From c1385a336300f5551e3071cc0b18c7339c68c833 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 21 Apr 2025 07:19:43 -0400 Subject: [PATCH] Fixes for 6.14 Signed-off-by: Sasha Levin --- ...decrement-refcount-on-error-in-sw_sy.patch | 71 +++++++ ...-msm-a6xx-don-t-let-ib_size-overflow.patch | 78 ++++++++ ...u-drop-rogue-intr_tear_rd_ptr-values.patch | 185 ++++++++++++++++++ ...error-pointers-in-dpu_plane_virtual_.patch | 48 +++++ ...rect-dispatch-configuration-for-v3d-.patch | 77 ++++++++ ...stract-out-ep_try_send_events-helper.patch | 71 +++++++ ...-epoll-timeout-if-it-s-in-the-future.patch | 92 +++++++++ ...bdex_statx-call-to-vfs_getattr_nosec.patch | 127 ++++++++++++ ...rect-hash-size-in-register_ftrace_di.patch | 44 +++++ queue-6.14/i2c-atr-fix-wrong-include.patch | 49 +++++ ...d-missing-selections-of-config_crc32.patch | 179 +++++++++++++++++ ..._count-directly-if-fail-to-queue-dl_.patch | 75 +++++++ queue-6.14/series | 12 ++ 13 files changed, 1108 insertions(+) create mode 100644 queue-6.14/dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch create mode 100644 queue-6.14/drm-msm-a6xx-don-t-let-ib_size-overflow.patch create mode 100644 queue-6.14/drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch create mode 100644 queue-6.14/drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch create mode 100644 queue-6.14/drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch create mode 100644 queue-6.14/eventpoll-abstract-out-ep_try_send_events-helper.patch create mode 100644 queue-6.14/eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch create mode 100644 queue-6.14/fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch create mode 100644 queue-6.14/ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch create mode 100644 queue-6.14/i2c-atr-fix-wrong-include.patch create mode 100644 queue-6.14/nfs-add-missing-selections-of-config_crc32.patch create mode 100644 queue-6.14/nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch diff --git a/queue-6.14/dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch b/queue-6.14/dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch new file mode 100644 index 0000000000..fc689feb51 --- /dev/null +++ b/queue-6.14/dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch @@ -0,0 +1,71 @@ +From 1b841567f3342cc15f5126cc638656a9ba392961 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 14:01:26 +0300 +Subject: dma-buf/sw_sync: Decrement refcount on error in + sw_sync_ioctl_get_deadline() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit d27326a9999286fa45ad063f760e63329254f130 ] + +Call dma_fence_put(fence) before returning an error if +dma_fence_to_sync_pt() fails. Use an unwind ladder at the +end of the function to do the cleanup. + +Fixes: 70e67aaec2f4 ("dma-buf/sw_sync: Add fence deadline support") +Signed-off-by: Dan Carpenter +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/msgid/a010a1ac-107b-4fc0-a052-9fd3706ad690@stanley.mountain +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/dma-buf/sw_sync.c | 19 ++++++++++++++----- + 1 file changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/dma-buf/sw_sync.c b/drivers/dma-buf/sw_sync.c +index f5905d67dedbb..22a808995f106 100644 +--- a/drivers/dma-buf/sw_sync.c ++++ b/drivers/dma-buf/sw_sync.c +@@ -438,15 +438,17 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long a + return -EINVAL; + + pt = dma_fence_to_sync_pt(fence); +- if (!pt) +- return -EINVAL; ++ if (!pt) { ++ ret = -EINVAL; ++ goto put_fence; ++ } + + spin_lock_irqsave(fence->lock, flags); +- if (test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) { +- data.deadline_ns = ktime_to_ns(pt->deadline); +- } else { ++ if (!test_bit(SW_SYNC_HAS_DEADLINE_BIT, &fence->flags)) { + ret = -ENOENT; ++ goto unlock; + } ++ data.deadline_ns = ktime_to_ns(pt->deadline); + spin_unlock_irqrestore(fence->lock, flags); + + dma_fence_put(fence); +@@ -458,6 +460,13 @@ static int sw_sync_ioctl_get_deadline(struct sync_timeline *obj, unsigned long a + return -EFAULT; + + return 0; ++ ++unlock: ++ spin_unlock_irqrestore(fence->lock, flags); ++put_fence: ++ dma_fence_put(fence); ++ ++ return ret; + } + + static long sw_sync_ioctl(struct file *file, unsigned int cmd, +-- +2.39.5 + diff --git a/queue-6.14/drm-msm-a6xx-don-t-let-ib_size-overflow.patch b/queue-6.14/drm-msm-a6xx-don-t-let-ib_size-overflow.patch new file mode 100644 index 0000000000..ca0c5d0b85 --- /dev/null +++ b/queue-6.14/drm-msm-a6xx-don-t-let-ib_size-overflow.patch @@ -0,0 +1,78 @@ +From cb9aa3411d23b07b871b367bc230eebfce3ea56a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Mar 2025 08:00:06 -0700 +Subject: drm/msm/a6xx+: Don't let IB_SIZE overflow + +From: Rob Clark + +[ Upstream commit 9d78f02503227d3554d26cf8ca73276105c98f3e ] + +IB_SIZE is only b0..b19. Starting with a6xx gen3, additional fields +were added above the IB_SIZE. Accidentially setting them can cause +badness. Fix this by properly defining the CP_INDIRECT_BUFFER packet +and using the