From: Greg Kroah-Hartman Date: Mon, 9 Nov 2020 10:48:30 +0000 (+0100) Subject: 5.9-stable patches X-Git-Tag: v4.4.242~7 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=211e5ae50baa375bde50530487eb9e005ebfa80d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.9-stable patches added patches: arc-stack-unwinding-avoid-indefinite-looping.patch drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch io_uring-fix-link-lookup-racing-with-link-timeout.patch mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch pm-runtime-drop-pm_runtime_clean_up_links.patch pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch usb-add-no_lpm-quirk-for-kingston-flash-drive.patch usb-dwc3-ep0-fix-delay-status-handling.patch usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch --- diff --git a/queue-5.9/arc-stack-unwinding-avoid-indefinite-looping.patch b/queue-5.9/arc-stack-unwinding-avoid-indefinite-looping.patch new file mode 100644 index 00000000000..2c794ff2c61 --- /dev/null +++ b/queue-5.9/arc-stack-unwinding-avoid-indefinite-looping.patch @@ -0,0 +1,72 @@ +From 328d2168ca524d501fc4b133d6be076142bd305c Mon Sep 17 00:00:00 2001 +From: Vineet Gupta +Date: Tue, 27 Oct 2020 15:01:17 -0700 +Subject: ARC: stack unwinding: avoid indefinite looping + +From: Vineet Gupta + +commit 328d2168ca524d501fc4b133d6be076142bd305c upstream. + +Currently stack unwinder is a while(1) loop which relies on the dwarf +unwinder to signal termination, which in turn relies on dwarf info to do +so. This in theory could cause an infinite loop if the dwarf info was +somehow messed up or the register contents were etc. + +This fix thus detects the excessive looping and breaks the loop. + +| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached +| CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq +| Load average: 4.33 2.60 1.11 2/74 139 +| PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND +| 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea] +| 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea] +| 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea] +| 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri] +| 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak] +| 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf] +| 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 138 115 root R 1464 0.1 2 0.1 top +| 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] +| 115 1 root S 1472 0.1 1 0.0 -/bin/sh +| 104 1 root S 1464 0.1 0 0.0 inetd +| 1 0 root S 1456 0.1 2 0.0 init +| 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages +| 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta] +| 10 2 root IW 0 0.0 1 0.0 [rcu_preempt] +| 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve] +| 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve] +| 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve] +| unwinder looping too long, aborting ! + +Cc: +Signed-off-by: Vineet Gupta +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arc/kernel/stacktrace.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/arch/arc/kernel/stacktrace.c ++++ b/arch/arc/kernel/stacktrace.c +@@ -112,7 +112,7 @@ arc_unwind_core(struct task_struct *tsk, + int (*consumer_fn) (unsigned int, void *), void *arg) + { + #ifdef CONFIG_ARC_DW2_UNWIND +- int ret = 0; ++ int ret = 0, cnt = 0; + unsigned int address; + struct unwind_frame_info frame_info; + +@@ -132,6 +132,11 @@ arc_unwind_core(struct task_struct *tsk, + break; + + frame_info.regs.r63 = frame_info.regs.r31; ++ ++ if (cnt++ > 128) { ++ printk("unwinder looping too long, aborting !\n"); ++ return 0; ++ } + } + + return address; /* return the last address it saw */ diff --git a/queue-5.9/drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch b/queue-5.9/drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch new file mode 100644 index 00000000000..cf3f2b10cfd --- /dev/null +++ b/queue-5.9/drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch @@ -0,0 +1,85 @@ +From d9a57c853975742c8281f703b9e536d8aa016ec2 Mon Sep 17 00:00:00 2001 +From: Imre Deak +Date: Tue, 27 Oct 2020 18:09:28 +0200 +Subject: drm/i915: Fix encoder lookup during PSR atomic check + +From: Imre Deak + +commit d9a57c853975742c8281f703b9e536d8aa016ec2 upstream. + +The atomic check hooks must look up the encoder to be used with a +connector from the connector's atomic state, and not assume that it's +the connector's current attached encoder. The latter one can change +under the atomic check func, or can be unset yet as in the case of MST +connectors. + +This fixes +[ 7.940719] Oops: 0000 [#1] SMP NOPTI +[ 7.944407] CPU: 2 PID: 143 Comm: kworker/2:2 Not tainted 5.6.0-1023-oem #23-Ubuntu +[ 7.952102] Hardware name: Dell Inc. Latitude 