From: Theodore Ts'o tytso@mit.edu

commit 609d54441493c99f21c1823dfd66fa7f4c512ff4 upstream.

Google-Bug-Id: 114199369 Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Al Viro viro@zeniv.linux.org.uk Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/file.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/file.c +++ b/fs/file.c @@ -627,6 +627,7 @@ int __close_fd(struct files_struct *file fdt = files_fdtable(files); if (fd >= fdt->max_fds) goto out_unlock; + fd = array_index_nospec(fd, fdt->max_fds); file = fdt->fd[fd]; if (!file) goto out_unlock;

From: Eric Whitney enwlinux@gmail.com

commit c9f62c8b2dbf7240536c0cc9a4529397bb8bf38e upstream.

A significant number of xfstests can cause ext4 to log one or more warning messages when they are run on a test file system where the inline_data feature has been enabled. An example:

"EXT4-fs warning (device vdc): ext4_dirblock_csum_set:425: inode #16385: comm fsstress: No space for directory leaf checksum. Please run e2fsck -D."

The xfstests include: ext4/057, 058, and 307; generic/013, 051, 068, 070, 076, 078, 083, 232, 269, 270, 390, 461, 475, 476, 482, 579, 585, 589, 626, 631, and 650.

In this situation, the warning message indicates a bug in the code that performs the RENAME_WHITEOUT operation on a directory entry that has been stored inline. It doesn't detect that the directory is stored inline, and incorrectly attempts to compute a dirent block checksum on the whiteout inode when creating it. This attempt fails as a result of the integrity checking in get_dirent_tail (usually due to a failure to match the EXT4_FT_DIR_CSUM magic cookie), and the warning message is then emitted.

Fix this by simply collecting the inlined data state at the time the search for the source directory entry is performed. Existing code handles the rest, and this is sufficient to eliminate all spurious warning messages produced by the tests above. Go one step further and do the same in the code that resets the source directory entry in the event of failure. The inlined state should be present in the "old" struct, but given the possibility of a race there's no harm in taking a conservative approach and getting that information again since the directory entry is being reread anyway.

Fixes: b7ff91fd030d ("ext4: find old entry again if failed to rename whiteout") Cc: stable@kernel.org Signed-off-by: Eric Whitney enwlinux@gmail.com Reviewed-by: Jan Kara jack@suse.cz Link: https://lore.kernel.org/r/20230210173244.679890-1-enwlinux@gmail.com Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/namei.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)

--- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -1419,11 +1419,10 @@ static struct buffer_head *__ext4_find_e int has_inline_data = 1; ret = ext4_find_inline_entry(dir, fname, res_dir, &has_inline_data); - if (has_inline_data) { - if (inlined) - *inlined = 1; + if (inlined) + *inlined = has_inline_data; + if (has_inline_data) goto cleanup_and_exit; - } }

if ((namelen <= 2) && (name[0] == '.') && @@ -3515,7 +3514,8 @@ static void ext4_resetent(handle_t *hand * so the old->de may no longer valid and need to find it again * before reset old inode info. */ - old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL); + old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, + &old.inlined); if (IS_ERR(old.bh)) retval = PTR_ERR(old.bh); if (!old.bh) @@ -3677,7 +3677,8 @@ static int ext4_rename(struct inode *old return retval; }

- old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, NULL); + old.bh = ext4_find_entry(old.dir, &old.dentry->d_name, &old.de, + &old.inlined); if (IS_ERR(old.bh)) return PTR_ERR(old.bh); /*

From: Ye Bin yebin10@huawei.com

commit 1dcdce5919115a471bf4921a57f20050c545a236 upstream.

The only caller of ext4_find_inline_data_nolock() that needs setting of EXT4_STATE_MAY_INLINE_DATA flag is ext4_iget_extra_inode(). In ext4_write_inline_data_end() we just need to update inode->i_inline_off. Since we are going to add one more caller that does not need to set EXT4_STATE_MAY_INLINE_DATA, just move setting of EXT4_STATE_MAY_INLINE_DATA out to ext4_iget_extra_inode().

Signed-off-by: Ye Bin yebin10@huawei.com Cc: stable@kernel.org Reviewed-by: Jan Kara jack@suse.cz Link: https://lore.kernel.org/r/20230307015253.2232062-2-yebin@huaweicloud.com Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/inline.c | 1 - fs/ext4/inode.c | 7 ++++++- 2 files changed, 6 insertions(+), 2 deletions(-)

--- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -157,7 +157,6 @@ int ext4_find_inline_data_nolock(struct (void *)ext4_raw_inode(&is.iloc)); EXT4_I(inode)->i_inline_size = EXT4_MIN_INLINE_DATA_SIZE + le32_to_cpu(is.s.here->e_value_size); - ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); } out: brelse(is.iloc.bh); --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -4865,8 +4865,13 @@ static inline int ext4_iget_extra_inode(

if (EXT4_INODE_HAS_XATTR_SPACE(inode) && *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { + int err; + ext4_set_inode_state(inode, EXT4_STATE_XATTR); - return ext4_find_inline_data_nolock(inode); + err = ext4_find_inline_data_nolock(inode); + if (!err && ext4_has_inline_data(inode)) + ext4_set_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA); + return err; } else EXT4_I(inode)->i_inline_off = 0; return 0;

From: Zhihao Cheng chengzhihao1@huawei.com

commit f5361da1e60d54ec81346aee8e3d8baf1be0b762 upstream.

If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0. However, if the "never before used" boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning:

WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID: 2580 Comm: bb Not tainted 6.3.0-rc1-00004-g703695902cfa RIP: 0010:ext4_file_write_iter+0xbc7/0xd10 Call Trace: vfs_write+0x3b1/0x5c0 ksys_write+0x77/0x160 __x64_sys_write+0x22/0x30 do_syscall_64+0x39/0x80

Reproducer: 1. create corrupted image and mount it: mke2fs -t ext4 /tmp/foo.img 200 debugfs -wR "sif <5> size 25700" /tmp/foo.img mount -t ext4 /tmp/foo.img /mnt cd /mnt echo 123 > file 2. Run the reproducer program: posix_memalign(&buf, 1024, 1024) fd = open("file", O_RDWR | O_DIRECT); ioctl(fd, EXT4_IOC_SWAP_BOOT); write(fd, buf, 1024);

