rebase patches on top of Ubuntu-5.13.0-21.21
(generated with debian/scripts/import-upstream-tag) Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
parent
7ceb3b1224
commit
4fce12053e
@ -21,7 +21,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|||||||
1 file changed, 7 insertions(+), 3 deletions(-)
|
1 file changed, 7 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
|
diff --git a/scripts/mkcompile_h b/scripts/mkcompile_h
|
||||||
index 4ae735039daf..5a1abe7b4169 100755
|
index a72b154de7b0..4dd111086466 100755
|
||||||
--- a/scripts/mkcompile_h
|
--- a/scripts/mkcompile_h
|
||||||
+++ b/scripts/mkcompile_h
|
+++ b/scripts/mkcompile_h
|
||||||
@@ -24,10 +24,14 @@ else
|
@@ -24,10 +24,14 @@ else
|
||||||
|
@ -55,10 +55,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|||||||
2 files changed, 111 insertions(+)
|
2 files changed, 111 insertions(+)
|
||||||
|
|
||||||
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
|
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
|
||||||
index ee85be64b680..a38a8e44422e 100644
|
index 8deb4cd7b133..291885ea26dd 100644
|
||||||
--- a/Documentation/admin-guide/kernel-parameters.txt
|
--- a/Documentation/admin-guide/kernel-parameters.txt
|
||||||
+++ b/Documentation/admin-guide/kernel-parameters.txt
|
+++ b/Documentation/admin-guide/kernel-parameters.txt
|
||||||
@@ -3653,6 +3653,15 @@
|
@@ -3808,6 +3808,15 @@
|
||||||
Also, it enforces the PCI Local Bus spec
|
Also, it enforces the PCI Local Bus spec
|
||||||
rule that those bits should be 0 in system reset
|
rule that those bits should be 0 in system reset
|
||||||
events (useful for kexec/kdump cases).
|
events (useful for kexec/kdump cases).
|
||||||
@ -75,10 +75,10 @@ index ee85be64b680..a38a8e44422e 100644
|
|||||||
Safety option to keep boot IRQs enabled. This
|
Safety option to keep boot IRQs enabled. This
|
||||||
should never be necessary.
|
should never be necessary.
|
||||||
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
|
||||||
index f32e521ade1e..4f3558d0c00a 100644
|
index cf71505ab0b9..7f381969e705 100644
|
||||||
--- a/drivers/pci/quirks.c
|
--- a/drivers/pci/quirks.c
|
||||||
+++ b/drivers/pci/quirks.c
|
+++ b/drivers/pci/quirks.c
|
||||||
@@ -192,6 +192,106 @@ static int __init pci_apply_final_quirks(void)
|
@@ -193,6 +193,106 @@ static int __init pci_apply_final_quirks(void)
|
||||||
}
|
}
|
||||||
fs_initcall_sync(pci_apply_final_quirks);
|
fs_initcall_sync(pci_apply_final_quirks);
|
||||||
|
|
||||||
@ -185,7 +185,7 @@ index f32e521ade1e..4f3558d0c00a 100644
|
|||||||
/*
|
/*
|
||||||
* Decoding should be disabled for a PCI device during BAR sizing to avoid
|
* Decoding should be disabled for a PCI device during BAR sizing to avoid
|
||||||
* conflict. But doing so may cause problems on host bridge and perhaps other
|
* conflict. But doing so may cause problems on host bridge and perhaps other
|
||||||
@@ -4857,6 +4957,8 @@ static const struct pci_dev_acs_enabled {
|
@@ -4858,6 +4958,8 @@ static const struct pci_dev_acs_enabled {
|
||||||
{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
|
{ PCI_VENDOR_ID_CAVIUM, PCI_ANY_ID, pci_quirk_cavium_acs },
|
||||||
/* APM X-Gene */
|
/* APM X-Gene */
|
||||||
{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
|
{ PCI_VENDOR_ID_AMCC, 0xE004, pci_quirk_xgene_acs },
|
||||||
|
@ -13,10 +13,10 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
|
||||||
index 14e6c73a6031..c191c9e50735 100644
|
index 1dcc66060a19..c0ca4f494a02 100644
|
||||||
--- a/virt/kvm/kvm_main.c
|
--- a/virt/kvm/kvm_main.c
|
||||||
+++ b/virt/kvm/kvm_main.c
|
+++ b/virt/kvm/kvm_main.c
|
||||||
@@ -77,7 +77,7 @@ module_param(halt_poll_ns, uint, 0644);
|
@@ -78,7 +78,7 @@ module_param(halt_poll_ns, uint, 0644);
|
||||||
EXPORT_SYMBOL_GPL(halt_poll_ns);
|
EXPORT_SYMBOL_GPL(halt_poll_ns);
|
||||||
|
|
||||||
/* Default doubles per-vcpu halt_poll_ns. */
|
/* Default doubles per-vcpu halt_poll_ns. */
|
||||||
|
@ -10,7 +10,7 @@ Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
|||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
diff --git a/net/core/dev.c b/net/core/dev.c
|
diff --git a/net/core/dev.c b/net/core/dev.c
|
||||||
index b91b76890cbc..cb7ffc3e848b 100644
|
index 04c4e236952f..3ff0e01f5cbf 100644
|
||||||
