From: Greg Kroah-Hartman Date: Sat, 21 Oct 2023 09:17:51 +0000 (+0200) Subject: 5.10-stable patches X-Git-Tag: v4.14.328~64 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=53241b0fe6603cee42ee1be49f14d2078687422e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.10-stable patches added patches: acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch mtd-physmap-core-restore-map_rom-fallback.patch mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch mtd-spinand-micron-correct-bitmask-for-ecc-status.patch nvme-pci-add-bogus_nid-for-intel-0a54-device.patch nvme-rdma-do-not-try-to-stop-unallocated-queues.patch pnfs-fix-a-hang-in-nfs4_evict_inode.patch revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch --- diff --git a/queue-5.10/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch b/queue-5.10/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch new file mode 100644 index 00000000000..a312dc4f36b --- /dev/null +++ b/queue-5.10/acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch @@ -0,0 +1,48 @@ +From 0c21a18d5d6c6a73d098fb9b4701572370942df9 Mon Sep 17 00:00:00 2001 +From: Sunil V L +Date: Mon, 16 Oct 2023 22:39:39 +0530 +Subject: ACPI: irq: Fix incorrect return value in acpi_register_gsi() + +From: Sunil V L + +commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream. + +acpi_register_gsi() should return a negative value in case of failure. + +Currently, it returns the return value from irq_create_fwspec_mapping(). +However, irq_create_fwspec_mapping() returns 0 for failure. Fix the +issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero. + +Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping") +Cc: 4.11+ # 4.11+ +Signed-off-by: Sunil V L +[ rjw: Rename a new local variable ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/irq.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/irq.c ++++ b/drivers/acpi/irq.c +@@ -52,6 +52,7 @@ int acpi_register_gsi(struct device *dev + int polarity) + { + struct irq_fwspec fwspec; ++ unsigned int irq; + + if (WARN_ON(!acpi_gsi_domain_id)) { + pr_warn("GSI: No registered irqchip, giving up\n"); +@@ -63,7 +64,11 @@ int acpi_register_gsi(struct device *dev + fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity); + fwspec.param_count = 2; + +- return irq_create_fwspec_mapping(&fwspec); ++ irq = irq_create_fwspec_mapping(&fwspec); ++ if (!irq) ++ return -EINVAL; ++ ++ return irq; + } + EXPORT_SYMBOL_GPL(acpi_register_gsi); + diff --git a/queue-5.10/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch b/queue-5.10/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch new file mode 100644 index 00000000000..db38f48ac8d --- /dev/null +++ b/queue-5.10/mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch @@ -0,0 +1,39 @@ +From 84ee19bffc9306128cd0f1c650e89767079efeff Mon Sep 17 00:00:00 2001 +From: Avri Altman +Date: Wed, 27 Sep 2023 10:15:00 +0300 +Subject: mmc: core: Capture correct oemid-bits for eMMC cards + +From: Avri Altman + +commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream. + +The OEMID is an 8-bit binary number rather than 16-bit as the current code +parses for. The OEMID occupies bits [111:104] in the CID register, see the +eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from +the legacy MMC specs (v3.31 and before). + +Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This +means we ignore the impact on some of those old MMC cards that may be out +there, but on the other hand this shouldn't be a problem as the OEMID seems +not be an important feature for these cards. + +Signed-off-by: Avri Altman +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/mmc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -95,7 +95,7 @@ static int mmc_decode_cid(struct mmc_car + case 3: /* MMC v3.1 - v3.3 */ + case 4: /* MMC v4 */ + card->cid.manfid = UNSTUFF_BITS(resp, 120, 8); +- card->cid.oemid = UNSTUFF_BITS(resp, 104, 16); ++ card->cid.oemid = UNSTUFF_BITS(resp, 104, 8); + card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8); + card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8); + card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8); diff --git a/queue-5.10/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch b/queue-5.10/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch new file mode 100644 index 00000000000..62afbee0fb5 --- /dev/null +++ b/queue-5.10/mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch @@ -0,0 +1,45 @@ +From 32a9cdb8869dc111a0c96cf8e1762be9684af15b Mon Sep 17 00:00:00 2001 +From: Haibo Chen +Date: Wed, 30 Aug 2023 17:39:22 +0800 +Subject: mmc: core: sdio: hold retuning if sdio in 1-bit mode + +From: Haibo Chen + +commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream. + +tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode, +need to hold retuning. + +Find this issue when use manual tuning method on imx93. When system +resume back, SDIO WIFI try to switch back to 4 bit mode, first will +trigger retuning, and all tuning command failed. + +Signed-off-by: Haibo Chen +Acked-by: Adrian Hunter +Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning") +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/sdio.