Fix this by setting i_disksize as well as i_size to zero when initiaizing the boot loader inode.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=217159 Cc: stable@kernel.org Signed-off-by: Zhihao Cheng chengzhihao1@huawei.com Link: https://lore.kernel.org/r/20230308032643.641113-1-chengzhihao1@huawei.com Signed-off-by: Theodore Ts'o tytso@mit.edu Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- fs/ext4/ioctl.c | 1 + 1 file changed, 1 insertion(+)

--- a/fs/ext4/ioctl.c +++ b/fs/ext4/ioctl.c @@ -178,6 +178,7 @@ static long swap_inode_boot_loader(struc ei_bl->i_flags = 0; inode_set_iversion(inode_bl, 1); i_size_write(inode_bl, 0); + EXT4_I(inode_bl)->i_disksize = inode_bl->i_size; inode_bl->i_mode = S_IFREG; if (ext4_has_feature_extents(sb)) { ext4_set_inode_flag(inode_bl, EXT4_INODE_EXTENTS);

From: Jan Kara jack@suse.cz

[ Upstream commit a768a9abc625d554f7b6428517089c193fcb5962 ]

Add comment explaining that load_nls() failure gets handled back in udf_fill_super() to avoid false impression that it is unhandled.

Signed-off-by: Jan Kara jack@suse.cz Stable-dep-of: fc8033a34a3c ("udf: Preserve link count of system files") Signed-off-by: Sasha Levin sashal@kernel.org --- fs/udf/super.c | 5 +++++ 1 file changed, 5 insertions(+)

diff --git a/fs/udf/super.c b/fs/udf/super.c index b7fb7cd35d89a..5d179616578cf 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -572,6 +572,11 @@ static int udf_parse_options(char *options, struct udf_options *uopt, if (!remount) { if (uopt->nls_map) unload_nls(uopt->nls_map); + /* + * load_nls() failure is handled later in + * udf_fill_super() after all options are + * parsed. + */ uopt->nls_map = load_nls(args[0].from); uopt->flags |= (1 << UDF_FLAG_NLS_MAP); }

From: Jan Kara jack@suse.cz

[ Upstream commit 382a2287bf9cd283206764572f66ab12657218aa ]

We use only a single member out of the i_ext union in udf_inode_info. Just remove the pointless union.

Signed-off-by: Jan Kara jack@suse.cz Stable-dep-of: fc8033a34a3c ("udf: Preserve link count of system files") Signed-off-by: Sasha Levin sashal@kernel.org --- fs/udf/directory.c | 2 +- fs/udf/file.c | 7 +++---- fs/udf/ialloc.c | 14 +++++++------- fs/udf/inode.c | 36 +++++++++++++++++------------------- fs/udf/misc.c | 6 +++--- fs/udf/namei.c | 7 +++---- fs/udf/partition.c | 2 +- fs/udf/super.c | 4 ++-- fs/udf/symlink.c | 2 +- fs/udf/udf_i.h | 6 +----- 10 files changed, 39 insertions(+), 47 deletions(-)

diff --git a/fs/udf/directory.c b/fs/udf/directory.c index d9523013096f9..73720320f0ab7 100644 --- a/fs/udf/directory.c +++ b/fs/udf/directory.c @@ -34,7 +34,7 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos, fibh->soffset = fibh->eoffset;

if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - fi = udf_get_fileident(iinfo->i_ext.i_data - + fi = udf_get_fileident(iinfo->i_data - (iinfo->i_efe ? sizeof(struct extendedFileEntry) : sizeof(struct fileEntry)), diff --git a/fs/udf/file.c b/fs/udf/file.c index 88b7fb8e9998c..8fff7ffc33a81 100644 --- a/fs/udf/file.c +++ b/fs/udf/file.c @@ -50,7 +50,7 @@ static void __udf_adinicb_readpage(struct page *page) * So just sample it once and use the same value everywhere. */ kaddr = kmap_atomic(page); - memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, isize); + memcpy(kaddr, iinfo->i_data + iinfo->i_lenEAttr, isize); memset(kaddr + isize, 0, PAGE_SIZE - isize); flush_dcache_page(page); SetPageUptodate(page); @@ -76,8 +76,7 @@ static int udf_adinicb_writepage(struct page *page, BUG_ON(!PageLocked(page));

kaddr = kmap_atomic(page); - memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr, - i_size_read(inode)); + memcpy(iinfo->i_data + iinfo->i_lenEAttr, kaddr, i_size_read(inode)); SetPageUptodate(page); kunmap_atomic(kaddr); mark_inode_dirty(inode); @@ -213,7 +212,7 @@ long udf_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) return put_user(UDF_I(inode)->i_lenEAttr, (int __user *)arg); case UDF_GETEABLOCK: return copy_to_user((char __user *)arg, - UDF_I(inode)->i_ext.i_data, + UDF_I(inode)->i_data, UDF_I(inode)->i_lenEAttr) ? -EFAULT : 0; default: return -ENOIOCTLCMD; diff --git a/fs/udf/ialloc.c b/fs/udf/ialloc.c index f8e5872f7cc27..cdaa86e077b29 100644 --- a/fs/udf/ialloc.c +++ b/fs/udf/ialloc.c @@ -67,16 +67,16 @@ struct inode *udf_new_inode(struct inode *dir, umode_t mode) iinfo->i_efe = 1; if (UDF_VERS_USE_EXTENDED_FE > sbi->s_udfrev) sbi->s_udfrev = UDF_VERS_USE_EXTENDED_FE; - iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize - - sizeof(struct extendedFileEntry), - GFP_KERNEL); + iinfo->i_data = kzalloc(inode->i_sb->s_blocksize - + sizeof(struct extendedFileEntry), + GFP_KERNEL); } else { iinfo->i_efe = 0; - iinfo->i_ext.i_data = kzalloc(inode->i_sb->s_blocksize - - sizeof(struct fileEntry), - GFP_KERNEL); + iinfo->i_data = kzalloc(inode->i_sb->s_blocksize - + sizeof(struct fileEntry), + GFP_KERNEL); } - if (!iinfo->i_ext.i_data) { + if (!iinfo->i_data) { iput(inode); return ERR_PTR(-ENOMEM); } diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 99d297b667ce1..415f1186d250f 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -150,8 +150,8 @@ void udf_evict_inode(struct inode *inode) truncate_inode_pages_final(&inode->i_data); invalidate_inode_buffers(inode); clear_inode(inode); - kfree(iinfo->i_ext.i_data); - iinfo->i_ext.i_data = NULL; + kfree(iinfo->i_data); + iinfo->i_data = NULL; udf_clear_extent_cache(inode); if (want_delete) { udf_free_inode(inode); @@ -278,14 +278,14 @@ int udf_expand_file_adinicb(struct inode *inode) kaddr = kmap_atomic(page); memset(kaddr + iinfo->i_lenAlloc, 0x00, PAGE_SIZE - iinfo->i_lenAlloc); - memcpy(kaddr, iinfo->i_ext.i_data + iinfo->i_lenEAttr, + memcpy(kaddr, iinfo->i_data + iinfo->i_lenEAttr, iinfo->i_lenAlloc); flush_dcache_page(page); SetPageUptodate(page); kunmap_atomic(kaddr); } down_write(&iinfo->i_data_sem); - memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0x00, + memset(iinfo->i_data + iinfo->i_lenEAttr, 0x00, iinfo->i_lenAlloc); iinfo->i_lenAlloc = 0; if (UDF_QUERY_FLAG(inode->i_sb, UDF_FLAG_USE_SHORT_AD)) @@ -303,8 +303,7 @@ int udf_expand_file_adinicb(struct inode *inode) lock_page(page); down_write(&iinfo->i_data_sem); kaddr = kmap_atomic(page); - memcpy(iinfo->i_ext.i_data + iinfo->i_lenEAttr, kaddr, - inode->i_size); + memcpy(iinfo->i_data + iinfo->i_lenEAttr, kaddr, inode->i_size); kunmap_atomic(kaddr); unlock_page(page); iinfo->i_alloc_type = ICBTAG_FLAG_AD_IN_ICB; @@ -392,8 +391,7 @@ struct buffer_head *udf_expand_dir_adinicb(struct inode *inode, } mark_buffer_dirty_inode(dbh, inode);

- memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr, 0, - iinfo->i_lenAlloc); + memset(iinfo->i_data + iinfo->i_lenEAttr, 0, iinfo->i_lenAlloc); iinfo->i_lenAlloc = 0; eloc.logicalBlockNum = *block; eloc.partitionReferenceNum = @@ -1241,7 +1239,7 @@ int udf_setsize(struct inode *inode, loff_t newsize) if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { down_write(&iinfo->i_data_sem); udf_clear_extent_cache(inode); - memset(iinfo->i_ext.i_data + iinfo->i_lenEAttr + newsize, + memset(iinfo->i_data + iinfo->i_lenEAttr + newsize, 0x00, bsize - newsize - udf_file_entry_alloc_offset(inode)); iinfo->i_lenAlloc = newsize; @@ -1390,7 +1388,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) sizeof(struct extendedFileEntry)); if (ret) goto out; - memcpy(iinfo->i_ext.i_data, + memcpy(iinfo->i_data, bh->b_data + sizeof(struct extendedFileEntry), bs - sizeof(struct extendedFileEntry)); } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_FE)) { @@ -1399,7 +1397,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) ret = udf_alloc_i_data(inode, bs - sizeof(struct fileEntry)); if (ret) goto out; - memcpy(iinfo->i_ext.i_data, + memcpy(iinfo->i_data, bh->b_data + sizeof(struct fileEntry), bs - sizeof(struct fileEntry)); } else if (fe->descTag.tagIdent == cpu_to_le16(TAG_IDENT_USE)) { @@ -1412,7 +1410,7 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) sizeof(struct unallocSpaceEntry)); if (ret) goto out; - memcpy(iinfo->i_ext.i_data, + memcpy(iinfo->i_data, bh->b_data + sizeof(struct unallocSpaceEntry), bs - sizeof(struct unallocSpaceEntry)); return 0; @@ -1591,8 +1589,8 @@ static int udf_read_inode(struct inode *inode, bool hidden_inode) static int udf_alloc_i_data(struct inode *inode, size_t size) { struct udf_inode_info *iinfo = UDF_I(inode); - iinfo->i_ext.i_data = kmalloc(size, GFP_KERNEL); - if (!iinfo->i_ext.i_data) + iinfo->i_data = kmalloc(size, GFP_KERNEL); + if (!iinfo->i_data) return -ENOMEM; return 0; } @@ -1666,7 +1664,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)

use->lengthAllocDescs = cpu_to_le32(iinfo->i_lenAlloc); memcpy(bh->b_data + sizeof(struct unallocSpaceEntry), - iinfo->i_ext.i_data, inode->i_sb->s_blocksize - + iinfo->i_data, inode->i_sb->s_blocksize - sizeof(struct unallocSpaceEntry)); use->descTag.tagIdent = cpu_to_le16(TAG_IDENT_USE); crclen = sizeof(struct unallocSpaceEntry); @@ -1735,7 +1733,7 @@ static int udf_update_inode(struct inode *inode, int do_sync)

if (iinfo->i_efe == 0) { memcpy(bh->b_data + sizeof(struct fileEntry), - iinfo->i_ext.i_data, + iinfo->i_data, inode->i_sb->s_blocksize - sizeof(struct fileEntry)); fe->logicalBlocksRecorded = cpu_to_le64(lb_recorded);

@@ -1754,7 +1752,7 @@ static int udf_update_inode(struct inode *inode, int do_sync) crclen = sizeof(struct fileEntry); } else { memcpy(bh->b_data + sizeof(struct extendedFileEntry), - iinfo->i_ext.i_data, + iinfo->i_data, inode->i_sb->s_blocksize - sizeof(struct extendedFileEntry)); efe->objectSize = @@ -2050,7 +2048,7 @@ void udf_write_aext(struct inode *inode, struct extent_position *epos, struct udf_inode_info *iinfo = UDF_I(inode);

if (!epos->bh) - ptr = iinfo->i_ext.i_data + epos->offset - + ptr = iinfo->i_data + epos->offset - udf_file_entry_alloc_offset(inode) + iinfo->i_lenEAttr; else @@ -2142,7 +2140,7 @@ int8_t udf_current_aext(struct inode *inode, struct extent_position *epos, if (!epos->bh) { if (!epos->offset) epos->offset = udf_file_entry_alloc_offset(inode); - ptr = iinfo->i_ext.i_data + epos->offset - + ptr = iinfo->i_data + epos->offset - udf_file_entry_alloc_offset(inode) + iinfo->i_lenEAttr; alen = udf_file_entry_alloc_offset(inode) + diff --git a/fs/udf/misc.c b/fs/udf/misc.c index 853bcff51043f..1614d308d0f06 100644 --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -52,9 +52,9 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, uint16_t crclen; struct udf_inode_info *iinfo = UDF_I(inode);

