--- /dev/null
+From aeb8482a051ca25325d2231f59280bd1502ad940 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:48 +0200
+Subject: blk-cgroup: cleanup the blkg_lookup family of functions
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 4a69f325aa43847e0827fbfe4b3623307b0c9baa ]
+
+Add a fully inlined blkg_lookup as the extra two checks aren't going
+to generated a lot more code vs the call to the slowpath routine, and
+open code the hint update in the two callers that care.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-5-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 38 +++++++++++++++-----------------------
+ block/blk-cgroup.h | 39 ++++++++++++---------------------------
+ 2 files changed, 27 insertions(+), 50 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index ee48b6f4d5d4..f66cf1734e84 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -263,29 +263,13 @@ static struct blkcg_gq *blkg_alloc(struct blkcg *blkcg, struct request_queue *q,
+ return NULL;
+ }
+
+-struct blkcg_gq *blkg_lookup_slowpath(struct blkcg *blkcg,
+- struct request_queue *q, bool update_hint)
++static void blkg_update_hint(struct blkcg *blkcg, struct blkcg_gq *blkg)
+ {
+- struct blkcg_gq *blkg;
+-
+- /*
+- * Hint didn't match. Look up from the radix tree. Note that the
+- * hint can only be updated under queue_lock as otherwise @blkg
+- * could have already been removed from blkg_tree. The caller is
+- * responsible for grabbing queue_lock if @update_hint.
+- */
+- blkg = radix_tree_lookup(&blkcg->blkg_tree, q->id);
+- if (blkg && blkg->q == q) {
+- if (update_hint) {
+- lockdep_assert_held(&q->queue_lock);
+- rcu_assign_pointer(blkcg->blkg_hint, blkg);
+- }
+- return blkg;
+- }
++ lockdep_assert_held(&blkg->q->queue_lock);
+
+- return NULL;
++ if (blkcg != &blkcg_root && blkg != rcu_dereference(blkcg->blkg_hint))
++ rcu_assign_pointer(blkcg->blkg_hint, blkg);
+ }
+-EXPORT_SYMBOL_GPL(blkg_lookup_slowpath);
+
+ /*
+ * If @new_blkg is %NULL, this function tries to allocate a new one as
+@@ -397,9 +381,11 @@ static struct blkcg_gq *blkg_lookup_create(struct blkcg *blkcg,
+ return blkg;
+
+ spin_lock_irqsave(&q->queue_lock, flags);
+- blkg = __blkg_lookup(blkcg, q, true);
+- if (blkg)
++ blkg = blkg_lookup(blkcg, q);
++ if (blkg) {
++ blkg_update_hint(blkcg, blkg);
+ goto found;
++ }
+
+ /*
+ * Create blkgs walking down from blkcg_root to @blkcg, so that all
+@@ -621,12 +607,18 @@ static struct blkcg_gq *blkg_lookup_check(struct blkcg *blkcg,
+ const struct blkcg_policy *pol,
+ struct request_queue *q)
+ {
++ struct blkcg_gq *blkg;
++
+ WARN_ON_ONCE(!rcu_read_lock_held());
+ lockdep_assert_held(&q->queue_lock);
+
+ if (!blkcg_policy_enabled(q, pol))
+ return ERR_PTR(-EOPNOTSUPP);
+- return __blkg_lookup(blkcg, q, true /* update_hint */);
++
++ blkg = blkg_lookup(blkcg, q);
++ if (blkg)
++ blkg_update_hint(blkcg, blkg);
++ return blkg;
+ }
+
+ /**
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 30396cad50e9..91b7ae0773be 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -178,8 +178,6 @@ struct blkcg_policy {
+ extern struct blkcg blkcg_root;
+ extern bool blkcg_debug_stats;
+
+-struct blkcg_gq *blkg_lookup_slowpath(struct blkcg *blkcg,
+- struct request_queue *q, bool update_hint);
+ int blkcg_init_queue(struct request_queue *q);
+ void blkcg_exit_queue(struct request_queue *q);
+
+@@ -227,22 +225,21 @@ static inline bool bio_issue_as_root_blkg(struct bio *bio)
+ }
+
+ /**
+- * __blkg_lookup - internal version of blkg_lookup()
++ * blkg_lookup - lookup blkg for the specified blkcg - q pair
+ * @blkcg: blkcg of interest
+ * @q: request_queue of interest
+- * @update_hint: whether to update lookup hint with the result or not
+ *
+- * This is internal version and shouldn't be used by policy
+- * implementations. Looks up blkgs for the @blkcg - @q pair regardless of
+- * @q's bypass state. If @update_hint is %true, the caller should be
+- * holding @q->queue_lock and lookup hint is updated on success.
