From: Sasha Levin Date: Wed, 11 Oct 2023 14:22:56 +0000 (-0400) Subject: Fixes for 5.15 X-Git-Tag: v6.1.58~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a6973bb2ba46da857e33ed750d69753646e1a855;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.15 Signed-off-by: Sasha Levin --- diff --git a/queue-5.15/iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch b/queue-5.15/iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch new file mode 100644 index 00000000000..88017c670d8 --- /dev/null +++ b/queue-5.15/iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch @@ -0,0 +1,127 @@ +From c53e353def15a2b057bbb48de114941753c8e43a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 20:04:17 +0800 +Subject: iommu/vt-d: Avoid memory allocation in iommu_suspend() + +From: Zhang Rui + +[ Upstream commit 59df44bfb0ca4c3ee1f1c3c5d0ee8e314844799e ] + +The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. +Allocating memory with the GFP_KERNEL flag may re-enable IRQs during +the suspend callback, which can cause intermittent suspend/hibernation +problems with the following kernel traces: + +Calling iommu_suspend+0x0/0x1d0 +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 15 at kernel/time/timekeeping.c:868 ktime_get+0x9b/0xb0 +... +CPU: 0 PID: 15 Comm: rcu_preempt Tainted: G U E 6.3-intel #r1 +RIP: 0010:ktime_get+0x9b/0xb0 +... +Call Trace: + + tick_sched_timer+0x22/0x90 + ? __pfx_tick_sched_timer+0x10/0x10 + __hrtimer_run_queues+0x111/0x2b0 + hrtimer_interrupt+0xfa/0x230 + __sysvec_apic_timer_interrupt+0x63/0x140 + sysvec_apic_timer_interrupt+0x7b/0xa0 + + + asm_sysvec_apic_timer_interrupt+0x1f/0x30 +... +------------[ cut here ]------------ +Interrupts enabled after iommu_suspend+0x0/0x1d0 +WARNING: CPU: 0 PID: 27420 at drivers/base/syscore.c:68 syscore_suspend+0x147/0x270 +CPU: 0 PID: 27420 Comm: rtcwake Tainted: G U W E 6.3-intel #r1 +RIP: 0010:syscore_suspend+0x147/0x270 +... +Call Trace: + + hibernation_snapshot+0x25b/0x670 + hibernate+0xcd/0x390 + state_store+0xcf/0xe0 + kobj_attr_store+0x13/0x30 + sysfs_kf_write+0x3f/0x50 + kernfs_fop_write_iter+0x128/0x200 + vfs_write+0x1fd/0x3c0 + ksys_write+0x6f/0xf0 + __x64_sys_write+0x1d/0x30 + do_syscall_64+0x3b/0x90 + entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Given that only 4 words memory is needed, avoid the memory allocation in +iommu_suspend(). + +CC: stable@kernel.org +Fixes: 33e07157105e ("iommu/vt-d: Avoid GFP_ATOMIC where it is not needed") +Signed-off-by: Zhang Rui +Tested-by: Ooi, Chin Hao +Link: https://lore.kernel.org/r/20230921093956.234692-1-rui.zhang@intel.com +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20230925120417.55977-2-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 16 ---------------- + include/linux/intel-iommu.h | 2 +- + 2 files changed, 1 insertion(+), 17 deletions(-) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 29538471c528e..b3aa6ce9d3d7d 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -3564,13 +3564,6 @@ static int iommu_suspend(void) + struct intel_iommu *iommu = NULL; + unsigned long flag; + +- for_each_active_iommu(iommu, drhd) { +- iommu->iommu_state = kcalloc(MAX_SR_DMAR_REGS, sizeof(u32), +- GFP_KERNEL); +- if (!iommu->iommu_state) +- goto nomem; +- } +- + iommu_flush_all(); + + for_each_active_iommu(iommu, drhd) { +@@ -3590,12 +3583,6 @@ static int iommu_suspend(void) + raw_spin_unlock_irqrestore(&iommu->register_lock, flag); + } + return 0; +- +-nomem: +- for_each_active_iommu(iommu, drhd) +- kfree(iommu->iommu_state); +- +- return -ENOMEM; + } + + static void iommu_resume(void) +@@ -3627,9 +3614,6 @@ static void iommu_resume(void) + + raw_spin_unlock_irqrestore(&iommu->register_lock, flag); + } +- +- for_each_active_iommu(iommu, drhd) +- kfree(iommu->iommu_state); + } + + static struct syscore_ops iommu_syscore_ops = { +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 0cf00786a164f..e00857c4efc28 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -604,7 +604,7 @@ struct intel_iommu { + struct iopf_queue *iopf_queue; + unsigned char iopfq_name[16]; + struct q_inval *qi; /* Queued invalidation info */ +- u32 *iommu_state; /* Store iommu states between suspend and resume.