January 2025 - Linux-stable-mirror

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.70 kernel. All users of the 6.6 kernel series must upgrade. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Documentation/admin-guide/media/building.rst | 2 Documentation/admin-guide/media/saa7134.rst | 2 Documentation/arch/arm64/silicon-errata.rst | 5 Documentation/devicetree/bindings/display/bridge/adi,adv7533.yaml | 2 Documentation/i2c/busses/i2c-i801.rst | 2 Makefile | 2 arch/arc/Makefile | 2 arch/loongarch/kernel/numa.c | 28 - arch/powerpc/kernel/setup-common.c | 1 arch/x86/entry/vsyscall/vsyscall_64.c | 2 arch/x86/include/asm/ptrace.h | 104 +++ arch/x86/include/asm/tlb.h | 4 arch/x86/kernel/Makefile | 4 arch/x86/kernel/cet.c | 30 + arch/x86/kernel/cpu/mshyperv.c | 68 ++ arch/x86/kernel/kexec-bzimage64.c | 4 arch/x86/kernel/kvm.c | 4 arch/x86/kernel/machine_kexec_64.c | 3 arch/x86/kernel/process_64.c | 2 arch/x86/kernel/reboot.c | 4 arch/x86/kernel/setup.c | 2 arch/x86/kernel/smp.c | 2 arch/x86/mm/numa.c | 34 - arch/x86/mm/tlb.c | 3 arch/x86/xen/enlighten_hvm.c | 4 arch/x86/xen/mmu_pv.c | 2 crypto/ecc.c | 22 crypto/ecdsa.c | 51 - drivers/acpi/arm64/iort.c | 9 drivers/bluetooth/btusb.c | 47 + drivers/clk/qcom/clk-alpha-pll.c | 27 + drivers/clk/qcom/clk-alpha-pll.h | 5 drivers/clocksource/hyperv_timer.c | 14 drivers/gpu/drm/amd/amdkfd/kfd_migrate.c | 4 drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 16 drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 14 drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 10 drivers/gpu/drm/bridge/adv7511/adv7533.c | 4 drivers/gpu/drm/i915/gt/intel_rc6.c | 2 drivers/i2c/busses/Kconfig | 2 drivers/i2c/busses/i2c-i801.c | 9 drivers/i2c/busses/i2c-xgene-slimpro.c | 16 drivers/iio/adc/ad7192.c | 39 - drivers/infiniband/core/uverbs_cmd.c | 16 drivers/infiniband/hw/bnxt_re/ib_verbs.c | 63 +- drivers/infiniband/hw/bnxt_re/main.c | 21 drivers/infiniband/hw/bnxt_re/qplib_fp.c | 93 +-- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 19 drivers/infiniband/hw/bnxt_re/qplib_res.h | 6 drivers/infiniband/hw/bnxt_re/qplib_sp.c | 26 drivers/infiniband/hw/bnxt_re/qplib_sp.h | 9 drivers/infiniband/hw/bnxt_re/roce_hsi.h | 30 + drivers/infiniband/hw/hns/hns_roce_alloc.c | 3 drivers/infiniband/hw/hns/hns_roce_cq.c | 11 drivers/infiniband/hw/hns/hns_roce_device.h | 12 drivers/infiniband/hw/hns/hns_roce_hem.c | 54 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 130 ++-- drivers/infiniband/hw/hns/hns_roce_mr.c | 95 ++- drivers/infiniband/hw/hns/hns_roce_qp.c | 4 drivers/infiniband/hw/hns/hns_roce_srq.c | 4 drivers/infiniband/hw/mlx5/main.c | 6 drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 drivers/irqchip/irq-gic.c | 2 drivers/mailbox/pcc.c | 136 ++++- drivers/media/usb/uvc/uvc_driver.c | 22 drivers/mmc/host/sdhci-msm.c | 16 drivers/net/dsa/microchip/ksz9477.c | 47 + drivers/net/dsa/microchip/ksz9477_reg.h | 4 drivers/net/dsa/microchip/lan937x_main.c | 62 ++ drivers/net/dsa/microchip/lan937x_reg.h | 9 drivers/net/ethernet/broadcom/bcmsysport.c | 21 drivers/net/ethernet/google/gve/gve_main.c | 25 drivers/net/ethernet/google/gve/gve_tx.c | 5 drivers/net/ethernet/marvell/mv643xx_eth.c | 14 drivers/net/ethernet/marvell/sky2.c | 1 drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c | 4 drivers/net/ethernet/mellanox/mlx5/core/esw/ipsec_fs.c | 6 drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 3 drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 drivers/net/ethernet/mellanox/mlx5/core/steering/dr_send.c | 4 drivers/net/ethernet/mellanox/mlxsw/spectrum_span.c | 3 drivers/net/ethernet/renesas/rswitch.c | 5 drivers/net/ethernet/sfc/tc_conntrack.c | 2 drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 118 ++-- drivers/net/ethernet/ti/icssg/icss_iep.c | 8 drivers/net/usb/qmi_wwan.c | 3 drivers/net/wireless/ath/ath10k/bmi.c | 1 drivers/net/wireless/ath/ath10k/ce.c | 1 drivers/net/wireless/ath/ath10k/core.c | 1 drivers/net/wireless/ath/ath10k/core.h | 1 drivers/net/wireless/ath/ath10k/coredump.c | 1 drivers/net/wireless/ath/ath10k/coredump.h | 1 drivers/net/wireless/ath/ath10k/debug.c | 1 drivers/net/wireless/ath/ath10k/debugfs_sta.c | 1 drivers/net/wireless/ath/ath10k/htc.c | 1 drivers/net/wireless/ath/ath10k/htt.h | 1 drivers/net/wireless/ath/ath10k/htt_rx.c | 1 drivers/net/wireless/ath/ath10k/htt_tx.c | 1 drivers/net/wireless/ath/ath10k/hw.c | 1 drivers/net/wireless/ath/ath10k/hw.h | 1 drivers/net/wireless/ath/ath10k/mac.c | 1 drivers/net/wireless/ath/ath10k/pci.c | 1 drivers/net/wireless/ath/ath10k/pci.h | 1 drivers/net/wireless/ath/ath10k/qmi.c | 1 drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.c | 1 drivers/net/wireless/ath/ath10k/qmi_wlfw_v01.h | 1 drivers/net/wireless/ath/ath10k/rx_desc.h | 1 drivers/net/wireless/ath/ath10k/sdio.c | 5 drivers/net/wireless/ath/ath10k/thermal.c | 1 drivers/net/wireless/ath/ath10k/usb.h | 1 drivers/net/wireless/ath/ath10k/wmi-tlv.h | 1 drivers/net/wireless/ath/ath10k/wmi.c | 1 drivers/net/wireless/ath/ath10k/wmi.h | 1 drivers/net/wireless/ath/ath10k/wow.c | 1 drivers/net/wireless/ath/ath12k/mac.c | 26 drivers/net/wireless/ath/ath12k/reg.c | 6 drivers/net/wireless/realtek/rtw88/sdio.c | 6 drivers/net/wireless/realtek/rtw88/usb.c | 5 drivers/net/wwan/iosm/iosm_ipc_mmio.c | 2 drivers/net/wwan/t7xx/t7xx_state_monitor.c | 26 drivers/net/wwan/t7xx/t7xx_state_monitor.h | 5 drivers/nvme/host/core.c | 27 - drivers/nvme/host/nvme.h | 5 drivers/nvme/host/pci.c | 9 drivers/of/address.c | 30 - drivers/pinctrl/pinctrl-mcp23s08.c | 6 drivers/platform/x86/mlx-platform.c | 2 drivers/remoteproc/qcom_q6v5_pas.c | 94 +++ drivers/scsi/hisi_sas/hisi_sas.h | 3 drivers/scsi/hisi_sas/hisi_sas_main.c | 17 drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 200 ++++--- drivers/scsi/mpi3mr/mpi3mr_os.c | 12 drivers/thunderbolt/nhi.c | 12 drivers/thunderbolt/nhi.h | 6 drivers/thunderbolt/retimer.c | 17 drivers/usb/chipidea/ci.h | 2 drivers/usb/chipidea/ci_hdrc_imx.c | 1 drivers/usb/chipidea/core.c | 2 drivers/usb/chipidea/otg.c | 5 drivers/usb/chipidea/udc.c | 6 drivers/usb/dwc3/core.h | 4 drivers/usb/dwc3/gadget.c | 54 +- drivers/usb/host/xhci-ring.c | 42 + drivers/usb/host/xhci.c | 21 drivers/usb/host/xhci.h | 2 drivers/usb/typec/ucsi/ucsi.c | 9 drivers/usb/typec/ucsi/ucsi.h | 5 drivers/usb/typec/ucsi/ucsi_glink.c | 60 +- drivers/watchdog/rzg2l_wdt.c | 83 +-- fs/btrfs/ctree.c | 37 - fs/btrfs/ctree.h | 7 fs/btrfs/disk-io.c | 9 fs/btrfs/inode.c | 2 fs/ceph/mds_client.c | 9 fs/ext4/ext4.h | 20 fs/ext4/extents.c | 18 fs/ext4/ialloc.c | 4 fs/ext4/inline.c | 4 fs/ext4/inode.c | 70 +- fs/ext4/ioctl.c | 13 fs/ext4/namei.c | 10 fs/ext4/super.c | 2 fs/ext4/xattr.c | 8 fs/f2fs/file.c | 13 fs/ntfs3/attrib.c | 32 - fs/ntfs3/frecord.c | 103 --- fs/ntfs3/inode.c | 3 fs/ntfs3/ntfs_fs.h | 3 fs/ocfs2/quota_global.c | 2 fs/ocfs2/quota_local.c | 1 fs/proc/task_mmu.c | 2 fs/smb/client/cifsacl.c | 266 +++++----- fs/smb/client/cifsacl.h | 20 fs/smb/client/cifsfs.c | 1 fs/smb/client/cifsglob.h | 22 fs/smb/client/cifsproto.h | 26 fs/smb/client/cifssmb.c | 6 fs/smb/client/inode.c | 4 fs/smb/client/smb2inode.c | 4 fs/smb/client/smb2ops.c | 14 fs/smb/client/smb2pdu.c | 12 fs/smb/client/smb2pdu.h | 8 fs/smb/client/smb2proto.h | 4 fs/smb/client/smb2transport.c | 56 +- fs/smb/client/xattr.c | 4 fs/smb/server/smb2pdu.c | 22 fs/smb/server/vfs.h | 1 fs/udf/namei.c | 17 include/acpi/pcc.h | 20 include/clocksource/hyperv_timer.h | 2 include/crypto/internal/ecc.h | 10 include/linux/bpf_verifier.h | 31 - include/linux/cleanup.h | 88 +++ include/linux/if_vlan.h | 16 include/linux/memblock.h | 1 include/linux/mlx5/driver.h | 6 include/linux/mutex.h | 3 include/linux/rwsem.h | 8 include/linux/seq_buf.h | 25 include/linux/spinlock.h | 15 include/linux/trace_events.h | 6 include/linux/trace_seq.h | 2 include/linux/usb/chipidea.h | 2 include/net/bluetooth/hci_core.h | 108 ++-- include/net/mac80211.h | 31 + include/net/netfilter/nf_tables.h | 7 kernel/bpf/core.c | 6 kernel/bpf/verifier.c | 175 ++---- kernel/kcov.c | 2 kernel/sched/core.c | 12 kernel/softirq.c | 15 kernel/trace/trace.c | 233 ++------ kernel/trace/trace.h | 6 kernel/trace/trace_events.c | 44 + kernel/trace/trace_output.c | 6 kernel/trace/trace_seq.c | 6 lib/seq_buf.c | 26 mm/kmemleak.c | 2 mm/memblock.c | 34 + mm/readahead.c | 6 mm/vmscan.c | 9 net/bluetooth/hci_conn.c | 13 net/bluetooth/hci_core.c | 10 net/bluetooth/iso.c | 6 net/bluetooth/l2cap_core.c | 12 net/bluetooth/rfcomm/core.c | 6 net/bluetooth/sco.c | 12 net/core/dev.c | 4 net/core/sock.c | 5 net/ipv4/ip_tunnel.c | 38 - net/ipv4/tcp_input.c | 1 net/ipv6/ila/ila_xlat.c | 16 net/llc/llc_input.c | 2 net/mac80211/ieee80211_i.h | 2 net/mac80211/mesh.c | 6 net/mac80211/status.c | 1 net/mac80211/util.c | 19 net/mctp/route.c | 36 - net/mptcp/options.c | 7 net/mptcp/protocol.c | 22 net/netrom/nr_route.c | 6 net/packet/af_packet.c | 28 - net/sctp/associola.c | 3 scripts/mod/file2alias.c | 4 scripts/sorttable.h | 5 security/selinux/ss/services.c | 8 sound/core/seq/oss/seq_oss_synth.c | 2 sound/core/seq/seq_clientmgr.c | 14 sound/core/ump.c | 61 +- sound/pci/hda/patch_ca0132.c | 37 - sound/pci/hda/patch_realtek.c | 2 sound/usb/format.c | 7 sound/usb/mixer_us16x08.c | 2 sound/usb/quirks.c | 2 tools/testing/selftests/bpf/progs/verifier_subprog_precision.c | 23 tools/testing/selftests/bpf/verifier/precise.c | 38 - 257 files changed, 3085 insertions(+), 1788 deletions(-) Adam Young (1): mailbox: pcc: Check before sending MCTP PCC response ACK Adrian Ratiu (2): sound: usb: enable DSD output for ddHiFi TC44C sound: usb: format: don't warn that raw DSD is unsupported Agustin Gutierrez (1): drm/amd/display: Fix DSC-re-computing Al Viro (1): udf_rename(): only access the child content on cross-directory rename Alessandro Carminati (1): mm/kmemleak: fix sleeping function called from invalid context at print message Andrea della Porta (1): of: address: Preserve the flags portion on 1:1 dma-ranges mapping Andrew Halaney (1): net: stmmac: don't create a MDIO bus if unnecessary Anton Protopopov (1): bpf: fix potential error return Antonio Pastor (1): net: llc: reset skb->transport_header Arnd Bergmann (1): kcov: mark in_softirq_really() as __always_inline Baoquan He (1): x86, crash: wrap crash dumping code into crash related ifdefs Biju Das (3): drm: adv7511: Drop dsi single lane support dt-bindings: display: adi,adv7533: Drop single lane support drm: adv7511: Fix use-after-free in adv7533_attach_dsi() Borislav Petkov (AMD) (1): x86/mm: Carve out INVLPG inline asm for use by others Brian Foster (1): ext4: partial zero eof block on unaligned inode size extension Chao Yu (1): f2fs: fix to wait dio completion ChenXiaoSong (4): smb/client: rename cifs_ntsd to smb_ntsd smb/client: rename cifs_sid to smb_sid smb/client: rename cifs_acl to smb_acl smb/client: rename cifs_ace to smb_ace Chengchang Tang (4): RDMA/hns: Refactor mtr find RDMA/hns: Remove unused parameters and variables RDMA/hns: Fix warning storm caused by invalid input in IO path RDMA/hns: Fix missing flush CQE for DWQE Chris Lu (2): Bluetooth: btusb: add callback function in btusb suspend/resume Bluetooth: btusb: mediatek: add callback function in btusb_disconnect Claudiu Beznea (3): watchdog: rzg2l_wdt: Remove reset de-assert from probe watchdog: rzg2l_wdt: Rely on the reset driver for doing proper reset watchdog: rzg2l_wdt: Power on the watchdog domain in the restart handler Damodharam Ammepalli (2): RDMA/bnxt_re: Add send queue size check for variable wqe RDMA/bnxt_re: Fix MSN table size for variable wqe mode Dan Carpenter (1): RDMA/uverbs: Prevent integer overflow issue Daniel Schaefer (1): ALSA hda/realtek: Add quirk for Framework F111:000C Daniele Palmas (1): net: usb: qmi_wwan: add Telit FE910C04 compositions David Hildenbrand (1): fs/proc/task_mmu: fix pagemap flags with PMD THP entries on 32bit Dennis Lam (1): ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv Devi Priya (1): clk: qcom: clk-alpha-pll: Add NSS HUAYRA ALPHA PLL support for ipq9574 Dmitry Baryshkov (7): remoteproc: qcom: pas: enable SAR2130P audio DSP support usb: typec: ucsi: add callback for connector status updates usb: typec: ucsi: glink: move GPIO reading into connector_status callback usb: typec: ucsi: add update_connector callback usb: typec: ucsi: glink: set orientation aware if supported usb: typec: ucsi: glink: be more precise on orientation-aware ports usb: typec: ucsi: glink: fix off-by-one in connector_status Dragos Tatulea (1): net/mlx5e: macsec: Maintain TX SA from encoding_sa Emmanuel Grumbach (1): wifi: mac80211: wake the queues in case of failure in resume Enzo Matsumiya (1): smb: client: destroy cfid_put_wq on module exit Eric Biggers (1): mmc: sdhci-msm: fix crypto key eviction Eric Dumazet (5): ip_tunnel: annotate data-races around t->parms.link net: restrict SO_REUSEPORT to inet sockets af_packet: fix vlan_get_tci() vs MSG_PEEK af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK ila: serialize calls to nf_register_net_hooks() Evgenii Shatokhin (1): pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking Fangzhi Zuo (1): drm/amd/display: Fix incorrect DSC recompute trigger Filipe Manana (3): btrfs: rename and export __btrfs_cow_block() btrfs: fix use-after-free when COWing tree bock and tracing is enabled btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount Greg Kroah-Hartman (1): Linux 6.6.70 Guixin Liu (1): scsi: mpi3mr: Use ida to manage mrioc ID Hao Qin (1): Bluetooth: btusb: Add new VID/PID 0489/e111 for MT7925 Herve Codina (1): of: address: Remove duplicated functions Hobin Woo (1): ksmbd: retry iterate_dir in smb2_query_dir Huisong Li (2): mailbox: pcc: Add support for platform notification handling mailbox: pcc: Support shared interrupt for multiple subspaces Ido Schimmel (3): ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_bind_dev() ipv4: ip_tunnel: Unmask upper DSCP bits in ip_md_tunnel_xmit() ipv4: ip_tunnel: Unmask upper DSCP bits in ip_tunnel_xmit() Ilya Shchipletsov (1): netrom: check buffer length before accessing it Issam Hamdi (1): wifi: mac80211: fix mbss changed flags corruption on 32 bit systems Jan Kara (1): udf: Verify inode link counts before performing rename Jarkko Nikula (2): i2c: i801: Add support for Intel Arrow Lake-H i2c: i801: Add support for Intel Panther Lake Jeff Johnson (1): wifi: ath10k: Update Qualcomm Innovation Center, Inc. copyrights Jeff Layton (1): ext4: convert to new timestamp accessors Jeremy Kerr (1): net: mctp: handle skb cleanup on sock_queue failures Jianbo Liu (1): net/mlx5e: Skip restore TC rules for vport rep without loaded flag Jiande Lu (1): Bluetooth: btusb: Add USB HW IDs for MT7921/MT7922/MT7925 Jingyang Wang (1): Bluetooth: Add support ITTIM PE50-M75C Jinjian Song (1): net: wwan: t7xx: Fix FSM command timeout issue Joe Hattori (3): platform/x86: mlx-platform: call pci_dev_put() to balance the refcount net: stmmac: restructure the error path of stmmac_probe_config_dt() net: mv643xx_eth: fix an OF node reference leak Johannes Thumshirn (1): btrfs: fix use-after-free in btrfs_encoded_read_endio() Jonathan Cameron (1): iio: adc: ad7192: Convert from of specific to fwnode property handling Joshua Washington (2): gve: guard XSK operations on the existence of queues gve: guard XDP xmit NDO on existence of xdp queues K Prateek Nayak (1): softirq: Allow raising SCHED_SOFTIRQ from SMP-call-function on RT kernel Kalesh AP (3): RDMA/bnxt_re: Fix the check for 9060 condition RDMA/bnxt_re: Fix reporting hw_ver in query_device RDMA/bnxt_re: Disable use of reserved wqes Kalle Valo (1): wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() Kang Yang (1): wifi: ath10k: avoid NULL pointer error during sdio remove Karthikeyan Periyasamy (1): wifi: ath12k: Optimize the mac80211 hw data access Kashyap Desai (2): RDMA/bnxt_re: Avoid sending the modify QP workaround for latest adapters RDMA/bnxt_re: Fix max SGEs for the Work Request Kees Cook (1): seq_buf: Introduce DECLARE_SEQ_BUF and seq_buf_str() Konstantin Komarov (2): fs/ntfs3: Implement fallocate for compressed files fs/ntfs3: Fix warning in ni_fiemap Kuan-Wei Chiu (1): scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity Laurent Pinchart (1): media: uvcvideo: Force UVC version to 1.0a for 0408:4035 Leon Romanovsky (2): RDMA/bnxt_re: Remove always true dattr validity check ARC: build: Try to guess GCC variant of cross compiler Li Zhijian (1): RDMA/rtrs: Ensure 'ib_sge list' is accessible Liam Ni (1): NUMA: optimize detection of memory with no node id assigned by firmware Liang Jie (1): net: sfc: Correct key_len for efx_tc_ct_zone_ht_params Luiz Augusto von Dentz (1): Bluetooth: hci_core: Fix sleeping function called from invalid context Lukas Wunner (1): crypto: ecdsa - Avoid signed integer overflow on signature decoding Maciej S. Szmigiero (1): net: wwan: iosm: Properly check for valid exec stage in ipc_mmio_init() Mario Limonciello (1): thunderbolt: Don't display nvm_version unless upgrade supported Markus Elfring (1): Bluetooth: hci_conn: Reduce hci_conn_drop() calls in two functions Masahiro Yamada (2): modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host modpost: fix the missed iteration for the max bit in do_input() Mathias Nyman (1): xhci: Turn NEC specific quirk for handling Stop Endpoint errors generic Matthew Wilcox (Oracle) (2): tracing: Move readpos from seq_buf to trace_seq powerpc: Remove initialisation of readpos Mauro Carvalho Chehab (1): docs: media: update location of the media patches Max Kellermann (1): ceph: give up on paths longer than PATH_MAX Meghana Malladi (1): net: ti: icssg-prueth: Fix clearing of IEP_CMP_CFG registers during iep_init Michal Pecio (3): xhci: retry Stop Endpoint on buggy NEC controllers usb: xhci: Limit Stop Endpoint retries usb: xhci: Avoid queuing redundant Stop Endpoint commands Mika Westerberg (2): thunderbolt: Add support for Intel Lunar Lake thunderbolt: Add support for Intel Panther Lake-M/P Mike Rapoport (Microsoft) (1): memblock: allow zero threshold in validate_numa_converage() Naman Jain (1): x86/hyperv: Fix hv tsc page based sched_clock for hibernation Namjae Jeon (1): ksmbd: set ATTR_CTIME flags when setting mtime Nathan Lynch (1): seq_buf: Make DECLARE_SEQ_BUF() usable Nikita Travkin (1): remoteproc: qcom: pas: Add sc7180 adsp Nikita Yushchenko (1): net: renesas: rswitch: fix possible early skb release Nikolay Kuratov (1): net/sctp: Prevent autoclose integer overflow in sctp_association_init() Nilay Shroff (2): nvme: use helper nvme_ctrl_state in nvme_keep_alive_finish function Revert "nvme: make keep-alive synchronous operation" Nuno Sa (1): iio: adc: ad7192: properly check spi_get_device_match_data() Pablo Neira Ayuso (1): netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext Paolo Abeni (3): mptcp: fix TCP options overflow. mptcp: fix recvbuffer adjust on sleeping rcvmsg mptcp: don't always assume copied data in mptcp_cleanup_rbuf() Pascal Hambourg (1): sky2: Add device ID 11ab:4373 for Marvell 88E8075 Patrisious Haddad (1): RDMA/mlx5: Enforce same type port association for multiport RoCE Paulo Alcantara (2): smb: client: stop flooding dmesg in smb2_calc_signature() smb: client: fix use-after-free of signing key Peter Zijlstra (1): cleanup: Add conditional guard support Ping-Ke Shih (2): wifi: mac80211: export ieee80211_purge_tx_queue() for drivers wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb Prike Liang (1): drm/amdkfd: Correct the migration DMA map direction Przemek Kitszel (1): cleanup: Adjust scoped_guard() macros to avoid potential warning Qinxin Xia (1): ACPI/IORT: Add PMCG platform information for HiSilicon HIP09A Rajendra Nayak (1): clk: qcom: clk-alpha-pll: Add support for zonda ole pll configure Ralph Boehme (1): fs/smb/client: implement chmod() for SMB3 POSIX Extensions Ranjan Kumar (1): scsi: mpi3mr: Start controller indexing from 0 Ricardo Ribalda (1): media: uvcvideo: Force UVC version to 1.0a for 0408:4033 Rob Herring (1): of: address: Store number of bus flag cells rather than bool Robert Beckett (1): nvme-pci: 512 byte aligned dma pool segment quirk Rodrigo Vivi (1): drm/i915/dg1: Fix power gate sequence. Rory Little (1): wifi: mac80211: Add non-atomic station iterator Saravanan Vajravel (1): RDMA/bnxt_re: Add check for path mtu in modify_qp Sebastian Ott (1): net/mlx5: unique names for per device caches Seiji Nishikawa (1): mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() Selvarasu Ganesan (1): usb: dwc3: gadget: Add missing check for single port RAM in TxFIFO resizing logic Selvin Xavier (6): RDMA/bnxt_re: Allow MSN table capability check RDMA/bnxt_re: Avoid initializing the software queue for user queues RDMA/bnxt_re: Fix max_qp_wrs reported RDMA/bnxt_re: Add support for Variable WQE in Genp7 adapters RDMA/bnxt_re: Fix the locking while accessing the QP table RDMA/bnxt_re: Fix the max WQE size for static WQE support Shahar Shitrit (1): net/mlx5: DR, select MSIX vector 0 for completion queue creation Shung-Hsi Yu (1): Revert "bpf: support non-r10 register spill/fill to/from stack in precision tracking" Stefan Berger (4): crypto: ecdsa - Convert byte arrays with key coordinates to digits crypto: ecdsa - Rename keylen to bufsize where necessary crypto: ecdsa - Use ecc_digits_from_bytes to convert signature crypto: ecc - Prevent ecc_digits_from_bytes from reading too many bytes Stefan Ekenberg (1): drm/bridge: adv7511_audio: Update Audio InfoFrame properly Steven Rostedt (3): tracing: Have process_string() also allow arrays tracing: Fix trace_check_vprintf() when tp_printk is used tracing: Check "%s" dereference via the field and not the TP_printk format Steven Rostedt (Google) (1): tracing: Handle old buffer mappings for event strings and functions Sudeep Holla (2): i2c: xgene-slimpro: Migrate to use generic PCC shmem related macros ACPI: PCC: Add PCC shared memory region command and status bitfields Takashi Iwai (8): ALSA: ump: Use guard() for locking ALSA: ump: Don't open legacy substream for an inactive group ALSA: ump: Indicate the inactive group in legacy substream names ALSA: ump: Update legacy substream names upon FB info update ALSA: ump: Shut up truncated string warning ALSA: hda/ca0132: Use standard HD-audio quirk matching helpers ALSA: seq: Check UMP support for midi_version change ALSA: seq: oss: Fix races at processing SysEx messages Tanya Agarwal (1): ALSA: usb-audio: US16x08: Initialize array before use Tengfei Fan (1): remoteproc: qcom: pas: Add support for SA8775p ADSP, CDSP and GPDSP Thiébaud Weksteen (1): selinux: ignore unknown extended permissions Thomas Gleixner (1): sched: Initialize idle tasks only once Tomer Maimon (1): usb: chipidea: add CI_HDRC_FORCE_VBUS_ACTIVE_ALWAYS flag Tristram Ha (2): net: dsa: microchip: Fix KSZ9477 set_ageing_time function net: dsa: microchip: Fix LAN937X set_ageing_time function Ulrik Strid (1): Bluetooth: btusb: Add new VID/PID 13d3/3602 for MT7925 Uros Bizjak (2): cleanup: Remove address space of returned pointer irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base Vasiliy Kovalev (1): ALSA: hda/realtek: Add new alc2xx-fixup-headset-mic model Vitalii Mordan (1): eth: bcmsysport: fix call balance of priv->clk handling routines Wang Liang (1): net: fix memory leak in tcp_conn_request() Willem de Bruijn (1): net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets Xiao Liang (1): net: Fix netns for ip_tunnel_init_flow() Xin Li (2): x86/ptrace: Cleanup the definition of the pt_regs structure x86/ptrace: Add FRED additional information to the pt_regs structure Xin Li (Intel) (1): x86/fred: Clear WFE in missing-ENDBRANCH #CPs Xu Yang (2): usb: chipidea: add CI_HDRC_HAS_SHORT_PKT_LIMIT flag usb: chipidea: udc: limit usb request length to max 16KB Yafang Shao (1): mm/readahead: fix large folio support in async readahead Yicong Yang (1): ACPI/IORT: Add PMCG platform information for HiSilicon HIP10/11 Yihang Li (5): scsi: hisi_sas: Directly call register snapshot instead of using workqueue scsi: hisi_sas: Allocate DFX memory during dump trigger scsi: hisi_sas: Create all dump files during debugfs initialization scsi: hisi_sas: Fix a deadlock issue related to automatic dump scsi: hisi_sas: Remove redundant checks for automatic debugfs dump wenglianfa (1): RDMA/hns: Fix mapping error of zero-hop WQE buffer

