From eeceeae8fccf9d8a960aced07e5bc0242f37bb9d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 16 May 2021 23:14:56 -0400 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...memory-leak-in-an-error-handling-pat.patch | 36 ++++ ...-swap-two-calls-in-blk_mq_exit_queue.patch | 51 ++++++ .../hwmon-occ-fix-poll-rate-limiting.patch | 64 +++++++ ...lsedlight-fix-rumtime-pm-imbalance-o.patch | 37 ++++ ...-out-of-bounds-access-when-preempted.patch | 162 ++++++++++++++++++ ...-fix-null-pointer-in-flush_workqueue.patch | 86 ++++++++++ queue-5.4/series | 7 + ...usb-fotg210-hcd-fix-an-error-message.patch | 53 ++++++ 8 files changed, 496 insertions(+) create mode 100644 queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch create mode 100644 queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch create mode 100644 queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch create mode 100644 queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch create mode 100644 queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch create mode 100644 queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch create mode 100644 queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch diff --git a/queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch b/queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch new file mode 100644 index 00000000000..7ebee7e03e1 --- /dev/null +++ b/queue-5.4/acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch @@ -0,0 +1,36 @@ +From 05ed4d372c1e7a0fe4b98f7d05a3829767f41af0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 09:23:09 +0200 +Subject: ACPI: scan: Fix a memory leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 0c8bd174f0fc131bc9dfab35cd8784f59045da87 ] + +If 'acpi_device_set_name()' fails, we must free +'acpi_device_bus_id->bus_id' or there is a (potential) memory leak. + +Fixes: eb50aaf960e3 ("ACPI: scan: Use unique number for instance_no") +Signed-off-by: Christophe JAILLET +Reviewed-by: Andy Shevchenko +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/scan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index dbb5919f23e2..95d119ff76b6 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -706,6 +706,7 @@ int acpi_device_add(struct acpi_device *device, + + result = acpi_device_set_name(device, acpi_device_bus_id); + if (result) { ++ kfree_const(acpi_device_bus_id->bus_id); + kfree(acpi_device_bus_id); + goto err_unlock; + } +-- +2.30.2 + diff --git a/queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch b/queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch new file mode 100644 index 00000000000..fec52c4ff1d --- /dev/null +++ b/queue-5.4/blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch @@ -0,0 +1,51 @@ +From 7f5d158289962cfcba7e5c5c1cddee449f487e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 May 2021 10:15:29 -0700 +Subject: blk-mq: Swap two calls in blk_mq_exit_queue() + +From: Bart Van Assche + +[ Upstream commit 630ef623ed26c18a457cdc070cf24014e50129c2 ] + +If a tag set is shared across request queues (e.g. SCSI LUNs) then the +block layer core keeps track of the number of active request queues in +tags->active_queues. blk_mq_tag_busy() and blk_mq_tag_idle() update that +atomic counter if the hctx flag BLK_MQ_F_TAG_QUEUE_SHARED is set. Make +sure that blk_mq_exit_queue() calls blk_mq_tag_idle() before that flag is +cleared by blk_mq_del_queue_tag_set(). + +Cc: Christoph Hellwig +Cc: Ming Lei +Cc: Hannes Reinecke +Fixes: 0d2602ca30e4 ("blk-mq: improve support for shared tags maps") +Signed-off-by: Bart Van Assche +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20210513171529.7977-1-bvanassche@acm.