*/ ++ u32 iommu_state[MAX_SR_DMAR_REGS]; /* Store iommu states between suspend and resume.*/ + + #ifdef CONFIG_IRQ_REMAP + struct ir_table *ir_table; /* Interrupt remapping info */ +-- +2.40.1 + diff --git a/queue-5.15/of-overlay-reorder-struct-fragment-fields-kerneldoc.patch b/queue-5.15/of-overlay-reorder-struct-fragment-fields-kerneldoc.patch new file mode 100644 index 00000000000..3f1a5377185 --- /dev/null +++ b/queue-5.15/of-overlay-reorder-struct-fragment-fields-kerneldoc.patch @@ -0,0 +1,38 @@ +From 808e018385063b45c65b374dd88b254df5a114cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Sep 2023 11:35:39 +0200 +Subject: of: overlay: Reorder struct fragment fields kerneldoc + +From: Geert Uytterhoeven + +[ Upstream commit 5d007ffdf6025fe83e497c44ed7c8aa8f150c4d1 ] + +The fields of the fragment structure were reordered, but the kerneldoc +was not updated. + +Fixes: 81225ea682f45629 ("of: overlay: reorder fields in struct fragment") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/cfa36d2bb95e3c399c415dbf58057302c70ef375.1695893695.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/overlay.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/of/overlay.c b/drivers/of/overlay.c +index ee7f3659b353c..cea5ad907235e 100644 +--- a/drivers/of/overlay.c ++++ b/drivers/of/overlay.c +@@ -45,8 +45,8 @@ struct target { + + /** + * struct fragment - info about fragment nodes in overlay expanded device tree +- * @target: target of the overlay operation + * @overlay: pointer to the __overlay__ node ++ * @target: target of the overlay operation + */ + struct fragment { + struct device_node *overlay; +-- +2.40.1 + diff --git a/queue-5.15/perf-arm-cmn-fix-the-unhandled-overflow-status-of-co.patch b/queue-5.15/perf-arm-cmn-fix-the-unhandled-overflow-status-of-co.patch new file mode 100644 index 00000000000..4ad1d0f8577 --- /dev/null +++ b/queue-5.15/perf-arm-cmn-fix-the-unhandled-overflow-status-of-co.patch @@ -0,0 +1,41 @@ +From b41feb81f982d1dc109bd2e75b6854efc5523825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 11:22:32 +0800 +Subject: perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 + +From: Jing Zhang + +[ Upstream commit 7f949f6f54ff593123ab95b6247bfa4542a65580 ] + +The register por_dt_pmovsr Bits[7:0] indicates overflow from counters 7 +to 0. But in arm_cmn_handle_irq(), only handled the overflow status of +Bits[3:0] which results in unhandled overflow status of counters 4 to 7. + +So let the overflow status of DTC counters 4 to 7 to be handled. + +Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver") +Signed-off-by: Jing Zhang +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/1695612152-123633-1-git-send-email-renyu.zj@linux.alibaba.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 40945343c4cc1..e2a055ba0b7a8 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -1177,7 +1177,7 @@ static irqreturn_t arm_cmn_handle_irq(int irq, void *dev_id) + u64 delta; + int i; + +- for (i = 0; i < CMN_DTM_NUM_COUNTERS; i++) { ++ for (i = 0; i < CMN_DT_NUM_COUNTERS; i++) { + if (status & (1U << i)) { + ret = IRQ_HANDLED; + if (WARN_ON(!dtc->counters[i])) +-- +2.40.1 + diff --git a/queue-5.15/platform-x86-hp-wmi-mark-driver-struct-with-__refdat.patch b/queue-5.15/platform-x86-hp-wmi-mark-driver-struct-with-__refdat.patch new file mode 100644 index 00000000000..b172b422178 --- /dev/null +++ b/queue-5.15/platform-x86-hp-wmi-mark-driver-struct-with-__refdat.patch @@ -0,0 +1,51 @@ +From 48a42607afe1b0159e2fe753a62186af305faf3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 13:16:24 +0200 +Subject: platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent + section mismatch warning +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 5b44abbc39ca15df80d0da4756078c98c831090f ] + +As described in the added code comment, a reference to .exit.text is ok +for drivers registered via module_platform_driver_probe(). Make this +explicit to prevent a section mismatch warning: + + WARNING: modpost: drivers/platform/x86/hp/hp-wmi: section mismatch in reference: hp_wmi_driver+0x8 (section: .data) -> hp_wmi_bios_remove (section: .exit.text) + +Fixes: c165b80cfecc ("hp-wmi: fix handling of platform device") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20231004111624.2667753-1-u.kleine-koenig@pengutronix.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp/hp-wmi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/x86/hp/hp-wmi.c b/drivers/platform/x86/hp/hp-wmi.c +index 8c845d263429f..be99a78e1bb8d 100644 +--- a/drivers/platform/x86/hp/hp-wmi.c ++++ b/drivers/platform/x86/hp/hp-wmi.c +@@ -1076,7 +1076,13 @@ static const struct dev_pm_ops hp_wmi_pm_ops = { + .restore = hp_wmi_resume_handler, + }; + +-static struct platform_driver hp_wmi_driver = { ++/* ++ * hp_wmi_bios_remove() lives in .exit.text. For drivers registered via ++ * module_platform_driver_probe() this is ok because they cannot get unbound at ++ * runtime. So mark the driver struct with __refdata to prevent modpost ++ * triggering a section mismatch warning. ++ */ ++static struct platform_driver hp_wmi_driver __refdata = { + .driver = { + .name = "hp-wmi", + .pm = &hp_wmi_pm_ops, +-- +2.40.1 + diff --git a/queue-5.15/platform-x86-think-lmi-fix-reference-leak.patch b/queue-5.15/platform-x86-think-lmi-fix-reference-leak.patch new file mode 100644 index 00000000000..46b01e56d6a --- /dev/null +++ b/queue-5.15/platform-x86-think-lmi-fix-reference-leak.patch @@ -0,0 +1,80 @@ +From 223eccebc3ba7454c9b3a950ae12676728bf07f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 25 Sep 2023 16:28:18 +0200 +Subject: platform/x86: think-lmi: Fix reference leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Armin Wolf + +[ Upstream commit 528ab3e605cabf2f9c9bd5944d3bfe15f6e94f81 ] + +If a duplicate attribute is found using kset_find_obj(), a reference +to that attribute is returned which needs to be disposed accordingly +using kobject_put(). Move the setting name validation into a separate +function to allow for this change without having to duplicate the +cleanup code for this setting. +As a side note, a very similar bug was fixed in +commit 7295a996fdab ("platform/x86: dell-sysman: Fix reference leak"), +so it seems that the bug was copied from that driver. + +Compile-tested only. + +Fixes: 1bcad8e510b2 ("platform/x86: think-lmi: Fix issues with duplicate attributes") +Reviewed-by: Mark Pearson +Reviewed-by: Ilpo Järvinen +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20230925142819.74525-2-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/think-lmi.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c +index 76f0d04e17f30..154b1b26d03f8 100644 +--- a/drivers/platform/x86/think-lmi.c ++++ b/drivers/platform/x86/think-lmi.c +@@ -787,6 +787,24 @@ static void tlmi_release_attr(void) + kset_unregister(tlmi_priv.authentication_kset); + } + ++static int tlmi_validate_setting_name(struct kset *attribute_kset, char *name) ++{ ++ struct kobject *duplicate; ++ ++ if (!strcmp(name, "Reserved")) ++ return -EINVAL; ++ ++ duplicate = kset_find_obj(attribute_kset, name); ++ if (duplicate) { ++ pr_debug("Duplicate attribute name found - %s\n", name); ++ /* kset_find_obj() returns a reference */ ++ kobject_put(duplicate); ++ return -EBUSY; ++ } ++ ++ return 