--- a/net/core/dev.c
|
--- a/net/core/dev.c
|
||||||
+++ b/net/core/dev.c
|
+++ b/net/core/dev.c
|
||||||
@@ -10517,7 +10517,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
|
@@ -10517,7 +10517,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
|
||||||
|
@ -2,6 +2,9 @@ From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|||||||
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
From: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||||
Date: Mon, 27 Sep 2021 11:28:39 +0200
|
Date: Mon, 27 Sep 2021 11:28:39 +0200
|
||||||
Subject: [PATCH] Revert "PCI: Coalesce host bridge contiguous apertures"
|
Subject: [PATCH] Revert "PCI: Coalesce host bridge contiguous apertures"
|
||||||
|
MIME-Version: 1.0
|
||||||
|
Content-Type: text/plain; charset=UTF-8
|
||||||
|
Content-Transfer-Encoding: 8bit
|
||||||
|
|
||||||
This reverts commit ab20e43b20b60f5cc8e2ea3763ffa388158469ac.
|
This reverts commit ab20e43b20b60f5cc8e2ea3763ffa388158469ac.
|
||||||
|
|
||||||
@ -12,8 +15,8 @@ Link: https://lore.kernel.org/r/20210709231529.GA3270116@roeck-us.net
|
|||||||
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
||||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||||
---
|
---
|
||||||
drivers/pci/probe.c | 52 +++++----------------------------------------
|
drivers/pci/probe.c | 50 ++++-----------------------------------------
|
||||||
1 file changed, 5 insertions(+), 47 deletions(-)
|
1 file changed, 4 insertions(+), 46 deletions(-)
|
||||||
|
|
||||||
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
|
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
|
||||||
index f6046a16dac1..275204646c68 100644
|
index f6046a16dac1..275204646c68 100644
|
||||||
@ -89,14 +92,13 @@ index f6046a16dac1..275204646c68 100644
|
|||||||
-
|
-
|
||||||
/* Add initial resources to the bus */
|
/* Add initial resources to the bus */
|
||||||
resource_list_for_each_entry_safe(window, n, &resources) {
|
resource_list_for_each_entry_safe(window, n, &resources) {
|
||||||
- offset = window->offset;
|
+ list_move_tail(&window->node, &bridge->windows);
|
||||||
- res = window->res;
|
offset = window->offset;
|
||||||
|
res = window->res;
|
||||||
- if (!res->end)
|
- if (!res->end)
|
||||||
- continue;
|
- continue;
|
||||||
-
|
-
|
||||||
list_move_tail(&window->node, &bridge->windows);
|
- list_move_tail(&window->node, &bridge->windows);
|
||||||
+ offset = window->offset;
|
|
||||||
+ res = window->res;
|
|
||||||
|
|
||||||
if (res->flags & IORESOURCE_BUS)
|
if (res->flags & IORESOURCE_BUS)
|
||||||
pci_bus_insert_busn_res(bus, bus->number, res->end);
|
pci_bus_insert_busn_res(bus, bus->number, res->end);
|
@ -55,7 +55,7 @@ Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|||||||
1 file changed, 27 insertions(+), 4 deletions(-)
|
1 file changed, 27 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
|
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
|
||||||
index be51670572fa..133f5d2b189d 100644
|
index 275204646c68..944c35d87258 100644
|
||||||
--- a/drivers/pci/probe.c
|
--- a/drivers/pci/probe.c
|
||||||
+++ b/drivers/pci/probe.c
|
+++ b/drivers/pci/probe.c
|
||||||
@@ -877,11 +877,11 @@ static void pci_set_bus_msi_domain(struct pci_bus *bus)
|
@@ -877,11 +877,11 @@ static void pci_set_bus_msi_domain(struct pci_bus *bus)
|
||||||
@ -73,7 +73,7 @@ index be51670572fa..133f5d2b189d 100644
|
|||||||
char addr[64], *fmt;
|
char addr[64], *fmt;
|
||||||
const char *name;
|
const char *name;
|
||||||
int err;
|
int err;
|
||||||
@@ -959,11 +959,34 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
|
@@ -961,11 +961,34 @@ static int pci_register_host_bridge(struct pci_host_bridge *bridge)
|
||||||
if (nr_node_ids > 1 && pcibus_to_node(bus) == NUMA_NO_NODE)
|
if (nr_node_ids > 1 && pcibus_to_node(bus) == NUMA_NO_NODE)
|
||||||
dev_warn(&bus->dev, "Unknown NUMA node; performance will be reduced\n");
|
dev_warn(&bus->dev, "Unknown NUMA node; performance will be reduced\n");
|
||||||
|
|
@ -1,75 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ming Lei <ming.lei@redhat.com>
|
|
||||||
Date: Fri, 10 Sep 2021 14:30:15 +0200
|
|
||||||
Subject: [PATCH] blk-mq: fix kernel panic during iterating over flush request
|
|
||||||
|
|
||||||
commit c2da19ed50554ce52ecbad3655c98371fe58599f upstream.
