core/linux-rpi to 6.1.16-3

Include fixes for blk-cgroup shipped in vanilla 6.1.17 now
https://lkml.org/lkml/2023/3/11/170

core/linux-rpi/0002-blk-cgroup-Revert-changes-causing-NULL-derefs-on-unm.patch

@@ -0,0 +1,130 @@
+From b52602c6b36f687afa37076dca4ae61b264e31e3 Mon Sep 17 00:00:00 2001
+Date: Sat, 11 Mar 2023 06:32:06 -0500
+Subject: [PATCH] blk-cgroup: Revert changes causing NULL derefs on unmount
+
+This reverts
+
+- commit bfe46d2efe46 (blk-cgroup: synchronize pd_free_fn() from
+  blkg_free_workfn() and blkcg_deactivate_policy(), 2023-01-19) and
+- commit 57a425badc05 (blk-cgroup: dropping parent refcount after
+  pd_free_fn() is done, 2023-01-19).
+
+For: https://bugs.archlinux.org/task/77811
+---
+ block/blk-cgroup.c     | 39 ++++++++-------------------------------
+ include/linux/blkdev.h |  1 -
+ 2 files changed, 8 insertions(+), 32 deletions(-)
+
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index f8b21be..7c91d91 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -87,32 +87,14 @@ static void blkg_free_workfn(struct work_struct *work)
+ {
+ 	struct blkcg_gq *blkg = container_of(work, struct blkcg_gq,
+ 					     free_work);
+-	struct request_queue *q = blkg->q;
+ 	int i;
+ 
+-	/*
+-	 * pd_free_fn() can also be called from blkcg_deactivate_policy(),
+-	 * in order to make sure pd_free_fn() is called in order, the deletion
+-	 * of the list blkg->q_node is delayed to here from blkg_destroy(), and
+-	 * blkcg_mutex is used to synchronize blkg_free_workfn() and
+-	 * blkcg_deactivate_policy().
+-	 */
+-	if (q)
+-		mutex_lock(&q->blkcg_mutex);
+-
+ 	for (i = 0; i < BLKCG_MAX_POLS; i++)
+ 		if (blkg->pd[i])
+ 			blkcg_policy[i]->pd_free_fn(blkg->pd[i]);
+ 
+-	if (blkg->parent)
+-		blkg_put(blkg->parent);
+-
+-	if (q) {
+-		list_del_init(&blkg->q_node);
+-		mutex_unlock(&q->blkcg_mutex);
+-		blk_put_queue(q);
+-	}
+-
++	if (blkg->q)
++		blk_put_queue(blkg->q);
+ 	free_percpu(blkg->iostat_cpu);
+ 	percpu_ref_exit(&blkg->refcnt);
+ 	kfree(blkg);
+@@ -145,6 +127,8 @@ static void __blkg_release(struct rcu_head *rcu)
+ 
+ 	/* release the blkcg and parent blkg refs this blkg has been holding */
+ 	css_put(&blkg->blkcg->css);
++	if (blkg->parent)
++		blkg_put(blkg->parent);
+ 	blkg_free(blkg);
+ }
+ 
+@@ -441,14 +425,9 @@ static void blkg_destroy(struct blkcg_gq *blkg)
+ 	lockdep_assert_held(&blkg->q->queue_lock);
+ 	lockdep_assert_held(&blkcg->lock);
+ 
+-	/*
+-	 * blkg stays on the queue list until blkg_free_workfn(), see details in
+-	 * blkg_free_workfn(), hence this function can be called from
+-	 * blkcg_destroy_blkgs() first and again from blkg_destroy_all() before
+-	 * blkg_free_workfn().
+-	 */
+-	if (hlist_unhashed(&blkg->blkcg_node))
+-		return;
++	/* Something wrong if we are trying to remove same group twice */
++	WARN_ON_ONCE(list_empty(&blkg->q_node));
++	WARN_ON_ONCE(hlist_unhashed(&blkg->blkcg_node));
+ 
+ 	for (i = 0; i < BLKCG_MAX_POLS; i++) {
+ 		struct blkcg_policy *pol = blkcg_policy[i];
+@@ -460,6 +439,7 @@ static void blkg_destroy(struct blkcg_gq *blkg)
+ 	blkg->online = false;
+ 
+ 	radix_tree_delete(&blkcg->blkg_tree, blkg->q->id);
++	list_del_init(&blkg->q_node);
+ 	hlist_del_init_rcu(&blkg->blkcg_node);
+ 
+ 	/*
+@@ -1246,7 +1226,6 @@ int blkcg_init_disk(struct gendisk *disk)
+ 	int ret;
+ 
+ 	INIT_LIST_HEAD(&q->blkg_list);
+-	mutex_init(&q->blkcg_mutex);
+ 
+ 	new_blkg = blkg_alloc(&blkcg_root, disk, GFP_KERNEL);
+ 	if (!new_blkg)
+@@ -1484,7 +1463,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
+ 	if (queue_is_mq(q))
+ 		blk_mq_freeze_queue(q);
+ 
+-	mutex_lock(&q->blkcg_mutex);
+ 	spin_lock_irq(&q->queue_lock);
+ 
+ 	__clear_bit(pol->plid, q->blkcg_pols);
+@@ -1503,7 +1481,6 @@ void blkcg_deactivate_policy(struct request_queue *q,
+ 	}
+ 
+ 	spin_unlock_irq(&q->queue_lock);
+-	mutex_unlock(&q->blkcg_mutex);
+ 
+ 	if (queue_is_mq(q))
+ 		blk_mq_unfreeze_queue(q);
+diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
+index 1680b6e..891f8cb 100644
+--- a/include/linux/blkdev.h
++++ b/include/linux/blkdev.h
+@@ -487,7 +487,6 @@ struct request_queue {
+ 	DECLARE_BITMAP		(blkcg_pols, BLKCG_MAX_POLS);
+ 	struct blkcg_gq		*root_blkg;
+ 	struct list_head	blkg_list;
+-	struct mutex		blkcg_mutex;
+ #endif
+ 
+ 	struct queue_limits	limits;
+-- 
+2.39.2
+