++ * Lookup blkg for the @blkcg - @q pair.
++
++ * Must be called in a RCU critical section.
+ */
+-static inline struct blkcg_gq *__blkg_lookup(struct blkcg *blkcg,
+- struct request_queue *q,
+- bool update_hint)
++static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg,
++ struct request_queue *q)
+ {
+ struct blkcg_gq *blkg;
+
++ WARN_ON_ONCE(!rcu_read_lock_held());
++
+ if (blkcg == &blkcg_root)
+ return q->root_blkg;
+
+@@ -250,22 +247,10 @@ static inline struct blkcg_gq *__blkg_lookup(struct blkcg *blkcg,
+ if (blkg && blkg->q == q)
+ return blkg;
+
+- return blkg_lookup_slowpath(blkcg, q, update_hint);
+-}
+-
+-/**
+- * blkg_lookup - lookup blkg for the specified blkcg - q pair
+- * @blkcg: blkcg of interest
+- * @q: request_queue of interest
+- *
+- * Lookup blkg for the @blkcg - @q pair. This function should be called
+- * under RCU read lock.
+- */
+-static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg,
+- struct request_queue *q)
+-{
+- WARN_ON_ONCE(!rcu_read_lock_held());
+- return __blkg_lookup(blkcg, q, false);
++ blkg = radix_tree_lookup(&blkcg->blkg_tree, q->id);
++ if (blkg && blkg->q != q)
++ blkg = NULL;
++ return blkg;
+ }
+
+ /**
+--
+2.35.1
+
--- /dev/null
+From 06b1a6a63c8fffaeef0d5f5ffe630222f54e5412 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:45 +0200
+Subject: blk-cgroup: fix error unwinding in blkcg_init_queue
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 33dc62796cb657a633050138a86253fb2a553713 ]
+
+When blk_throtl_init fails, we need to call blk_ioprio_exit. Switch to
+proper goto based unwinding to fix this.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-2-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index c8f0c865bf4e..bcd3873ac5ff 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1297,17 +1297,18 @@ int blkcg_init_queue(struct request_queue *q)
+
+ ret = blk_throtl_init(q);
+ if (ret)
+- goto err_destroy_all;
++ goto err_ioprio_exit;
+
+ ret = blk_iolatency_init(q);
+- if (ret) {
+- blk_throtl_exit(q);
+- blk_ioprio_exit(q);
+- goto err_destroy_all;
+- }
++ if (ret)
++ goto err_throtl_exit;
+
+ return 0;
+
++err_throtl_exit:
++ blk_throtl_exit(q);
++err_ioprio_exit:
++ blk_ioprio_exit(q);
+ err_destroy_all:
+ blkg_destroy_all(q);
+ return ret;
+--
+2.35.1
+
--- /dev/null
+From 54129f8d012227dc601d096cba4e626a16fc194c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:50 +0200
+Subject: blk-cgroup: pass a gendisk to blkcg_init_queue and blkcg_exit_queue
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 9823538fb7efe66ce987a1e4c0e0f3dc882623c4 ]
+
+Pass the gendisk to blkcg_init_disk and blkcg_exit_disk as part of moving
+the blk-cgroup infrastructure to be gendisk based. Also remove the
+rather pointless kerneldoc comments for these internal functions with a
+single caller each.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-7-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 25 +++++--------------------
+ block/blk-cgroup.h | 8 ++++----
+ block/genhd.c | 5 +++--
+ 3 files changed, 12 insertions(+), 26 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index f66cf1734e84..4943f36d8a84 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1246,18 +1246,9 @@ static int blkcg_css_online(struct cgroup_subsys_state *css)
+ return 0;
+ }
+
+-/**
+- * blkcg_init_queue - initialize blkcg part of request queue
+- * @q: request_queue to initialize
+- *
+- * Called from blk_alloc_queue(). Responsible for initializing blkcg
+- * part of new request_queue @q.
+- *
+- * RETURNS:
+- * 0 on success, -errno on failure.