7320/, BIOS 88.87.11 09/07/2020 +[ 7.959278] Workqueue: events output_poll_execute [drm_kms_helper] +[ 7.965511] RIP: 0010:intel_psr_atomic_check+0x37/0xa0 [i915] +[ 7.971327] Code: 80 2d 06 00 00 20 74 42 80 b8 34 71 00 00 00 74 39 48 8b 72 08 48 85 f6 74 30 80 b8 f8 71 00 00 00 74 27 4c 8b 87 80 04 00 00 <41> 8b 78 78 83 ff 08 77 19 31 c9 83 ff 05 77 19 48 81 c1 20 01 00 +[ 7.977541] input: PS/2 Generic Mouse as /devices/platform/i8042/serio1/input/input5 +[ 7.990154] RSP: 0018:ffffb864c073fac8 EFLAGS: 00010202 +[ 7.990155] RAX: ffff8c5d55ce0000 RBX: ffff8c5d54519000 RCX: 0000000000000000 +[ 7.990155] RDX: ffff8c5d55cb30c0 RSI: ffff8c5d89a0c800 RDI: ffff8c5d55fcf800 +[ 7.990156] RBP: ffffb864c073fac8 R08: 0000000000000000 R09: ffff8c5d55d9f3a0 +[ 7.990156] R10: ffff8c5d55cb30c0 R11: 0000000000000009 R12: ffff8c5d55fcf800 +[ 7.990156] R13: ffff8c5d55cb30c0 R14: ffff8c5d56989cc0 R15: ffff8c5d56989cc0 +[ 7.990158] FS: 0000000000000000(0000) GS:ffff8c5d8e480000(0000) knlGS:0000000000000000 +[ 8.047193] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 8.052970] CR2: 0000000000000078 CR3: 0000000856500005 CR4: 0000000000760ee0 +[ 8.060137] PKRU: 55555554 +[ 8.062867] Call Trace: +[ 8.065361] intel_digital_connector_atomic_check+0x53/0x130 [i915] +[ 8.071703] intel_dp_mst_atomic_check+0x5b/0x200 [i915] +[ 8.077074] drm_atomic_helper_check_modeset+0x1db/0x790 [drm_kms_helper] +[ 8.083942] intel_atomic_check+0x92/0xc50 [i915] +[ 8.088705] ? drm_plane_check_pixel_format+0x4f/0xb0 [drm] +[ 8.094345] ? drm_atomic_plane_check+0x7a/0x3a0 [drm] +[ 8.099548] drm_atomic_check_only+0x2b1/0x450 [drm] +[ 8.104573] drm_atomic_commit+0x18/0x50 [drm] +[ 8.109070] drm_client_modeset_commit_atomic+0x1c9/0x200 [drm] +[ 8.115056] drm_client_modeset_commit_force+0x55/0x160 [drm] +[ 8.120866] drm_fb_helper_restore_fbdev_mode_unlocked+0x54/0xb0 [drm_kms_helper] +[ 8.128415] drm_fb_helper_set_par+0x34/0x50 [drm_kms_helper] +[ 8.134225] drm_fb_helper_hotplug_event.part.0+0xb4/0xe0 [drm_kms_helper] +[ 8.141150] drm_fb_helper_hotplug_event+0x1c/0x30 [drm_kms_helper] +[ 8.147481] intel_fbdev_output_poll_changed+0x6f/0xa0 [i915] +[ 8.153287] drm_kms_helper_hotplug_event+0x2c/0x40 [drm_kms_helper] +[ 8.159709] output_poll_execute+0x1aa/0x1c0 [drm_kms_helper] +[ 8.165506] process_one_work+0x1e8/0x3b0 +[ 8.169561] worker_thread+0x4d/0x400 +[ 8.173249] kthread+0x104/0x140 +[ 8.176515] ? process_one_work+0x3b0/0x3b0 +[ 8.180726] ? kthread_park+0x90/0x90 +[ 8.184416] ret_from_fork+0x1f/0x40 + +Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/2361 +References: https://gitlab.freedesktop.org/drm/intel/-/issues/2486 +Reported-by: William Tseng +Reported-by: Cooper Chiou +Cc: +Signed-off-by: Imre Deak +Reviewed-by: Anshuman Gupta +Link: https://patchwork.freedesktop.org/patch/msgid/20201027160928.3665377-1-imre.deak@intel.com +(cherry picked from commit 00e5deb5c4f5fe367311465e720e65cfa1178792) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/display/intel_psr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/display/intel_psr.c ++++ b/drivers/gpu/drm/i915/display/intel_psr.c +@@ -1672,7 +1672,7 @@ void intel_psr_atomic_check(struct drm_c + return; + + intel_connector = to_intel_connector(connector); +- dig_port = enc_to_dig_port(intel_attached_encoder(intel_connector)); ++ dig_port = enc_to_dig_port(to_intel_encoder(new_state->best_encoder)); + if (dev_priv->psr.dp != &dig_port->dp) + return; + diff --git a/queue-5.9/drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch b/queue-5.9/drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch new file mode 100644 index 00000000000..44da071680d --- /dev/null +++ b/queue-5.9/drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch @@ -0,0 +1,171 @@ +From 8ce70996f759a37bac92e69ae0addd715227bfd1 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Thu, 22 Oct 2020 07:41:27 +0100 +Subject: drm/i915/gt: Use the local HWSP offset during submission + +From: Chris Wilson + +commit 8ce70996f759a37bac92e69ae0addd715227bfd1 upstream. + +We wrap the timeline on construction of the next request, but there may +still be requests in flight that have not yet finalized the breadcrumb. +(The breadcrumb is delayed as we need engine-local offsets, and for the +virtual engine that is not known until execution.) As such, by the time +we write to the timeline's HWSP offset it may have changed, and we +should use the value we preserved in the request instead. + +Though the window is small and infrequent (at full flow we can expect a +timeline's seqno to wrap once every 30 minutes), the impact of writing +the old seqno into the new HWSP is severe: the old requests are never +completed, and the new requests are completed before they are