- ea = iinfo->i_ext.i_data; + ea = iinfo->i_data; if (iinfo->i_lenEAttr) { - ad = iinfo->i_ext.i_data + iinfo->i_lenEAttr; + ad = iinfo->i_data + iinfo->i_lenEAttr; } else { ad = ea; size += sizeof(struct extendedAttrHeaderDesc); @@ -153,7 +153,7 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type, uint32_t offset; struct udf_inode_info *iinfo = UDF_I(inode);

- ea = iinfo->i_ext.i_data; + ea = iinfo->i_data;

if (iinfo->i_lenEAttr) { struct extendedAttrHeaderDesc *eahd; diff --git a/fs/udf/namei.c b/fs/udf/namei.c index ef251622da137..05dd1f45ba90b 100644 --- a/fs/udf/namei.c +++ b/fs/udf/namei.c @@ -478,8 +478,7 @@ static struct fileIdentDesc *udf_add_entry(struct inode *dir, if (dinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { block = dinfo->i_location.logicalBlockNum; fi = (struct fileIdentDesc *) - (dinfo->i_ext.i_data + - fibh->soffset - + (dinfo->i_data + fibh->soffset - udf_ext0_offset(dir) + dinfo->i_lenEAttr); } else { @@ -962,7 +961,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry, mark_buffer_dirty_inode(epos.bh, inode); ea = epos.bh->b_data + udf_ext0_offset(inode); } else - ea = iinfo->i_ext.i_data + iinfo->i_lenEAttr; + ea = iinfo->i_data + iinfo->i_lenEAttr;

eoffset = sb->s_blocksize - udf_ext0_offset(inode); pc = (struct pathComponent *)ea; @@ -1142,7 +1141,7 @@ static int udf_rename(struct inode *old_dir, struct dentry *old_dentry, retval = -EIO; if (old_iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { dir_fi = udf_get_fileident( - old_iinfo->i_ext.i_data - + old_iinfo->i_data - (old_iinfo->i_efe ? sizeof(struct extendedFileEntry) : sizeof(struct fileEntry)), diff --git a/fs/udf/partition.c b/fs/udf/partition.c index 090baff83990a..4cbf40575965e 100644 --- a/fs/udf/partition.c +++ b/fs/udf/partition.c @@ -65,7 +65,7 @@ uint32_t udf_get_pblock_virt15(struct super_block *sb, uint32_t block, }

if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - loc = le32_to_cpu(((__le32 *)(iinfo->i_ext.i_data + + loc = le32_to_cpu(((__le32 *)(iinfo->i_data + vdata->s_start_offset))[block]); goto translate; } diff --git a/fs/udf/super.c b/fs/udf/super.c index ec082b27e9fba..cdaef406f3899 100644 --- a/fs/udf/super.c +++ b/fs/udf/super.c @@ -174,7 +174,7 @@ static void init_once(void *foo) { struct udf_inode_info *ei = (struct udf_inode_info *)foo;

- ei->i_ext.i_data = NULL; + ei->i_data = NULL; inode_init_once(&ei->vfs_inode); }

@@ -1207,7 +1207,7 @@ static int udf_load_vat(struct super_block *sb, int p_index, int type1_index) vat20 = (struct virtualAllocationTable20 *)bh->b_data; } else { vat20 = (struct virtualAllocationTable20 *) - vati->i_ext.i_data; + vati->i_data; }

map->s_type_specific.s_virtual.s_start_offset = diff --git a/fs/udf/symlink.c b/fs/udf/symlink.c index 6023c97c6da2f..aef3e4d9014d2 100644 --- a/fs/udf/symlink.c +++ b/fs/udf/symlink.c @@ -122,7 +122,7 @@ static int udf_symlink_filler(struct file *file, struct page *page)

down_read(&iinfo->i_data_sem); if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - symlink = iinfo->i_ext.i_data + iinfo->i_lenEAttr; + symlink = iinfo->i_data + iinfo->i_lenEAttr; } else { bh = sb_bread(inode->i_sb, pos);

diff --git a/fs/udf/udf_i.h b/fs/udf/udf_i.h index 00d773d1b7cf0..2a4731314d51f 100644 --- a/fs/udf/udf_i.h +++ b/fs/udf/udf_i.h @@ -44,11 +44,7 @@ struct udf_inode_info { unsigned i_strat4096 : 1; unsigned i_streamdir : 1; unsigned reserved : 25; - union { - struct short_ad *i_sad; - struct long_ad *i_lad; - __u8 *i_data; - } i_ext; + __u8 *i_data; struct kernel_lb_addr i_locStreamdir; __u64 i_lenStreams; struct rw_semaphore i_data_sem;

From: Jan Kara jack@suse.cz

[ Upstream commit 85a37983ec69cc9fcd188bc37c4de15ee326355a ]

When UDF filesystem is corrupted, hidden system inodes can be linked into directory hierarchy which is an avenue for further serious corruption of the filesystem and kernel confusion as noticed by syzbot fuzzed images. Refuse to access system inodes linked into directory hierarchy and vice versa.

CC: stable@vger.kernel.org Reported-by: syzbot+38695a20b8addcbc1084@syzkaller.appspotmail.com Signed-off-by: Jan Kara jack@suse.cz Signed-off-by: Sasha Levin sashal@kernel.org --- fs/udf/inode.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/fs/udf/inode.c b/fs/udf/inode.c index 7436337914b19..77421e65623a1 100644 --- a/fs/udf/inode.c +++ b/fs/udf/inode.c @@ -1871,8 +1871,13 @@ struct inode *__udf_iget(struct super_block *sb, struct kernel_lb_addr *ino, if (!inode) return ERR_PTR(-ENOMEM);

- if (!(inode->i_state & I_NEW)) + if (!(inode->i_state & I_NEW)) { + if (UDF_I(inode)->i_hidden != hidden_inode) { + iput(inode); + return ERR_PTR(-EFSCORRUPTED); + } return inode; + }

memcpy(&UDF_I(inode)->i_location, ino, sizeof(struct kernel_lb_addr)); err = udf_read_inode(inode, hidden_inode);

From: Krzysztof Kozlowski krzk@kernel.org

[ Upstream commit 1708f56081e239a29ed8646aa7fde6853235d93f ]

Using full paths to extend or override a device tree node is error prone since if there was a typo error, a new node will be created instead of extending the node as it was desired. This will lead to run-time errors that could be hard to detect.

A mistyped label on the other hand, will cause a dtc compile error (during build time).

