From: Greg Kroah-Hartman Date: Wed, 30 Dec 2020 15:41:11 +0000 (+0100) Subject: 5.10-stable patches X-Git-Tag: v4.19.165~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4c234eced5de91b916b959197ae17fdef5a5f32c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch io_uring-close-a-small-race-gap-for-files-cancel.patch md-raid10-initialize-r10_bio-read_slot-before-use.patch --- diff --git a/queue-5.10/drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch b/queue-5.10/drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch new file mode 100644 index 00000000000..538c2b6a288 --- /dev/null +++ b/queue-5.10/drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch @@ -0,0 +1,111 @@ +From 6bdeff12a96c9a5da95c8d11fefd145eb165e32a Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Tue, 15 Dec 2020 10:33:34 -0500 +Subject: drm/amd/display: Add get_dig_frontend implementation for DCEx + +From: Rodrigo Siqueira + +commit 6bdeff12a96c9a5da95c8d11fefd145eb165e32a upstream. + +Some old ASICs might not implement/require get_dig_frontend helper; in +this scenario, we can have a NULL pointer exception when we try to call +it inside vbios disable operation. For example, this situation might +happen when using Polaris12 with an eDP panel. This commit avoids this +situation by adding a specific get_dig_frontend implementation for DCEx. + +Cc: Alex Deucher +Cc: Borislav Petkov +Cc: Harry Wentland +Cc: Nicholas Kazlauskas +Cc: Chiawen Huang +Reported-and-tested-by: Borislav Petkov +Acked-by: Alex Deucher +Signed-off-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c | 44 +++++++++++++++++- + drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h | 2 + 2 files changed, 44 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.c +@@ -119,7 +119,8 @@ static const struct link_encoder_funcs d + .disable_hpd = dce110_link_encoder_disable_hpd, + .is_dig_enabled = dce110_is_dig_enabled, + .destroy = dce110_link_encoder_destroy, +- .get_max_link_cap = dce110_link_encoder_get_max_link_cap ++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap, ++ .get_dig_frontend = dce110_get_dig_frontend, + }; + + static enum bp_result link_transmitter_control( +@@ -235,6 +236,44 @@ static void set_link_training_complete( + + } + ++unsigned int dce110_get_dig_frontend(struct link_encoder *enc) ++{ ++ struct dce110_link_encoder *enc110 = TO_DCE110_LINK_ENC(enc); ++ u32 value; ++ enum engine_id result; ++ ++ REG_GET(DIG_BE_CNTL, DIG_FE_SOURCE_SELECT, &value); ++ ++ switch (value) { ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGA: ++ result = ENGINE_ID_DIGA; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGB: ++ result = ENGINE_ID_DIGB; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGC: ++ result = ENGINE_ID_DIGC; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGD: ++ result = ENGINE_ID_DIGD; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGE: ++ result = ENGINE_ID_DIGE; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGF: ++ result = ENGINE_ID_DIGF; ++ break; ++ case DCE110_DIG_FE_SOURCE_SELECT_DIGG: ++ result = ENGINE_ID_DIGG; ++ break; ++ default: ++ // invalid source select DIG ++ result = ENGINE_ID_UNKNOWN; ++ } ++ ++ return result; ++} ++ + void dce110_link_encoder_set_dp_phy_pattern_training_pattern( + struct link_encoder *enc, + uint32_t index) +@@ -1665,7 +1704,8 @@ static const struct link_encoder_funcs d + .disable_hpd = dce110_link_encoder_disable_hpd, + .is_dig_enabled = dce110_is_dig_enabled, + .destroy = dce110_link_encoder_destroy, +- .get_max_link_cap = dce110_link_encoder_get_max_link_cap ++ .get_max_link_cap = dce110_link_encoder_get_max_link_cap, ++ .get_dig_frontend = dce110_get_dig_frontend + }; + + void dce60_link_encoder_construct( +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_link_encoder.h +@@ -295,6 +295,8 @@ void dce110_link_encoder_connect_dig_be_ + enum engine_id engine, + bool connect); + ++unsigned int dce110_get_dig_frontend(struct link_encoder *enc); ++ + void dce110_link_encoder_set_dp_phy_pattern_training_pattern( + struct link_encoder *enc, + uint32_t index); diff --git a/queue-5.10/io_uring-close-a-small-race-gap-for-files-cancel.patch