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/mmc/core/sdio.c ++++ b/drivers/mmc/core/sdio.c +@@ -1075,8 +1075,14 @@ static int mmc_sdio_resume(struct mmc_ho + } + err = mmc_sdio_reinit_card(host); + } else if (mmc_card_wake_sdio_irq(host)) { +- /* We may have switched to 1-bit mode during suspend */ ++ /* ++ * We may have switched to 1-bit mode during suspend, ++ * need to hold retuning, because tuning only supprt ++ * 4-bit mode or 8 bit mode. ++ */ ++ mmc_retune_hold_now(host); + err = sdio_enable_4bit_bus(host->card); ++ mmc_retune_release(host); + } + + if (err) diff --git a/queue-5.10/mtd-physmap-core-restore-map_rom-fallback.patch b/queue-5.10/mtd-physmap-core-restore-map_rom-fallback.patch new file mode 100644 index 00000000000..7088f93a4b3 --- /dev/null +++ b/queue-5.10/mtd-physmap-core-restore-map_rom-fallback.patch @@ -0,0 +1,43 @@ +From 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 30 Aug 2023 17:00:34 +0200 +Subject: mtd: physmap-core: Restore map_rom fallback + +From: Geert Uytterhoeven + +commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream. + +When the exact mapping type driver was not available, the old +physmap_of_core driver fell back to mapping the region as ROM. +Unfortunately this feature was lost when the DT and pdata cases were +merged. Revive this useful feature. + +Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/maps/physmap-core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/mtd/maps/physmap-core.c ++++ b/drivers/mtd/maps/physmap-core.c +@@ -556,6 +556,17 @@ static int physmap_flash_probe(struct pl + if (info->probe_type) { + info->mtds[i] = do_map_probe(info->probe_type, + &info->maps[i]); ++ ++ /* Fall back to mapping region as ROM */ ++ if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) && ++ strcmp(info->probe_type, "map_rom")) { ++ dev_warn(&dev->dev, ++ "map_probe() failed for type %s\n", ++ info->probe_type); ++ ++ info->mtds[i] = do_map_probe("map_rom", ++ &info->maps[i]); ++ } + } else { + int j; + diff --git a/queue-5.10/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch b/queue-5.10/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch new file mode 100644 index 00000000000..98efed18a81 --- /dev/null +++ b/queue-5.10/mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch @@ -0,0 +1,74 @@ +From 3a4a893dbb19e229db3b753f0462520b561dee98 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Mon, 17 Jul 2023 21:42:20 +0200 +Subject: mtd: rawnand: arasan: Ensure program page operations are successful + +From: Miquel Raynal + +commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream. + +The NAND core complies with the ONFI specification, which itself +mentions that after any program or erase operation, a status check +should be performed to see whether the operation was finished *and* +successful. + +The NAND core offers helpers to finish a page write (sending the +"PAGE PROG" command, waiting for the NAND chip to be ready again, and +checking the operation status). But in some cases, advanced controller +drivers might want to optimize this and craft their own page write +helper to leverage additional hardware capabilities, thus not always +using the core facilities. + +Some drivers, like this one, do not use the core helper to finish a page +write because the final cycles are automatically managed by the +hardware. In this case, the additional care must be taken to manually +perform the final status check. + +Let's read the NAND chip status at the end of the page write helper and +return -EIO upon error. + +Cc: Michal Simek +Cc: stable@vger.kernel.org +Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine") +Signed-off-by: Miquel Raynal +Acked-by: Michal Simek +Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -451,6 +451,7 @@ static int anfc_write_page_hw_ecc(struct + struct mtd_info *mtd = nand_to_mtd(chip); + unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0); + dma_addr_t dma_addr; ++ u8 status; + int ret; + struct anfc_op nfc_op = { + .pkt_reg = +@@ -497,10 +498,21 @@ static int anfc_write_page_hw_ecc(struct + } + + /* Spare data is not protected */ +- if (oob_required) ++ if (oob_required) { + ret = nand_write_oob_std(chip, page); ++ if (ret) ++ return ret; ++ } ++ ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; + +- return ret; ++ return 0; + } + + static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, diff --git a/queue-5.10/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch b/queue-5.10/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch new file mode 100644 index 00000000000..33fdc8edf2e --- /dev/null +++ b/queue-5.10/mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch @@ -0,0 +1,93 @@ +From 3e01d5254698ea3d18e09d96b974c762328352cd Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Mon, 17 Jul 2023 21:42:19 +0200 +Subject: mtd: rawnand: marvell: Ensure program page operations are successful + +From: Miquel Raynal + +commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream. + +The NAND core complies with the ONFI specification, which itself +mentions that after any program or erase operation, a status check +should be performed to see whether the operation was finished *and* +successful. + +The NAND core offers helpers to finish a page write (sending the +"PAGE PROG" command, waiting for the NAND chip to be ready again, and +checking the operation status). But in some cases, advanced controller +drivers might want to optimize this and craft their own page write +helper to leverage additional hardware capabilities, thus not always +using the core facilities. + +Some drivers, like this one, do not use the core helper to finish a page +write because the final cycles are automatically managed by the +hardware. In this case, the additional care must be taken to manually +perform the final status check. + +Let's read the NAND chip status at the end of the page write helper and +return -EIO upon error. + +Cc: stable@vger.kernel.org +Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver") +Reported-by: Aviram Dali +Signed-off-by: Miquel Raynal +Tested-by: Ravi Chandra Minnikanti +Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++- + 1 file changed, 22 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -1148,6 +1148,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri + .ndcb[2] = NDCB2_ADDR5_PAGE(page), + }; + unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0); ++ u8 status; + int ret; + + /* NFCv2 needs more information about the operation being executed */ +@@ -1181,7 +1182,18 @@ static int marvell_nfc_hw_ecc_hmg_do_wri + + ret = marvell_nfc_wait_op(chip, + PSEC_TO_MSEC(sdr->tPROG_max)); +- return ret; ++ if (ret) ++ return ret; ++ ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; ++ ++ return 0; + } + + static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip, +@@ -1610,6 +1622,7 @@ static int marvell_nfc_hw_ecc_bch_write_ + int data_len = lt->data_bytes; + int spare_len = lt->spare_bytes; + int chunk, ret; ++ u8 status; + + marvell_nfc_select_target(chip, chip->cur_cs); + +@@ -1646,6 +1659,14 @@ static int marvell_nfc_hw_ecc_bch_write_ + if (ret) + return ret; + ++ /* Check write status on the chip side */ ++ ret = nand_status_op(chip, &status); ++ if (ret) ++ return ret; ++ ++ if (status & NAND_STATUS_FAIL) ++ return -EIO; ++ + return 0; + } + diff --git a/queue-5.10/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch b/queue-5.10/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch new file mode 100644 index 00000000000..8212f201a3b --- /dev/null +++ b/queue-5.10/mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch @@ -0,0 +1,34 @@ +From 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd Mon Sep 17 00:00:00 2001 +From: Bibek Kumar Patro +Date: Wed, 13 Sep 2023 12:37:02 +0530 +Subject: mtd: rawnand: qcom: Unmap the right resource upon probe failure + +From: Bibek Kumar Patro + +commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream. + +We currently provide the physical address of the DMA region +rather than the output of dma_map_resource() which is obviously wrong. + +Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()") +Cc: stable@vger.kernel.org +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Bibek Kumar Patro +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/qcom_nandc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/qcom_nandc.c ++++ b/drivers/mtd/nand/raw/qcom_nandc.c +@@ -2996,7 +2996,7 @@ err_nandc_alloc: + err_aon_clk: + clk_disable_unprepare(nandc->core_clk); + err_core_clk: +- dma_unmap_resource(dev, res->start, resource_size(res), ++ dma_unmap_resource(dev, nandc->base_dma, resource_size(res), + DMA_BIDIRECTIONAL, 0); + return ret; + } diff --git a/queue-5.10/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch b/queue-5.10/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch new file mode 100644 index 00000000000..a8db5a1e10b --- /dev/null +++ b/queue-5.10/mtd-spinand-micron-correct-bitmask-for-ecc-status.patch @@ -0,0 +1,32 @@ +From 9836a987860e33943945d4b257729a4f94eae576 Mon Sep 17 00:00:00 2001 +From: Martin Kurbanov +Date: Tue, 5 Sep 2023 17:56:37 +0300 +Subject: mtd: spinand: micron: correct bitmask for ecc status + +From: Martin Kurbanov + +commit 9836a987860e33943945d4b257729a4f94eae576 upstream. + +Valid bitmask is 0x70 in the status register. + +Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD") +Signed-off-by: Martin Kurbanov +Reviewed-by: Frieder Schrempf +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/spi/micron.