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 057a634396a9..0674f53c6052 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2970,10 +2970,12 @@ EXPORT_SYMBOL(blk_mq_init_allocated_queue); + /* tags can _not_ be used after returning from blk_mq_exit_queue */ + void blk_mq_exit_queue(struct request_queue *q) + { +- struct blk_mq_tag_set *set = q->tag_set; ++ struct blk_mq_tag_set *set = q->tag_set; + +- blk_mq_del_queue_tag_set(q); ++ /* Checks hctx->flags & BLK_MQ_F_TAG_QUEUE_SHARED. */ + blk_mq_exit_hw_queues(q, set, set->nr_hw_queues); ++ /* May clear BLK_MQ_F_TAG_QUEUE_SHARED in hctx->flags. */ ++ blk_mq_del_queue_tag_set(q); + } + + static int __blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set) +-- +2.30.2 + diff --git a/queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch b/queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch new file mode 100644 index 00000000000..723ef303627 --- /dev/null +++ b/queue-5.4/hwmon-occ-fix-poll-rate-limiting.patch @@ -0,0 +1,64 @@ +From 0e53d16b468fb839481c6edb5ab409a38281622f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 10:13:36 -0500 +Subject: hwmon: (occ) Fix poll rate limiting + +From: Eddie James + +[ Upstream commit 5216dff22dc2bbbbe6f00335f9fd2879670e753b ] + +The poll rate limiter time was initialized at zero. This breaks the +comparison in time_after if jiffies is large. Switch to storing the +next update time rather than the previous time, and initialize the +time when the device is probed. + +Fixes: c10e753d43eb ("hwmon (occ): Add sensor types and versions") +Signed-off-by: Eddie James +Link: https://lore.kernel.org/r/20210429151336.18980-1-eajames@linux.ibm.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/occ/common.c | 5 +++-- + drivers/hwmon/occ/common.h | 2 +- + 2 files changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c +index 30e18eb60da7..0b689ccbb793 100644 +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -209,9 +209,9 @@ int occ_update_response(struct occ *occ) + return rc; + + /* limit the maximum rate of polling the OCC */ +- if (time_after(jiffies, occ->last_update + OCC_UPDATE_FREQUENCY)) { ++ if (time_after(jiffies, occ->next_update)) { + rc = occ_poll(occ); +- occ->last_update = jiffies; ++ occ->next_update = jiffies + OCC_UPDATE_FREQUENCY; + } else { + rc = occ->last_error; + } +@@ -1089,6 +1089,7 @@ int occ_setup(struct occ *occ, const char *name) + return rc; + } + ++ occ->next_update = jiffies + OCC_UPDATE_FREQUENCY; + occ_parse_poll_response(occ); + + rc = occ_setup_sensor_attrs(occ); +diff --git a/drivers/hwmon/occ/common.h b/drivers/hwmon/occ/common.h +index 67e6968b8978..e6df719770e8 100644 +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -99,7 +99,7 @@ struct occ { + u8 poll_cmd_data; /* to perform OCC poll command */ + int (*send_cmd)(struct occ *occ, u8 *cmd); + +- unsigned long last_update; ++ unsigned long next_update; + struct mutex lock; /* lock OCC access */ + + struct device *hwmon; +-- +2.30.2 + diff --git a/queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch b/queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch new file mode 100644 index 00000000000..dba3aa760dc --- /dev/null +++ b/queue-5.4/iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch @@ -0,0 +1,37 @@ +From 