5 months, 3 weeks

2
4
0 0

[PATCH] brcmfmac: NULL pointer dereference on tx statistic update

by Marcel Hamer

On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequence deletes the interface: brcmf_detach() brcmf_remove_interface() brcmf_del_if() Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches. After brcmf_remove_interface() call the brcmf_proto_detach() function is called providing the following sequence: brcmf_detach() brcmf_proto_detach() brcmf_proto_msgbuf_detach() brcmf_flowring_detach() brcmf_msgbuf_delete_flowring() brcmf_msgbuf_remove_flowring() brcmf_flowring_delete() brcmf_get_ifp() brcmf_txfinalize() Since brcmf_get_ip() can and actually will return NULL in this case the call to brcmf_txfinalize() will result in a NULL pointer dereference inside brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors. This will only happen if a flowring still has an skb. Cc: stable(a)vger.kernel.org Signed-off-by: Marcel Hamer <marcel.hamer(a)windriver.com> Link: https://lore.kernel.org/all/b519e746-ddfd-421f-d897-7620d229e4b2@gmail.com/ --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c index c3a57e30c855..cf731bc7ae24 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c @@ -549,7 +549,7 @@ void brcmf_txfinalize(struct brcmf_if *ifp, struct sk_buff *txp, bool success) wake_up(&ifp->pend_8021x_wait); } - if (!success) + if (!success && ifp) ifp->ndev->stats.tx_errors++; brcmu_pkt_buf_free_skb(txp); -- 2.34.1

5 months, 3 weeks

2
2
0 0

Linux 6.6.71

by Greg Kroah-Hartman

I'm announcing the release of the 6.6.71 kernel. It's only needed if you could not properly build 6.6.70 as there is a configuration that is pretty common that would fail to build properly. That is now resolved. If you did not have a problem building 6.6.70, no need to upgrade at this point in time. The updated 6.6.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 +- arch/x86/kernel/Makefile | 4 ++-- arch/x86/kernel/cpu/mshyperv.c | 10 ++-------- arch/x86/kernel/kexec-bzimage64.c | 4 ---- arch/x86/kernel/kvm.c | 4 ++-- arch/x86/kernel/machine_kexec_64.c | 3 --- arch/x86/kernel/reboot.c | 4 ++-- arch/x86/kernel/setup.c | 2 +- arch/x86/kernel/smp.c | 2 +- arch/x86/xen/enlighten_hvm.c | 4 ---- arch/x86/xen/mmu_pv.c | 2 +- 11 files changed, 12 insertions(+), 29 deletions(-) Greg Kroah-Hartman (3): Revert "x86/hyperv: Fix hv tsc page based sched_clock for hibernation" Revert "x86, crash: wrap crash dumping code into crash related ifdefs" Linux 6.6.71 Naman Jain (1): x86/hyperv: Fix hv tsc page based sched_clock for hibernation

5 months, 3 weeks

1
1
0 0

[PATCH net v2 4/5] vsock: reset socket state when de-assigning the transport

by Stefano Garzarella

Transport's release() and destruct() are called when de-assigning the vsock transport. These callbacks can touch some socket state like sock flags, sk_state, and peer_shutdown. Since we are reassigning the socket to a new transport during vsock_connect(), let's reset these fields to have a clean state with the new transport. Fixes: c0cfa2d8a788 ("vsock: add multi-transports support") Cc: stable(a)vger.kernel.org Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> --- net/vmw_vsock/af_vsock.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c index 5cf8109f672a..74d35a871644 100644 --- a/net/vmw_vsock/af_vsock.c +++ b/net/vmw_vsock/af_vsock.c @@ -491,6 +491,15 @@ int vsock_assign_transport(struct vsock_sock *vsk, struct vsock_sock *psk) */ vsk->transport->release(vsk); vsock_deassign_transport(vsk); + + /* transport's release() and destruct() can touch some socket + * state, since we are reassigning the socket to a new transport + * during vsock_connect(), let's reset these fields to have a + * clean state. + */ + sock_reset_flag(sk, SOCK_DONE); + sk->sk_state = TCP_CLOSE; + vsk->peer_shutdown = 0; } /* We increase the module refcnt to prevent the transport unloading -- 2.47.1

5 months, 3 weeks

2
2
0 0

[PATCH v2] samples/landlock: Fix possible NULL dereference in parse_path()

by Gax-c

From: Zichen Xie <zichenxie0106(a)gmail.com> malloc() may return NULL, leading to NULL dereference. Add a NULL check. Fixes: ba84b0bf5a16 ("samples/landlock: Add a sandbox manager example") Signed-off-by: Zichen Xie <zichenxie0106(a)gmail.com> Cc: stable(a)vger.kernel.org --- v2: Modify logic & Add Fixes tag. --- samples/landlock/sandboxer.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/samples/landlock/sandboxer.c b/samples/landlock/sandboxer.c index 57565dfd74a2..ef2a34173d84 100644 --- a/samples/landlock/sandboxer.c +++ b/samples/landlock/sandboxer.c @@ -91,6 +91,9 @@ static int parse_path(char *env_path, const char ***const path_list) } } *path_list = malloc(num_paths * sizeof(**path_list)); + if (*path_list == NULL) + return -1; + for (i = 0; i < num_paths; i++) (*path_list)[i] = strsep(&env_path, ENV_DELIMITER); @@ -127,6 +130,11 @@ static int populate_ruleset_fs(const char *const env_var, const int ruleset_fd, env_path_name = strdup(env_path_name); unsetenv(env_var); num_paths = parse_path(env_path_name, &path_list); + if (num_paths == -1) { + fprintf(stderr, "Failed to allocate memory\n"); + ret = 1; + goto out_free_name; + } if (num_paths == 1 && path_list[0][0] == '\0') { /* * Allows to not use all possible restrictions (e.g. use -- 2.34.1

5 months, 3 weeks

2
1
0 0

[PATCH] drm/sched: Remove job submit/free race when using unordered workqueues

by Tvrtko Ursulin

After commit f7fe64ad0f22 ("drm/sched: Split free_job into own work item") and with drivers who use the unordered workqueue sched_jobs can be freed in parallel as soon as the complete_all(&entity->entity_idle) is called. This makes all dereferencing in the lower part of the worker unsafe so lets fix it by moving the complete_all() call to after the worker is done touching the job. Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin(a)igalia.com> Fixes: f7fe64ad0f22 ("drm/sched: Split free_job into own work item") Cc: Christian König <christian.koenig(a)amd.com> Cc: Danilo Krummrich <dakr(a)redhat.com> Cc: Matthew Brost <matthew.brost(a)intel.com> Cc: Philipp Stanner <pstanner(a)redhat.com> Cc: <stable(a)vger.kernel.org> # v6.8+ --- drivers/gpu/drm/scheduler/sched_main.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/gpu/drm/scheduler/sched_main.c b/drivers/gpu/drm/scheduler/sched_main.c index 57da84908752..f0d02c061c23 100644 --- a/drivers/gpu/drm/scheduler/sched_main.c +++ b/drivers/gpu/drm/scheduler/sched_main.c @@ -1188,7 +1188,6 @@ static void drm_sched_run_job_work(struct work_struct *w) container_of(w, struct drm_gpu_scheduler, work_run_job); struct drm_sched_entity *entity; struct dma_fence *fence; - struct drm_sched_fence *s_fence; struct drm_sched_job *sched_job; int r; @@ -1207,15 +1206,12 @@ static void drm_sched_run_job_work(struct work_struct *w) return; } - s_fence = sched_job->s_fence; - atomic_add(sched_job->credits, &sched->credit_count); drm_sched_job_begin(sched_job); trace_drm_run_job(sched_job, entity); fence = sched->ops->run_job(sched_job); - complete_all(&entity->entity_idle); - drm_sched_fence_scheduled(s_fence, fence); + drm_sched_fence_scheduled(sched_job->s_fence, fence); if (!IS_ERR_OR_NULL(fence)) { /* Drop for original kref_init of the fence */ @@ -1232,6 +1228,7 @@ static void drm_sched_run_job_work(struct work_struct *w) PTR_ERR(fence) : 0); } + complete_all(&entity->entity_idle); wake_up(&sched->job_scheduled); drm_sched_run_job_queue(sched); } -- 2.47.1