generated builder macro to ensure unintended bits are not +set. + +v2: add missing type attribute for IB_BASE +v3: fix offset attribute in xml + +Reported-by: Connor Abbott +Fixes: a83366ef19ea ("drm/msm/a6xx: add A640/A650 to gpulist") +Signed-off-by: Rob Clark +Patchwork: https://patchwork.freedesktop.org/patch/643396/ +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 8 ++++---- + drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml | 7 +++++++ + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index 0ae29a7c8a4d3..2a317cdb8eaa1 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -242,10 +242,10 @@ static void a6xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) + break; + fallthrough; + case MSM_SUBMIT_CMD_BUF: +- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3); ++ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3); + OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); + OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); +- OUT_RING(ring, submit->cmd[i].size); ++ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size)); + ibs++; + break; + } +@@ -377,10 +377,10 @@ static void a7xx_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit) + break; + fallthrough; + case MSM_SUBMIT_CMD_BUF: +- OUT_PKT7(ring, CP_INDIRECT_BUFFER_PFE, 3); ++ OUT_PKT7(ring, CP_INDIRECT_BUFFER, 3); + OUT_RING(ring, lower_32_bits(submit->cmd[i].iova)); + OUT_RING(ring, upper_32_bits(submit->cmd[i].iova)); +- OUT_RING(ring, submit->cmd[i].size); ++ OUT_RING(ring, A5XX_CP_INDIRECT_BUFFER_2_IB_SIZE(submit->cmd[i].size)); + ibs++; + break; + } +diff --git a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml +index 55a35182858cc..5a6ae9fc31945 100644 +--- a/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml ++++ b/drivers/gpu/drm/msm/registers/adreno/adreno_pm4.xml +@@ -2259,5 +2259,12 @@ opcode: CP_LOAD_STATE4 (30) (4 dwords) + + + ++ ++ ++ ++ ++ ++ ++ + + +-- +2.39.5 + diff --git a/queue-6.14/drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch b/queue-6.14/drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch new file mode 100644 index 0000000000..3876bd5c2f --- /dev/null +++ b/queue-6.14/drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch @@ -0,0 +1,185 @@ +From a8bf8fbc503a74280e36744ec726bc7860b858c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Apr 2025 16:02:44 +0300 +Subject: drm/msm/dpu: drop rogue intr_tear_rd_ptr values + +From: Dmitry Baryshkov + +[ Upstream commit ddfa00afae800b3dea02fa36f3f4012a8379ae58 ] + +The commit 5a9d50150c2c ("drm/msm/dpu: shift IRQ indices by 1") shifted +IRQ indices by 1, making 'NO_IRQ' to be 0 rather than -1 (and allowing +to skip the definition if the IRQ is not present). +Several platform files were sketched before that commit, but got applied +afterwards. As such, they inherited historical (and currently incorrect) +setting of .intr_tear_rd_ptr = -1 for 'NO_IRQ' value. + +Drop that setting for all the affected platforms. + +Fixes: 62af6e1cb596 ("drm/msm/dpu: Add support for MSM8917") +Fixes: c079680bb0fa ("drm/msm/dpu: Add support for MSM8937") +Fixes: 7a6109ce1c2c ("drm/msm/dpu: Add support for MSM8953") +Fixes: daf9a92daeb8 ("drm/msm/dpu: Add support for MSM8996") +Fixes: 7204df5e7e68 ("drm/msm/dpu: add support for SDM660 and SDM630 platforms") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/647486/ +Link: https://lore.kernel.org/r/20250408-dpu-drop-intr-rd-ptr-v1-1-eeac337d88f8@oss.qualcomm.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h | 2 -- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h | 1 - + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h | 3 --- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h | 4 ---- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h | 3 --- + drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h | 2 -- + 6 files changed, 15 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h +index ab3dfb0b374ea..cb89d8cf300f9 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_14_msm8937.h +@@ -132,7 +132,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_2", .id = INTF_2, + .base = 0x6b000, .len = 0x268, +@@ -141,7 +140,6 @@ static const struct dpu_intf_cfg msm8937_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), +- .intr_tear_rd_ptr = -1, + }, + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h +index 6bdaecca67614..b2a38e62d3a93 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_15_msm8917.h +@@ -118,7 +118,6 @@ static const struct dpu_intf_cfg msm8917_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h +index 14f36ea6ad0eb..06859984d2a5c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_16_msm8953.h +@@ -131,7 +131,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_1", .id = INTF_1, + .base = 0x6a800, .len = 0x268, +@@ -140,7 +139,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_2", .id = INTF_2, + .base = 0x6b000, .len = 0x268, +@@ -149,7 +147,6 @@ static const struct dpu_intf_cfg msm8953_intf[] = { + .prog_fetch_lines_worst_case = 14, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), +- .intr_tear_rd_ptr = -1, + }, + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h +index 491f6f5827d15..153e275513c31 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_1_7_msm8996.h +@@ -241,7 +241,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { + .prog_fetch_lines_worst_case = 25, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_1", .id = INTF_1, + .base = 0x6a800, .len = 0x268, +@@ -250,7 +249,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { + .prog_fetch_lines_worst_case = 25, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_2", .id = INTF_2, + .base = 0x6b000, .len = 0x268, +@@ -259,7 +257,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { + .prog_fetch_lines_worst_case = 25, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_3", .id = INTF_3, + .base = 0x6b800, .len = 0x268, +@@ -267,7 +264,6 @@ static const struct dpu_intf_cfg msm8996_intf[] = { + .prog_fetch_lines_worst_case = 25, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 30), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 31), +- .intr_tear_rd_ptr = -1, + }, + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h +index 424815e7fb7dd..f247625ed7e5b 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_2_sdm660.h +@@ -202,7 +202,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { + .prog_fetch_lines_worst_case = 21, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_1", .id = INTF_1, + .base = 0x6a800, .len = 0x280, +@@ -211,7 +210,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { + .prog_fetch_lines_worst_case = 21, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_2", .id = INTF_2, + .base = 0x6b000, .len = 0x280, +@@ -220,7 +218,6 @@ static const struct dpu_intf_cfg sdm660_intf[] = { + .prog_fetch_lines_worst_case = 21, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 28), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 29), +- .intr_tear_rd_ptr = -1, + }, + }; + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h +index df01227fc3646..5ddd2b3c0cd2e 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h ++++ b/drivers/gpu/drm/msm/disp/dpu1/catalog/dpu_3_3_sdm630.h +@@ -147,7 +147,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = { + .prog_fetch_lines_worst_case = 21, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 24), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 25), +- .intr_tear_rd_ptr = -1, + }, { + .name = "intf_1", .id = INTF_1, + .base = 0x6a800, .len = 0x280, +@@ -156,7 +155,6 @@ static const struct dpu_intf_cfg sdm630_intf[] = { + .prog_fetch_lines_worst_case = 21, + .intr_underrun = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 26), + .intr_vsync = DPU_IRQ_IDX(MDP_SSPP_TOP0_INTR, 27), +- .intr_tear_rd_ptr = -1, + }, + }; + +-- +2.39.5 + diff --git a/queue-6.14/drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch b/queue-6.14/drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch new file mode 100644 index 0000000000..4dd97d85b4 --- /dev/null +++ b/queue-6.14/drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch @@ -0,0 +1,48 @@ +From 37baa169b2256ca5772bf2b5ce401f3855376782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Mar 2025 20:10:04 -0500 +Subject: drm/msm/dpu: Fix error pointers in dpu_plane_virtual_atomic_check + +From: Chenyuan Yang + +[ Upstream commit 5cb1b130e1cd04239cc9c26a98279f4660dce583 ] + +The function dpu_plane_virtual_atomic_check was dereferencing pointers +returned by drm_atomic_get_plane_state without checking for errors. This +could lead to undefined behavior if the function returns an error pointer. + +This commit adds checks using IS_ERR to ensure that plane_state is +valid before dereferencing them. + +Similar to commit da29abe71e16 +("drm/amd/display: Fix error pointers in amdgpu_dm_crtc_mem_type_changed"). + +Fixes: 774bcfb73176 ("drm/msm/dpu: add support for virtual planes") +Signed-off-by: Chenyuan Yang +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Abhinav Kumar +Patchwork: https://patchwork.freedesktop.org/patch/643132/ +Link: https://lore.kernel.org/r/20250314011004.663804-1-chenyuan0y@gmail.com +Signed-off-by: Abhinav Kumar +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +index af3e541f60c30..b19193b02ab32 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c +@@ -1059,6 +1059,9 @@ static int dpu_plane_virtual_atomic_check(struct drm_plane *plane, + struct drm_crtc_state *crtc_state; + int ret; + ++ if (IS_ERR(plane_state)) ++ return PTR_ERR(plane_state); ++ + if (plane_state->crtc) + crtc_state = drm_atomic_get_new_crtc_state(state, + plane_state->crtc); +-- +2.39.5 + diff --git a/queue-6.14/drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch b/queue-6.14/drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch new file mode 100644 index 0000000000..ef80223ca4 --- /dev/null +++ b/queue-6.14/drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch @@ -0,0 +1,77 @@ +From 8c308ac3222cdf8f9af09b77e5ff061d53fb4111 