35ba043bbf5116badcea75fe822eda6839ffc588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 13:32:02 +0800 +Subject: iio: proximity: pulsedlight: Fix rumtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit a2fa9242e89f27696515699fe0f0296bf1ac1815 ] + +When lidar_write_control() fails, a pairing PM usage counter +decrement is needed to keep the counter balanced. + +Fixes: 4ac4e086fd8c5 ("iio: pulsedlight-lidar-lite: add runtime PM") +Signed-off-by: Dinghao Liu +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210412053204.4889-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index 47af54f14756..67f85268b63d 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -158,6 +158,7 @@ static int lidar_get_measurement(struct lidar_data *data, u16 *reg) + ret = lidar_write_control(data, LIDAR_REG_CONTROL_ACQUIRE); + if (ret < 0) { + dev_err(&client->dev, "cannot send start measurement command"); ++ pm_runtime_put_noidle(&client->dev); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch b/queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch new file mode 100644 index 00000000000..c636956b1f9 --- /dev/null +++ b/queue-5.4/kyber-fix-out-of-bounds-access-when-preempted.patch @@ -0,0 +1,162 @@ +From feb14273537541e0c4f8fa2465d3581233c61e08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 17:05:35 -0700 +Subject: kyber: fix out of bounds access when preempted + +From: Omar Sandoval + +[ Upstream commit efed9a3337e341bd0989161b97453b52567bc59d ] + +__blk_mq_sched_bio_merge() gets the ctx and hctx for the current CPU and +passes the hctx to ->bio_merge(). kyber_bio_merge() then gets the ctx +for the current CPU again and uses that to get the corresponding Kyber +context in the passed hctx. However, the thread may be preempted between +the two calls to blk_mq_get_ctx(), and the ctx returned the second time +may no longer correspond to the passed hctx. This "works" accidentally +most of the time, but it can cause us to read garbage if the second ctx +came from an hctx with more ctx's than the first one (i.e., if +ctx->index_hw[hctx->type] > hctx->nr_ctx). + +This manifested as this UBSAN array index out of bounds error reported +by Jakub: + +UBSAN: array-index-out-of-bounds in ../kernel/locking/qspinlock.c:130:9 +index 13106 is out of range for type 'long unsigned int [128]' +Call Trace: + dump_stack+0xa4/0xe5 + ubsan_epilogue+0x5/0x40 + __ubsan_handle_out_of_bounds.cold.13+0x2a/0x34 + queued_spin_lock_slowpath+0x476/0x480 + do_raw_spin_lock+0x1c2/0x1d0 + kyber_bio_merge+0x112/0x180 + blk_mq_submit_bio+0x1f5/0x1100 + submit_bio_noacct+0x7b0/0x870 + submit_bio+0xc2/0x3a0 + btrfs_map_bio+0x4f0/0x9d0 + btrfs_submit_data_bio+0x24e/0x310 + submit_one_bio+0x7f/0xb0 + submit_extent_page+0xc4/0x440 + __extent_writepage_io+0x2b8/0x5e0 + __extent_writepage+0x28d/0x6e0 + extent_write_cache_pages+0x4d7/0x7a0 + extent_writepages+0xa2/0x110 + do_writepages+0x8f/0x180 + __writeback_single_inode+0x99/0x7f0 + writeback_sb_inodes+0x34e/0x790 + __writeback_inodes_wb+0x9e/0x120 + wb_writeback+0x4d2/0x660 + wb_workfn+0x64d/0xa10 + process_one_work+0x53a/0xa80 + worker_thread+0x69/0x5b0 + kthread+0x20b/0x240 + ret_from_fork+0x1f/0x30 + +Only Kyber uses the hctx, so fix it by passing the request_queue to +->bio_merge() instead. BFQ and mq-deadline just use that, and Kyber can +map the queues itself to avoid the mismatch. + +Fixes: a6088845c2bf ("block: kyber: make kyber more friendly with merging") +Reported-by: Jakub Kicinski +Signed-off-by: Omar Sandoval +Link: https://lore.kernel.org/r/c7598605401a48d5cfeadebb678abd10af22b83f.1620691329.git.osandov@fb.