+- */
+-int blkcg_init_queue(struct request_queue *q)
++int blkcg_init_disk(struct gendisk *disk)
+ {
++ struct request_queue *q = disk->queue;
+ struct blkcg_gq *new_blkg, *blkg;
+ bool preloaded;
+ int ret;
+@@ -1310,16 +1301,10 @@ int blkcg_init_queue(struct request_queue *q)
+ return PTR_ERR(blkg);
+ }
+
+-/**
+- * blkcg_exit_queue - exit and release blkcg part of request_queue
+- * @q: request_queue being released
+- *
+- * Called from blk_exit_queue(). Responsible for exiting blkcg part.
+- */
+-void blkcg_exit_queue(struct request_queue *q)
++void blkcg_exit_disk(struct gendisk *disk)
+ {
+- blkg_destroy_all(q);
+- blk_throtl_exit(q);
++ blkg_destroy_all(disk->queue);
++ blk_throtl_exit(disk->queue);
+ }
+
+ static void blkcg_bind(struct cgroup_subsys_state *root_css)
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index 91b7ae0773be..aa2b286bc825 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -178,8 +178,8 @@ struct blkcg_policy {
+ extern struct blkcg blkcg_root;
+ extern bool blkcg_debug_stats;
+
+-int blkcg_init_queue(struct request_queue *q);
+-void blkcg_exit_queue(struct request_queue *q);
++int blkcg_init_disk(struct gendisk *disk);
++void blkcg_exit_disk(struct gendisk *disk);
+
+ /* Blkio controller policy registration */
+ int blkcg_policy_register(struct blkcg_policy *pol);
+@@ -481,8 +481,8 @@ struct blkcg {
+ };
+
+ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { return NULL; }
+-static inline int blkcg_init_queue(struct request_queue *q) { return 0; }
+-static inline void blkcg_exit_queue(struct request_queue *q) { }
++static inline int blkcg_init_disk(struct gendisk *disk) { return 0; }
++static inline void blkcg_exit_disk(struct gendisk *disk) { }
+ static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
+ static inline void blkcg_policy_unregister(struct blkcg_policy *pol) { }
+ static inline int blkcg_activate_policy(struct request_queue *q,
+diff --git a/block/genhd.c b/block/genhd.c
+index 28654723bc2b..0568da4c0a2e 100644
+--- a/block/genhd.c
++++ b/block/genhd.c
+@@ -1154,7 +1154,8 @@ static void disk_release(struct device *dev)
+ !test_bit(GD_ADDED, &disk->state))
+ blk_mq_exit_queue(disk->queue);
+
+- blkcg_exit_queue(disk->queue);
++ blkcg_exit_disk(disk);
++
+ bioset_exit(&disk->bio_split);
+
+ disk_release_events(disk);
+@@ -1367,7 +1368,7 @@ struct gendisk *__alloc_disk_node(struct request_queue *q, int node_id,
+ if (xa_insert(&disk->part_tbl, 0, disk->part0, GFP_KERNEL))
+ goto out_destroy_part_tbl;
+
+- if (blkcg_init_queue(q))
++ if (blkcg_init_disk(disk))
+ goto out_erase_part0;
+
+ rand_initialize_disk(disk);
+--
+2.35.1
+
--- /dev/null
+From 34d1ff832bd95f54409c053df67ccbb22f9f78d6 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:59 +0200
+Subject: blk-cgroup: pass a gendisk to blkg_destroy_all
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 00ad6991bbae116b7c83f68754edd6f4d5e65e01 ]
+
+Pass the gendisk to blkg_destroy_all as part of moving the blk-cgroup
+infrastructure to be gendisk based.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-16-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 13 ++++---------
+ 1 file changed, 4 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index afe802e1180f..cd682fe46d2f 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -462,14 +462,9 @@ static void blkg_destroy(struct blkcg_gq *blkg)
+ percpu_ref_kill(&blkg->refcnt);
+ }
+
+-/**
+- * blkg_destroy_all - destroy all blkgs associated with a request_queue
+- * @q: request_queue of interest
+- *
+- * Destroy all blkgs associated with @q.