Signed-off-by: Krzysztof Kozlowski krzk@kernel.org Link: https://lore.kernel.org/r/20200830135200.24304-16-krzk@kernel.org Stable-dep-of: 408ab6786dbf ("ARM: dts: exynos: correct TMU phandle in Exynos4210") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos4210.dtsi | 36 +++++++++++++++---------------- 1 file changed, 17 insertions(+), 19 deletions(-)

diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi index 0ed9ef75075bc..2ec6c01550564 100644 --- a/arch/arm/boot/dts/exynos4210.dtsi +++ b/arch/arm/boot/dts/exynos4210.dtsi @@ -370,26 +370,24 @@ }; }; }; +};

- thermal-zones { - cpu_thermal: cpu-thermal { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&tmu 0>; - - trips { - cpu_alert0: cpu-alert-0 { - temperature = <85000>; /* millicelsius */ - }; - cpu_alert1: cpu-alert-1 { - temperature = <100000>; /* millicelsius */ - }; - cpu_alert2: cpu-alert-2 { - temperature = <110000>; /* millicelsius */ - }; - }; - }; - }; +&cpu_alert0 { + temperature = <85000>; /* millicelsius */ +}; + +&cpu_alert1 { + temperature = <100000>; /* millicelsius */ +}; + +&cpu_alert2 { + temperature = <110000>; /* millicelsius */ +}; + +&cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&tmu 0>; };

&gic {

From: Viresh Kumar viresh.kumar@linaro.org

[ Upstream commit 670734f5581023a2e695e82ea662e4d603fd3e8a ]

Each CPU can (and does) participate in cooling down the system but the DT only captures a handful of them, normally CPU0, in the cooling maps. Things work by chance currently as under normal circumstances its the first CPU of each cluster which is used by the operating systems to probe the cooling devices. But as soon as this CPU ordering changes and any other CPU is used to bring up the cooling device, we will start seeing failures.

Also the DT is rather incomplete when we list only one CPU in the cooling maps, as the hardware doesn't have any such limitations.

Update cooling maps to include all devices affected by individual trip points.

Signed-off-by: Viresh Kumar viresh.kumar@linaro.org Signed-off-by: Krzysztof Kozlowski krzk@kernel.org Stable-dep-of: 33e2c595e2e4 ("ARM: dts: exynos: correct TMU phandle in Exynos5250") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos3250-artik5.dtsi | 6 +- arch/arm/boot/dts/exynos3250-monk.dts | 6 +- arch/arm/boot/dts/exynos3250-rinato.dts | 6 +- arch/arm/boot/dts/exynos4210-trats.dts | 4 +- arch/arm/boot/dts/exynos4210.dtsi | 2 +- .../boot/dts/exynos4412-itop-scp-core.dtsi | 8 +- arch/arm/boot/dts/exynos4412-midas.dtsi | 8 +- .../boot/dts/exynos4412-odroid-common.dtsi | 8 +- arch/arm/boot/dts/exynos4412-odroidu3.dts | 18 ++- arch/arm/boot/dts/exynos4412.dtsi | 6 +- arch/arm/boot/dts/exynos5250.dtsi | 7 +- arch/arm/boot/dts/exynos5422-odroidhc1.dts | 106 +++++++++++------- .../boot/dts/exynos5422-odroidxu3-common.dtsi | 106 +++++++++++------- 13 files changed, 178 insertions(+), 113 deletions(-)

diff --git a/arch/arm/boot/dts/exynos3250-artik5.dtsi b/arch/arm/boot/dts/exynos3250-artik5.dtsi index 6e30db644c83a..86aa0956b2d3b 100644 --- a/arch/arm/boot/dts/exynos3250-artik5.dtsi +++ b/arch/arm/boot/dts/exynos3250-artik5.dtsi @@ -36,11 +36,13 @@ cooling-maps { map0 { /* Corresponds to 500MHz */ - cooling-device = <&cpu0 5 5>; + cooling-device = <&cpu0 5 5>, + <&cpu1 5 5>; }; map1 { /* Corresponds to 200MHz */ - cooling-device = <&cpu0 8 8>; + cooling-device = <&cpu0 8 8>, + <&cpu1 8 8>; }; }; }; diff --git a/arch/arm/boot/dts/exynos3250-monk.dts b/arch/arm/boot/dts/exynos3250-monk.dts index d343dc13ceecd..c9b6fb65d6861 100644 --- a/arch/arm/boot/dts/exynos3250-monk.dts +++ b/arch/arm/boot/dts/exynos3250-monk.dts @@ -121,11 +121,13 @@ cooling-maps { map0 { /* Correspond to 500MHz at freq_table */ - cooling-device = <&cpu0 5 5>; + cooling-device = <&cpu0 5 5>, + <&cpu1 5 5>; }; map1 { /* Correspond to 200MHz at freq_table */ - cooling-device = <&cpu0 8 8>; + cooling-device = <&cpu0 8 8>, + <&cpu1 8 8>; }; }; }; diff --git a/arch/arm/boot/dts/exynos3250-rinato.dts b/arch/arm/boot/dts/exynos3250-rinato.dts index e398604b2ce0f..4eb5f79b1c3b2 100644 --- a/arch/arm/boot/dts/exynos3250-rinato.dts +++ b/arch/arm/boot/dts/exynos3250-rinato.dts @@ -116,11 +116,13 @@ cooling-maps { map0 { /* Corresponds to 500MHz */ - cooling-device = <&cpu0 5 5>; + cooling-device = <&cpu0 5 5>, + <&cpu1 5 5>; }; map1 { /* Corresponds to 200MHz */ - cooling-device = <&cpu0 8 8>; + cooling-device = <&cpu0 8 8>, + <&cpu1 8 8>; }; }; }; diff --git a/arch/arm/boot/dts/exynos4210-trats.dts b/arch/arm/boot/dts/exynos4210-trats.dts index 6f1d76cb79515..230969556e1ce 100644 --- a/arch/arm/boot/dts/exynos4210-trats.dts +++ b/arch/arm/boot/dts/exynos4210-trats.dts @@ -138,11 +138,11 @@ cooling-maps { map0 { /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 2 2>; + cooling-device = <&cpu0 2 2>, <&cpu1 2 2>; }; map1 { /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 4 4>; + cooling-device = <&cpu0 4 4>, <&cpu1 4 4>; }; }; }; diff --git a/arch/arm/boot/dts/exynos4210.dtsi b/arch/arm/boot/dts/exynos4210.dtsi index 24bea84034af2..b7b6edbc0499e 100644 --- a/arch/arm/boot/dts/exynos4210.dtsi +++ b/arch/arm/boot/dts/exynos4210.dtsi @@ -51,7 +51,7 @@ #cooling-cells = <2>; /* min followed by max */ };