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 3 +-- + block/blk-mq-sched.c | 8 +++++--- + block/kyber-iosched.c | 5 +++-- + block/mq-deadline.c | 3 +-- + include/linux/elevator.h | 2 +- + 5 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index c19006d59b79..136232a01f71 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2210,10 +2210,9 @@ static void bfq_remove_request(struct request_queue *q, + + } + +-static bool bfq_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio, ++static bool bfq_bio_merge(struct request_queue *q, struct bio *bio, + unsigned int nr_segs) + { +- struct request_queue *q = hctx->queue; + struct bfq_data *bfqd = q->elevator->elevator_data; + struct request *free = NULL; + /* +diff --git a/block/blk-mq-sched.c b/block/blk-mq-sched.c +index 7620734d5542..f422c7feea7e 100644 +--- a/block/blk-mq-sched.c ++++ b/block/blk-mq-sched.c +@@ -334,14 +334,16 @@ bool __blk_mq_sched_bio_merge(struct request_queue *q, struct bio *bio, + unsigned int nr_segs) + { + struct elevator_queue *e = q->elevator; +- struct blk_mq_ctx *ctx = blk_mq_get_ctx(q); +- struct blk_mq_hw_ctx *hctx = blk_mq_map_queue(q, bio->bi_opf, ctx); ++ struct blk_mq_ctx *ctx; ++ struct blk_mq_hw_ctx *hctx; + bool ret = false; + enum hctx_type type; + + if (e && e->type->ops.bio_merge) +- return e->type->ops.bio_merge(hctx, bio, nr_segs); ++ return e->type->ops.bio_merge(q, bio, nr_segs); + ++ ctx = blk_mq_get_ctx(q); ++ hctx = blk_mq_map_queue(q, bio->bi_opf, ctx); + type = hctx->type; + if ((hctx->flags & BLK_MQ_F_SHOULD_MERGE) && + !list_empty_careful(&ctx->rq_lists[type])) { +diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c +index 34dcea0ef637..77a0fcebdc77 100644 +--- a/block/kyber-iosched.c ++++ b/block/kyber-iosched.c +@@ -562,11 +562,12 @@ static void kyber_limit_depth(unsigned int op, struct blk_mq_alloc_data *data) + } + } + +-static bool kyber_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio, ++static bool kyber_bio_merge(struct request_queue *q, struct bio *bio, + unsigned int nr_segs) + { ++ struct blk_mq_ctx *ctx = blk_mq_get_ctx(q); ++ struct blk_mq_hw_ctx *hctx = blk_mq_map_queue(q, bio->bi_opf, ctx); + struct kyber_hctx_data *khd = hctx->sched_data; +- struct blk_mq_ctx *ctx = blk_mq_get_ctx(hctx->queue); + struct kyber_ctx_queue *kcq = &khd->kcqs[ctx->index_hw[hctx->type]]; + unsigned int sched_domain = kyber_sched_domain(bio->bi_opf); + struct list_head *rq_list = &kcq->rq_list[sched_domain]; +diff --git a/block/mq-deadline.c b/block/mq-deadline.c +index b490f47fd553..19c6922e85f1 100644 +--- a/block/mq-deadline.c ++++ b/block/mq-deadline.c +@@ -459,10 +459,9 @@ static int dd_request_merge(struct request_queue *q, struct request **rq, + return ELEVATOR_NO_MERGE; + } + +-static bool dd_bio_merge(struct blk_mq_hw_ctx *hctx, struct bio *bio, ++static bool dd_bio_merge(struct request_queue *q, struct bio *bio, + unsigned int nr_segs) + { +- struct request_queue *q = hctx->queue; + struct deadline_data *dd = q->elevator->elevator_data; + struct request *free = NULL; + bool ret; +diff --git a/include/linux/elevator.h b/include/linux/elevator.h +index 901bda352dcb..7b4d5face204 100644 +--- a/include/linux/elevator.h ++++ b/include/linux/elevator.h +@@ -34,7 +34,7 @@ struct elevator_mq_ops { + void (*depth_updated)(struct blk_mq_hw_ctx *); + + bool (*allow_merge)(struct request_queue *, struct request *, struct bio *); +- bool (*bio_merge)(struct