core/linux-rpi/PKGBUILD

@@ -10,7 +10,7 @@ _srcname=linux-${_commit}
 _kernelname=${pkgbase#linux}
 _regen=
 pkgver=6.1.16
-pkgrel=2
+pkgrel=3
 pkgdesc='Linux'
 url="http://www.kernel.org/"
 arch=(armv7h aarch64)
@@ -24,6 +24,7 @@ source_aarch64=('config8' 'config8.txt')
 source=("linux-$pkgver-${_commit:0:10}.tar.gz::https://github.com/raspberrypi/linux/archive/${_commit}.tar.gz"
         cmdline.txt
         0001-Make-proc-cpuinfo-consistent-on-arm64-and-arm.patch
+        0002-blk-cgroup-Revert-changes-causing-NULL-derefs-on-unm.patch
         linux.preset
         60-linux.hook
         90-linux.hook
@@ -32,6 +33,7 @@ source=("linux-$pkgver-${_commit:0:10}.tar.gz::https://github.com/raspberrypi/li
 md5sums=('40bc7797903c3730848cf1e692c9feb7'
          '3bab7426d8c8818dda8353da3892a41f'
          'f66a7ea3feb708d398ef57e4da4815e9'
+         '2e0affdf7f2290e5c214745d2318d5db'
          '86d4a35722b5410e3b29fc92dae15d4b'
          '0a5f16bfec6ad982a2f6782724cca8ba'
          '441ec084c47cddc53e592fb0cbce4edf'
@@ -52,7 +54,10 @@ prepare() {
   cd "${srcdir}/${_srcname}"
 
   # consistent behavior of lscpu on arm/arm64
-  patch -Np1 -i ../0001-Make-proc-cpuinfo-consistent-on-arm64-and-arm.patch
+  patch -p1 -i ../0001-Make-proc-cpuinfo-consistent-on-arm64-and-arm.patch
+
+  # https://bugs.archlinux.org/task/77811
+  patch -p1 -i ../0002-blk-cgroup-Revert-changes-causing-NULL-derefs-on-unm.patch
 
   echo "Setting version..."
   scripts/setlocalversion --save-scmversion