|
|
||||||
|
|
||||||
For fixing use-after-free during iterating over requests, we grabbed
|
|
||||||
request's refcount before calling ->fn in commit 2e315dc07df0 ("blk-mq:
|
|
||||||
grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter").
|
|
||||||
Turns out this way may cause kernel panic when iterating over one flush
|
|
||||||
request:
|
|
||||||
|
|
||||||
1) old flush request's tag is just released, and this tag is reused by
|
|
||||||
one new request, but ->rqs[] isn't updated yet
|
|
||||||
|
|
||||||
2) the flush request can be re-used for submitting one new flush command,
|
|
||||||
so blk_rq_init() is called at the same time
|
|
||||||
|
|
||||||
3) meantime blk_mq_queue_tag_busy_iter() is called, and old flush request
|
|
||||||
is retrieved from ->rqs[tag]; when blk_mq_put_rq_ref() is called,
|
|
||||||
flush_rq->end_io may not be updated yet, so NULL pointer dereference
|
|
||||||
is triggered in blk_mq_put_rq_ref().
|
|
||||||
|
|
||||||
Fix the issue by calling refcount_set(&flush_rq->ref, 1) after
|
|
||||||
flush_rq->end_io is set. So far the only other caller of blk_rq_init() is
|
|
||||||
scsi_ioctl_reset() in which the request doesn't enter block IO stack and
|
|
||||||
the request reference count isn't used, so the change is safe.
|
|
||||||
|
|
||||||
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
|
|
||||||
Reported-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
|
||||||
Tested-by: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
|
||||||
Signed-off-by: Ming Lei <ming.lei@redhat.com>
|
|
||||||
Reviewed-by: Christoph Hellwig <hch@lst.de>
|
|
||||||
Reviewed-by: John Garry <john.garry@huawei.com>
|
|
||||||
Link: https://lore.kernel.org/r/20210811142624.618598-1-ming.lei@redhat.com
|
|
||||||
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
||||||
Cc: Yi Zhang <yi.zhang@redhat.com>
|
|
||||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
||||||
---
|
|
||||||
block/blk-core.c | 1 -
|
|
||||||
block/blk-flush.c | 8 ++++++++
|
|
||||||
2 files changed, 8 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/block/blk-core.c b/block/blk-core.c
|
|
||||||
index 7663a9b94b80..debdf9b0bf30 100644
|
|
||||||
--- a/block/blk-core.c
|
|
||||||
+++ b/block/blk-core.c
|
|
||||||
@@ -121,7 +121,6 @@ void blk_rq_init(struct request_queue *q, struct request *rq)
|
|
||||||
rq->internal_tag = BLK_MQ_NO_TAG;
|
|
||||||
rq->start_time_ns = ktime_get_ns();
|
|
||||||
rq->part = NULL;
|
|
||||||
- refcount_set(&rq->ref, 1);
|
|
||||||
blk_crypto_rq_set_defaults(rq);
|
|
||||||
}
|
|
||||||
EXPORT_SYMBOL(blk_rq_init);
|
|
||||||
diff --git a/block/blk-flush.c b/block/blk-flush.c
|
|
||||||
index e89d007dbf6a..8b11ab3b3762 100644
|
|
||||||
--- a/block/blk-flush.c
|
|
||||||
+++ b/block/blk-flush.c
|
|
||||||
@@ -329,6 +329,14 @@ static void blk_kick_flush(struct request_queue *q, struct blk_flush_queue *fq,
|
|
||||||
flush_rq->rq_flags |= RQF_FLUSH_SEQ;
|
|
||||||
flush_rq->rq_disk = first_rq->rq_disk;
|
|
||||||
flush_rq->end_io = flush_end_io;
|
|
||||||
+ /*
|
|
||||||
+ * Order WRITE ->end_io and WRITE rq->ref, and its pair is the one
|
|
||||||
+ * implied in refcount_inc_not_zero() called from
|
|
||||||
+ * blk_mq_find_and_get_req(), which orders WRITE/READ flush_rq->ref
|
|
||||||
+ * and READ flush_rq->end_io
|
|
||||||
+ */
|
|
||||||
+ smp_wmb();
|
|
||||||
+ refcount_set(&flush_rq->ref, 1);
|
|
||||||
|
|
||||||
blk_flush_queue_rq(flush_rq, false);
|
|
||||||
}
|
|
@ -1,91 +0,0 @@
|
|||||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ming Lei <ming.lei@redhat.com>
|
|
||||||
Date: Fri, 10 Sep 2021 14:30:16 +0200
|
|
||||||
Subject: [PATCH] blk-mq: fix is_flush_rq
|
|
||||||
|
|
||||||
commit a9ed27a764156929efe714033edb3e9023c5f321 upstream.