blk_mq_hw_ctx *, struct bio *, unsigned int); ++ bool (*bio_merge)(struct request_queue *, struct bio *, unsigned int); + int (*request_merge)(struct request_queue *q, struct request **, struct bio *); + void (*request_merged)(struct request_queue *, struct request *, enum elv_merge); + void (*requests_merged)(struct request_queue *, struct request *, struct request *); +-- +2.30.2 + diff --git a/queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch b/queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch new file mode 100644 index 00000000000..a9e71a01cbd --- /dev/null +++ b/queue-5.4/nbd-fix-null-pointer-in-flush_workqueue.patch @@ -0,0 +1,86 @@ +From df713e302e9d6e0e8b07e3a53834e41473a47fd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 19:43:30 +0800 +Subject: nbd: Fix NULL pointer in flush_workqueue + +From: Sun Ke + +[ Upstream commit 79ebe9110fa458d58f1fceb078e2068d7ad37390 ] + +Open /dev/nbdX first, the config_refs will be 1 and +the pointers in nbd_device are still null. Disconnect +/dev/nbdX, then reference a null recv_workq. The +protection by config_refs in nbd_genl_disconnect is useless. + +[ 656.366194] BUG: kernel NULL pointer dereference, address: 0000000000000020 +[ 656.368943] #PF: supervisor write access in kernel mode +[ 656.369844] #PF: error_code(0x0002) - not-present page +[ 656.370717] PGD 10cc87067 P4D 10cc87067 PUD 1074b4067 PMD 0 +[ 656.371693] Oops: 0002 [#1] SMP +[ 656.372242] CPU: 5 PID: 7977 Comm: nbd-client Not tainted 5.11.0-rc5-00040-g76c057c84d28 #1 +[ 656.373661] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 +[ 656.375904] RIP: 0010:mutex_lock+0x29/0x60 +[ 656.376627] Code: 00 0f 1f 44 00 00 55 48 89 fd 48 83 05 6f d7 fe 08 01 e8 7a c3 ff ff 48 83 05 6a d7 fe 08 01 31 c0 65 48 8b 14 25 00 6d 01 00 48 0f b1 55 d +[ 656.378934] RSP: 0018:ffffc900005eb9b0 EFLAGS: 00010246 +[ 656.379350] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 +[ 656.379915] RDX: ffff888104cf2600 RSI: ffffffffaae8f452 RDI: 0000000000000020 +[ 656.380473] RBP: 0000000000000020 R08: 0000000000000000 R09: ffff88813bd6b318 +[ 656.381039] R10: 00000000000000c7 R11: fefefefefefefeff R12: ffff888102710b40 +[ 656.381599] R13: ffffc900005eb9e0 R14: ffffffffb2930680 R15: ffff88810770ef00 +[ 656.382166] FS: 00007fdf117ebb40(0000) GS:ffff88813bd40000(0000) knlGS:0000000000000000 +[ 656.382806] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 656.383261] CR2: 0000000000000020 CR3: 0000000100c84000 CR4: 00000000000006e0 +[ 656.383819] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 656.384370] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 656.384927] Call Trace: +[ 656.385111] flush_workqueue+0x92/0x6c0 +[ 656.385395] nbd_disconnect_and_put+0x81/0xd0 +[ 656.385716] nbd_genl_disconnect+0x125/0x2a0 +[ 656.386034] genl_family_rcv_msg_doit.isra.0+0x102/0x1b0 +[ 656.386422] genl_rcv_msg+0xfc/0x2b0 +[ 656.386685] ? nbd_ioctl+0x490/0x490 +[ 656.386954] ? genl_family_rcv_msg_doit.isra.0+0x1b0/0x1b0 +[ 656.387354] netlink_rcv_skb+0x62/0x180 +[ 656.387638] genl_rcv+0x34/0x60 +[ 656.387874] netlink_unicast+0x26d/0x590 +[ 656.388162] netlink_sendmsg+0x398/0x6c0 +[ 656.388451] ? netlink_rcv_skb+0x180/0x180 +[ 656.388750] ____sys_sendmsg+0x1da/0x320 +[ 656.389038] ? ____sys_recvmsg+0x130/0x220 +[ 656.389334] ___sys_sendmsg+0x8e/0xf0 +[ 656.389605] ? ___sys_recvmsg+0xa2/0xf0 +[ 656.389889] ? handle_mm_fault+0x1671/0x21d0 +[ 656.390201] __sys_sendmsg+0x6d/0xe0 +[ 656.390464] __x64_sys_sendmsg+0x23/0x30 +[ 