0; ++} ++ + static int tlmi_sysfs_init(void) + { + int i, ret; +@@ -815,10 +833,8 @@ static int tlmi_sysfs_init(void) + continue; + + /* check for duplicate or reserved values */ +- if (kset_find_obj(tlmi_priv.attribute_kset, tlmi_priv.setting[i]->display_name) || +- !strcmp(tlmi_priv.setting[i]->display_name, "Reserved")) { +- pr_debug("duplicate or reserved attribute name found - %s\n", +- tlmi_priv.setting[i]->display_name); ++ if (tlmi_validate_setting_name(tlmi_priv.attribute_kset, ++ tlmi_priv.setting[i]->display_name) < 0) { + kfree(tlmi_priv.setting[i]->possible_values); + kfree(tlmi_priv.setting[i]); + tlmi_priv.setting[i] = NULL; +-- +2.40.1 + diff --git a/queue-5.15/rdma-cxgb4-check-skb-value-for-failure-to-allocate.patch b/queue-5.15/rdma-cxgb4-check-skb-value-for-failure-to-allocate.patch new file mode 100644 index 00000000000..898fc79546d --- /dev/null +++ b/queue-5.15/rdma-cxgb4-check-skb-value-for-failure-to-allocate.patch @@ -0,0 +1,39 @@ +From faa3b9080ccc7e516ba151664cb007666f2fdd85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Sep 2023 15:40:48 +0300 +Subject: RDMA/cxgb4: Check skb value for failure to allocate + +From: Artem Chernyshev + +[ Upstream commit 8fb8a82086f5bda6893ea6557c5a458e4549c6d7 ] + +get_skb() can fail to allocate skb, so check it. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Fixes: 5be78ee924ae ("RDMA/cxgb4: Fix LE hash collision bug for active open connection") +Signed-off-by: Artem Chernyshev +Link: https://lore.kernel.org/r/20230905124048.284165-1-artem.chernyshev@red-soft.ru +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index a3e4913904b75..f159cbb6bb3ea 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -1965,6 +1965,9 @@ static int send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid) + int win; + + skb = get_skb(NULL, sizeof(*req), GFP_KERNEL); ++ if (!skb) ++ return -ENOMEM; ++ + req = __skb_put_zero(skb, sizeof(*req)); + req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR)); + req->len16_pkd = htonl(FW_WR_LEN16_V(DIV_ROUND_UP(sizeof(*req), 16))); +-- +2.40.1 + diff --git a/queue-5.15/rdma-srp-do-not-call-scsi_done-from-srp_abort.patch b/queue-5.15/rdma-srp-do-not-call-scsi_done-from-srp_abort.patch new file mode 100644 index 00000000000..cf38ed5b189 --- /dev/null +++ b/queue-5.15/rdma-srp-do-not-call-scsi_done-from-srp_abort.patch @@ -0,0 +1,71 @@ +From 75d15d19c2572b5d7c633452ec3f135df37e8259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Aug 2023 13:57:27 -0700 +Subject: RDMA/srp: Do not call scsi_done() from srp_abort() + +From: Bart Van Assche + +[ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] + +After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler +callback, it performs one of the following actions: +* Call scsi_queue_insert(). +* Call scsi_finish_command(). +* Call scsi_eh_scmd_add(). +Hence, SCSI abort handlers must not call scsi_done(). Otherwise all +the above actions would trigger a use-after-free. Hence remove the +scsi_done() call from srp_abort(). Keep the srp_free_req() call +before returning SUCCESS because we may not see the command again if +SUCCESS is returned. + +Cc: Bob Pearson +Cc: Shinichiro Kawasaki +Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") +Signed-off-by: Bart Van Assche +Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index df7c740e26338..2938d7040f907 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2783,7 +2783,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) + u32 tag; + u16 ch_idx; + struct srp_rdma_ch *ch; +- int ret; + + shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); + +@@ -2797,19 +2796,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) + shost_printk(KERN_ERR, target->scsi_host, + "Sending SRP abort for tag %#x\n", tag); + if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, +- SRP_TSK_ABORT_TASK, NULL) == 