even +submitted. + +Fixes: ebece7539242 ("drm/i915: Keep timeline HWSP allocated until idle across the system") +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Cc: Joonas Lahtinen +Cc: # v5.2+ +Reviewed-by: Mika Kuoppala +Link: https://patchwork.freedesktop.org/patch/msgid/20201022064127.10159-1-chris@chris-wilson.co.uk +(cherry picked from commit c10f6019d0b2dc8a6a62b55459f3ada5bc4e5e1a) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gt/intel_lrc.c | 27 +++++++++++++++++-------- + drivers/gpu/drm/i915/gt/intel_timeline.c | 18 +++++++++------- + drivers/gpu/drm/i915/gt/intel_timeline_types.h | 2 + + 3 files changed, 31 insertions(+), 16 deletions(-) + +--- a/drivers/gpu/drm/i915/gt/intel_lrc.c ++++ b/drivers/gpu/drm/i915/gt/intel_lrc.c +@@ -3539,6 +3539,19 @@ static const struct intel_context_ops ex + .destroy = execlists_context_destroy, + }; + ++static u32 hwsp_offset(const struct i915_request *rq) ++{ ++ const struct intel_timeline_cacheline *cl; ++ ++ /* Before the request is executed, the timeline/cachline is fixed */ ++ ++ cl = rcu_dereference_protected(rq->hwsp_cacheline, 1); ++ if (cl) ++ return cl->ggtt_offset; ++ ++ return rcu_dereference_protected(rq->timeline, 1)->hwsp_offset; ++} ++ + static int gen8_emit_init_breadcrumb(struct i915_request *rq) + { + u32 *cs; +@@ -3561,7 +3574,7 @@ static int gen8_emit_init_breadcrumb(str + *cs++ = MI_NOOP; + + *cs++ = MI_STORE_DWORD_IMM_GEN4 | MI_USE_GGTT; +- *cs++ = i915_request_timeline(rq)->hwsp_offset; ++ *cs++ = hwsp_offset(rq); + *cs++ = 0; + *cs++ = rq->fence.seqno - 1; + +@@ -4865,11 +4878,9 @@ gen8_emit_fini_breadcrumb_tail(struct i9 + return gen8_emit_wa_tail(request, cs); + } + +-static u32 *emit_xcs_breadcrumb(struct i915_request *request, u32 *cs) ++static u32 *emit_xcs_breadcrumb(struct i915_request *rq, u32 *cs) + { +- u32 addr = i915_request_active_timeline(request)->hwsp_offset; +- +- return gen8_emit_ggtt_write(cs, request->fence.seqno, addr, 0); ++ return gen8_emit_ggtt_write(cs, rq->fence.seqno, hwsp_offset(rq), 0); + } + + static u32 *gen8_emit_fini_breadcrumb(struct i915_request *rq, u32 *cs) +@@ -4888,7 +4899,7 @@ static u32 *gen8_emit_fini_breadcrumb_rc + /* XXX flush+write+CS_STALL all in one upsets gem_concurrent_blt:kbl */ + cs = gen8_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL_FLUSH_ENABLE | + PIPE_CONTROL_CS_STALL); + +@@ -4900,7 +4911,7 @@ gen11_emit_fini_breadcrumb_rcs(struct i9 + { + cs = gen8_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_TILE_CACHE_FLUSH | + PIPE_CONTROL_RENDER_TARGET_CACHE_FLUSH | +@@ -4970,7 +4981,7 @@ gen12_emit_fini_breadcrumb_rcs(struct i9 + { + cs = gen12_emit_ggtt_write_rcs(cs, + request->fence.seqno, +- i915_request_active_timeline(request)->hwsp_offset, ++ hwsp_offset(request), + PIPE_CONTROL0_HDC_PIPELINE_FLUSH, + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_TILE_CACHE_FLUSH | +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -188,10 +188,14 @@ cacheline_alloc(struct intel_timeline_hw + return cl; + } + +-static void cacheline_acquire(struct intel_timeline_cacheline *cl) ++static void cacheline_acquire(struct intel_timeline_cacheline *cl, ++ u32 ggtt_offset) + { +- if (cl) +- i915_active_acquire(&cl->active); ++ if (!cl) ++ return; ++ ++ cl->ggtt_offset = ggtt_offset; ++ i915_active_acquire(&cl->active); + } + + static void cacheline_release(struct intel_timeline_cacheline *cl) +@@ -332,7 +336,7 @@ int intel_timeline_pin(struct intel_time + GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n", + tl->fence_context, tl->hwsp_offset); + +- cacheline_acquire(tl->hwsp_cacheline); ++ cacheline_acquire(tl->hwsp_cacheline, tl->hwsp_offset); + if (atomic_fetch_inc(&tl->pin_count)) { + cacheline_release(tl->hwsp_cacheline); + __i915_vma_unpin(tl->hwsp_ggtt); +@@ -505,7 +509,7 @@ __intel_timeline_get_seqno(struct intel_ + GT_TRACE(tl->gt, "timeline:%llx using HWSP offset:%x\n", + tl->fence_context, tl->hwsp_offset); + +- cacheline_acquire(cl); ++ cacheline_acquire(cl, tl->hwsp_offset); + tl->hwsp_cacheline = cl; + + *seqno = timeline_advance(tl); +@@ -563,9 +567,7 @@ int intel_timeline_read_hwsp(struct i915 + if (err) + goto out; + +- *hwsp = i915_ggtt_offset(cl->hwsp->vma) + +- ptr_unmask_bits(cl->vaddr, CACHELINE_BITS) * CACHELINE_BYTES; +- ++ *hwsp = cl->ggtt_offset; + out: + i915_active_release(&cl->active); + return err; +--- a/drivers/gpu/drm/i915/gt/intel_timeline_types.h ++++ b/drivers/gpu/drm/i915/gt/intel_timeline_types.h +@@ -94,6 +94,8 @@ struct intel_timeline_cacheline { + struct intel_timeline_hwsp *hwsp; + void *vaddr; + ++ u32 ggtt_offset; ++ + struct rcu_head rcu; + }; + diff --git a/queue-5.9/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch b/queue-5.9/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch new file mode 100644 index 00000000000..25e2baf238e --- /dev/null +++ b/queue-5.9/drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch @@ -0,0 +1,89 @@ +From 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d Mon Sep 17 00:00:00 2001 +From: Boris Brezillon +Date: Sun, 1 Nov 2020 18:40:16 +0100 +Subject: drm/panfrost: Fix a deadlock between the shrinker and madvise path + +From: Boris Brezillon + +commit 7d2d6d01293e6d9b42a6cb410be4158571f7fe9d upstream. + +panfrost_ioctl_madvise() and panfrost_gem_purge() acquire the mappings +and shmem locks in different orders, thus leading to a potential +the mappings lock first. + +Fixes: bdefca2d8dc0 ("drm/panfrost: Add the panfrost_gem_mapping concept") +Cc: +Cc: Christian Hewitt +Reported-by: Christian Hewitt +Signed-off-by: Boris Brezillon +Reviewed-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20201101174016.839110-1-boris.brezillon@collabora.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/panfrost/panfrost_gem.c | 4 +--- + drivers/gpu/drm/panfrost/panfrost_gem.h | 2 +- + drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c | 14 +++++++++++--- + 3 files changed, 13 insertions(+), 7 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_gem.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.c +@@ -105,14 +105,12 @@ void panfrost_gem_mapping_put(struct pan + kref_put(&mapping->refcount, panfrost_gem_mapping_release); + } + +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo) ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo) + { + struct panfrost_gem_mapping *mapping; + +- mutex_lock(&bo->mappings.lock); + list_for_each_entry(mapping, &bo->mappings.list, node) + panfrost_gem_teardown_mapping(mapping); +- mutex_unlock(&bo->mappings.lock); + } + + int panfrost_gem_open(struct drm_gem_object *obj, struct drm_file *file_priv) +--- a/drivers/gpu/drm/panfrost/panfrost_gem.h ++++ b/drivers/gpu/drm/panfrost/panfrost_gem.h +@@ -82,7 +82,7 @@ struct panfrost_gem_mapping * + panfrost_gem_mapping_get(struct panfrost_gem_object *bo, + struct panfrost_file_priv *priv); + void panfrost_gem_mapping_put(struct panfrost_gem_mapping *mapping); +-void panfrost_gem_teardown_mappings(struct panfrost_gem_object *bo); ++void panfrost_gem_teardown_mappings_locked(struct panfrost_gem_object *bo); + + void panfrost_gem_shrinker_init(struct drm_device *dev); + void panfrost_gem_shrinker_cleanup(struct drm_device *dev); +--- a/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gem_shrinker.c +@@ -40,18 +40,26 @@ static bool panfrost_gem_purge(struct dr + { + struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); + struct panfrost_gem_object *bo = to_panfrost_bo(obj); ++ bool ret = false; + + if (atomic_read(&bo->gpu_usecount)) + return false; + +- if (!mutex_trylock(&shmem->pages_lock)) ++ if (!mutex_trylock(&bo->mappings.lock)) + return false; + +- panfrost_gem_teardown_mappings(bo); ++ if (!mutex_trylock(&shmem->pages_lock)) ++ goto unlock_mappings; ++ ++ panfrost_gem_teardown_mappings_locked(bo); + drm_gem_shmem_purge_locked(obj); ++ ret = true; + + mutex_unlock(&shmem->pages_lock); +- return true; ++ ++unlock_mappings: ++ mutex_unlock(&bo->mappings.lock); ++ return ret; + } + + static unsigned long diff --git a/queue-5.9/io_uring-fix-link-lookup-racing-with-link-timeout.patch b/queue-5.9/io_uring-fix-link-lookup-racing-with-link-timeout.patch new file mode 100644 index 00000000000..5b4d0636cc5 --- /dev/null +++ b/queue-5.9/io_uring-fix-link-lookup-racing-with-link-timeout.patch @@ -0,0 +1,46 @@ +From 9a472ef7a3690ac0b77ebfb04c88fa795de2adea Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Thu, 5 Nov 2020 22:31:37 +0000 +Subject: io_uring: fix link lookup racing with link timeout + +From: Pavel Begunkov + +commit 9a472ef7a3690ac0b77ebfb04c88fa795de2adea upstream. + +We can't just go over linked requests because it may race with linked +timeouts. Take ctx->completion_lock in that case. + +Cc: stable@vger.kernel.org # v5.7+ +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -8176,7 +8176,21 @@ static bool io_timeout_remove_link(struc + + static bool io_cancel_link_cb(struct io_wq_work *work, void *data) + { +- return io_match_link(container_of(work, struct io_kiocb, work), data); ++ struct io_kiocb *req = container_of(work, struct io_kiocb, work); ++ bool ret; ++ ++ if (req->flags & REQ_F_LINK_TIMEOUT) { ++ unsigned long flags; ++ struct io_ring_ctx *ctx = req->ctx; ++ ++ /* protect against races with linked timeouts */ ++ spin_lock_irqsave(&ctx->completion_lock, flags); ++ ret = io_match_link(req, data); ++ spin_unlock_irqrestore(&ctx->completion_lock, flags); ++ } else { ++ ret = io_match_link(req, data); ++ } ++ return ret; + } + + static void