+- */
+-static void blkg_destroy_all(struct request_queue *q)
++static void blkg_destroy_all(struct gendisk *disk)
+ {
++ struct request_queue *q = disk->queue;
+ struct blkcg_gq *blkg, *n;
+ int count = BLKG_DESTROY_BATCH_SIZE;
+
+@@ -1292,7 +1287,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ err_ioprio_exit:
+ blk_ioprio_exit(q);
+ err_destroy_all:
+- blkg_destroy_all(q);
++ blkg_destroy_all(disk);
+ return ret;
+ err_unlock:
+ spin_unlock_irq(&q->queue_lock);
+@@ -1303,7 +1298,7 @@ int blkcg_init_disk(struct gendisk *disk)
+
+ void blkcg_exit_disk(struct gendisk *disk)
+ {
+- blkg_destroy_all(disk->queue);
++ blkg_destroy_all(disk);
+ blk_throtl_exit(disk);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 84627b3a7ae54c910bc1c7b74cbd7f976a146c5f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:46 +0200
+Subject: blk-cgroup: remove blk_queue_root_blkg
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 928f6f00a91ecbef6cb1fe59474831ceaf205290 ]
+
+Just open code it in the only caller and drop the unused !BLK_CGROUP
+stub.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-3-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 3 +--
+ block/blk-cgroup.h | 13 -------------
+ 2 files changed, 1 insertion(+), 15 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index bcd3873ac5ff..11f256214928 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -915,8 +915,7 @@ static void blkcg_fill_root_iostats(void)
+ class_dev_iter_init(&iter, &block_class, NULL, &disk_type);
+ while ((dev = class_dev_iter_next(&iter))) {
+ struct block_device *bdev = dev_to_bdev(dev);
+- struct blkcg_gq *blkg =
+- blk_queue_root_blkg(bdev_get_queue(bdev));
++ struct blkcg_gq *blkg = bdev->bd_disk->queue->root_blkg;
+ struct blkg_iostat tmp;
+ int cpu;
+ unsigned long flags;
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index d2724d1dd7c9..c1fb00a1dfc0 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -268,17 +268,6 @@ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg,
+ return __blkg_lookup(blkcg, q, false);
+ }
+
+-/**
+- * blk_queue_root_blkg - return blkg for the (blkcg_root, @q) pair
+- * @q: request_queue of interest
+- *
+- * Lookup blkg for @q at the root level. See also blkg_lookup().
+- */
+-static inline struct blkcg_gq *blk_queue_root_blkg(struct request_queue *q)
+-{
+- return q->root_blkg;
+-}
+-
+ /**
+ * blkg_to_pdata - get policy private data
+ * @blkg: blkg of interest
+@@ -507,8 +496,6 @@ struct blkcg {
+ };
+
+ static inline struct blkcg_gq *blkg_lookup(struct blkcg *blkcg, void *key) { return NULL; }
+-static inline struct blkcg_gq *blk_queue_root_blkg(struct request_queue *q)
+-{ return NULL; }
+ static inline int blkcg_init_queue(struct request_queue *q) { return 0; }
+ static inline void blkcg_exit_queue(struct request_queue *q) { }
+ static inline int blkcg_policy_register(struct blkcg_policy *pol) { return 0; }
+--
+2.35.1
+
--- /dev/null
+From 97f974fe3002c969d06f4b46fd91cac7fddfcb9f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:47 +0200
+Subject: blk-cgroup: remove open coded blkg_lookup instances
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit 79fcc5be93e5b17a2a5d36553f7a5c1ad9e953b6 ]
+
+Use blkg_lookup instead of open coding it.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-4-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 +++---
+ block/blk-cgroup.h | 8 ++++----
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 11f256214928..ee48b6f4d5d4 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -324,7 +324,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg,
+
+ /* link parent */
+ if (blkcg_parent(blkcg)) {
+- blkg->parent = __blkg_lookup(blkcg_parent(blkcg), q, false);
++ blkg->parent = blkg_lookup(blkcg_parent(blkcg), q);
+ if (WARN_ON_ONCE(!blkg->parent)) {