0) +- ret = SUCCESS; +- else if (target->rport->state == SRP_RPORT_LOST) +- ret = FAST_IO_FAIL; +- else +- ret = FAILED; +- if (ret == SUCCESS) { ++ SRP_TSK_ABORT_TASK, NULL) == 0) { + srp_free_req(ch, req, scmnd, 0); +- scmnd->result = DID_ABORT << 16; +- scsi_done(scmnd); ++ return SUCCESS; + } ++ if (target->rport->state == SRP_RPORT_LOST) ++ return FAST_IO_FAIL; + +- return ret; ++ return FAILED; + } + + static int srp_reset_device(struct scsi_cmnd *scmnd) +-- +2.40.1 + diff --git a/queue-5.15/scsi-core-rename-scsi_mq_done-into-scsi_done-and-exp.patch b/queue-5.15/scsi-core-rename-scsi_mq_done-into-scsi_done-and-exp.patch new file mode 100644 index 00000000000..9731590a1cb --- /dev/null +++ b/queue-5.15/scsi-core-rename-scsi_mq_done-into-scsi_done-and-exp.patch @@ -0,0 +1,71 @@ +From 36a1813b3160c512698fc6cc4a406859cc5c5d01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 13:27:57 -0700 +Subject: scsi: core: Rename scsi_mq_done() into scsi_done() and export it + +From: Bart Van Assche + +[ Upstream commit a710eacb9d13cb5d9eb5341ebc6fc8f7b96f8c6f ] + +Since the removal of the legacy block layer there is only one completion +function left in the SCSI core, namely scsi_mq_done(). Rename it into +scsi_done(). Export that function to allow SCSI LLDs to call it directly. + +Link: https://lore.kernel.org/r/20211007202923.2174984-3-bvanassche@acm.org +Reviewed-by: Benjamin Block +Reviewed-by: Bean Huo +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 5 +++-- + include/scsi/scsi_cmnd.h | 2 ++ + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 7bdaa6b757cd4..3dbfd15e6fe79 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1576,7 +1576,7 @@ static blk_status_t scsi_prepare_cmd(struct request *req) + return scsi_cmd_to_driver(cmd)->init_command(cmd); + } + +-static void scsi_mq_done(struct scsi_cmnd *cmd) ++void scsi_done(struct scsi_cmnd *cmd) + { + switch (cmd->submitter) { + case SUBMITTED_BY_BLOCK_LAYER: +@@ -1594,6 +1594,7 @@ static void scsi_mq_done(struct scsi_cmnd *cmd) + trace_scsi_dispatch_cmd_done(cmd); + blk_mq_complete_request(scsi_cmd_to_rq(cmd)); + } ++EXPORT_SYMBOL(scsi_done); + + static void scsi_mq_put_budget(struct request_queue *q, int budget_token) + { +@@ -1694,7 +1695,7 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx, + scsi_set_resid(cmd, 0); + memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); + cmd->submitter = SUBMITTED_BY_BLOCK_LAYER; +- cmd->scsi_done = scsi_mq_done; ++ cmd->scsi_done = scsi_done; + + blk_mq_start_request(req); + reason = scsi_dispatch_cmd(cmd); +diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h +index 0823bad7b0c90..e1180771604d7 100644 +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -172,6 +172,8 @@ static inline struct scsi_driver *scsi_cmd_to_driver(struct scsi_cmnd *cmd) + return *(struct scsi_driver **)rq->rq_disk->private_data; + } + ++void scsi_done(struct scsi_cmnd *cmd); ++ + extern void scsi_finish_command(struct scsi_cmnd *cmd); + + extern void *scsi_kmap_atomic_sg(struct scatterlist *sg, int sg_count, +-- +2.40.1 + diff --git a/queue-5.15/scsi-core-use-a-structure-member-to-track-the-scsi-c.patch b/queue-5.15/scsi-core-use-a-structure-member-to-track-the-scsi-c.patch new file mode 100644 index 00000000000..d269ecb7213 --- /dev/null +++ b/queue-5.15/scsi-core-use-a-structure-member-to-track-the-scsi-c.patch @@ -0,0 +1,173 @@ +From ddd5d8cbd4e1f51f73857d43cf83a8145b0a5d72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 13:27:56 -0700 +Subject: scsi: core: Use a structure member to track the SCSI command + submitter + +From: Bart Van Assche + +[ Upstream commit bf23e619039d360d503b7282d030daf2277a5d47 ] + +Conditional statements are faster than indirect calls. Use a structure +member to track the SCSI command