5 months, 3 weeks

1
0
0 0

[PATCH 1/2] Revert "drm/meson: vclk: fix calculation of 59.94 fractional rates"

by Christian Hewitt

This reverts commit bfbc68e4d8695497f858a45a142665e22a512ea3. The patch does permit the offending YUV420 @ 59.94 phy_freq and vclk_freq mode to match in calculations. It also results in all fractional rates being unavailable for use. This was unintended and requires the patch to be reverted. Cc: <stable(a)vger.kernel.org> Signed-off-by: Christian Hewitt <christianshewitt(a)gmail.com> --- drivers/gpu/drm/meson/meson_vclk.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/meson/meson_vclk.c b/drivers/gpu/drm/meson/meson_vclk.c index 2a942dc6a6dc..2a82119eb58e 100644 --- a/drivers/gpu/drm/meson/meson_vclk.c +++ b/drivers/gpu/drm/meson/meson_vclk.c @@ -790,13 +790,13 @@ meson_vclk_vic_supported_freq(struct meson_drm *priv, unsigned int phy_freq, FREQ_1000_1001(params[i].pixel_freq)); DRM_DEBUG_DRIVER("i = %d phy_freq = %d alt = %d\n", i, params[i].phy_freq, - FREQ_1000_1001(params[i].phy_freq/1000)*1000); + FREQ_1000_1001(params[i].phy_freq/10)*10); /* Match strict frequency */ if (phy_freq == params[i].phy_freq && vclk_freq == params[i].vclk_freq) return MODE_OK; /* Match 1000/1001 variant */ - if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/1000)*1000) && + if (phy_freq == (FREQ_1000_1001(params[i].phy_freq/10)*10) && vclk_freq == FREQ_1000_1001(params[i].vclk_freq)) return MODE_OK; } @@ -1070,7 +1070,7 @@ void meson_vclk_setup(struct meson_drm *priv, unsigned int target, for (freq = 0 ; params[freq].pixel_freq ; ++freq) { if ((phy_freq == params[freq].phy_freq || - phy_freq == FREQ_1000_1001(params[freq].phy_freq/1000)*1000) && + phy_freq == FREQ_1000_1001(params[freq].phy_freq/10)*10) && (vclk_freq == params[freq].vclk_freq || vclk_freq == FREQ_1000_1001(params[freq].vclk_freq))) { if (vclk_freq != params[freq].vclk_freq) -- 2.34.1

5 months, 3 weeks

2
1
0 0

[PATCH net v2 2/5] vsock/bpf: return early if transport is not assigned

by Stefano Garzarella

Some of the core functions can only be called if the transport has been assigned. As Michal reported, a socket might have the transport at NULL, for example after a failed connect(), causing the following trace: BUG: kernel NULL pointer dereference, address: 00000000000000a0 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 12faf8067 P4D 12faf8067 PUD 113670067 PMD 0 Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 15 UID: 0 PID: 1198 Comm: a.out Not tainted 6.13.0-rc2+ RIP: 0010:vsock_connectible_has_data+0x1f/0x40 Call Trace: vsock_bpf_recvmsg+0xca/0x5e0 sock_recvmsg+0xb9/0xc0 __sys_recvfrom+0xb3/0x130 __x64_sys_recvfrom+0x20/0x30 do_syscall_64+0x93/0x180 entry_SYSCALL_64_after_hwframe+0x76/0x7e So we need to check the `vsk->transport` in vsock_bpf_recvmsg(), especially for connected sockets (stream/seqpacket) as we already do in __vsock_connectible_recvmsg(). Fixes: 634f1a7110b4 ("vsock: support sockmap") Cc: stable(a)vger.kernel.org Reported-by: Michal Luczaj <mhal(a)rbox.co> Closes: https://lore.kernel.org/netdev/5ca20d4c-1017-49c2-9516-f6f75fd331e9@rbox.co/ Tested-by: Michal Luczaj <mhal(a)rbox.co> Reported-by: syzbot+3affdbfc986ecd9200fd(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/677f84a8.050a0220.25a300.01b3.GAE@google.com/ Tested-by: syzbot+3affdbfc986ecd9200fd(a)syzkaller.appspotmail.com Reviewed-by: Hyunwoo Kim <v4bel(a)theori.io> Acked-by: Michael S. Tsirkin <mst(a)redhat.com> Reviewed-by: Luigi Leonardi <leonardi(a)redhat.com> Signed-off-by: Stefano Garzarella <sgarzare(a)redhat.com> --- net/vmw_vsock/vsock_bpf.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/vmw_vsock/vsock_bpf.c b/net/vmw_vsock/vsock_bpf.c index 4aa6e74ec295..f201d9eca1df 100644 --- a/net/vmw_vsock/vsock_bpf.c +++ b/net/vmw_vsock/vsock_bpf.c @@ -77,6 +77,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int flags, int *addr_len) { struct sk_psock *psock; + struct vsock_sock *vsk; int copied; psock = sk_psock_get(sk); @@ -84,6 +85,13 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, return __vsock_recvmsg(sk, msg, len, flags); lock_sock(sk); + vsk = vsock_sk(sk); + + if (!vsk->transport) { + copied = -ENODEV; + goto out; + } + if (vsock_has_data(sk, psock) && sk_psock_queue_empty(psock)) { release_sock(sk); sk_psock_put(sk, psock); @@ -108,6 +116,7 @@ static int vsock_bpf_recvmsg(struct sock *sk, struct msghdr *msg, copied = sk_msg_recvmsg(sk, psock, msg, len, flags); } +out: release_sock(sk); sk_psock_put(sk, psock); -- 2.47.1