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/mtd/nand/spi/micron.c ++++ b/drivers/mtd/nand/spi/micron.c +@@ -12,7 +12,7 @@ + + #define SPINAND_MFR_MICRON 0x2c + +-#define MICRON_STATUS_ECC_MASK GENMASK(7, 4) ++#define MICRON_STATUS_ECC_MASK GENMASK(6, 4) + #define MICRON_STATUS_ECC_NO_BITFLIPS (0 << 4) + #define MICRON_STATUS_ECC_1TO3_BITFLIPS (1 << 4) + #define MICRON_STATUS_ECC_4TO6_BITFLIPS (3 << 4) diff --git a/queue-5.10/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch b/queue-5.10/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch new file mode 100644 index 00000000000..064ee503086 --- /dev/null +++ b/queue-5.10/nvme-pci-add-bogus_nid-for-intel-0a54-device.patch @@ -0,0 +1,32 @@ +From 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 Mon Sep 17 00:00:00 2001 +From: Keith Busch +Date: Thu, 12 Oct 2023 11:13:51 -0700 +Subject: nvme-pci: add BOGUS_NID for Intel 0a54 device + +From: Keith Busch + +commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream. + +These ones claim cmic and nmic capable, so need special consideration to ignore +their duplicate identifiers. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981 +Reported-by: welsh@cassens.com +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/pci.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -3181,7 +3181,8 @@ static const struct pci_device_id nvme_i + { PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */ + .driver_data = NVME_QUIRK_STRIPE_SIZE | + NVME_QUIRK_DEALLOCATE_ZEROES | +- NVME_QUIRK_IGNORE_DEV_SUBNQN, }, ++ NVME_QUIRK_IGNORE_DEV_SUBNQN | ++ NVME_QUIRK_BOGUS_NID, }, + { PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */ + .driver_data = NVME_QUIRK_STRIPE_SIZE | + NVME_QUIRK_DEALLOCATE_ZEROES, }, diff --git a/queue-5.10/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch b/queue-5.10/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch new file mode 100644 index 00000000000..7fe8a4a60b2 --- /dev/null +++ b/queue-5.10/nvme-rdma-do-not-try-to-stop-unallocated-queues.patch @@ -0,0 +1,43 @@ +From 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 Mon Sep 17 00:00:00 2001 +From: Maurizio Lombardi +Date: Mon, 31 Jul 2023 12:37:58 +0200 +Subject: nvme-rdma: do not try to stop unallocated queues + +From: Maurizio Lombardi + +commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream. + +Trying to stop a queue which hasn't been allocated will result +in a warning due to calling mutex_lock() against an uninitialized mutex. + + DEBUG_LOCKS_WARN_ON(lock->magic != lock) + WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579 + + Call trace: + RIP: 0010:__mutex_lock+0x1173/0x14a0 + nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma] + nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma] + nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma] + nvme_do_delete_ctrl+0x149/0x158 [nvme_core] + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Tested-by: Yi Zhang +Signed-off-by: Keith Busch +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nvme/host/rdma.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -644,6 +644,9 @@ static void __nvme_rdma_stop_queue(struc + + static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue) + { ++ if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags)) ++ return; ++ + mutex_lock(&queue->queue_lock); + if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags)) + __nvme_rdma_stop_queue(queue); diff --git a/queue-5.10/pnfs-fix-a-hang-in-nfs4_evict_inode.patch b/queue-5.10/pnfs-fix-a-hang-in-nfs4_evict_inode.patch new file mode 100644 index 00000000000..bdd099a72d4 --- /dev/null +++ b/queue-5.10/pnfs-fix-a-hang-in-nfs4_evict_inode.patch @@ -0,0 +1,84 @@ +From f63955721a8020e979b99cc417dcb6da3106aa24 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Sun, 8 Oct 2023 14:20:19 -0400 +Subject: pNFS: Fix a hang in nfs4_evict_inode() + +From: Trond Myklebust + +commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream. + +We are not allowed to call pnfs_mark_matching_lsegs_return() without +also holding a reference to the layout header, since doing so could lead +to the reference count going to zero when we call +pnfs_layout_remove_lseg(). This again can lead to a hang when we get to +nfs4_evict_inode() and are unable to clear the layout pointer. + +pnfs_layout_return_unused_byserver() is guilty of this behaviour, and +has been seen to trigger the refcount warning prior to a hang. + +Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode") +Cc: stable@vger.kernel.org +Signed-off-by: Trond Myklebust +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/pnfs.