io_attempt_cancel(struct io_ring_ctx *ctx, struct io_kiocb *req) diff --git a/queue-5.9/mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch b/queue-5.9/mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch new file mode 100644 index 00000000000..40e0939c72c --- /dev/null +++ b/queue-5.9/mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch @@ -0,0 +1,58 @@ +From 804fc6a2931e692f50e8e317fcb0c8887331b405 Mon Sep 17 00:00:00 2001 +From: Mathy Vanhoef +Date: Mon, 19 Oct 2020 20:01:13 +0400 +Subject: mac80211: fix regression where EAPOL frames were sent in plaintext + +From: Mathy Vanhoef + +commit 804fc6a2931e692f50e8e317fcb0c8887331b405 upstream. + +When sending EAPOL frames via NL80211 they are treated as injected +frames in mac80211. Due to commit 1df2bdba528b ("mac80211: never drop +injected frames even if normally not allowed") these injected frames +were not assigned a sta context in the function ieee80211_tx_dequeue, +causing certain wireless network cards to always send EAPOL frames in +plaintext. This may cause compatibility issues with some clients or +APs, which for instance can cause the group key handshake to fail and +in turn would cause the station to get disconnected. + +This commit fixes this regression by assigning a sta context in +ieee80211_tx_dequeue to injected frames as well. + +Note that sending EAPOL frames in plaintext is not a security issue +since they contain their own encryption and authentication protection. + +Cc: stable@vger.kernel.org +Fixes: 1df2bdba528b ("mac80211: never drop injected frames even if normally not allowed") +Reported-by: Thomas Deutschmann +Tested-by: Christian Hesse +Tested-by: Thomas Deutschmann +Signed-off-by: Mathy Vanhoef +Link: https://lore.kernel.org/r/20201019160113.350912-1-Mathy.Vanhoef@kuleuven.be +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman + +--- + net/mac80211/tx.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -3613,13 +3613,14 @@ begin: + tx.skb = skb; + tx.sdata = vif_to_sdata(info->control.vif); + +- if (txq->sta && !(info->flags & IEEE80211_TX_CTL_INJECTED)) { ++ if (txq->sta) { + tx.sta = container_of(txq->sta, struct sta_info, sta); + /* + * Drop unicast frames to unauthorised stations unless they are +- * EAPOL frames from the local station. ++ * injected frames or EAPOL frames from the local station. + */ +- if (unlikely(ieee80211_is_data(hdr->frame_control) && ++ if (unlikely(!(info->flags & IEEE80211_TX_CTL_INJECTED) && ++ ieee80211_is_data(hdr->frame_control) && + !ieee80211_vif_is_mesh(&tx.sdata->vif) && + tx.sdata->vif.type != NL80211_IFTYPE_OCB && + !is_multicast_ether_addr(hdr->addr1) && diff --git a/queue-5.9/pm-runtime-drop-pm_runtime_clean_up_links.patch b/queue-5.9/pm-runtime-drop-pm_runtime_clean_up_links.patch new file mode 100644 index 00000000000..81fe1021838 --- /dev/null +++ b/queue-5.9/pm-runtime-drop-pm_runtime_clean_up_links.patch @@ -0,0 +1,106 @@ +From d6e36668598154820177bfd78c1621d8e6c580a2 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 21 Oct 2020 21:13:10 +0200 +Subject: PM: runtime: Drop pm_runtime_clean_up_links() + +From: Rafael J. Wysocki + +commit d6e36668598154820177bfd78c1621d8e6c580a2 upstream. + +After commit d12544fb2aa9 ("PM: runtime: Remove link state checks in +rpm_get/put_supplier()") nothing prevents the consumer device's +runtime PM from acquiring additional references to the supplier +device after pm_runtime_clean_up_links() has run (or even while it +is running), so calling this function from __device_release_driver() +may be pointless (or even harmful). + +Moreover, it ignores stateless device links, so the runtime PM +handling of managed and stateless device links is inconsistent +because of it, so better get rid of it entirely. + +Fixes: d12544fb2aa9 ("PM: runtime: Remove link state checks in rpm_get/put_supplier()") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 1 - + drivers/base/power/runtime.c | 36 ------------------------------------ + include/linux/pm_runtime.h | 2 -- + 3 files changed, 39 deletions(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1133,7 +1133,6 @@ static void __device_release_driver(stru + } + + pm_runtime_get_sync(dev); +- pm_runtime_clean_up_links(dev); + + driver_sysfs_remove(dev); + +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1643,42 +1643,6 @@ void pm_runtime_remove(struct device *de + } + + /** +- * pm_runtime_clean_up_links - Prepare links to consumers for driver removal. +- * @dev: Device whose driver is going to be removed. +- * +- * Check links from this device to any consumers and if any of them have active +- * runtime PM references to the device, drop the usage counter of the device +- * (as many times as needed). +- * +- * Links with the DL_FLAG_MANAGED flag unset are ignored. +- * +- * Since the device is guaranteed to be runtime-active at the point this is +- * called, nothing else needs to be done here. +- * +- * Moreover, this is called after device_links_busy() has returned 'false', so +- * the status of each link is guaranteed to be DL_STATE_SUPPLIER_UNBIND and +- * therefore rpm_active can't be manipulated concurrently. +- */ +-void pm_runtime_clean_up_links(struct device *dev) +-{ +- struct device_link *link; +- int idx; +- +- idx = device_links_read_lock(); +- +- list_for_each_entry_rcu(link, &dev->links.consumers, s_node, +- device_links_read_lock_held()) { +- if (!