* dev/watchdog is a virtual (and thus non-seekable) filesystem */
+       return nonseekable_open(inode, file);
+@@ -814,11 +813,11 @@ out_clear:
+       return err;
+ }
+-static void watchdog_core_data_release(struct kref *kref)
++static void watchdog_core_data_release(struct device *dev)
+ {
+       struct watchdog_core_data *wd_data;
+-      wd_data = container_of(kref, struct watchdog_core_data, kref);
++      wd_data = container_of(dev, struct watchdog_core_data, dev);
+       kfree(wd_data);
+ }
+@@ -878,7 +877,7 @@ done:
+        */
+       if (!running) {
+               module_put(wd_data->cdev.owner);
+-              kref_put(&wd_data->kref, watchdog_core_data_release);
++              put_device(&wd_data->dev);
+       }
+       return 0;
+ }
+@@ -897,17 +896,22 @@ static struct miscdevice watchdog_miscde
+       .fops           = &watchdog_fops,
+ };
++static struct class watchdog_class = {
++      .name =         "watchdog",
++      .owner =        THIS_MODULE,
++      .dev_groups =   wdt_groups,
++};
++
+ /*
+  *    watchdog_cdev_register: register watchdog character device
+  *    @wdd: watchdog device
+- *    @devno: character device number
+  *
+  *    Register a watchdog character device including handling the legacy
+  *    /dev/watchdog node. /dev/watchdog is actually a miscdevice and
+  *    thus we set it up like that.
+  */
+-static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno)
++static int watchdog_cdev_register(struct watchdog_device *wdd)
+ {
+       struct watchdog_core_data *wd_data;
+       int err;
+@@ -915,7 +919,6 @@ static int watchdog_cdev_register(struct
+       wd_data = kzalloc(sizeof(struct watchdog_core_data), GFP_KERNEL);
+       if (!wd_data)
+               return -ENOMEM;
+-      kref_init(&wd_data->kref);
+       mutex_init(&wd_data->lock);
+       wd_data->wdd = wdd;
+@@ -942,23 +945,33 @@ static int watchdog_cdev_register(struct
+               }
+       }
++      device_initialize(&wd_data->dev);
++      wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
++      wd_data->dev.class = &watchdog_class;
++      wd_data->dev.parent = wdd->parent;
++      wd_data->dev.groups = wdd->groups;
++      wd_data->dev.release = watchdog_core_data_release;
++      dev_set_drvdata(&wd_data->dev, wdd);
++      dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
++
+       /* Fill in the data structures */
+       cdev_init(&wd_data->cdev, &watchdog_fops);
+-      wd_data->cdev.owner = wdd->ops->owner;
+       /* Add the device */
+-      err = cdev_add(&wd_data->cdev, devno, 1);
++      err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
+       if (err) {
+               pr_err("watchdog%d unable to add device %d:%d\n",
+                       wdd->id,  MAJOR(watchdog_devt), wdd->id);
+               if (wdd->id == 0) {
+                       misc_deregister(&watchdog_miscdev);
+                       old_wd_data = NULL;
+-                      kref_put(&wd_data->kref, watchdog_core_data_release);
++                      put_device(&wd_data->dev);
+               }
+               return err;
+       }
++      wd_data->cdev.owner = wdd->ops->owner;
++
+       /* Record time of most recent heartbeat as 'just before now'. */
+       wd_data->last_hw_keepalive = jiffies - 1;
+@@ -968,7 +981,7 @@ static int watchdog_cdev_register(struct
+        */
+       if (watchdog_hw_running(wdd)) {
+               __module_get(wdd->ops->owner);
+-              kref_get(&wd_data->kref);
++              get_device(&wd_data->dev);
+               if (handle_boot_enabled)
+                       queue_delayed_work(watchdog_wq, &wd_data->work, 0);
+               else
+@@ -991,7 +1004,7 @@ static void watchdog_cdev_unregister(str
+ {
+       struct watchdog_core_data *wd_data = wdd->wd_data;
+-      cdev_del(&wd_data->cdev);
++      cdev_device_del(&wd_data->cdev, &wd_data->dev);
+       if (wdd->id == 0) {
+               misc_deregister(&watchdog_miscdev);
+               old_wd_data = NULL;
+@@ -1009,15 +1022,9 @@ static void watchdog_cdev_unregister(str
+       cancel_delayed_work_sync(&wd_data->work);
+-      kref_put(&wd_data->kref, watchdog_core_data_release);
++      put_device(&wd_data->dev);
+ }
+-static struct class watchdog_class = {
+-      .name =         "watchdog",
+-      .owner =        THIS_MODULE,
+-      .dev_groups =   wdt_groups,
+-};
+-
+ /*
+  *    watchdog_dev_register: register a watchdog device
+  *    @wdd: watchdog device
+@@ -1029,27 +1036,14 @@ static struct class watchdog_class = {
+ int watchdog_dev_register(struct watchdog_device *wdd)
+ {
+-      struct device *dev;
+-      dev_t devno;
+       int ret;
+-      devno = MKDEV(MAJOR(watchdog_devt), wdd->id);
+-
+-      ret = watchdog_cdev_register(wdd, devno);
++      ret = watchdog_cdev_register(wdd);
+       if (ret)
+               return ret;
+-      dev = device_create_with_groups(&watchdog_class, wdd->parent,
+-                                      devno, wdd, wdd->groups,
+-                                      "watchdog%d", wdd->id);
+-      if (IS_ERR(dev)) {
+-              watchdog_cdev_unregister(wdd);
+-              return PTR_ERR(dev);
+-      }
+-
+       ret = watchdog_register_pretimeout(wdd);
+       if (ret) {
+-              device_destroy(&watchdog_class, devno);
+               watchdog_cdev_unregister(wdd);
+       }
+@@ -1067,7 +1061,6 @@ int watchdog_dev_register(struct watchdo
+ void watchdog_dev_unregister(struct watchdog_device *wdd)
+ {
+       watchdog_unregister_pretimeout(wdd);
+-      device_destroy(&watchdog_class, wdd->wd_data->cdev.dev);
+       watchdog_cdev_unregister(wdd);
+ }
diff --git a/queue-4.19/series b/queue-4.19/series
new file mode 100644 (file)
index 0000000..1caeb34
--- /dev/null
@@ -0,0 +1,3 @@
+i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
+kvm-svm-fix-potential-memory-leak-in-svm_cpu_init.patch
+riscv-set-max_pfn-to-the-pfn-of-the-last-page.patch
diff --git a/queue-5.4/series b/queue-5.4/series
new file mode 100644 (file)
index 0000000..79741c3
--- /dev/null
@@ -0,0 +1,2 @@
+i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch
+kvm-svm-fix-potential-memory-leak-in-svm_cpu_init.patch
diff --git a/queue-5.6/series b/queue-5.6/series
new file mode 100644 (file)
index 0000000..0583602
--- /dev/null
@@ -0,0 +1 @@
+i2c-dev-fix-the-race-between-the-release-of-i2c_dev-and-cdev.patch