+ ret = -ENODEV;
+ goto err_put_css;
+@@ -412,7 +412,7 @@ static struct blkcg_gq *blkg_lookup_create(struct blkcg *blkcg,
+ struct blkcg_gq *ret_blkg = q->root_blkg;
+
+ while (parent) {
+- blkg = __blkg_lookup(parent, q, false);
++ blkg = blkg_lookup(parent, q);
+ if (blkg) {
+ /* remember closest blkg */
+ ret_blkg = blkg;
+@@ -724,7 +724,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ struct blkcg_gq *new_blkg;
+
+ parent = blkcg_parent(blkcg);
+- while (parent && !__blkg_lookup(parent, q, false)) {
++ while (parent && !blkg_lookup(parent, q)) {
+ pos = parent;
+ parent = blkcg_parent(parent);
+ }
+diff --git a/block/blk-cgroup.h b/block/blk-cgroup.h
+index c1fb00a1dfc0..30396cad50e9 100644
+--- a/block/blk-cgroup.h
++++ b/block/blk-cgroup.h
+@@ -362,8 +362,8 @@ static inline void blkg_put(struct blkcg_gq *blkg)
+ */
+ #define blkg_for_each_descendant_pre(d_blkg, pos_css, p_blkg) \
+ css_for_each_descendant_pre((pos_css), &(p_blkg)->blkcg->css) \
+- if (((d_blkg) = __blkg_lookup(css_to_blkcg(pos_css), \
+- (p_blkg)->q, false)))
++ if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css), \
++ (p_blkg)->q)))
+
+ /**
+ * blkg_for_each_descendant_post - post-order walk of a blkg's descendants
+@@ -377,8 +377,8 @@ static inline void blkg_put(struct blkcg_gq *blkg)
+ */
+ #define blkg_for_each_descendant_post(d_blkg, pos_css, p_blkg) \
+ css_for_each_descendant_post((pos_css), &(p_blkg)->blkcg->css) \
+- if (((d_blkg) = __blkg_lookup(css_to_blkcg(pos_css), \
+- (p_blkg)->q, false)))
++ if (((d_blkg) = blkg_lookup(css_to_blkcg(pos_css), \
++ (p_blkg)->q)))
+
+ bool __blkcg_punt_bio_submit(struct bio *bio);
+
+--
+2.35.1
+
--- /dev/null
+From e41ce75f577709ae4e9eb828f017d3e992a3a04e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 10 Dec 2022 08:33:10 -1000
+Subject: blk-iolatency: Fix memory leak on add_disk() failures
+
+From: Tejun Heo <tj@kernel.org>
+
+[ Upstream commit 813e693023ba10da9e75067780f8378465bf27cc ]
+
+When a gendisk is successfully initialized but add_disk() fails such as when
+a loop device has invalid number of minor device numbers specified,
+blkcg_init_disk() is called during init and then blkcg_exit_disk() during
+error handling. Unfortunately, iolatency gets initialized in the former but
+doesn't get cleaned up in the latter.
+
+This is because, in non-error cases, the cleanup is performed by
+del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos
+policies, iolatency being one of them, can only be activated once the disk
+is fully registered and visible. That assumption is true for wbt and iocost,
+but not so for iolatency as it gets initialized before add_disk() is called.
+
+It is desirable to lazy-init rq_qos policies because they are optional
+features and add to hot path overhead once initialized - each IO has to walk
+all the registered rq_qos policies. So, we want to switch iolatency to lazy
+init too. However, that's a bigger change. As a fix for the immediate
+problem, let's just add an extra call to rq_qos_exit() in blkcg_exit_disk().
+This is safe because duplicate calls to rq_qos_exit() become noop's.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: darklight2357@icloud.com
+Cc: Josef Bacik <josef@toxicpanda.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Fixes: d70675121546 ("block: introduce blk-iolatency io controller")
+Cc: stable@vger.kernel.org # v4.19+
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/Y5TQ5gm3O4HXrXR3@slm.duckdns.org
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index cd682fe46d2f..ee517fb06aa6 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -33,6 +33,7 @@
+ #include "blk-cgroup.h"
+ #include "blk-ioprio.h"
+ #include "blk-throttle.h"
++#include "blk-rq-qos.h"
+
+ /*
+ * blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation.