(link->flags & DL_FLAG_MANAGED)) +- continue; +- +- while (refcount_dec_not_one(&link->rpm_active)) +- pm_runtime_put_noidle(dev); +- } +- +- device_links_read_unlock(idx); +-} +- +-/** + * pm_runtime_get_suppliers - Resume and reference-count supplier devices. + * @dev: Consumer device. + */ +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -54,7 +54,6 @@ extern u64 pm_runtime_autosuspend_expira + extern void pm_runtime_update_max_time_suspended(struct device *dev, + s64 delta_ns); + extern void pm_runtime_set_memalloc_noio(struct device *dev, bool enable); +-extern void pm_runtime_clean_up_links(struct device *dev); + extern void pm_runtime_get_suppliers(struct device *dev); + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); +@@ -276,7 +275,6 @@ static inline u64 pm_runtime_autosuspend + struct device *dev) { return 0; } + static inline void pm_runtime_set_memalloc_noio(struct device *dev, + bool enable){} +-static inline void pm_runtime_clean_up_links(struct device *dev) {} + static inline void pm_runtime_get_suppliers(struct device *dev) {} + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} diff --git a/queue-5.9/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch b/queue-5.9/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch new file mode 100644 index 00000000000..e8cf417a01c --- /dev/null +++ b/queue-5.9/pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch @@ -0,0 +1,106 @@ +From e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Wed, 21 Oct 2020 21:12:15 +0200 +Subject: PM: runtime: Drop runtime PM references to supplier on link removal + +From: Rafael J. Wysocki + +commit e0e398e204634db8fb71bd89cf2f6e3e5bd09b51 upstream. + +While removing a device link, drop the supplier device's runtime PM +usage counter as many times as needed to drop all of the runtime PM +references to it from the consumer in addition to dropping the +consumer's link count. + +Fixes: baa8809f6097 ("PM / runtime: Optimize the use of device links") +Signed-off-by: Rafael J. Wysocki +Cc: 5.1+ # 5.1+ +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/core.c | 6 ++---- + drivers/base/power/runtime.c | 21 ++++++++++++++++++++- + include/linux/pm_runtime.h | 4 ++-- + 3 files changed, 24 insertions(+), 7 deletions(-) + +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -763,8 +763,7 @@ static void __device_link_del(struct kre + dev_dbg(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del_rcu(&link->s_node); + list_del_rcu(&link->c_node); +@@ -778,8 +777,7 @@ static void __device_link_del(struct kre + dev_info(link->consumer, "Dropping the link to %s\n", + dev_name(link->supplier)); + +- if (link->flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_drop_link(link->consumer); ++ pm_runtime_drop_link(link); + + list_del(&link->s_node); + list_del(&link->c_node); +--- a/drivers/base/power/runtime.c ++++ b/drivers/base/power/runtime.c +@@ -1729,7 +1729,7 @@ void pm_runtime_new_link(struct device * + spin_unlock_irq(&dev->power.lock); + } + +-void pm_runtime_drop_link(struct device *dev) ++static void pm_runtime_drop_link_count(struct device *dev) + { + spin_lock_irq(&dev->power.lock); + WARN_ON(dev->power.links_count == 0); +@@ -1737,6 +1737,25 @@ void pm_runtime_drop_link(struct device + spin_unlock_irq(&dev->power.lock); + } + ++/** ++ * pm_runtime_drop_link - Prepare for device link removal. ++ * @link: Device link going away. ++ * ++ * Drop the link count of the consumer end of @link and decrement the supplier ++ * device's runtime PM usage counter as many times as needed to drop all of the ++ * PM runtime reference to it from the consumer. ++ */ ++void pm_runtime_drop_link(struct device_link *link) ++{ ++ if (!