Hi
This is backport of patches d208b89401e0 ("dm: fix mempool NULL pointer
race when completing IO") and 9f6dc6337610 ("dm: interlock pending dm_io
and dm_wait_for_bios_completion") for the kernel 4.14.
The bugs fixed by these patches can cause random crashing when reloading
dm table, so it is eligible for stable backport.
This patch is different from the upstream patches because the code
diverged significantly.
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
drivers/md/dm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: linux-stable/drivers/md/dm.c
===================================================================
--- linux-stable.orig/drivers/md/dm.c 2022-04-19 16:33:39.000000000 +0200
+++ linux-stable/drivers/md/dm.c 2022-04-19 16:33:39.000000000 +0200
@@ -543,6 +543,8 @@ static void end_io_acct(struct dm_io *io
bio->bi_iter.bi_sector, bio_sectors(bio),
true, duration, &io->stats_aux);
+ free_io(md, io);
+
/*
* After this is decremented the bio must not be touched if it is
* a flush.
@@ -802,7 +804,6 @@ static void dec_pending(struct dm_io *io
io_error = io->status;
bio = io->bio;
end_io_acct(io);
- free_io(md, io);
if (io_error == BLK_STS_DM_REQUEUE)
return;
@@ -2227,6 +2228,8 @@ static int dm_wait_for_completion(struct
}
finish_wait(&md->wait, &wait);
+ smp_rmb();
+
return r;
}
Hi
This is backport of patches d208b89401e0 ("dm: fix mempool NULL pointer
race when completing IO") and 9f6dc6337610 ("dm: interlock pending dm_io
and dm_wait_for_bios_completion") for the kernel 4.9.
The bugs fixed by these patches can cause random crashing when reloading
dm table, so it is eligible for stable backport.
This patch is different from the upstream patches because the code
diverged significantly.
Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com>
---
drivers/md/dm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
Index: linux-stable/drivers/md/dm.c
===================================================================
--- linux-stable.orig/drivers/md/dm.c 2022-04-19 16:35:22.000000000 +0200
+++ linux-stable/drivers/md/dm.c 2022-04-19 16:35:22.000000000 +0200
@@ -539,6 +539,8 @@ static void end_io_acct(struct dm_io *io
bio->bi_iter.bi_sector, bio_sectors(bio),
true, duration, &io->stats_aux);
+ free_io(md, io);
+
/*
* After this is decremented the bio must not be touched if it is
* a flush.
@@ -794,7 +796,6 @@ static void dec_pending(struct dm_io *io
io_error = io->error;
bio = io->bio;
end_io_acct(io);
- free_io(md, io);
if (io_error == DM_ENDIO_REQUEUE)
return;
@@ -2024,6 +2025,8 @@ static int dm_wait_for_completion(struct
}
finish_wait(&md->wait, &wait);
+ smp_rmb();
+
return r;
}
This is a note to let you know that I've just added the patch titled
usb: dwc3: core: Fix tx/rx threshold settings
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From f28ad9069363dec7deb88032b70612755eed9ee6 Mon Sep 17 00:00:00 2001
From: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
Date: Mon, 11 Apr 2022 18:33:47 -0700
Subject: usb: dwc3: core: Fix tx/rx threshold settings
The current driver logic checks against 0 to determine whether the
periodic tx/rx threshold settings are set, but we may get bogus values
from uninitialized variables if no device property is set. Properly
default these variables to 0.
Fixes: 938a5ad1d305 ("usb: dwc3: Check for ESS TX/RX threshold config")
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Thinh Nguyen <Thinh.Nguyen(a)synopsys.com>
Link: https://lore.kernel.org/r/cccfce990b11b730b0dae42f9d217dc6fb988c90.16497271…
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 5bfd3e88af35..1ca9dae57855 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1377,10 +1377,10 @@ static void dwc3_get_properties(struct dwc3 *dwc)
u8 lpm_nyet_threshold;
u8 tx_de_emphasis;
u8 hird_threshold;
- u8 rx_thr_num_pkt_prd;
- u8 rx_max_burst_prd;
- u8 tx_thr_num_pkt_prd;
- u8 tx_max_burst_prd;
+ u8 rx_thr_num_pkt_prd = 0;
+ u8 rx_max_burst_prd = 0;
+ u8 tx_thr_num_pkt_prd = 0;
+ u8 tx_max_burst_prd = 0;
u8 tx_fifo_resize_max_num;
const char *usb_psy_name;
int ret;
--
2.36.0
This is a note to let you know that I've just added the patch titled
usb: xhci: tegra:Fix PM usage reference leak of
to my usb git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.