+@@ -1299,6 +1300,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ void blkcg_exit_disk(struct gendisk *disk)
+ {
+ blkg_destroy_all(disk);
++ rq_qos_exit(disk->queue);
+ blk_throtl_exit(disk);
+ }
+
+--
+2.35.1
+
--- /dev/null
+From 78fc8eb22a06cb274ada974f3456702d520fc780 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 21 Sep 2022 20:04:56 +0200
+Subject: blk-throttle: pass a gendisk to blk_throtl_init and blk_throtl_exit
+
+From: Christoph Hellwig <hch@lst.de>
+
+[ Upstream commit e13793bae65919cd3e6a7827f8d30f4dbb8584ee ]
+
+Pass the gendisk to blk_throtl_init and blk_throtl_exit as part of moving
+the blk-cgroup infrastructure to be gendisk based.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Andreas Herrmann <aherrmann@suse.de>
+Acked-by: Tejun Heo <tj@kernel.org>
+Link: https://lore.kernel.org/r/20220921180501.1539876-13-hch@lst.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Stable-dep-of: 813e693023ba ("blk-iolatency: Fix memory leak on add_disk() failures")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ block/blk-cgroup.c | 6 +++---
+ block/blk-throttle.c | 7 +++++--
+ block/blk-throttle.h | 8 ++++----
+ 3 files changed, 12 insertions(+), 9 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index 4943f36d8a84..afe802e1180f 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -1277,7 +1277,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ if (ret)
+ goto err_destroy_all;
+
+- ret = blk_throtl_init(q);
++ ret = blk_throtl_init(disk);
+ if (ret)
+ goto err_ioprio_exit;
+
+@@ -1288,7 +1288,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ return 0;
+
+ err_throtl_exit:
+- blk_throtl_exit(q);
++ blk_throtl_exit(disk);
+ err_ioprio_exit:
+ blk_ioprio_exit(q);
+ err_destroy_all:
+@@ -1304,7 +1304,7 @@ int blkcg_init_disk(struct gendisk *disk)
+ void blkcg_exit_disk(struct gendisk *disk)
+ {
+ blkg_destroy_all(disk->queue);
+- blk_throtl_exit(disk->queue);
++ blk_throtl_exit(disk);
+ }
+
+ static void blkcg_bind(struct cgroup_subsys_state *root_css)
+diff --git a/block/blk-throttle.c b/block/blk-throttle.c
+index 35cf744ea9d1..f84a6ed440c9 100644
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2276,8 +2276,9 @@ void blk_throtl_bio_endio(struct bio *bio)
+ }
+ #endif
+
+-int blk_throtl_init(struct request_queue *q)
++int blk_throtl_init(struct gendisk *disk)
+ {
++ struct request_queue *q = disk->queue;
+ struct throtl_data *td;
+ int ret;
+
+@@ -2319,8 +2320,10 @@ int blk_throtl_init(struct request_queue *q)
+ return ret;
+ }
+
+-void blk_throtl_exit(struct request_queue *q)
++void blk_throtl_exit(struct gendisk *disk)
+ {
++ struct request_queue *q = disk->queue;
++
+ BUG_ON(!q->td);
+ del_timer_sync(&q->td->service_queue.pending_timer);
+ throtl_shutdown_wq(q);
+diff --git a/block/blk-throttle.h b/block/blk-throttle.h
+index ee7299e6dea9..e8c2b3d4a18b 100644
+--- a/block/blk-throttle.h
++++ b/block/blk-throttle.h
+@@ -159,14 +159,14 @@ static inline struct throtl_grp *blkg_to_tg(struct blkcg_gq *blkg)
+ * Internal throttling interface
+ */
+ #ifndef CONFIG_BLK_DEV_THROTTLING
+-static inline int blk_throtl_init(struct request_queue *q) { return 0; }
+-static inline void blk_throtl_exit(struct request_queue *q) { }
++static inline int blk_throtl_init(struct gendisk *disk) { return 0; }
++static inline void blk_throtl_exit(struct gendisk *disk) { }
+ static inline void blk_throtl_register_queue(struct request_queue *q) { }
+ static inline bool blk_throtl_bio(struct bio *bio) { return false; }
+ static inline void blk_throtl_cancel_bios(struct request_queue *q) { }
+ #else /* CONFIG_BLK_DEV_THROTTLING */
+-int blk_throtl_init(struct request_queue *q);
+-void blk_throtl_exit(struct request_queue *q);
++int blk_throtl_init(struct gendisk *disk);
++void blk_throtl_exit(struct gendisk *disk);
+ void blk_throtl_register_queue(struct request_queue *q);
+ bool __blk_throtl_bio(struct bio *bio);
+ void blk_throtl_cancel_bios(struct request_queue *q);
+--
+2.35.1
+
--- /dev/null
+From 23ee1709c1c32837b72b50038065aedf25815e0d Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 00:02:53 +0100
+Subject: bpf: Resolve fext program type when checking map compatibility
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Toke Høiland-Jørgensen <toke@redhat.com>
+
+[ Upstream commit 1c123c567fb138ebd187480b7fc0610fcb0851f5 ]
+
+The bpf_prog_map_compatible() check makes sure that BPF program types are
+not mixed inside BPF map types that can contain programs (tail call maps,
+cpumaps and devmaps). It does this by setting the fields of the map->owner
+struct to the values of the first program being checked against, and
+rejecting any subsequent programs if the values don't match.