submitter such that later patches can call +scsi_done(scmd) instead of scmd->scsi_done(scmd). + +The asymmetric behavior that scsi_send_eh_cmnd() sets the submission +context to the SCSI error handler and that it does not restore the +submission context to the SCSI core is retained. + +Link: https://lore.kernel.org/r/20211007202923.2174984-2-bvanassche@acm.org +Cc: Hannes Reinecke +Cc: Ming Lei +Cc: Christoph Hellwig +Reviewed-by: Benjamin Block +Reviewed-by: Bean Huo +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_error.c | 17 ++++++----------- + drivers/scsi/scsi_lib.c | 10 ++++++++++ + drivers/scsi/scsi_priv.h | 1 + + include/scsi/scsi_cmnd.h | 7 +++++++ + 4 files changed, 24 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index dd9f5778f687d..18b99240a9062 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -50,8 +50,6 @@ + + #include + +-static void scsi_eh_done(struct scsi_cmnd *scmd); +- + /* + * These should *probably* be handled by the host itself. + * Since it is allowed to sleep, it probably should. +@@ -542,7 +540,8 @@ enum scsi_disposition scsi_check_sense(struct scsi_cmnd *scmd) + /* handler does not care. Drop down to default handling */ + } + +- if (scmd->cmnd[0] == TEST_UNIT_READY && scmd->scsi_done != scsi_eh_done) ++ if (scmd->cmnd[0] == TEST_UNIT_READY && ++ scmd->submitter != SUBMITTED_BY_SCSI_ERROR_HANDLER) + /* + * nasty: for mid-layer issued TURs, we need to return the + * actual sense data without any recovery attempt. For eh +@@ -804,7 +803,7 @@ static enum scsi_disposition scsi_eh_completed_normally(struct scsi_cmnd *scmd) + * scsi_eh_done - Completion function for error handling. + * @scmd: Cmd that is done. + */ +-static void scsi_eh_done(struct scsi_cmnd *scmd) ++void scsi_eh_done(struct scsi_cmnd *scmd) + { + struct completion *eh_action; + +@@ -1104,7 +1103,7 @@ static enum scsi_disposition scsi_send_eh_cmnd(struct scsi_cmnd *scmd, + shost->eh_action = &done; + + scsi_log_send(scmd); +- scmd->scsi_done = scsi_eh_done; ++ scmd->submitter = SUBMITTED_BY_SCSI_ERROR_HANDLER; + + /* + * Lock sdev->state_mutex to avoid that scsi_device_quiesce() can +@@ -1131,6 +1130,7 @@ static enum scsi_disposition scsi_send_eh_cmnd(struct scsi_cmnd *scmd, + if (rtn) { + if (timeleft > stall_for) { + scsi_eh_restore_cmnd(scmd, &ses); ++ + timeleft -= stall_for; + msleep(jiffies_to_msecs(stall_for)); + goto retry; +@@ -2360,11 +2360,6 @@ void scsi_report_device_reset(struct Scsi_Host *shost, int channel, int target) + } + EXPORT_SYMBOL(scsi_report_device_reset); + +-static void +-scsi_reset_provider_done_command(struct scsi_cmnd *scmd) +-{ +-} +- + /** + * scsi_ioctl_reset: explicitly reset a host/bus/target/device + * @dev: scsi_device to operate on +@@ -2401,7 +2396,7 @@ scsi_ioctl_reset(struct scsi_device *dev, int __user *arg) + scsi_init_command(dev, scmd); + scmd->cmnd = scsi_req(rq)->cmd; + +- scmd->scsi_done = scsi_reset_provider_done_command; ++ scmd->submitter = SUBMITTED_BY_SCSI_RESET_IOCTL; + memset(&scmd->sdb, 0, sizeof(scmd->sdb)); + + scmd->cmd_len = 0; +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 5525e6ffee537..7bdaa6b757cd4 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1578,6 +1578,15 @@ static blk_status_t scsi_prepare_cmd(struct request *req) + + static void scsi_mq_done(struct scsi_cmnd *cmd) + { ++ switch (cmd->submitter) { ++ case SUBMITTED_BY_BLOCK_LAYER: ++ break; ++ case SUBMITTED_BY_SCSI_ERROR_HANDLER: ++ return scsi_eh_done(cmd); ++ case SUBMITTED_BY_SCSI_RESET_IOCTL: ++ return; ++ } ++ + if (unlikely(blk_should_fake_timeout(scsi_cmd_to_rq(cmd)->q))) + return; + if (unlikely(test_and_set_bit(SCMD_STATE_COMPLETE, &cmd->state))) +@@ -1684,6 +1693,7 @@ static blk_status_t scsi_queue_rq(struct blk_mq_hw_ctx *hctx, + + scsi_set_resid(cmd, 0); + memset(cmd->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); ++ cmd->submitter = SUBMITTED_BY_BLOCK_LAYER; + cmd->scsi_done = scsi_mq_done; + + blk_mq_start_request(req); +diff --git a/drivers/scsi/scsi_priv.h b/drivers/scsi/scsi_priv.h +index 6d9152031a403..b7f9631493522 100644 +--- a/drivers/scsi/scsi_priv.h ++++ b/drivers/scsi/scsi_priv.h +@@ -84,6 +84,7 @@ void scsi_eh_ready_devs(struct Scsi_Host *shost, + int scsi_eh_get_sense(struct list_head *work_q, + struct list_head *done_q); + int scsi_noretry_cmd(struct scsi_cmnd *scmd); ++void scsi_eh_done(struct scsi_cmnd *scmd); + + /* scsi_lib.c */ + extern int scsi_maybe_unblock_host(struct scsi_device *sdev); +diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h +index 685249233f2fe..0823bad7b0c90 100644 +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -65,6 +65,12 @@ struct scsi_pointer { + #define SCMD_STATE_COMPLETE 0 + #define SCMD_STATE_INFLIGHT 1 + ++enum scsi_cmnd_submitter { ++ SUBMITTED_BY_BLOCK_LAYER = 0, ++ SUBMITTED_BY_SCSI_ERROR_HANDLER = 1, ++ SUBMITTED_BY_SCSI_RESET_IOCTL = 2, ++} __packed; ++ + struct scsi_cmnd { + struct scsi_request req; + struct scsi_device *device; +@@ -90,6 +96,7 @@ struct scsi_cmnd { + unsigned char prot_op; + unsigned char prot_type; + unsigned char prot_flags; ++ enum scsi_cmnd_submitter submitter; + + unsigned short cmd_len; + enum dma_data_direction sc_data_direction; +-- +2.40.1 + diff --git a/queue-5.15/scsi-ib_srp-call-scsi_done-directly.patch b/queue-5.15/scsi-ib_srp-call-scsi_done-directly.patch new file mode 100644 index 00000000000..f019d83baa2 --- /dev/null +++ b/queue-5.15/scsi-ib_srp-call-scsi_done-directly.patch @@ -0,0 +1,64 @@ +From 27c29769a01788d0976384196b620e9bc164283f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 13:28:00 -0700 +Subject: scsi: ib_srp: Call scsi_done() directly + +From: Bart Van Assche + +[ Upstream commit 5f9ae9eecb15ef00d89a5884add1117a8e634e7f ] + +Conditional statements are faster than indirect calls. Hence call +scsi_done() directly. + +Link: https://lore.kernel.org/r/20211007202923.2174984-6-bvanassche@acm.org +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()") +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 7701204fe5423..df7c740e26338 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1266,7 +1266,7 @@ static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req, + if (scmnd) { + srp_free_req(ch, req, scmnd, 0); + scmnd->result = result; +- scmnd->scsi_done(scmnd); ++ scsi_done(scmnd); + } + } + +@@ -1984,7 +1984,7 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) + srp_free_req(ch, req, scmnd, + be32_to_cpu(rsp->req_lim_delta)); + +- scmnd->scsi_done(scmnd); ++ scsi_done(scmnd); + } + } + +@@ -2236,7 +2236,7 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd) + + err: + if (scmnd->result) { +- scmnd->scsi_done(scmnd); ++ scsi_done(scmnd); + ret = 0; + } else { + ret = SCSI_MLQUEUE_HOST_BUSY; +@@ -2806,7 +2806,7 @@ static int srp_abort(struct scsi_cmnd *scmnd) + if (ret == SUCCESS) { + srp_free_req(ch, req, scmnd, 0); + scmnd->result = DID_ABORT << 16; +- scmnd->scsi_done(scmnd); ++ scsi_done(scmnd); + } + + return ret; +-- +2.40.1 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..924ddb7a9c7 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,10 @@ +iommu-vt-d-avoid-memory-allocation-in-iommu_suspend.patch +scsi-core-use-a-structure-member-to-track-the-scsi-c.patch +scsi-core-rename-scsi_mq_done-into-scsi_done-and-exp.patch +scsi-ib_srp-call-scsi_done-directly.patch +rdma-srp-do-not-call-scsi_done-from-srp_abort.patch +rdma-cxgb4-check-skb-value-for-failure-to-allocate.patch +perf-arm-cmn-fix-the-unhandled-overflow-status-of-co.patch +of-overlay-reorder-struct-fragment-fields-kerneldoc.patch +platform-x86-think-lmi-fix-reference-leak.patch +platform-x86-hp-wmi-mark-driver-struct-with-__refdat.patch