The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.
If you have any questions about this process, please let me know.
From 8771039482d965bdc8cefd972bcabac2b76944a8 Mon Sep 17 00:00:00 2001
From: zhangqilong <zhangqilong3(a)huawei.com>
Date: Sat, 19 Mar 2022 10:38:22 +0800
Subject: usb: xhci: tegra:Fix PM usage reference leak of
tegra_xusb_unpowergate_partitions
pm_runtime_get_sync will increment pm usage counter
even it failed. Forgetting to putting operation will
result in reference leak here. We fix it by replacing
it with pm_runtime_resume_and_get to keep usage counter
balanced.
Fixes: 41a7426d25fa ("usb: xhci: tegra: Unlink power domain devices")
Cc: stable <stable(a)vger.kernel.org>
Signed-off-by: Zhang Qilong <zhangqilong3(a)huawei.com>
Link: https://lore.kernel.org/r/20220319023822.145641-1-zhangqilong3@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
---
drivers/usb/host/xhci-tegra.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
index c8af2cd2216d..996958a6565c 100644
--- a/drivers/usb/host/xhci-tegra.c
+++ b/drivers/usb/host/xhci-tegra.c
@@ -1034,13 +1034,13 @@ static int tegra_xusb_unpowergate_partitions(struct tegra_xusb *tegra)
int rc;
if (tegra->use_genpd) {
- rc = pm_runtime_get_sync(tegra->genpd_dev_ss);
+ rc = pm_runtime_resume_and_get(tegra->genpd_dev_ss);
if (rc < 0) {
dev_err(dev, "failed to enable XUSB SS partition\n");
return rc;
}
- rc = pm_runtime_get_sync(tegra->genpd_dev_host);
+ rc = pm_runtime_resume_and_get(tegra->genpd_dev_host);
if (rc < 0) {
dev_err(dev, "failed to enable XUSB Host partition\n");
pm_runtime_put_sync(tegra->genpd_dev_ss);
--
2.36.0
From: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
commit d6b88ce2eb9d ("ACPI: processor idle: Allow playing dead in C3 state")
was supposedly just trying to enable C3 when the CPU is offlined,
but it also mistakenly enabled C3 usage without setting ARB_DIS=1
in normal idle scenarios.
This results in a machine that won't boot past the point when it first
enters C3. Restore the correct behaviour (either demote to C1/C2, or
use C3 but also set ARB_DIS=1).
I hit this on a Fujitsu Siemens Lifebook S6010 (P3) machine.
Cc: stable(a)vger.kernel.org
Cc: Woody Suwalski <wsuwalski(a)gmail.com>
Cc: Mario Limonciello <mario.limonciello(a)amd.com>
Cc: Richard Gong <richard.gong(a)amd.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Fixes: d6b88ce2eb9d ("ACPI: processor idle: Allow playing dead in C3 state")
Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com>
---
drivers/acpi/processor_idle.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 4556c86c3465..54f0a1915025 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -793,10 +793,10 @@ static int acpi_processor_setup_cstates(struct acpi_processor *pr)
state->flags = 0;
if (cx->type == ACPI_STATE_C1 || cx->type == ACPI_STATE_C2 ||
- cx->type == ACPI_STATE_C3) {
+ cx->type == ACPI_STATE_C3)
state->enter_dead = acpi_idle_play_dead;
+ if (cx->type == ACPI_STATE_C1 || cx->type == ACPI_STATE_C2)
drv->safe_state_index = count;
- }
/*
* Halt-induced C1 is not good for ->enter_s2idle, because it
* re-enables interrupts on exit. Moreover, C1 is generally not
--
2.35.1