- cpu@901 { + cpu1: cpu@901 { device_type = "cpu"; compatible = "arm,cortex-a9"; reg = <0x901>; diff --git a/arch/arm/boot/dts/exynos4412-itop-scp-core.dtsi b/arch/arm/boot/dts/exynos4412-itop-scp-core.dtsi index ab7affab7f1c0..4ca05599ee2ac 100644 --- a/arch/arm/boot/dts/exynos4412-itop-scp-core.dtsi +++ b/arch/arm/boot/dts/exynos4412-itop-scp-core.dtsi @@ -45,11 +45,15 @@ cooling-maps { map0 { /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 7 7>; + cooling-device = <&cpu0 7 7>, <&cpu1 7 7>, + <&cpu2 7 7>, <&cpu3 7 7>; }; map1 { /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 13 13>; + cooling-device = <&cpu0 13 13>, + <&cpu1 13 13>, + <&cpu2 13 13>, + <&cpu3 13 13>; }; }; }; diff --git a/arch/arm/boot/dts/exynos4412-midas.dtsi b/arch/arm/boot/dts/exynos4412-midas.dtsi index 93c8918e599bd..047240a32097a 100644 --- a/arch/arm/boot/dts/exynos4412-midas.dtsi +++ b/arch/arm/boot/dts/exynos4412-midas.dtsi @@ -267,11 +267,15 @@ cooling-maps { map0 { /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 7 7>; + cooling-device = <&cpu0 7 7>, <&cpu1 7 7>, + <&cpu2 7 7>, <&cpu3 7 7>; }; map1 { /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 13 13>; + cooling-device = <&cpu0 13 13>, + <&cpu1 13 13>, + <&cpu2 13 13>, + <&cpu3 13 13>; }; }; }; diff --git a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi index dbca8eeefae13..e269818668bb1 100644 --- a/arch/arm/boot/dts/exynos4412-odroid-common.dtsi +++ b/arch/arm/boot/dts/exynos4412-odroid-common.dtsi @@ -72,11 +72,15 @@ cooling-maps { cooling_map0: map0 { /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 7 7>; + cooling-device = <&cpu0 7 7>, <&cpu1 7 7>, + <&cpu2 7 7>, <&cpu3 7 7>; }; cooling_map1: map1 { /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 13 13>; + cooling-device = <&cpu0 13 13>, + <&cpu1 13 13>, + <&cpu2 13 13>, + <&cpu3 13 13>; }; }; }; diff --git a/arch/arm/boot/dts/exynos4412-odroidu3.dts b/arch/arm/boot/dts/exynos4412-odroidu3.dts index 459919b65df81..2bdf899df4366 100644 --- a/arch/arm/boot/dts/exynos4412-odroidu3.dts +++ b/arch/arm/boot/dts/exynos4412-odroidu3.dts @@ -45,24 +45,22 @@ cooling-maps { map0 { trip = <&cpu_alert1>; - cooling-device = <&cpu0 9 9>; + cooling-device = <&cpu0 9 9>, <&cpu1 9 9>, + <&cpu2 9 9>, <&cpu3 9 9>, + <&fan0 1 2>; }; map1 { trip = <&cpu_alert2>; - cooling-device = <&cpu0 15 15>; + cooling-device = <&cpu0 15 15>, + <&cpu1 15 15>, + <&cpu2 15 15>, + <&cpu3 15 15>, + <&fan0 2 3>; }; map2 { trip = <&cpu_alert0>; cooling-device = <&fan0 0 1>; }; - map3 { - trip = <&cpu_alert1>; - cooling-device = <&fan0 1 2>; - }; - map4 { - trip = <&cpu_alert2>; - cooling-device = <&fan0 2 3>; - }; }; }; }; diff --git a/arch/arm/boot/dts/exynos4412.dtsi b/arch/arm/boot/dts/exynos4412.dtsi index 51f72f0327e52..cd04bb4aea5f8 100644 --- a/arch/arm/boot/dts/exynos4412.dtsi +++ b/arch/arm/boot/dts/exynos4412.dtsi @@ -45,7 +45,7 @@ #cooling-cells = <2>; /* min followed by max */ };

- cpu@a01 { + cpu1: cpu@a01 { device_type = "cpu"; compatible = "arm,cortex-a9"; reg = <0xA01>; @@ -55,7 +55,7 @@ #cooling-cells = <2>; /* min followed by max */ };

- cpu@a02 { + cpu2: cpu@a02 { device_type = "cpu"; compatible = "arm,cortex-a9"; reg = <0xA02>; @@ -65,7 +65,7 @@ #cooling-cells = <2>; /* min followed by max */ };