(link->flags & DL_FLAG_PM_RUNTIME)) ++ return; ++ ++ pm_runtime_drop_link_count(link->consumer); ++ ++ while (refcount_dec_not_one(&link->rpm_active)) ++ pm_runtime_put(link->supplier); ++} ++ + static bool pm_runtime_need_not_resume(struct device *dev) + { + return atomic_read(&dev->power.usage_count) <= 1 && +--- a/include/linux/pm_runtime.h ++++ b/include/linux/pm_runtime.h +@@ -58,7 +58,7 @@ extern void pm_runtime_clean_up_links(st + extern void pm_runtime_get_suppliers(struct device *dev); + extern void pm_runtime_put_suppliers(struct device *dev); + extern void pm_runtime_new_link(struct device *dev); +-extern void pm_runtime_drop_link(struct device *dev); ++extern void pm_runtime_drop_link(struct device_link *link); + + /** + * pm_runtime_get_if_in_use - Conditionally bump up runtime PM usage counter. +@@ -280,7 +280,7 @@ static inline void pm_runtime_clean_up_l + static inline void pm_runtime_get_suppliers(struct device *dev) {} + static inline void pm_runtime_put_suppliers(struct device *dev) {} + static inline void pm_runtime_new_link(struct device *dev) {} +-static inline void pm_runtime_drop_link(struct device *dev) {} ++static inline void pm_runtime_drop_link(struct device_link *link) {} + + #endif /* !CONFIG_PM */ + diff --git a/queue-5.9/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch b/queue-5.9/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch new file mode 100644 index 00000000000..14d9ef45b08 --- /dev/null +++ b/queue-5.9/pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch @@ -0,0 +1,60 @@ +From 9226c504e364158a17a68ff1fe9d67d266922f50 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 22 Oct 2020 17:38:22 +0200 +Subject: PM: runtime: Resume the device earlier in __device_release_driver() + +From: Rafael J. Wysocki + +commit 9226c504e364158a17a68ff1fe9d67d266922f50 upstream. + +Since the device is resumed from runtime-suspend in +__device_release_driver() anyway, it is better to do that before +looking for busy managed device links from it to consumers, because +if there are any, device_links_unbind_consumers() will be called +and it will cause the consumer devices' drivers to unbind, so the +consumer devices will be runtime-resumed. In turn, resuming each +consumer device will cause the supplier to be resumed and when the +runtime PM references from the given consumer to it are dropped, it +may be suspended. Then, the runtime-resume of the next consumer +will cause the supplier to resume again and so on. + +Update the code accordingly. + +Signed-off-by: Rafael J. Wysocki +Fixes: 9ed9895370ae ("driver core: Functional dependencies tracking support") +Cc: All applicable # All applicable +Tested-by: Xiang Chen +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/dd.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -1117,6 +1117,8 @@ static void __device_release_driver(stru + + drv = dev->driver; + if (drv) { ++ pm_runtime_get_sync(dev); ++ + while (device_links_busy(dev)) { + __device_driver_unlock(dev, parent); + +@@ -1128,12 +1130,12 @@ static void __device_release_driver(stru + * have released the driver successfully while this one + * was waiting, so check for that. + */ +- if (dev->driver != drv) ++ if (dev->driver != drv) { ++ pm_runtime_put(dev); + return; ++ } + } + +- pm_runtime_get_sync(dev); +- + driver_sysfs_remove(dev); + + if (dev->bus) diff --git a/queue-5.9/series b/queue-5.9/series index 6a85f6aa920..bb3ed10fe03 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -118,3 +118,15 @@ usb-serial-cyberjack-fix-write-urb-completion-race.patch usb-serial-option-add-quectel-ec200t-module-support.patch usb-serial-option-add-le910cx-compositions-0x1203-0x1230-0x1231.patch usb-serial-option-add-telit-fn980-composition-0x1055.patch +usb-dwc3-ep0-fix-delay-status-handling.patch +usb-add-no_lpm-quirk-for-kingston-flash-drive.patch +usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch +io_uring-fix-link-lookup-racing-with-link-timeout.patch +mac80211-fix-regression-where-eapol-frames-were-sent-in-plaintext.patch +drm-panfrost-fix-a-deadlock-between-the-shrinker-and-madvise-path.patch +arc-stack-unwinding-avoid-indefinite-looping.patch +pm-runtime-drop-runtime-pm-references-to-supplier-on-link-removal.patch +pm-runtime-drop-pm_runtime_clean_up_links.patch +pm-runtime-resume-the-device-earlier-in-__device_release_driver.patch +drm-i915-fix-encoder-lookup-during-psr-atomic-check.patch +drm-i915-gt-use-the-local-hwsp-offset-during-submission.patch diff --git a/queue-5.9/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch b/queue-5.9/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch new file mode 100644 index 00000000000..f8b379d0d73 --- /dev/null +++ b/queue-5.9/usb-add-no_lpm-quirk-for-kingston-flash-drive.patch @@ -0,0 +1,39 @@ +From afaa2e745a246c5ab95103a65b1ed00101e1bc63 Mon Sep 17 00:00:00 2001 +From: Alan Stern +Date: Mon, 2 Nov 2020 09:58:21 -0500 +Subject: USB: Add NO_LPM quirk for Kingston flash drive + +From: Alan Stern + +commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream. + +In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston +flash drive