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Apr 2025 17:50:06 -0300 +Subject: drm/v3d: Fix Indirect Dispatch configuration for V3D 7.1.6 and later +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit dcdae6e92d4e062da29235fe88980604595e3f0f ] + +This commit is a resubmission of commit 1fe1c66274fb ("drm/v3d: Fix +Indirect Dispatch configuration for V3D 7.1.6 and later"), which was +accidentally reverted by commit 91dae758bdb8 ("Merge tag +'drm-misc-next-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel +into drm-next"), likely due to an unfortunate conflict resolution. + +From the original commit message: + +``` +`args->cfg[4]` is configured in Indirect Dispatch using the number of +batches. Currently, for all V3D tech versions, `args->cfg[4]` equals the +number of batches subtracted by 1. But, for V3D 7.1.6 and later, we must not +subtract 1 from the number of batches. + +Implement the fix by checking the V3D tech version and revision. + +Fixes several `dEQP-VK.synchronization*` CTS tests related to Indirect Dispatch. +``` + +Fixes: 91dae758bdb8 ("Merge tag 'drm-misc-next-2024-08-01' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next") +Signed-off-by: Maíra Canal +Reviewed-by: Iago Toral Quiroga +Link: https://lore.kernel.org/r/20250409205051.9639-1-mcanal@igalia.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/v3d/v3d_sched.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/v3d/v3d_sched.c b/drivers/gpu/drm/v3d/v3d_sched.c +index 05608c894ed93..6db503a569180 100644 +--- a/drivers/gpu/drm/v3d/v3d_sched.c ++++ b/drivers/gpu/drm/v3d/v3d_sched.c +@@ -428,7 +428,8 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job) + struct v3d_bo *bo = to_v3d_bo(job->base.bo[0]); + struct v3d_bo *indirect = to_v3d_bo(indirect_csd->indirect); + struct drm_v3d_submit_csd *args = &indirect_csd->job->args; +- u32 *wg_counts; ++ struct v3d_dev *v3d = job->base.v3d; ++ u32 num_batches, *wg_counts; + + v3d_get_bo_vaddr(bo); + v3d_get_bo_vaddr(indirect); +@@ -441,8 +442,17 @@ v3d_rewrite_csd_job_wg_counts_from_indirect(struct v3d_cpu_job *job) + args->cfg[0] = wg_counts[0] << V3D_CSD_CFG012_WG_COUNT_SHIFT; + args->cfg[1] = wg_counts[1] << V3D_CSD_CFG012_WG_COUNT_SHIFT; + args->cfg[2] = wg_counts[2] << V3D_CSD_CFG012_WG_COUNT_SHIFT; +- args->cfg[4] = DIV_ROUND_UP(indirect_csd->wg_size, 16) * +- (wg_counts[0] * wg_counts[1] * wg_counts[2]) - 1; ++ ++ num_batches = DIV_ROUND_UP(indirect_csd->wg_size, 16) * ++ (wg_counts[0] * wg_counts[1] * wg_counts[2]); ++ ++ /* V3D 7.1.6 and later don't subtract 1 from the number of batches */ ++ if (v3d->ver < 71 || (v3d->ver == 71 && v3d->rev < 6)) ++ args->cfg[4] = num_batches - 1; ++ else ++ args->cfg[4] = num_batches; ++ ++ WARN_ON(args->cfg[4] == ~0); + + for (int i = 0; i < 3; i++) { + /* 0xffffffff indicates that the uniform rewrite is not needed */ +-- +2.39.5 + diff --git a/queue-6.14/eventpoll-abstract-out-ep_try_send_events-helper.patch b/queue-6.14/eventpoll-abstract-out-ep_try_send_events-helper.patch new file mode 100644 index 0000000000..192fee327f --- /dev/null +++ b/queue-6.14/eventpoll-abstract-out-ep_try_send_events-helper.patch @@ -0,0 +1,71 @@ +From bfd4f4b93c6b0d4fc5f6dcfe285c194b4af59493 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 10:22:25 -0700 +Subject: eventpoll: abstract out ep_try_send_events() helper + +From: Jens Axboe + +[ Upstream commit 38d203560118a673018df5892a6555bb0aba7762 ] + +In preparation for reusing this helper in another epoll setup helper, +abstract it out. + +Signed-off-by: Jens Axboe +Link: https://lore.kernel.org/r/20250219172552.1565603-3-axboe@kernel.dk +Signed-off-by: Christian Brauner +Stable-dep-of: 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the future") +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 7c0980db77b31..67d1808fda0e5 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1980,6 +1980,22 @@ static int ep_autoremove_wake_function(struct wait_queue_entry *wq_entry, + return ret; + } + ++static int ep_try_send_events(struct eventpoll *ep, ++ struct epoll_event __user *events, int maxevents) ++{ ++ int res; ++ ++ /* ++ * Try to transfer events to user space. In case we get 0 events and ++ * there's still timeout left over, we go trying again in search of ++ * more luck. ++ */ ++ res = ep_send_events(ep, events, maxevents); ++ if (res > 0) ++ ep_suspend_napi_irqs(ep); ++ return res; ++} ++ + /** + * ep_poll - Retrieves ready events, and delivers them to the caller-supplied + * event buffer. +@@ -2031,17 +2047,9 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, + + while (1) { + if (eavail) { +- /* +- * Try to transfer events to user space. In case we get +- * 0 events and there's still timeout left over, we go +- * trying again in search of more luck. +- */ +- res = ep_send_events(ep, events, maxevents); +- if (res) { +- if (res > 0) +- ep_suspend_napi_irqs(ep); ++ res = ep_try_send_events(ep, events, maxevents); ++ if (res) + return res; +- } + } + + if (timed_out) +-- +2.39.5 + diff --git a/queue-6.14/eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch b/queue-6.14/eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch new file mode 100644 index 0000000000..21d84ab3b7 --- /dev/null +++ b/queue-6.14/eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch @@ -0,0 +1,92 @@ +From 3d80440c9ad6fa4ec98dc29a7bab1fa2caf6f5e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Apr 2025 18:58:25 +0000 +Subject: eventpoll: Set epoll timeout if it's in the future + +From: Joe Damato + +[ Upstream commit 0a65bc27bd645894175c059397b4916e31955fb2 ] + +Avoid an edge case where epoll_wait arms a timer and calls schedule() +even if the timer will expire immediately. + +For example: if the user has specified an epoll busy poll usecs which is +equal or larger than the epoll_wait/epoll_pwait2 timeout, it is +unnecessary to call schedule_hrtimeout_range; the busy poll usecs have +consumed the entire timeout duration so it is unnecessary to induce +scheduling latency by calling schedule() (via schedule_hrtimeout_range). + +This can be measured using a simple bpftrace script: + +tracepoint:sched:sched_switch +/ args->prev_pid == $1 / +{ + print(kstack()); + print(ustack()); +} + +Before this patch is applied: + + Testing an epoll_wait app with busy poll usecs set to 1000, and + epoll_wait timeout set to 1ms using the script above shows: + + __traceiter_sched_switch+69 + __schedule+1495 + schedule+32 + schedule_hrtimeout_range+159 + do_epoll_wait+1424 + __x64_sys_epoll_wait+97 + do_syscall_64+95 + entry_SYSCALL_64_after_hwframe+118 + + epoll_wait+82 + + Which is unexpected; the busy poll usecs should have consumed the + entire timeout and there should be no reason to arm a timer. + +After this patch is applied: the same test scenario does not generate a +call to schedule() in the above edge case. If the busy poll usecs are +reduced (for example usecs: 100, epoll_wait timeout 1ms) the timer is +armed as expected. + +Fixes: bf3b9f6372c4 ("epoll: Add busy poll support to epoll with socket fds.") +Signed-off-by: Joe Damato +Link: https://lore.kernel.org/20250416185826.26375-1-jdamato@fastly.com +Reviewed-by: Jan Kara +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/eventpoll.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/fs/eventpoll.c b/fs/eventpoll.c +index 67d1808fda0e5..c01234bbac498 100644 +--- a/fs/eventpoll.c ++++ b/fs/eventpoll.c +@@ -1996,6 +1996,14 @@ static int ep_try_send_events(struct eventpoll *ep, + return res; + } + ++static int ep_schedule_timeout(ktime_t *to) ++{ ++ if (to) ++ return ktime_after(*to, ktime_get()); ++ else ++ return 1; ++} ++ + /** + * ep_poll - Retrieves ready events, and delivers them to the caller-supplied + * event buffer. +@@ -2103,7 +2111,7 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, + + write_unlock_irq(&ep->lock); + +- if (!eavail) ++ if (!eavail && ep_schedule_timeout(to)) + timed_out = !schedule_hrtimeout_range(to, slack, + HRTIMER_MODE_ABS); + __set_current_state(TASK_RUNNING); +-- +2.39.5 + diff --git a/queue-6.14/fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch b/queue-6.14/fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch new file mode 100644 index 0000000000..2c0f2a36d4 --- /dev/null +++ b/queue-6.14/fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch @@ -0,0 +1,127 @@ +From ba72f014dfdcb5896817f3bc8f141da311a7b75d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Apr 2025 08:40:42 +0200 +Subject: fs: move the bdex_statx call to vfs_getattr_nosec +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Hellwig + +[ Upstream commit 777d0961ff95b26d5887fdae69900374364976f3 ] + +Currently bdex_statx is only called from the very high-level +vfs_statx_path function, and thus bypassing it for in-kernel calls +to vfs_getattr or vfs_getattr_nosec. + +This breaks querying the block ѕize of the underlying device in the +loop driver and also is a pitfall for any other new kernel caller. + +Move the call into the lowest level helper to ensure all callers get +the right results. + +Fixes: 2d985f8c6b91 ("vfs: support STATX_DIOALIGN on block devices") +Fixes: f4774e92aab8 ("loop: take the file system minimum dio alignment into account") +Reported-by: "Darrick J. Wong" +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/20250417064042.712140-1-hch@lst.de +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + block/bdev.c | 3 +-- + fs/stat.c | 32 ++++++++++++++++++-------------- + include/linux/blkdev.h | 6 +++--- + 3 files changed, 22 insertions(+), 19 deletions(-) + +diff --git a/block/bdev.c b/block/bdev.c +index 9d73a8fbf7f99..e5147cab21b21 100644 +--- a/block/bdev.c ++++ b/block/bdev.c +@@ -1268,8 +1268,7 @@ void sync_bdevs(bool wait) + /* + * Handle STATX_{DIOALIGN, WRITE_ATOMIC} for block devices. + */ +-void bdev_statx(struct path *path, struct kstat *stat, +- u32 request_mask) ++void bdev_statx(const struct path *path, struct kstat *stat, u32 request_mask) + { + struct inode *backing_inode; + struct