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -2633,31 +2633,44 @@ pnfs_should_return_unused_layout(struct + return mode == 0; + } + +-static int +-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data) ++static int pnfs_layout_return_unused_byserver(struct nfs_server *server, ++ void *data) + { + const struct pnfs_layout_range *range = data; ++ const struct cred *cred; + struct pnfs_layout_hdr *lo; + struct inode *inode; ++ nfs4_stateid stateid; ++ enum pnfs_iomode iomode; ++ + restart: + rcu_read_lock(); + list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) { +- if (!pnfs_layout_can_be_returned(lo) || ++ inode = lo->plh_inode; ++ if (!inode || !pnfs_layout_can_be_returned(lo) || + test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) + continue; +- inode = lo->plh_inode; + spin_lock(&inode->i_lock); +- if (!pnfs_should_return_unused_layout(lo, range)) { ++ if (!lo->plh_inode || ++ !pnfs_should_return_unused_layout(lo, range)) { + spin_unlock(&inode->i_lock); + continue; + } ++ pnfs_get_layout_hdr(lo); ++ pnfs_set_plh_return_info(lo, range->iomode, 0); ++ if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs, ++ range, 0) != 0 || ++ !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) { ++ spin_unlock(&inode->i_lock); ++ rcu_read_unlock(); ++ pnfs_put_layout_hdr(lo); ++ cond_resched(); ++ goto restart; ++ } + spin_unlock(&inode->i_lock); +- inode = pnfs_grab_inode_layout_hdr(lo); +- if (!inode) +- continue; + rcu_read_unlock(); +- pnfs_mark_layout_for_return(inode, range); +- iput(inode); ++ pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false); ++ pnfs_put_layout_hdr(lo); + cond_resched(); + goto restart; + } diff --git a/queue-5.10/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch b/queue-5.10/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch new file mode 100644 index 00000000000..78430218e8a --- /dev/null +++ b/queue-5.10/revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch @@ -0,0 +1,77 @@ +From 62140a1e4dec4594d5d1e1d353747bf2ef434e8b Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 17 Oct 2023 17:18:06 +0300 +Subject: Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" + +From: Andy Shevchenko + +commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream. + +The commit breaks MMC enumeration on the Intel Merrifield +plaform. + +Before: +[ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA +[ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA +[ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA +[ 36.706399] mmc0: new DDR MMC card at address 0001 +[ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001 +[ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB +[ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 + +After: +[ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA +[ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA +[ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA +[ 36.720627] mmc1: new DDR MMC card at address 0001 +[ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001 +[ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB +[ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10 + +This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/core.c | 16 +++++++--------- + 1 file changed, 7 insertions(+), 9 deletions(-) + +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1007,20 +1007,17 @@ static int add_setting(struct pinctrl *p + + static struct pinctrl *find_pinctrl(struct device *dev) + { +- struct pinctrl *entry, *p = NULL; ++ struct pinctrl *p; + + mutex_lock(&pinctrl_list_mutex); +- +- list_for_each_entry(entry, &pinctrl_list, node) { +- if (entry->dev == dev) { +- p = entry; +- kref_get(&p->users); +- break; ++ list_for_each_entry(p, &pinctrl_list, node) ++ if (p->dev == dev) { ++ mutex_unlock(&pinctrl_list_mutex); ++ return p; + } +- } + + mutex_unlock(&pinctrl_list_mutex); +- return p; ++ return NULL; + } + + static void pinctrl_free(struct pinctrl *p, bool inlist); +@@ -1129,6 +1126,7 @@ struct pinctrl *pinctrl_get(struct devic + p = find_pinctrl(dev); + if (p) { + dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n"); ++ kref_get(&p->users); + return p; + } + diff --git a/queue-5.10/series b/queue-5.10/series index 6ebca503278..b853d6d84de 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -176,3 +176,15 @@ hid-multitouch-add-required-quirk-for-synaptics-0xcd.patch platform-x86-touchscreen_dmi-add-info-for-the-positi.patch net-mlx5-handle-fw-tracer-change-ownership-event-bas.patch bluetooth-hci_event-fix-using-memcmp-when-comparing-.patch +mtd-rawnand-qcom-unmap-the-right-resource-upon-probe-failure.patch +mtd-rawnand-marvell-ensure-program-page-operations-are-successful.patch +mtd-rawnand-arasan-ensure-program-page-operations-are-successful.patch +mtd-spinand-micron-correct-bitmask-for-ecc-status.patch +mtd-physmap-core-restore-map_rom-fallback.patch +mmc-core-sdio-hold-retuning-if-sdio-in-1-bit-mode.patch +mmc-core-capture-correct-oemid-bits-for-emmc-cards.patch +revert-pinctrl-avoid-unsafe-code-pattern-in-find_pinctrl.patch +pnfs-fix-a-hang-in-nfs4_evict_inode.patch +acpi-irq-fix-incorrect-return-value-in-acpi_register_gsi.patch +nvme-pci-add-bogus_nid-for-intel-0a54-device.patch +nvme-rdma-do-not-try-to-stop-unallocated-queues.patch