spontaneously disconnects and reconnects, over and over. +Testing revealed that disabling Link Power Management for the drive +fixed the problem. + +This patch adds a quirk entry for that drive to turn off LPM permanently. + +CC: Hans de Goede +CC: +Reported-and-tested-by: Julien Humbert +Signed-off-by: Alan Stern +Link: https://lore.kernel.org/r/20201102145821.GA1478741@rowland.harvard.edu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/core/quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -378,6 +378,9 @@ static const struct usb_device_id usb_qu + { USB_DEVICE(0x0926, 0x3333), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* Kingston DataTraveler 3.0 */ ++ { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + diff --git a/queue-5.9/usb-dwc3-ep0-fix-delay-status-handling.patch b/queue-5.9/usb-dwc3-ep0-fix-delay-status-handling.patch new file mode 100644 index 00000000000..b28dab7ff80 --- /dev/null +++ b/queue-5.9/usb-dwc3-ep0-fix-delay-status-handling.patch @@ -0,0 +1,43 @@ +From fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Thu, 22 Oct 2020 15:44:59 -0700 +Subject: usb: dwc3: ep0: Fix delay status handling + +From: Thinh Nguyen + +commit fa27e2f6c5e674f3f1225f9ca7a7821faaf393bb upstream. + +If we want to send a control status on our own time (through +delayed_status), make sure to handle a case where we may queue the +delayed status before the host requesting for it (when XferNotReady +is generated). Otherwise, the driver won't send anything because it's +not EP0_STATUS_PHASE yet. To resolve this, regardless whether +dwc->ep0state is EP0_STATUS_PHASE, make sure to clear the +dwc->delayed_status flag if dwc3_ep0_send_delayed_status() is called. +The control status can be sent when the host requests it later. + +Cc: +Fixes: d97c78a1908e ("usb: dwc3: gadget: END_TRANSFER before CLEAR_STALL command") +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/dwc3/ep0.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -1058,10 +1058,11 @@ void dwc3_ep0_send_delayed_status(struct + { + unsigned int direction = !dwc->ep0_expect_in; + ++ dwc->delayed_status = false; ++ + if (dwc->ep0state != EP0_STATUS_PHASE) + return; + +- dwc->delayed_status = false; + __dwc3_ep0_do_control_status(dwc, dwc->eps[direction]); + } + diff --git a/queue-5.9/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch b/queue-5.9/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch new file mode 100644 index 00000000000..23dd6632f79 --- /dev/null +++ b/queue-5.9/usb-mtu3-fix-panic-in-mtu3_gadget_stop.patch @@ -0,0 +1,71 @@ +From 20914919ad31849ee2b9cfe0428f4a20335c9e2a Mon Sep 17 00:00:00 2001 +From: Macpaul Lin +Date: Fri, 6 Nov 2020 13:54:29 +0800 +Subject: usb: mtu3: fix panic in mtu3_gadget_stop() + +From: Macpaul Lin + +commit 20914919ad31849ee2b9cfe0428f4a20335c9e2a upstream. + +This patch fixes a possible issue when mtu3_gadget_stop() +already assigned NULL to mtu->gadget_driver during mtu_gadget_disconnect(). + +[] notifier_call_chain+0xa4/0x128 +[] __atomic_notifier_call_chain+0x84/0x138 +[] notify_die+0xb0/0x120 +[] die+0x1f8/0x5d0 +[] __do_kernel_fault+0x19c/0x280 +[] do_bad_area+0x44/0x140 +[] do_translation_fault+0x4c/0x90 +[] do_mem_abort+0xb8/0x258 +[] el1_da+0x24/0x3c +[] mtu3_gadget_disconnect+0xac/0x128 +[] mtu3_irq+0x34c/0xc18 +[] __handle_irq_event_percpu+0x2ac/0xcd0 +[] handle_irq_event_percpu+0x80/0x138 +[] handle_irq_event+0xac/0x148 +[] handle_fasteoi_irq+0x234/0x568 +[] generic_handle_irq+0x48/0x68 +[] __handle_domain_irq+0x264/0x1740 +[] gic_handle_irq+0x14c/0x250 +[] el1_irq+0xec/0x194 +[] dma_pool_alloc+0x6e4/0xae0 +[] cmdq_mbox_pool_alloc_impl+0xb0/0x238 +[] cmdq_pkt_alloc_buf+0x2dc/0x7c0 +[] cmdq_pkt_add_cmd_buffer+0x178/0x270 +[] cmdq_pkt_perf_begin+0x108/0x148 +[] cmdq_pkt_create+0x178/0x1f0 +[] mtk_crtc_config_default_path+0x328/0x7a0 +[] mtk_drm_idlemgr_kick+0xa6c/0x1460 +[] mtk_drm_crtc_atomic_begin+0x1a4/0x1a68 +[] drm_atomic_helper_commit_planes+0x154/0x878 +[] mtk_atomic_complete.isra.16+0xe80/0x19c8 +[] mtk_atomic_commit+0x258/0x898 +[] drm_atomic_commit+0xcc/0x108 +[] drm_mode_atomic_ioctl+0x1c20/0x2580 +[] drm_ioctl_kernel+0x118/0x1b0 +[] drm_ioctl+0x5c0/0x920 +[] do_vfs_ioctl+0x188/0x1820 +[] SyS_ioctl+0x8c/0xa0 + +Fixes: df2069acb005 ("usb: Add MediaTek USB3 DRD driver") +Signed-off-by: Macpaul Lin +Acked-by: Chunfeng Yun +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/1604642069-20961-1-git-send-email-macpaul.lin@mediatek.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/mtu3/mtu3_gadget.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -564,6 +564,7 @@ static int mtu3_gadget_stop(struct usb_g + + spin_unlock_irqrestore(&mtu->lock, flags); + ++ synchronize_irq(mtu->irq); + return 0; + } +