block_device *bdev; +diff --git a/fs/stat.c b/fs/stat.c +index f13308bfdc983..3d9222807214a 100644 +--- a/fs/stat.c ++++ b/fs/stat.c +@@ -204,12 +204,25 @@ int vfs_getattr_nosec(const struct path *path, struct kstat *stat, + STATX_ATTR_DAX); + + idmap = mnt_idmap(path->mnt); +- if (inode->i_op->getattr) +- return inode->i_op->getattr(idmap, path, stat, +- request_mask, +- query_flags); ++ if (inode->i_op->getattr) { ++ int ret; ++ ++ ret = inode->i_op->getattr(idmap, path, stat, request_mask, ++ query_flags); ++ if (ret) ++ return ret; ++ } else { ++ generic_fillattr(idmap, request_mask, inode, stat); ++ } ++ ++ /* ++ * If this is a block device inode, override the filesystem attributes ++ * with the block device specific parameters that need to be obtained ++ * from the bdev backing inode. ++ */ ++ if (S_ISBLK(stat->mode)) ++ bdev_statx(path, stat, request_mask); + +- generic_fillattr(idmap, request_mask, inode, stat); + return 0; + } + EXPORT_SYMBOL(vfs_getattr_nosec); +@@ -295,15 +308,6 @@ static int vfs_statx_path(struct path *path, int flags, struct kstat *stat, + if (path_mounted(path)) + stat->attributes |= STATX_ATTR_MOUNT_ROOT; + stat->attributes_mask |= STATX_ATTR_MOUNT_ROOT; +- +- /* +- * If this is a block device inode, override the filesystem +- * attributes with the block device specific parameters that need to be +- * obtained from the bdev backing inode. +- */ +- if (S_ISBLK(stat->mode)) +- bdev_statx(path, stat, request_mask); +- + return 0; + } + +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index d37751789bf58..38fc78501ef2d 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1664,7 +1664,7 @@ int sync_blockdev(struct block_device *bdev); + int sync_blockdev_range(struct block_device *bdev, loff_t lstart, loff_t lend); + int sync_blockdev_nowait(struct block_device *bdev); + void sync_bdevs(bool wait); +-void bdev_statx(struct path *, struct kstat *, u32); ++void bdev_statx(const struct path *path, struct kstat *stat, u32 request_mask); + void printk_all_partitions(void); + int __init early_lookup_bdev(const char *pathname, dev_t *dev); + #else +@@ -1682,8 +1682,8 @@ static inline int sync_blockdev_nowait(struct block_device *bdev) + static inline void sync_bdevs(bool wait) + { + } +-static inline void bdev_statx(struct path *path, struct kstat *stat, +- u32 request_mask) ++static inline void bdev_statx(const struct path *path, struct kstat *stat, ++ u32 request_mask) + { + } + static inline void printk_all_partitions(void) +-- +2.39.5 + diff --git a/queue-6.14/ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch b/queue-6.14/ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch new file mode 100644 index 0000000000..6ddd712d69 --- /dev/null +++ b/queue-6.14/ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch @@ -0,0 +1,44 @@ +From bbe2b5735d7b9107b1db40ac1080d9d044564846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Apr 2025 09:44:44 +0800 +Subject: ftrace: fix incorrect hash size in register_ftrace_direct() + +From: Menglong Dong + +[ Upstream commit 92f1d3b40179b15630d72e2c6e4e25a899b67ba9 ] + +The maximum of the ftrace hash bits is made fls(32) in +register_ftrace_direct(), which seems illogical. So, we fix it by making +the max hash bits FTRACE_HASH_MAX_BITS instead. + +Link: https://lore.kernel.org/20250413014444.36724-1-dongml2@chinatelecom.cn +Fixes: d05cb470663a ("ftrace: Fix modification of direct_function hash while in use") +Signed-off-by: Menglong Dong +Acked-by: Masami Hiramatsu (Google) +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + kernel/trace/ftrace.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index 62d300eee7eb8..201e770185dde 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -5912,9 +5912,10 @@ int register_ftrace_direct(struct ftrace_ops *ops, unsigned long addr) + + /* Make a copy hash to place the new and the old entries in */ + size = hash->count + direct_functions->count; +- if (size > 32) +- size = 32; +- new_hash = alloc_ftrace_hash(fls(size)); ++ size = fls(size); ++ if (size > FTRACE_HASH_MAX_BITS) ++ size = FTRACE_HASH_MAX_BITS; ++ new_hash = alloc_ftrace_hash(size); + if (!new_hash) + goto out_unlock; + +-- +2.39.5 + diff --git a/queue-6.14/i2c-atr-fix-wrong-include.patch b/queue-6.14/i2c-atr-fix-wrong-include.patch new file mode 100644 index 0000000000..d8eee89559 --- /dev/null +++ b/queue-6.14/i2c-atr-fix-wrong-include.patch @@ -0,0 +1,49 @@ +From c192c1120bd38d00fc37698d2e62487986648eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Mar 2025 10:16:46 +0300 +Subject: i2c: atr: Fix wrong include + +From: Andy Shevchenko + +[ Upstream commit 75caec0c2aa3a7ec84348d438c74cb8a2eb4de97 ] + +The fwnode.h is not supposed to be used by the drivers as it +has the definitions for the core parts for different device +property provider implementations. Drop it. + +Note, that fwnode API for drivers is provided in property.h +which is included here. + +Fixes: a076a860acae ("media: i2c: add I2C Address Translator (ATR) support") +Signed-off-by: Andy Shevchenko +Acked-by: Mukesh Kumar Savaliya +Reviewed-by: Luca Ceresoli +Reviewed-by: Tomi Valkeinen +[wsa: reworded subject] +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-atr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/i2c-atr.c b/drivers/i2c/i2c-atr.c +index 8fe9ddff8e96f..783fb8df2ebee 100644 +--- a/drivers/i2c/i2c-atr.c ++++ b/drivers/i2c/i2c-atr.c +@@ -8,12 +8,12 @@ + * Originally based on i2c-mux.c + */ + +-#include + #include + #include + #include + #include + #include ++#include + #include + #include + +-- +2.39.5 + diff --git a/queue-6.14/nfs-add-missing-selections-of-config_crc32.patch b/queue-6.14/nfs-add-missing-selections-of-config_crc32.patch new file mode 100644 index 0000000000..f6fa2ff2f7 --- /dev/null +++ b/queue-6.14/nfs-add-missing-selections-of-config_crc32.patch @@ -0,0 +1,179 @@ +From 76236f06f6c3648a00e2bfcd90e784bd81450564 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Apr 2025 15:02:21 -0700 +Subject: nfs: add missing selections of CONFIG_CRC32 + +From: Eric Biggers + +[ Upstream commit cd35b6cb46649750b7dbd0df0e2d767415d8917b ] + +nfs.ko, nfsd.ko, and lockd.ko all use crc32_le(), which is available +only when CONFIG_CRC32 is enabled. But the only NFS kconfig option that +selected CONFIG_CRC32 was CONFIG_NFS_DEBUG, which is client-specific and +did not actually guard the use of crc32_le() even on the client. + +The code worked around this bug by only actually calling crc32_le() when +CONFIG_CRC32 is built-in, instead hard-coding '0' in other cases. This +avoided randconfig build errors, and in real kernels the fallback code +was unlikely to be reached since CONFIG_CRC32 is 'default y'. But, this +really needs to just be done properly, especially now that I'm planning +to update CONFIG_CRC32 to not be 'default y'. + +Therefore, make CONFIG_NFS_FS, CONFIG_NFSD, and CONFIG_LOCKD select +CONFIG_CRC32. Then remove the fallback code that becomes unnecessary, +as well as the selection of CONFIG_CRC32 from CONFIG_NFS_DEBUG. + +Fixes: 1264a2f053a3 ("NFS: refactor code for calculating the crc32 hash of a filehandle") +Signed-off-by: Eric Biggers +Acked-by: Anna Schumaker +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/Kconfig | 1 + + fs/nfs/Kconfig | 2 +- + fs/nfs/internal.h | 7 ------- + fs/nfs/nfs4session.h | 4 ---- + fs/nfsd/Kconfig | 1 + + fs/nfsd/nfsfh.h | 7 ------- + include/linux/nfs.h | 7 ------- + 7 files changed, 3 insertions(+), 26 deletions(-) + +diff --git a/fs/Kconfig b/fs/Kconfig +index 64d420e3c4758..8fd1011f7d628 100644 +--- a/fs/Kconfig ++++ b/fs/Kconfig +@@ -368,6 +368,7 @@ config GRACE_PERIOD + config LOCKD + tristate + depends on FILE_LOCKING ++ select CRC32 + select GRACE_PERIOD + + config LOCKD_V4 +diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig +index d3f76101ad4b9..07932ce9246c1 100644 +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -2,6 +2,7 @@ + config NFS_FS + tristate "NFS client support" + depends on INET && FILE_LOCKING && MULTIUSER ++ select CRC32 + select LOCKD + select SUNRPC + select NFS_COMMON +@@ -196,7 +197,6 @@ config NFS_USE_KERNEL_DNS + config NFS_DEBUG + bool + depends on NFS_FS && SUNRPC_DEBUG +- select CRC32 + default y + + config NFS_DISABLE_UDP_SUPPORT +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index fae2c7ae4acc2..59bb4d0338f39 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -899,18 +899,11 @@ u64 nfs_timespec_to_change_attr(const struct timespec64 *ts) + return ((u64)ts->tv_sec << 30) + ts->tv_nsec; + } + +-#ifdef CONFIG_CRC32 + static inline u32 nfs_stateid_hash(const nfs4_stateid *stateid) + { + return ~crc32_le(0xFFFFFFFF, &stateid->other[0], + NFS4_STATEID_OTHER_SIZE); + } +-#else +-static inline u32 nfs_stateid_hash(nfs4_stateid *stateid) +-{ +- return 0; +-} +-#endif + + static inline bool nfs_error_is_fatal(int err) + { +diff --git a/fs/nfs/nfs4session.h b/fs/nfs/nfs4session.h +index 351616c61df54..f9c291e2165cd 100644 +--- a/fs/nfs/nfs4session.h ++++ b/fs/nfs/nfs4session.h +@@ -148,16 +148,12 @@ static inline void nfs4_copy_sessionid(struct nfs4_sessionid *dst, + memcpy(dst->data, src->data, NFS4_MAX_SESSIONID_LEN); + } + +-#ifdef CONFIG_CRC32 + /* + * nfs_session_id_hash - calculate the crc32 hash for the session id + * @session - pointer to session + */ + #define nfs_session_id_hash(sess_id) \ + (~crc32_le(0xFFFFFFFF, &(sess_id)->data[0], sizeof((sess_id)->data))) +-#else +-#define nfs_session_id_hash(session) (0) +-#endif + #else /* defined(CONFIG_NFS_V4_1) */ + + static inline int nfs4_init_session(struct nfs_client *clp) +diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig +index 792d3fed1b45f..731a88f6313eb 100644 +--- a/fs/nfsd/Kconfig ++++ b/fs/nfsd/Kconfig +@@ -4,6 +4,7 @@ config NFSD + depends on INET + depends on FILE_LOCKING + depends on FSNOTIFY ++ select CRC32 + select LOCKD + select SUNRPC + select EXPORTFS +diff --git a/fs/nfsd/nfsfh.h b/fs/nfsd/nfsfh.h +index 876152a91f122..5103c2f4d2253 100644 +--- a/fs/nfsd/nfsfh.h ++++ b/fs/nfsd/nfsfh.h +@@ -267,7 +267,6 @@ static inline bool fh_fsid_match(const struct knfsd_fh *fh1, + return true; + } + +-#ifdef CONFIG_CRC32 + /** + * knfsd_fh_hash - calculate the crc32 hash for the filehandle + * @fh - pointer to filehandle +@@ -279,12 +278,6 @@ static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh) + { + return ~crc32_le(0xFFFFFFFF, fh->fh_raw, fh->fh_size); + } +-#else +-static inline u32 knfsd_fh_hash(const struct knfsd_fh *fh) +-{ +- return 0; +-} +-#endif + + /** + * fh_clear_pre_post_attrs - Reset pre/post attributes +diff --git a/include/linux/nfs.h b/include/linux/nfs.h +index 9ad727ddfedb3..0906a0b40c6aa 100644 +--- a/include/linux/nfs.h ++++ b/include/linux/nfs.h +@@ -55,7 +55,6 @@ enum nfs3_stable_how { + NFS_INVALID_STABLE_HOW = -1 + }; + +-#ifdef CONFIG_CRC32 + /** + * nfs_fhandle_hash - calculate the crc32 hash for the filehandle + * @fh - pointer to filehandle +@@ -67,10 +66,4 @@ static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh) + { + return ~crc32_le(0xFFFFFFFF, &fh->data[0], fh->size); + } +-#else /* CONFIG_CRC32 */ +-static inline u32 nfs_fhandle_hash(const struct nfs_fh *fh) +-{ +- return 0; +-} +-#endif /* CONFIG_CRC32 */ + #endif /* _LINUX_NFS_H */ +-- +2.39.5 + diff --git a/queue-6.14/nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch b/queue-6.14/nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch new file mode 100644 index 0000000000..e82c4daee2 --- /dev/null +++ b/queue-6.14/nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch @@ -0,0 +1,75 @@ +From 4bce0d36528b397f0925aa3e6a4e225feda738e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Apr 2025 09:57:08 +0800 +Subject: nfsd: decrease sc_count directly if fail to queue dl_recall + +From: Li Lingfeng + +[ Upstream commit a1d14d931bf700c1025db8c46d6731aa5cf440f9 ] + +A deadlock warning occurred when invoking nfs4_put_stid following a failed +dl_recall queue operation: + T1 T2 + nfs4_laundromat + nfs4_get_client_reaplist + nfs4_anylock_blockers +__break_lease + spin_lock // ctx->flc_lock + spin_lock // clp->cl_lock + nfs4_lockowner_has_blockers + locks_owner_has_blockers + spin_lock // flctx->flc_lock + nfsd_break_deleg_cb + nfsd_break_one_deleg + nfs4_put_stid + refcount_dec_and_lock + spin_lock // clp->cl_lock + +When a file is opened, an nfs4_delegation is allocated with sc_count +initialized to 1, and the file_lease holds a reference to the delegation. +The file_lease is then associated with the file through kernel_setlease. + +The disassociation is performed in nfsd4_delegreturn via the following +call chain: +nfsd4_delegreturn --> destroy_delegation --> destroy_unhashed_deleg --> +nfs4_unlock_deleg_lease --> kernel_setlease --> generic_delete_lease +The corresponding sc_count reference will be released after this +disassociation. + +Since nfsd_break_one_deleg executes while holding the flc_lock, the +disassociation process becomes blocked when attempting to acquire flc_lock +in generic_delete_lease. This means: +1) sc_count in nfsd_break_one_deleg will not be decremented to 0; +2) The nfs4_put_stid called by nfsd_break_one_deleg will not attempt to +acquire cl_lock; +3) Consequently, no deadlock condition is created. + +Given that sc_count in nfsd_break_one_deleg remains non-zero, we can +safely perform refcount_dec on sc_count directly. This approach +effectively avoids triggering deadlock warnings. + +Fixes: 230ca758453c ("nfsd: put dl_stid if fail to queue dl_recall") +Signed-off-by: Li Lingfeng +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 2de49e2d6ac48..613bee7edb81e 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -5432,7 +5432,7 @@ static void nfsd_break_one_deleg(struct nfs4_delegation *dp) + queued = nfsd4_run_cb(&dp->dl_recall); + WARN_ON_ONCE(!queued); + if (!queued) +- nfs4_put_stid(&dp->dl_stid); ++ refcount_dec(&dp->dl_stid.sc_count); + } + + /* Called from break_lease() with flc_lock held. */ +-- +2.39.5 + diff --git a/queue-6.14/series b/queue-6.14/series index 5ead7f0923..504e9fef89 100644 --- a/queue-6.14/series +++ b/queue-6.14/series @@ -93,3 +93,15 @@ thermal-intel-int340x-fix-panther-lake-dlvr-support.patch riscv-kgdb-do-not-inline-arch_kgdb_breakpoint.patch riscv-kgdb-remove-.option-norvc-.option-rvc-for-kgdb.patch cpufreq-sched-fix-the-usage-of-cpufreq_need_update_l.patch +drm-v3d-fix-indirect-dispatch-configuration-for-v3d-.patch +drm-msm-dpu-fix-error-pointers-in-dpu_plane_virtual_.patch +drm-msm-dpu-drop-rogue-intr_tear_rd_ptr-values.patch +dma-buf-sw_sync-decrement-refcount-on-error-in-sw_sy.patch +nfs-add-missing-selections-of-config_crc32.patch +nfsd-decrease-sc_count-directly-if-fail-to-queue-dl_.patch +i2c-atr-fix-wrong-include.patch +eventpoll-abstract-out-ep_try_send_events-helper.patch +eventpoll-set-epoll-timeout-if-it-s-in-the-future.patch +fs-move-the-bdex_statx-call-to-vfs_getattr_nosec.patch +ftrace-fix-incorrect-hash-size-in-register_ftrace_di.patch +drm-msm-a6xx-don-t-let-ib_size-overflow.patch -- 2.47.3