+
+One of the values being set in the map owner struct is the program type,
+and since the code did not resolve the prog type for fext programs, the map
+owner type would be set to PROG_TYPE_EXT and subsequent loading of programs
+of the target type into the map would fail.
+
+This bug is seen in particular for XDP programs that are loaded as
+PROG_TYPE_EXT using libxdp; these cannot insert programs into devmaps and
+cpumaps because the check fails as described above.
+
+Fix the bug by resolving the fext program type to its target program type
+as elsewhere in the verifier.
+
+v3:
+- Add Yonghong's ACK
+
+Fixes: f45d5b6ce2e8 ("bpf: generalise tail call map compatibility check")
+Acked-by: Yonghong Song <yhs@fb.com>
+Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
+Link: https://lore.kernel.org/r/20221214230254.790066-1-toke@redhat.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/bpf/core.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
+index c4600a5781de..7d315c94b80a 100644
+--- a/kernel/bpf/core.c
++++ b/kernel/bpf/core.c
+@@ -2088,6 +2088,7 @@ static unsigned int __bpf_prog_ret0_warn(const void *ctx,
+ bool bpf_prog_map_compatible(struct bpf_map *map,
+ const struct bpf_prog *fp)
+ {
++ enum bpf_prog_type prog_type = resolve_prog_type(fp);
+ bool ret;
+
+ if (fp->kprobe_override)
+@@ -2098,12 +2099,12 @@ bool bpf_prog_map_compatible(struct bpf_map *map,
+ /* There's no owner yet where we could check for
+ * compatibility.
+ */
+- map->owner.type = fp->type;
++ map->owner.type = prog_type;
+ map->owner.jited = fp->jited;
+ map->owner.xdp_has_frags = fp->aux->xdp_has_frags;
+ ret = true;
+ } else {
+- ret = map->owner.type == fp->type &&
++ ret = map->owner.type == prog_type &&
+ map->owner.jited == fp->jited &&
+ map->owner.xdp_has_frags == fp->aux->xdp_has_frags;
+ }
+--
+2.35.1
+
--- /dev/null
+From a7acae869aa09950d87f35d156e78f5d2a4d0bc0 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 19 Dec 2022 10:21:50 -0300
+Subject: cifs: don't leak -ENOMEM in smb2_open_file()
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit f60ffa662d1427cfd31fe9d895c3566ac50bfe52 ]
+
+A NULL error response might be a valid case where smb2_reconnect()
+failed to reconnect the session and tcon due to a disconnected server
+prior to issuing the I/O operation, so don't leak -ENOMEM to userspace
+on such occasions.
+
+Fixes: 76894f3e2f71 ("cifs: improve symlink handling for smb2+")
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2file.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index ffbd9a99fc12..ba6cc50af390 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -122,8 +122,8 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32
+ struct smb2_hdr *hdr = err_iov.iov_base;
+
+ if (unlikely(!err_iov.iov_base || err_buftype == CIFS_NO_BUFFER))
+- rc = -ENOMEM;
+- else if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
++ goto out;
++ if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
+ rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov,
+ &data->symlink_target);
+ if (!rc) {
+--
+2.35.1
+
--- /dev/null
+From 810eccbce5f5281d5666052aa44f22ef00f0ece5 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 14 Oct 2022 13:40:42 -0300
+Subject: cifs: fix static checker warning
+
+From: Paulo Alcantara <pc@cjr.nz>
+
+[ Upstream commit a9e17d3d74d14e5fd10d54f0a07e0fce4e5f80dd ]
+
+Remove unnecessary NULL check of oparam->cifs_sb when parsing symlink
+error response as it's already set by all smb2_open_file() callers and
+deferenced earlier.