5 months, 3 weeks

1
0
0 0

[PATCH 5.10 000/138] 5.10.233-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.233 release. There are 138 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 08 Jan 2025 15:11:04 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.233-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.233-rc1 Seiji Nishikawa <snishika(a)redhat.com> mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() Biju Das <biju.das.jz(a)bp.renesas.com> drm: adv7511: Drop dsi single lane support Nikolay Kuratov <kniv(a)yandex-team.ru> net/sctp: Prevent autoclose integer overflow in sctp_association_init() Pascal Hambourg <pascal(a)plouf.fr.eu.org> sky2: Add device ID 11ab:4373 for Marvell 88E8075 Evgenii Shatokhin <e.shatokhin(a)yadro.com> pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking Dan Carpenter <dan.carpenter(a)linaro.org> RDMA/uverbs: Prevent integer overflow issue Masahiro Yamada <masahiroy(a)kernel.org> modpost: fix the missed iteration for the max bit in do_input() Masahiro Yamada <masahiroy(a)kernel.org> modpost: fix input MODULE_DEVICE_TABLE() built for 64-bit on 32-bit host Zygo Blaxell <ce3g8jdj(a)umail.furryterror.org> btrfs: don't set lock_owner when locking extent buffer for reading Josef Bacik <josef(a)toxicpanda.com> btrfs: locking: remove the recursion handling code Leon Romanovsky <leon(a)kernel.org> ARC: build: Try to guess GCC variant of cross compiler Uros Bizjak <ubizjak(a)gmail.com> irqchip/gic: Correct declaration of *percpu_base pointer in union gic_base Daniele Palmas <dnlplm(a)gmail.com> net: usb: qmi_wwan: add Telit FE910C04 compositions Anton Protopopov <aspsk(a)isovalent.com> bpf: fix potential error return Adrian Ratiu <adrian.ratiu(a)collabora.com> sound: usb: format: don't warn that raw DSD is unsupported Filipe Manana <fdmanana(a)suse.com> btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount Emmanuel Grumbach <emmanuel.grumbach(a)intel.com> wifi: mac80211: wake the queues in case of failure in resume Lizhi Xu <lizhi.xu(a)windriver.com> tracing: Prevent bad count for tracing_cpumask_write Tetsuo Handa <penguin-kernel(a)I-love.SAKURA.ne.jp> kernel: Initialize cpumask before parsing Filipe Manana <fdmanana(a)suse.com> btrfs: fix use-after-free when COWing tree bock and tracing is enabled Filipe Manana <fdmanana(a)suse.com> btrfs: rename and export __btrfs_cow_block() Josef Bacik <josef(a)toxicpanda.com> btrfs: locking: remove all the blocking helpers Josef Bacik <josef(a)toxicpanda.com> btrfs: switch extent buffer tree lock to rw_semaphore Andy Shevchenko <andriy.shevchenko(a)linux.intel.com> dmaengine: dw: Select only supported masters for ACPI devices Eric Dumazet <edumazet(a)google.com> ila: serialize calls to nf_register_net_hooks() Eric Dumazet <edumazet(a)google.com> af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Eric Dumazet <edumazet(a)google.com> af_packet: fix vlan_get_tci() vs MSG_PEEK Li Zhijian <lizhijian(a)fujitsu.com> RDMA/rtrs: Ensure 'ib_sge list' is accessible Vitalii Mordan <mordan(a)ispras.ru> eth: bcmsysport: fix call balance of priv->clk handling routines Tanya Agarwal <tanyaagarwal25699(a)gmail.com> ALSA: usb-audio: US16x08: Initialize array before use Antonio Pastor <antonio.pastor(a)gmail.com> net: llc: reset skb->transport_header Pablo Neira Ayuso <pablo(a)netfilter.org> netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext Ilya Shchipletsov <rabbelkin(a)mail.ru> netrom: check buffer length before accessing it Stefan Ekenberg <stefan.ekenberg(a)axis.com> drm/bridge: adv7511_audio: Update Audio InfoFrame properly Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Fix the locking while accessing the QP table Selvin Xavier <selvin.xavier(a)broadcom.com> RDMA/bnxt_re: Fix max_qp_wrs reported Kalesh AP <kalesh-anakkur.purayil(a)broadcom.com> RDMA/bnxt_re: Fix reporting hw_ver in query_device Saravanan Vajravel <saravanan.vajravel(a)broadcom.com> RDMA/bnxt_re: Add check for path mtu in modify_qp Patrisious Haddad <phaddad(a)nvidia.com> RDMA/mlx5: Enforce same type port association for multiport RoCE Parav Pandit <parav(a)nvidia.com> net/mlx5: Make API mlx5_core_is_ecpf accept const pointer Kairui Song <kasong(a)tencent.com> zram: fix uninitialized ZRAM not releasing backing device Sergey Senozhatsky <senozhatsky(a)chromium.org> drivers/block/zram/zram_drv.c: do not keep dangling zcomp pointer after zram reset Christoph Hellwig <hch(a)lst.de> zram: use set_capacity_and_notify Christoph Hellwig <hch(a)lst.de> block: remove the update_bdev parameter to set_capacity_revalidate_and_notify Christoph Hellwig <hch(a)lst.de> sd: update the bdev size in sd_revalidate_disk Christoph Hellwig <hch(a)lst.de> nvme: let set_capacity_revalidate_and_notify update the bdev size Christoph Hellwig <hch(a)lst.de> loop: let set_capacity_revalidate_and_notify update the bdev size Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Add support for Intel Panther Lake-M/P Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Add support for Intel Lunar Lake Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Add Intel Barlow Ridge PCI ID Mika Westerberg <mika.westerberg(a)linux.intel.com> thunderbolt: Add support for Intel Meteor Lake George D Sworo <george.d.sworo(a)intel.com> thunderbolt: Add support for Intel Raptor Lake Azhar Shaikh <azhar.shaikh(a)intel.com> thunderbolt: Add support for Intel Alder Lake Thiébaud Weksteen <tweek(a)google.com> selinux: ignore unknown extended permissions Naman Jain <namjain(a)linux.microsoft.com> x86/hyperv: Fix hv tsc page based sched_clock for hibernation Eric Dumazet <edumazet(a)google.com> ipv6: prevent possible UAF in ip6_xmit() Vasily Averin <vvs(a)virtuozzo.com> skb_expand_head() adjust skb->truesize incorrectly Yang Erkun <yangerkun(a)huaweicloud.com> nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net Filipe Manana <fdmanana(a)suse.com> btrfs: avoid monopolizing a core when activating a swap file Dimitri Fedrau <dimitri.fedrau(a)liebherr.com> power: supply: gpio-charger: Fix set charge current limits Christian Göttsche <cgzones(a)googlemail.com> tracing: Constify string literal data member in struct trace_event_call Catalin Marinas <catalin.marinas(a)arm.com> arm64: Ensure bits ASID[15:8] are masked out when the kernel uses 8-bit ASIDs Yunfeng Ye <yeyunfeng(a)huawei.com> arm64: mm: Rename asid2idx() to ctxid2asid() Imre Deak <imre.deak(a)intel.com> drm/dp_mst: Fix MST sideband message body length check Jiayuan Chen <mrpre(a)163.com> bpf: fix recursive lock when verdict program return SK_PASS Hou Tao <houtao1(a)huawei.com> bpf: Check validity of link->type in bpf_link_show_fdinfo() Eric Dumazet <edumazet(a)google.com> ipv6: fix possible UAF in ip6_finish_output2() Vasily Averin <vvs(a)virtuozzo.com> ipv6: use skb_expand_head in ip6_xmit Vasily Averin <vvs(a)virtuozzo.com> ipv6: use skb_expand_head in ip6_finish_output2 Vasily Averin <vvs(a)virtuozzo.com> skbuff: introduce skb_expand_head() Jiaxun Yang <jiaxun.yang(a)flygoat.com> MIPS: Probe toolchain support of -msym32 Ming Lei <ming.lei(a)redhat.com> virtio-blk: don't keep queue frozen during system suspend Cathy Avery <cavery(a)redhat.com> scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error Ranjan Kumar <ranjan.kumar(a)broadcom.com> scsi: mpt3sas: Diag-Reset when Doorbell-In-Use bit is set during driver load time Armin Wolf <W_Armin(a)gmx.de> platform/x86: asus-nb-wmi: Ignore unknown event 0xCF Mark Brown <broonie(a)kernel.org> regmap: Use correct format specifier for logging range errors bo liu <bo.liu(a)senarytech.com> ALSA: hda/conexant: fix Z60MR100 startup pop issue Tomas Henzl <thenzl(a)redhat.com> scsi: megaraid_sas: Fix for a potential deadlock Magnus Lindholm <linmag7(a)gmail.com> scsi: qla1280: Fix hw revision numbering for ISP1020/1040 James Hilliard <james.hilliard1(a)gmail.com> watchdog: it87_wdt: add PWRGD enable quirk for Qotom QCML04 Masami Hiramatsu (Google) <mhiramat(a)kernel.org> tracing/kprobe: Make trace_kprobe's module callback called after jump_label update Dan Carpenter <dan.carpenter(a)linaro.org> mtd: rawnand: fix double free in atmel_pmecc_create_user() Chen Ridong <chenridong(a)huawei.com> dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset Javier Carrasco <javier.carrasco.cruz(a)gmail.com> dmaengine: mv_xor: fix child node refcount handling in early exit Zijun Hu <quic_zijuhu(a)quicinc.com> phy: core: Fix that API devm_phy_destroy() fails to destroy the phy Zijun Hu <quic_zijuhu(a)quicinc.com> phy: core: Fix that API devm_of_phy_provider_unregister() fails to unregister the phy provider Zijun Hu <quic_zijuhu(a)quicinc.com> phy: core: Fix that API devm_phy_put() fails to release the phy Zijun Hu <quic_zijuhu(a)quicinc.com> phy: core: Fix an OF node refcount leakage in of_phy_provider_lookup() Zijun Hu <quic_zijuhu(a)quicinc.com> phy: core: Fix an OF node refcount leakage in _of_phy_get() Zichen Xie <zichenxie0106(a)gmail.com> mtd: diskonchip: Cast an operand to prevent potential overflow NeilBrown <neilb(a)suse.de> nfsd: restore callback functionality for NFSv4.0 Cong Wang <cong.wang(a)bytedance.com> bpf: Check negative offsets in __bpf_skb_min_len() Cong Wang <cong.wang(a)bytedance.com> tcp_bpf: Charge receive socket buffer in