|
|
||||||
|
|
||||||
is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
|
|
||||||
following check:
|
|
||||||
|
|
||||||
hctx->fq->flush_rq == req
|
|
||||||
|
|
||||||
but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
|
|
||||||
|
|
||||||
1) memory re-order in blk_mq_rq_ctx_init():
|
|
||||||
|
|
||||||
rq->mq_hctx = data->hctx;
|
|
||||||
...
|
|
||||||
refcount_set(&rq->ref, 1);
|
|
||||||
|
|
||||||
OR
|
|
||||||
|
|
||||||
2) tag re-use and ->rqs[] isn't updated with new request.
|
|
||||||
|
|
||||||
Fix the issue by re-writing is_flush_rq() as:
|
|
||||||
|
|
||||||
return rq->end_io == flush_end_io;
|
|
||||||
|
|
||||||
which turns out simpler to follow and immune to data race since we have
|
|
||||||
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
|
|
||||||
|
|
||||||
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
|
|
||||||
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
|
||||||
Cc: Yufen Yu <yuyufen@huawei.com>
|
|
||||||
Signed-off-by: Ming Lei <ming.lei@redhat.com>
|
|
||||||
Link: https://lore.kernel.org/r/20210818010925.607383-1-ming.lei@redhat.com
|
|
||||||
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
|
||||||
Cc: Yi Zhang <yi.zhang@redhat.com>
|
|
||||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
||||||
---
|
|
||||||
block/blk-flush.c | 5 +++++
|
|
||||||
block/blk-mq.c | 2 +-
|
|
||||||
block/blk.h | 6 +-----
|
|
||||||
3 files changed, 7 insertions(+), 6 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/block/blk-flush.c b/block/blk-flush.c
|
|
||||||
index 8b11ab3b3762..705ee6c99020 100644
|
|
||||||
--- a/block/blk-flush.c
|
|
||||||
+++ b/block/blk-flush.c
|
|
||||||
@@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
|
|
||||||
spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
|
|
||||||
}
|
|
||||||
|
|
||||||
+bool is_flush_rq(struct request *rq)
|
|
||||||
+{
|
|
||||||
+ return rq->end_io == flush_end_io;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
/**
|
|
||||||
* blk_kick_flush - consider issuing flush request
|
|
||||||
* @q: request_queue being kicked
|
|
||||||
diff --git a/block/blk-mq.c b/block/blk-mq.c
|
|
||||||
index cb619ec8aaf2..601e40204d06 100644
|
|
||||||
--- a/block/blk-mq.c
|
|
||||||
+++ b/block/blk-mq.c
|
|
||||||
@@ -937,7 +937,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
|
|
||||||
|
|
||||||
void blk_mq_put_rq_ref(struct request *rq)
|
|
||||||
{
|
|
||||||
- if (is_flush_rq(rq, rq->mq_hctx))
|
|
||||||
+ if (is_flush_rq(rq))
|
|
||||||
rq->end_io(rq, 0);
|
|
||||||
else if (refcount_dec_and_test(&rq->ref))
|
|
||||||
__blk_mq_free_request(rq);
|
|
||||||
diff --git a/block/blk.h b/block/blk.h
|
|
||||||
index 7550364c326c..4a4ffd992790 100644
|
|
||||||
--- a/block/blk.h
|
|
||||||
+++ b/block/blk.h
|
|
||||||
@@ -43,11 +43,7 @@ static inline void __blk_get_queue(struct request_queue *q)
|
|
||||||
kobject_get(&q->kobj);
|
|
||||||
}
|
|
||||||
|
|
||||||
-static inline bool
|
|
||||||
-is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
|
|
||||||
-{
|
|
||||||
- return hctx->fq->flush_rq == req;
|
|
||||||
-}
|
|
||||||
+bool is_flush_rq(struct request *req);
|
|
||||||
|
|
||||||
struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
|
|
||||||
gfp_t flags);
|
|
Loading…
Reference in New Issue
Block a user