+
+This fixes below report:
+
+ fs/cifs/smb2file.c:126 smb2_open_file()
+ warn: variable dereferenced before check 'oparms->cifs_sb' (see line 112)
+
+Link: https://lore.kernel.org/r/Y0kt42j2tdpYakRu@kili
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Paulo Alcantara (SUSE) <pc@cjr.nz>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Stable-dep-of: f60ffa662d14 ("cifs: don't leak -ENOMEM in smb2_open_file()")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/cifs/smb2file.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c
+index 4992b43616a7..ffbd9a99fc12 100644
+--- a/fs/cifs/smb2file.c
++++ b/fs/cifs/smb2file.c
+@@ -123,7 +123,7 @@ int smb2_open_file(const unsigned int xid, struct cifs_open_parms *oparms, __u32
+
+ if (unlikely(!err_iov.iov_base || err_buftype == CIFS_NO_BUFFER))
+ rc = -ENOMEM;
+- else if (hdr->Status == STATUS_STOPPED_ON_SYMLINK && oparms->cifs_sb) {
++ else if (hdr->Status == STATUS_STOPPED_ON_SYMLINK) {
+ rc = smb2_parse_symlink_response(oparms->cifs_sb, &err_iov,
+ &data->symlink_target);
+ if (!rc) {
+--
+2.35.1
+
--- /dev/null
+usb-dwc3-qcom-fix-memory-leak-in-dwc3_qcom_interconn.patch
+blk-cgroup-fix-error-unwinding-in-blkcg_init_queue.patch
+blk-cgroup-remove-blk_queue_root_blkg.patch
+blk-cgroup-remove-open-coded-blkg_lookup-instances.patch
+blk-cgroup-cleanup-the-blkg_lookup-family-of-functio.patch
+blk-cgroup-pass-a-gendisk-to-blkcg_init_queue-and-bl.patch
+blk-throttle-pass-a-gendisk-to-blk_throtl_init-and-b.patch
+blk-cgroup-pass-a-gendisk-to-blkg_destroy_all.patch
+blk-iolatency-fix-memory-leak-on-add_disk-failures.patch
+cifs-fix-static-checker-warning.patch
+cifs-don-t-leak-enomem-in-smb2_open_file.patch
+bpf-resolve-fext-program-type-when-checking-map-comp.patch
--- /dev/null
+From 8e3246f1ab63d47ac516417de976951377426ea7 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 6 Dec 2022 12:17:31 +0400
+Subject: usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
+
+From: Miaoqian Lin <linmq006@gmail.com>
+
+[ Upstream commit 97a48da1619ba6bd42a0e5da0a03aa490a9496b1 ]
+
+of_icc_get() alloc resources for path handle, we should release it when not
+need anymore. Like the release in dwc3_qcom_interconnect_exit() function.
+Add icc_put() in error handling to fix this.
+
+Fixes: bea46b981515 ("usb: dwc3: qcom: Add interconnect support in dwc3 driver")
+Cc: stable <stable@kernel.org>
+Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
+Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
+Link: https://lore.kernel.org/r/20221206081731.818107-1-linmq006@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/usb/dwc3/dwc3-qcom.c | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
+index d3f3937d7005..e7d37b6000ad 100644
+--- a/drivers/usb/dwc3/dwc3-qcom.c
++++ b/drivers/usb/dwc3/dwc3-qcom.c
+@@ -260,7 +260,8 @@ static int dwc3_qcom_interconnect_init(struct dwc3_qcom *qcom)
+ if (IS_ERR(qcom->icc_path_apps)) {
+ dev_err(dev, "failed to get apps-usb path: %ld\n",
+ PTR_ERR(qcom->icc_path_apps));
+- return PTR_ERR(qcom->icc_path_apps);
++ ret = PTR_ERR(qcom->icc_path_apps);
++ goto put_path_ddr;
+ }
+
+ if (usb_get_maximum_speed(&qcom->dwc3->dev) >= USB_SPEED_SUPER ||
+@@ -273,17 +274,23 @@ static int dwc3_qcom_interconnect_init(struct dwc3_qcom *qcom)
+
+ if (ret) {
+ dev_err(dev, "failed to set bandwidth for usb-ddr path: %d\n", ret);
+- return ret;
++ goto put_path_apps;
+ }
+
+ ret = icc_set_bw(qcom->icc_path_apps,
+ APPS_USB_AVG_BW, APPS_USB_PEAK_BW);
+ if (ret) {
+ dev_err(dev, "failed to set bandwidth for apps-usb path: %d\n", ret);
+- return ret;
++ goto put_path_apps;
+ }
+
+ return 0;
++
++put_path_apps:
++ icc_put(qcom->icc_path_apps);
++put_path_ddr:
++ icc_put(qcom->icc_path_ddr);
++ return ret;
+ }
+
+ /**
+--
+2.35.1
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