bpf_tcp_ingress() Bart Van Assche <bvanassche(a)acm.org> mm/vmstat: fix a W=1 clang compiler warning Nikita Zhandarovich <n.zhandarovich(a)fintech.ru> media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Xuewen Yan <xuewen.yan(a)unisoc.com> epoll: Add synchronous wakeup support for ep_poll_callback Ilya Dryomov <idryomov(a)gmail.com> ceph: validate snapdirname option length when mounting Zijun Hu <quic_zijuhu(a)quicinc.com> of: Fix refcount leakage for OF node returned by __of_get_dma_parent() Herve Codina <herve.codina(a)bootlin.com> of: Fix error path in of_parse_phandle_with_args_map() Jann Horn <jannh(a)google.com> udmabuf: also check for F_SEAL_FUTURE_WRITE Edward Adam Davis <eadavis(a)qq.com> nilfs2: prevent use of deleted inode Zijun Hu <quic_zijuhu(a)quicinc.com> of/irq: Fix using uninitialized variable @addr_len in API of_irq_parse_one() Trond Myklebust <trond.myklebust(a)hammerspace.com> NFS/pnfs: Fix a live lock between recalled layouts and layoutget Michael Kelley <mhklinux(a)outlook.com> Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet Qu Wenruo <wqu(a)suse.com> btrfs: tree-checker: reject inline extent items with 0 ref count Kairui Song <kasong(a)tencent.com> zram: refuse to use zero sized block device as backing device Geert Uytterhoeven <geert+renesas(a)glider.be> sh: clk: Fix clk_enable() to return 0 on NULL clk Murad Masimov <m.masimov(a)maxima.ru> hwmon: (tmp513) Fix interpretation of values of Temperature Result and Limit Registers Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() Daniele Palmas <dnlplm(a)gmail.com> USB: serial: option: add Telit FE910C04 rmnet compositions Jack Wu <wojackbb(a)gmail.com> USB: serial: option: add MediaTek T7XX compositions Mank Wang <mank.wang(a)netprisma.com> USB: serial: option: add Netprisma LCUK54 modules for WWAN Ready Michal Hrusecky <michal.hrusecky(a)turris.com> USB: serial: option: add MeiG Smart SLM770A Daniel Swanemar <d.swanemar(a)gmail.com> USB: serial: option: add TCL IK512 MBIM & ECM James Bottomley <James.Bottomley(a)HansenPartnership.com> efivarfs: Fix error on non-existent file Geert Uytterhoeven <geert+renesas(a)glider.be> i2c: riic: Always round-up when calculating bus period Dan Carpenter <dan.carpenter(a)linaro.org> chelsio/chtls: prevent potential integer overflow on 32bit Prathamesh Shete <pshete(a)nvidia.com> mmc: sdhci-tegra: Remove SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC quirk Phil Sutter <phil(a)nwl.cc> netfilter: ipset: Fix for recursive locking warning Joe Hattori <joe(a)pf.is.s.u-tokyo.ac.jp> net: ethernet: bgmac-platform: fix an OF node reference leak Dan Carpenter <dan.carpenter(a)linaro.org> net: hinic: Fix cleanup in create_rxqs/txqs() Shannon Nelson <shannon.nelson(a)amd.com> ionic: use ee->offset when returning sprom data Eric Dumazet <edumazet(a)google.com> netdevsim: prevent bad user input in nsim_dev_health_break_write() Wei Yongjun <weiyongjun1(a)huawei.com> netdevsim: switch to memdup_user_nul() Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: check return value of sock_recvmsg when draining clc data Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg Guangguan Wang <guangguan.wang(a)linux.alibaba.com> net/smc: check sndbuf_space again after NOSPACE flag is set in smc_poll Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix incorrect symlink detection in fast symlink Gao Xiang <hsiangkao(a)linux.alibaba.com> erofs: fix order >= MAX_ORDER warning due to crafted negative i_size Vladimir Riabchun <ferr.lambarginio(a)gmail.com> i2c: pnx: Fix timeout in wait functions Peng Hongchi <hongchi.peng(a)siengine.com> usb: dwc2: gadget: Don't write invalid mapped sg entries into dma_desc with iommu enabled Roger Quadros <rogerq(a)kernel.org> usb: cdns3: Add quirk flag to enable suspend residency Ajit Khaparde <ajit.khaparde(a)broadcom.com> PCI: Add ACS quirk for Broadcom BCM5760X NIC Takashi Iwai <tiwai(a)suse.de> ALSA: usb: Fix UBSAN warning in parse_audio_unit() Jiaxun Yang <jiaxun.yang(a)flygoat.com> MIPS: Loongson64: DTS: Fix msi node for ls7a Vidya Sagar <vidyas(a)nvidia.com> PCI: Use preserve_config in place of pci_flags Kai-Heng Feng <kai.heng.feng(a)canonical.com> PCI/AER: Disable AER service on suspend Lion Ackermann <nnamrec(a)gmail.com> net: sched: fix ordering of qlen adjustment ------------- Diffstat: Makefile | 4 +- arch/arc/Makefile | 2 +- arch/arm64/mm/context.c | 22 +- arch/mips/Makefile | 2 +- .../boot/dts/loongson/loongson64g_4core_ls7a.dts | 1 + arch/x86/kernel/cpu/mshyperv.c | 58 +++ block/genhd.c | 13 +- drivers/base/regmap/regmap.c | 4 +- drivers/block/loop.c | 8 +- drivers/block/virtio_blk.c | 9 +- drivers/block/xen-blkfront.c | 2 +- drivers/block/zram/zram_drv.c | 35 +- drivers/clocksource/hyperv_timer.c | 14 +- drivers/dma-buf/udmabuf.c | 2 +- drivers/dma/at_xdmac.c | 2 + drivers/dma/dw/acpi.c | 6 +- drivers/dma/dw/internal.h | 6 + drivers/dma/dw/pci.c | 4 +- drivers/dma/mv_xor.c | 2 + drivers/gpu/drm/bridge/adv7511/adv7511_audio.c | 14 +- drivers/gpu/drm/bridge/adv7511/adv7533.c | 2 +- drivers/gpu/drm/drm_dp_mst_topology.c | 3 + drivers/gpu/drm/drm_modes.c | 11 +- drivers/hv/hv_kvp.c | 6 + drivers/hv/hv_snapshot.c | 6 + drivers/hv/hv_util.c | 9 + drivers/hv/hyperv_vmbus.h | 2 + drivers/hwmon/tmp513.c | 2 +- drivers/i2c/busses/i2c-pnx.c | 4 +- drivers/i2c/busses/i2c-riic.c | 2 +- drivers/infiniband/core/uverbs_cmd.c | 16 +- drivers/infiniband/hw/bnxt_re/ib_verbs.c | 28 +- drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 + drivers/infiniband/hw/bnxt_re/qplib_sp.c | 2 +- drivers/infiniband/hw/mlx5/main.c | 6 +- drivers/infiniband/ulp/rtrs/rtrs-srv.c | 2 +- drivers/irqchip/irq-gic.c | 2 +- drivers/media/dvb-frontends/dib3000mb.c | 2 +- drivers/mmc/host/sdhci-tegra.c | 1 - drivers/mtd/nand/raw/atmel/pmecc.c | 4 +- drivers/mtd/nand/raw/diskonchip.c | 2 +- drivers/net/ethernet/broadcom/bcmsysport.c | 21 +- drivers/net/ethernet/broadcom/bgmac-platform.c | 5 +- .../chelsio/inline_crypto/chtls/chtls_main.c | 5 +- drivers/net/ethernet/huawei/hinic/hinic_main.c | 2 + drivers/net/ethernet/marvell/sky2.c | 1 + .../net/ethernet/pensando/ionic/ionic_ethtool.c | 4 +- drivers/net/netdevsim/health.c | 13 +- drivers/net/usb/qmi_wwan.c | 3 + drivers/nvme/host/core.c | 5 +- drivers/of/address.c | 2 +- drivers/of/base.c | 15 +- drivers/of/irq.c | 1 + drivers/pci/controller/pci-host-common.c | 4 - drivers/pci/pcie/aer.c | 18 + drivers/pci/probe.c | 22 +- drivers/pci/quirks.c | 4 + drivers/phy/phy-core.c | 21 +- drivers/pinctrl/pinctrl-mcp23s08.c | 6 + drivers/platform/x86/asus-nb-wmi.c | 1 + drivers/power/supply/gpio-charger.c | 8 + drivers/scsi/megaraid/megaraid_sas_base.c | 5 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 7 +- drivers/scsi/qla1280.h | 12 +- drivers/scsi/sd.c | 9 +- drivers/scsi/storvsc_drv.c | 7 +- drivers/sh/clk/core.c | 2 +- drivers/thunderbolt/icm.c | 7 + drivers/thunderbolt/nhi.c | 28 ++ drivers/thunderbolt/nhi.h | 15 + drivers/usb/cdns3/core.h | 1 + drivers/usb/cdns3/drd.c | 10 +- drivers/usb/cdns3/drd.h | 3 + drivers/usb/dwc2/gadget.c | 4 +- drivers/usb/serial/option.c | 27 ++ drivers/watchdog/it87_wdt.c | 39 ++ fs/btrfs/backref.c | 10 +- fs/btrfs/ctree.c | 128 ++---- fs/btrfs/ctree.h | 7 + fs/btrfs/delayed-inode.c | 7 - fs/btrfs/disk-io.c | 17 +- fs/btrfs/extent-tree.c | 19 +- fs/btrfs/extent_io.c | 13 +- fs/btrfs/extent_io.h | 21 +- fs/btrfs/file.c | 3 +- fs/btrfs/inode.c | 3 +- fs/btrfs/locking.c | 447 ++------------------- fs/btrfs/locking.h | 13 +- fs/btrfs/print-tree.c | 11 +- fs/btrfs/qgroup.c | 9 +- fs/btrfs/ref-verify.c | 6 +- fs/btrfs/relocation.c | 4 - fs/btrfs/transaction.c | 2 - fs/btrfs/tree-checker.c | 27 +- fs/btrfs/tree-defrag.c | 1 - fs/btrfs/tree-log.c | 3 - fs/ceph/super.c | 2 + fs/efivarfs/inode.c | 2 +- fs/efivarfs/internal.h | 1 - fs/efivarfs/super.c | 3 - fs/erofs/inode.c | 20 +- fs/eventpoll.c | 5 +- fs/nfs/pnfs.c | 2 +- fs/nfsd/nfs4callback.c | 4 +- fs/nfsd/nfs4state.c | 2 +- fs/nilfs2/inode.c | 8 +- fs/nilfs2/namei.c | 5 + include/clocksource/hyperv_timer.h | 2 + include/linux/genhd.h | 3 +- include/linux/hyperv.h | 1 + include/linux/if_vlan.h | 16 +- include/linux/mlx5/driver.h | 8 +- include/linux/skbuff.h | 1 + include/linux/trace_events.h | 2 +- include/linux/vmstat.h | 2 +- include/linux/wait.h | 1 + include/net/netfilter/nf_tables.h | 7 +- include/net/sock.h | 10 +- kernel/bpf/core.c | 6 +- kernel/bpf/syscall.c | 13 +- kernel/irq/proc.c | 4 +- kernel/profile.c | 2 +- kernel/trace/trace.c | 5 +- kernel/trace/trace_kprobe.c | 2 +- mm/vmscan.c | 9 +- net/core/filter.c | 21 +- net/core/skbuff.c | 52 +++ net/core/skmsg.c | 4 +- net/ipv4/tcp_bpf.c | 2 +- net/ipv6/ila/ila_xlat.c | 16 +- net/ipv6/ip6_output.c | 86 ++-- net/llc/llc_input.c | 2 +- net/mac80211/util.c | 3 + net/netfilter/ipset/ip_set_list_set.c | 3 + net/netrom/nr_route.c | 6 + net/packet/af_packet.c | 28 +- net/sched/sch_cake.c | 2 +- net/sched/sch_choke.c | 2 +- net/sctp/associola.c | 3 +- net/smc/af_smc.c | 13 +- net/smc/smc_clc.c | 9 + net/smc/smc_clc.h | 6 +- scripts/mod/file2alias.c | 4 +- security/selinux/ss/services.c | 8 +- sound/pci/hda/patch_conexant.c | 28 ++ sound/usb/format.c | 7 +- sound/usb/mixer.c | 7 + sound/usb/mixer_us16x08.c | 2 +- 148 files changed, 934 insertions(+), 940 deletions(-)