b/queue-5.10/io_uring-close-a-small-race-gap-for-files-cancel.patch new file mode 100644 index 00000000000..3534c970994 --- /dev/null +++ b/queue-5.10/io_uring-close-a-small-race-gap-for-files-cancel.patch @@ -0,0 +1,51 @@ +From dfea9fce29fda6f2f91161677e0e0d9b671bc099 Mon Sep 17 00:00:00 2001 +From: Pavel Begunkov +Date: Fri, 18 Dec 2020 13:12:21 +0000 +Subject: io_uring: close a small race gap for files cancel + +From: Pavel Begunkov + +commit dfea9fce29fda6f2f91161677e0e0d9b671bc099 upstream. + +The purpose of io_uring_cancel_files() is to wait for all requests +matching ->files to go/be cancelled. We should first drop files of a +request in io_req_drop_files() and only then make it undiscoverable for +io_uring_cancel_files. + +First drop, then delete from list. It's ok to leave req->id->files +dangling, because it's not dereferenced by cancellation code, only +compared against. It would potentially go to sleep and be awaken by +following in io_req_drop_files() wake_up(). + +Fixes: 0f2122045b946 ("io_uring: don't rely on weak ->files references") +Cc: # 5.5+ +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman + +--- + fs/io_uring.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -5861,15 +5861,15 @@ static void io_req_drop_files(struct io_ + struct io_ring_ctx *ctx = req->ctx; + unsigned long flags; + ++ put_files_struct(req->work.identity->files); ++ put_nsproxy(req->work.identity->nsproxy); + spin_lock_irqsave(&ctx->inflight_lock, flags); + list_del(&req->inflight_entry); +- if (waitqueue_active(&ctx->inflight_wait)) +- wake_up(&ctx->inflight_wait); + spin_unlock_irqrestore(&ctx->inflight_lock, flags); + req->flags &= ~REQ_F_INFLIGHT; +- put_files_struct(req->work.identity->files); +- put_nsproxy(req->work.identity->nsproxy); + req->work.flags &= ~IO_WQ_WORK_FILES; ++ if (waitqueue_active(&ctx->inflight_wait)) ++ wake_up(&ctx->inflight_wait); + } + + static void __io_clean_op(struct io_kiocb *req) diff --git a/queue-5.10/md-raid10-initialize-r10_bio-read_slot-before-use.patch b/queue-5.10/md-raid10-initialize-r10_bio-read_slot-before-use.patch new file mode 100644 index 00000000000..46bc78bea41 --- /dev/null +++ b/queue-5.10/md-raid10-initialize-r10_bio-read_slot-before-use.patch @@ -0,0 +1,46 @@ +From 93decc563637c4288380912eac0eb42fb246cc04 Mon Sep 17 00:00:00 2001 +From: Kevin Vigor +Date: Fri, 6 Nov 2020 14:20:34 -0800 +Subject: md/raid10: initialize r10_bio->read_slot before use. + +From: Kevin Vigor + +commit 93decc563637c4288380912eac0eb42fb246cc04 upstream. + +In __make_request() a new r10bio is allocated and passed to +raid10_read_request(). The read_slot member of the bio is not +initialized, and the raid10_read_request() uses it to index an +array. This leads to occasional panics. + +Fix by initializing the field to invalid value and checking for +valid value in raid10_read_request(). + +Cc: stable@vger.kernel.org +Signed-off-by: Kevin Vigor +Signed-off-by: Song Liu +Signed-off-by: Greg Kroah-Hartman + + +--- + drivers/md/raid10.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1128,7 +1128,7 @@ static void raid10_read_request(struct m + struct md_rdev *err_rdev = NULL; + gfp_t gfp = GFP_NOIO; + +- if (r10_bio->devs[slot].rdev) { ++ if (slot >= 0 && r10_bio->devs[slot].rdev) { + /* + * This is an error retry, but we cannot + * safely dereference the rdev in the r10_bio, +@@ -1493,6 +1493,7 @@ static void __make_request(struct mddev + r10_bio->mddev = mddev; + r10_bio->sector = bio->bi_iter.bi_sector; + r10_bio->state = 0; ++ r10_bio->read_slot = -1; + memset(r10_bio->devs, 0, sizeof(r10_bio->devs[0]) * conf->copies); + + if (bio_data_dir(bio) == READ) diff --git a/queue-5.10/series b/queue-5.10/series index 1da481e27ff..ea9301f9d3b 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -2,3 +2,6 @@ net-sched-sch_taprio-reset-child-qdiscs-before-freeing-them.patch mptcp-fix-security-context-on-server-socket.patch ethtool-fix-error-paths-in-ethnl_set_channels.patch ethtool-fix-string-set-id-check.patch +md-raid10-initialize-r10_bio-read_slot-before-use.patch +drm-amd-display-add-get_dig_frontend-implementation-for-dcex.patch +io_uring-close-a-small-race-gap-for-files-cancel.patch