- cpu@a03 { + cpu3: cpu@a03 { device_type = "cpu"; compatible = "arm,cortex-a9"; reg = <0xA03>; diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi index b85527faa6ea4..e6b1a8a9b832c 100644 --- a/arch/arm/boot/dts/exynos5250.dtsi +++ b/arch/arm/boot/dts/exynos5250.dtsi @@ -59,7 +59,7 @@ operating-points-v2 = <&cpu0_opp_table>; #cooling-cells = <2>; /* min followed by max */ }; - cpu@1 { + cpu1: cpu@1 { device_type = "cpu"; compatible = "arm,cortex-a15"; reg = <1>; @@ -1066,11 +1066,12 @@ cooling-maps { map0 { /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 9 9>; + cooling-device = <&cpu0 9 9>, <&cpu1 9 9>; }; map1 { /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 15 15>; + cooling-device = <&cpu0 15 15>, + <&cpu1 15 15>; }; }; }; diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts index abc6fb7d27259..fce5a4579693e 100644 --- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts +++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts @@ -56,24 +56,30 @@ */ map0 { trip = <&cpu0_alert0>; - cooling-device = <&cpu0 0 2>; - }; - map1 { - trip = <&cpu0_alert0>; - cooling-device = <&cpu4 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; /* * When reaching cpu0_alert1, reduce CPU * further, down to 600 MHz (12 steps for big, * 7 steps for LITTLE). */ - map2 { - trip = <&cpu0_alert1>; - cooling-device = <&cpu0 3 7>; - }; - map3 { + map1 { trip = <&cpu0_alert1>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -99,19 +105,25 @@ cooling-maps { map0 { trip = <&cpu1_alert0>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map1 { - trip = <&cpu1_alert0>; - cooling-device = <&cpu4 0 2>; - }; - map2 { - trip = <&cpu1_alert1>; - cooling-device = <&cpu0 3 7>; - }; - map3 { trip = <&cpu1_alert1>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -137,19 +149,25 @@ cooling-maps { map0 { trip = <&cpu2_alert0>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map1 { - trip = <&cpu2_alert0>; - cooling-device = <&cpu4 0 2>; - }; - map2 { - trip = <&cpu2_alert1>; - cooling-device = <&cpu0 3 7>; - }; - map3 { trip = <&cpu2_alert1>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -175,19 +193,25 @@ cooling-maps { map0 { trip = <&cpu3_alert0>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map1 { - trip = <&cpu3_alert0>; - cooling-device = <&cpu4 0 2>; - }; - map2 { - trip = <&cpu3_alert1>; - cooling-device = <&cpu0 3 7>; - }; - map3 { trip = <&cpu3_alert1>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi index 96e281c0a118a..264651141d688 100644 --- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi @@ -113,24 +113,30 @@ */ map3 { trip = <&cpu0_alert3>; - cooling-device = <&cpu0 0 2>; - }; - map4 { - trip = <&cpu0_alert3>; - cooling-device = <&cpu4 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; /* * When reaching cpu0_alert4, reduce CPU * further, down to 600 MHz (12 steps for big, * 7 steps for LITTLE). */ - map5 { - trip = <&cpu0_alert4>; - cooling-device = <&cpu0 3 7>; - }; - map6 { + map4 { trip = <&cpu0_alert4>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -185,19 +191,25 @@ }; map3 { trip = <&cpu1_alert3>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map4 { - trip = <&cpu1_alert3>; - cooling-device = <&cpu4 0 2>; - }; - map5 { - trip = <&cpu1_alert4>; - cooling-device = <&cpu0 3 7>; - }; - map6 { trip = <&cpu1_alert4>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -252,19 +264,25 @@ }; map3 { trip = <&cpu2_alert3>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map4 { - trip = <&cpu2_alert3>; - cooling-device = <&cpu4 0 2>; - }; - map5 { - trip = <&cpu2_alert4>; - cooling-device = <&cpu0 3 7>; - }; - map6 { trip = <&cpu2_alert4>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; }; @@ -319,19 +337,25 @@ }; map3 { trip = <&cpu3_alert3>; - cooling-device = <&cpu0 0 2>; + cooling-device = <&cpu0 0 2>, + <&cpu1 0 2>, + <&cpu2 0 2>, + <&cpu3 0 2>, + <&cpu4 0 2>, + <&cpu5 0 2>, + <&cpu6 0 2>, + <&cpu7 0 2>; }; map4 { - trip = <&cpu3_alert3>; - cooling-device = <&cpu4 0 2>; - }; - map5 { - trip = <&cpu3_alert4>; - cooling-device = <&cpu0 3 7>; - }; - map6 { trip = <&cpu3_alert4>; - cooling-device = <&cpu4 3 12>; + cooling-device = <&cpu0 3 7>, + <&cpu1 3 7>, + <&cpu2 3 7>, + <&cpu3 3 7>, + <&cpu4 3 12>, + <&cpu5 3 12>, + <&cpu6 3 12>, + <&cpu7 3 12>; }; }; };

From: Krzysztof Kozlowski krzk@kernel.org

[ Upstream commit 7e86ef5cc89609cbad8b9dd2f476789c638dbb92 ]

Using full paths to extend or override a device tree node is error prone since if there was a typo error, a new node will be created instead of extending the node as it was desired. This will lead to run-time errors that could be hard to detect.

A mistyped label on the other hand, will cause a dtc compile error (during build time).

Signed-off-by: Krzysztof Kozlowski krzk@kernel.org Link: https://lore.kernel.org/r/20200901075417.22481-8-krzk@kernel.org Stable-dep-of: 33e2c595e2e4 ("ARM: dts: exynos: correct TMU phandle in Exynos5250") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos5250.dtsi | 38 +++++++++++++++---------------- 1 file changed, 18 insertions(+), 20 deletions(-)

diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi index 59e5f0016b862..1883b8c2cd7b9 100644 --- a/arch/arm/boot/dts/exynos5250.dtsi +++ b/arch/arm/boot/dts/exynos5250.dtsi @@ -1043,26 +1043,6 @@ }; };

- thermal-zones { - cpu_thermal: cpu-thermal { - polling-delay-passive = <0>; - polling-delay = <0>; - thermal-sensors = <&tmu 0>; - - cooling-maps { - map0 { - /* Corresponds to 800MHz at freq_table */ - cooling-device = <&cpu0 9 9>, <&cpu1 9 9>; - }; - map1 { - /* Corresponds to 200MHz at freq_table */ - cooling-device = <&cpu0 15 15>, - <&cpu1 15 15>; - }; - }; - }; - }; - timer { compatible = "arm,armv7-timer"; interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_LEVEL_LOW)>, @@ -1078,6 +1058,24 @@ }; };

+&cpu_thermal { + polling-delay-passive = <0>; + polling-delay = <0>; + thermal-sensors = <&tmu 0>; + + cooling-maps { + map0 { + /* Corresponds to 800MHz at freq_table */ + cooling-device = <&cpu0 9 9>, <&cpu1 9 9>; + }; + map1 { + /* Corresponds to 200MHz at freq_table */ + cooling-device = <&cpu0 15 15>, + <&cpu1 15 15>; + }; + }; +}; + &dp { power-domains = <&pd_disp1>; clocks = <&clock CLK_DP>;

From: Masahiro Yamada yamada.masahiro@socionext.com

[ Upstream commit d9f78edfd81b9e484423534360350ef7253cc888 ]

The current implementation of need-builtin is false-positive, for example, in the following Makefile:

obj-m := foo/ obj-y := foo/bar/

..., where foo/built-in.a is not required.

Signed-off-by: Masahiro Yamada yamada.masahiro@socionext.com Stable-dep-of: 2e3d0e20d845 ("ARM: dts: exynos: correct TMU phandle in Odroid HC1") Signed-off-by: Sasha Levin sashal@kernel.org --- scripts/Makefile.build | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/Makefile.build b/scripts/Makefile.build index 64fac0ad32d6b..7635cc05fcfa3 100644 --- a/scripts/Makefile.build +++ b/scripts/Makefile.build @@ -541,7 +541,8 @@ targets += $(call intermediate_targets, .asn1.o, .asn1.c .asn1.h) \

PHONY += $(subdir-ym) $(subdir-ym): - $(Q)$(MAKE) $(build)=$@ need-builtin=$(if $(findstring $@,$(subdir-obj-y)),1) + $(Q)$(MAKE) $(build)=$@ \ + need-builtin=$(if $(filter $@/built-in.a, $(subdir-obj-y)),1)

# Add FORCE to the prequisites of a target to force it to be always rebuilt. # ---------------------------------------------------------------------------

From: Marek Szyprowski m.szyprowski@samsung.com

[ Upstream commit 1c651356f482ff08f6acef197a362f2e71d55a98 ]

Add trip points and cooling maps for GPU thermal zone for Odroid XU3/XU4/HC1 boards. Trip points are based on the CPU thermal zone for the those boards.