5 months, 3 weeks

11
155
0 0

[PATCH v3 05/10] btrfs: do proper folio cleanup when run_delalloc_nocow() failed

by Qu Wenruo

[BUG] With CONFIG_DEBUG_VM set, test case generic/476 has some chance to crash with the following VM_BUG_ON_FOLIO(): BTRFS error (device dm-3): cow_file_range failed, start 1146880 end 1253375 len 106496 ret -28 BTRFS error (device dm-3): run_delalloc_nocow failed, start 1146880 end 1253375 len 106496 ret -28 page: refcount:4 mapcount:0 mapping:00000000592787cc index:0x12 pfn:0x10664 aops:btrfs_aops [btrfs] ino:101 dentry name(?):"f1774" flags: 0x2fffff80004028(uptodate|lru|private|node=0|zone=2|lastcpupid=0xfffff) page dumped because: VM_BUG_ON_FOLIO(!folio_test_locked(folio)) ------------[ cut here ]------------ kernel BUG at mm/page-writeback.c:2992! Internal error: Oops - BUG: 00000000f2000800 [#1] SMP CPU: 2 UID: 0 PID: 3943513 Comm: kworker/u24:15 Tainted: G OE 6.12.0-rc7-custom+ #87 Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 Workqueue: events_unbound btrfs_async_reclaim_data_space [btrfs] pc : folio_clear_dirty_for_io+0x128/0x258 lr : folio_clear_dirty_for_io+0x128/0x258 Call trace: folio_clear_dirty_for_io+0x128/0x258 btrfs_folio_clamp_clear_dirty+0x80/0xd0 [btrfs] __process_folios_contig+0x154/0x268 [btrfs] extent_clear_unlock_delalloc+0x5c/0x80 [btrfs] run_delalloc_nocow+0x5f8/0x760 [btrfs] btrfs_run_delalloc_range+0xa8/0x220 [btrfs] writepage_delalloc+0x230/0x4c8 [btrfs] extent_writepage+0xb8/0x358 [btrfs] extent_write_cache_pages+0x21c/0x4e8 [btrfs] btrfs_writepages+0x94/0x150 [btrfs] do_writepages+0x74/0x190 filemap_fdatawrite_wbc+0x88/0xc8 start_delalloc_inodes+0x178/0x3a8 [btrfs] btrfs_start_delalloc_roots+0x174/0x280 [btrfs] shrink_delalloc+0x114/0x280 [btrfs] flush_space+0x250/0x2f8 [btrfs] btrfs_async_reclaim_data_space+0x180/0x228 [btrfs] process_one_work+0x164/0x408 worker_thread+0x25c/0x388 kthread+0x100/0x118 ret_from_fork+0x10/0x20 Code: 910a8021 a90363f7 a9046bf9 94012379 (d4210000) ---[ end trace 0000000000000000 ]--- [CAUSE] The first two lines of extra debug messages show the problem is caused by the error handling of run_delalloc_nocow(). E.g. we have the following dirtied range (4K blocksize 4K page size): 0 16K 32K |//////////////////////////////////////| | Pre-allocated | And the range [0, 16K) has a preallocated extent. - Enter run_delalloc_nocow() for range [0, 16K) Which found range [0, 16K) is preallocated, can do the proper NOCOW write. - Enter fallback_to_fow() for range [16K, 32K) Since the range [16K, 32K) is not backed by preallocated extent, we have to go COW. - cow_file_range() failed for range [16K, 32K) So cow_file_range() will do the clean up by clearing folio dirty, unlock the folios. Now the folios in range [16K, 32K) is unlocked. - Enter extent_clear_unlock_delalloc() from run_delalloc_nocow() Which is called with PAGE_START_WRITEBACK to start page writeback. But folios can only be marked writeback when it's properly locked, thus this triggered the VM_BUG_ON_FOLIO(). Furthermore there is another hidden but common bug that run_delalloc_nocow() is not clearing the folio dirty flags in its error handling path. This is the common bug shared between run_delalloc_nocow() and cow_file_range(). [FIX] - Clear folio dirty for range [@start, @cur_offset) Introduce a helper, cleanup_dirty_folios(), which will find and lock the folio in the range, clear the dirty flag and start/end the writeback, with the extra handling for the @locked_folio. - Introduce a helper to clear folio dirty, start and end writeback - Introduce a helper to record the last failed COW range end This is to trace which range we should skip, to avoid double unlocking. - Skip the failed COW range for the error handling Cc: stable(a)vger.kernel.org Reviewed-by: Boris Burkov <boris(a)bur.io> Signed-off-by: Qu Wenruo <wqu(a)suse.com> --- fs/btrfs/inode.c | 98 ++++++++++++++++++++++++++++++++++++++++++---- fs/btrfs/subpage.h | 13 ++++++ 2 files changed, 104 insertions(+), 7 deletions(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index 1afbeaf3cf4c..a450fc080ca3 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -1958,6 +1958,54 @@ static int can_nocow_file_extent(struct btrfs_path *path, return ret < 0 ? ret : can_nocow; } +/* + * To cleanup the dirty folios which will never be submitted due to + * error. + * + * When running a delalloc range, we may need to split the ranges (due to + * fragmentation or NOCOW limit). If we hit an error in the later part, + * we will error out and previously successfully executed range will never + * be submitted, thus we have to cleanup those folios by clear their + * dirty flag, start and finish the writeback. + */ +static void cleanup_dirty_folios(struct btrfs_inode *inode, + struct folio *locked_folio, + u64 start, u64 end, int error) +{ + struct btrfs_fs_info *fs_info = inode->root->fs_info; + struct address_space *mapping = inode->vfs_inode.i_mapping; + pgoff_t start_index = start >> PAGE_SHIFT; + pgoff_t end_index = end >> PAGE_SHIFT; + u32 len; + + ASSERT(end + 1 - start < U32_MAX); + ASSERT(IS_ALIGNED(start, fs_info->sectorsize) && + IS_ALIGNED(end + 1, fs_info->sectorsize)); + len = end + 1 - start; + + /* + * Handle the locked folio first. + * btrfs_folio_clamp_*() helpers can handle range out of the folio case. + */ + btrfs_folio_clamp_finish_io(fs_info, locked_folio, start, len); + + for (pgoff_t index = start_index; index <= end_index; index++) { + struct folio *folio; + + /* Already handled at the beginning. */ + if (index == locked_folio->index) + continue; + folio = __filemap_get_folio(mapping, index, FGP_LOCK, GFP_NOFS); + /* Cache already dropped, no need to do any cleanup. */ + if (IS_ERR(folio)) + continue; + btrfs_folio_clamp_finish_io(fs_info, locked_folio, start, len); + folio_unlock(folio); + folio_put(folio); + } + mapping_set_error(mapping, error); +} + /* * when nowcow writeback call back. This checks for snapshots or COW copies * of the extents that exist in the file, and COWs the file as required. @@ -1973,6 +2021,11 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, struct btrfs_root *root = inode->root; struct btrfs_path *path; u64 cow_start = (u64)-1; + /* + * If not 0, represents the inclusive end of the last fallback_to_cow() + * range. Only for error handling. + */ + u64 cow_end = 0; u64 cur_offset = start; int ret; bool check_prev = true; @@ -2133,6 +2186,7 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, found_key.offset - 1); cow_start = (u64)-1; if (ret) { + cow_end = found_key.offset - 1; btrfs_dec_nocow_writers(nocow_bg); goto error; } @@ -2206,11 +2260,12 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, cow_start = cur_offset; if (cow_start != (u64)-1) { - cur_offset = end; ret = fallback_to_cow(inode, locked_folio, cow_start, end); cow_start = (u64)-1; - if (ret) + if (ret) { + cow_end = end; goto error; + } } btrfs_free_path(path); @@ -2218,12 +2273,41 @@ static noinline int run_delalloc_nocow(struct btrfs_inode *inode, error: /* - * If an error happened while a COW region is outstanding, cur_offset - * needs to be reset to cow_start to ensure the COW region is unlocked - * as well. + * There are several error cases: + * + * 1) Failed without falling back to COW + * start cur_offset end + * |/////////////| | + * + * For range [start, cur_offset) the folios are already unlocked (except + * @locked_folio), EXTENT_DELALLOC already removed. + * Only need to clear the dirty flag as they will never be submitted. + * Ordered extent and extent maps are handled by + * btrfs_mark_ordered_io_finished() inside run_delalloc_range(). + * + * 2) Failed with error from fallback_to_cow() + * start cur_offset cow_end end + * |/////////////|-----------| | + * + * For range [start, cur_offset) it's the same as case 1). + * But for range [cur_offset, cow_end), the folios have dirty flag + * cleared and unlocked, EXTENT_DEALLLOC cleared by cow_file_range(). + * + * Thus we should not call extent_clear_unlock_delalloc() on range + * [cur_offset, cow_end), as the folios are already unlocked. + * + * So clear the folio dirty flags for [start, cur_offset) first. */ - if (cow_start != (u64)-1) - cur_offset = cow_start; + if (cur_offset > start) + cleanup_dirty_folios(inode, locked_folio, start, cur_offset - 1, ret); + + /* + * If an error happened while a COW region is outstanding, cur_offset + * needs to be reset to @cow_end + 1 to skip the COW range, as + * cow_file_range() will do the proper cleanup at error. + */ + if (cow_end) + cur_offset = cow_end + 1; /* * We need to lock the extent here because we're clearing DELALLOC and diff --git a/fs/btrfs/subpage.h b/fs/btrfs/subpage.h index 428fa9389fd4..44fff1f4eac4 100644 --- a/fs/btrfs/subpage.h +++ b/fs/btrfs/subpage.h @@ -137,6 +137,19 @@ DECLARE_BTRFS_SUBPAGE_OPS(writeback); DECLARE_BTRFS_SUBPAGE_OPS(ordered); DECLARE_BTRFS_SUBPAGE_OPS(checked); +/* + * Helper for error cleanup, where a folio will have its dirty flag cleared, + * with writeback started and finished. + */ +static inline void btrfs_folio_clamp_finish_io(struct btrfs_fs_info *fs_info, + struct folio *locked_folio, + u64 start, u32 len) +{ + btrfs_folio_clamp_clear_dirty(fs_info, locked_folio, start, len); + btrfs_folio_clamp_set_writeback(fs_info, locked_folio, start, len); + btrfs_folio_clamp_clear_writeback(fs_info, locked_folio, start, len); +} + bool btrfs_subpage_clear_and_test_dirty(const struct btrfs_fs_info *fs_info, struct folio *folio, u64 start, u32 len); -- 2.47.1

5 months, 3 weeks

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror January 2025