656.390751] do_syscall_64+0x45/0x70 +[ 656.391017] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +To fix it, just add if (nbd->recv_workq) to nbd_disconnect_and_put(). + +Fixes: e9e006f5fcf2 ("nbd: fix max number of supported devs") +Signed-off-by: Sun Ke +Reviewed-by: Josef Bacik +Link: https://lore.kernel.org/r/20210512114331.1233964-2-sunke32@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index e11fddcb73b9..839364371f9a 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -2016,7 +2016,8 @@ static void nbd_disconnect_and_put(struct nbd_device *nbd) + * config ref and try to destroy the workqueue from inside the work + * queue. + */ +- flush_workqueue(nbd->recv_workq); ++ if (nbd->recv_workq) ++ flush_workqueue(nbd->recv_workq); + if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, + &nbd->config->runtime_flags)) + nbd_config_put(nbd); +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 1aa9aaeaab1..732b6d883f2 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -102,3 +102,10 @@ userfaultfd-release-page-in-error-path-to-avoid-bug_on.patch mm-hugetlb-fix-f_seal_future_write.patch drm-radeon-dpm-disable-sclk-switching-on-oland-when-two-4k-60hz-monitors-are-connected.patch drm-i915-avoid-div-by-zero-on-gen2.patch +iio-proximity-pulsedlight-fix-rumtime-pm-imbalance-o.patch +usb-fotg210-hcd-fix-an-error-message.patch +hwmon-occ-fix-poll-rate-limiting.patch +acpi-scan-fix-a-memory-leak-in-an-error-handling-pat.patch +kyber-fix-out-of-bounds-access-when-preempted.patch +nbd-fix-null-pointer-in-flush_workqueue.patch +blk-mq-swap-two-calls-in-blk_mq_exit_queue.patch diff --git a/queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch b/queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch new file mode 100644 index 00000000000..88d29ee790d --- /dev/null +++ b/queue-5.4/usb-fotg210-hcd-fix-an-error-message.patch @@ -0,0 +1,53 @@ +From f11d07f707777ea4cc2e172476d03dcb401edfaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 May 2021 22:39:10 +0200 +Subject: usb: fotg210-hcd: Fix an error message + +From: Christophe JAILLET + +[ Upstream commit a60a34366e0d09ca002c966dd7c43a68c28b1f82 ] + +'retval' is known to be -ENODEV here. +This is a hard-coded default error code which is not useful in the error +message. Moreover, another error message is printed at the end of the +error handling path. The corresponding error code (-ENOMEM) is more +informative. + +So remove simplify the first error message. + +While at it, also remove the useless initialization of 'retval'. + +Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/94531bcff98e46d4f9c20183a90b7f47f699126c.1620333419.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/fotg210-hcd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/host/fotg210-hcd.c b/drivers/usb/host/fotg210-hcd.c +index 9e0c98d6bdb0..c3f74d6674e1 100644 +--- a/drivers/usb/host/fotg210-hcd.c ++++ b/drivers/usb/host/fotg210-hcd.c +@@ -5571,7 +5571,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + struct usb_hcd *hcd; + struct resource *res; + int irq; +- int retval = -ENODEV; ++ int retval; + struct fotg210_hcd *fotg210; + + if (usb_disabled()) +@@ -5591,7 +5591,7 @@ static int fotg210_hcd_probe(struct platform_device *pdev) + hcd = usb_create_hcd(&fotg210_fotg210_hc_driver, dev, + dev_name(dev)); + if (!hcd) { +- dev_err(dev, "failed to create hcd with err %d\n", retval); ++ dev_err(dev, "failed to create hcd\n"); + retval = -ENOMEM; + goto fail_create_hcd; + } +-- +2.30.2 + -- 2.47.3