Signed-off-by: Marek Szyprowski m.szyprowski@samsung.com Signed-off-by: Krzysztof Kozlowski krzk@kernel.org Stable-dep-of: 2e3d0e20d845 ("ARM: dts: exynos: correct TMU phandle in Odroid HC1") Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos5422-odroidhc1.dts | 30 ++++++++++ .../boot/dts/exynos5422-odroidxu3-common.dtsi | 59 +++++++++++++++++++ 2 files changed, 89 insertions(+)

diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts index fce5a4579693e..3235d7a27e042 100644 --- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts +++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts @@ -215,6 +215,36 @@ }; }; }; + gpu_thermal: gpu-thermal { + thermal-sensors = <&tmu_gpu 0>; + trips { + gpu_alert0: gpu-alert-0 { + temperature = <70000>; + hysteresis = <10000>; + type = "active"; + }; + gpu_alert1: gpu-alert-1 { + temperature = <85000>; + hysteresis = <10000>; + type = "active"; + }; + gpu_crit0: gpu-crit-0 { + temperature = <120000>; + hysteresis = <0>; + type = "critical"; + }; + }; + cooling-maps { + map0 { + trip = <&gpu_alert0>; + cooling-device = <&gpu 0 2>; + }; + map1 { + trip = <&gpu_alert1>; + cooling-device = <&gpu 3 6>; + }; + }; + }; };

}; diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi index 264651141d688..402d69877fd97 100644 --- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi @@ -359,6 +359,65 @@ }; }; }; + gpu_thermal: gpu-thermal { + thermal-sensors = <&tmu_gpu 0>; + polling-delay-passive = <250>; + polling-delay = <0>; + trips { + gpu_alert0: gpu-alert-0 { + temperature = <50000>; + hysteresis = <5000>; + type = "active"; + }; + gpu_alert1: gpu-alert-1 { + temperature = <60000>; + hysteresis = <5000>; + type = "active"; + }; + gpu_alert2: gpu-alert-2 { + temperature = <70000>; + hysteresis = <5000>; + type = "active"; + }; + gpu_crit0: gpu-crit-0 { + temperature = <120000>; + hysteresis = <0>; + type = "critical"; + }; + gpu_alert3: gpu-alert-3 { + temperature = <70000>; + hysteresis = <10000>; + type = "passive"; + }; + gpu_alert4: gpu-alert-4 { + temperature = <85000>; + hysteresis = <10000>; + type = "passive"; + }; + }; + cooling-maps { + map0 { + trip = <&gpu_alert0>; + cooling-device = <&fan0 0 1>; + }; + map1 { + trip = <&gpu_alert1>; + cooling-device = <&fan0 1 2>; + }; + map2 { + trip = <&gpu_alert2>; + cooling-device = <&fan0 2 3>; + }; + map3 { + trip = <&gpu_alert3>; + cooling-device = <&gpu 0 2>; + }; + map4 { + trip = <&gpu_alert4>; + cooling-device = <&gpu 3 6>; + }; + }; + }; }; };

From: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org

[ Upstream commit a3583e92d188ec6c58c7f603ac5e72dd8a11c21a ]

TMU node uses 0 as thermal-sensor-cells, thus thermal zone referencing it must not have an argument to phandle. This was not critical before, but since rework of thermal Devicetree initialization in the commit 3fd6d6e2b4e8 ("thermal/of: Rework the thermal device tree initialization"), this leads to errors registering thermal zones other than first one:

thermal_sys: cpu0-thermal: Failed to read thermal-sensors cells: -2 thermal_sys: Failed to find thermal zone for tmu id=0 exynos-tmu 10064000.tmu: Failed to register sensor: -2 exynos-tmu: probe of 10064000.tmu failed with error -2

Fixes: f1722d7dd8b8 ("ARM: dts: Define default thermal-zones for exynos5422") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20230209105841.779596-6-krzysztof.kozlowski@linaro... Signed-off-by: Krzysztof Kozlowski krzysztof.kozlowski@linaro.org Signed-off-by: Sasha Levin sashal@kernel.org --- arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi index 402d69877fd97..86f64db15a3dd 100644 --- a/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi +++ b/arch/arm/boot/dts/exynos5422-odroidxu3-common.dtsi @@ -52,7 +52,7 @@

thermal-zones { cpu0_thermal: cpu0-thermal { - thermal-sensors = <&tmu_cpu0 0>; + thermal-sensors = <&tmu_cpu0>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -141,7 +141,7 @@ }; }; cpu1_thermal: cpu1-thermal { - thermal-sensors = <&tmu_cpu1 0>; + thermal-sensors = <&tmu_cpu1>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -214,7 +214,7 @@ }; }; cpu2_thermal: cpu2-thermal { - thermal-sensors = <&tmu_cpu2 0>; + thermal-sensors = <&tmu_cpu2>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -287,7 +287,7 @@ }; }; cpu3_thermal: cpu3-thermal { - thermal-sensors = <&tmu_cpu3 0>; + thermal-sensors = <&tmu_cpu3>; polling-delay-passive = <250>; polling-delay = <0>; trips { @@ -360,7 +360,7 @@ }; }; gpu_thermal: gpu-thermal { - thermal-sensors = <&tmu_gpu 0>; + thermal-sensors = <&tmu_gpu>; polling-delay-passive = <250>; polling-delay = <0>; trips {

From: Nobuhiro Iwamatsu nobuhiro1.iwamatsu@toshiba.co.jp

This reverts commit 269f650a0b26067092873308117e0bf0c6ec8289 which is commit 2b2bf6b7faa9010fae10dc7de76627a3fdb525b3 upstream.

dev_err_probe() does not suppot in 4.19.y. So this driver will fail to build.

``` CC drivers/staging/mt7621-spi/spi-mt7621.o drivers/staging/mt7621-spi/spi-mt7621.c: In function 'mt7621_spi_probe': drivers/staging/mt7621-spi/spi-mt7621.c:446:24: error: implicit declaration of function 'dev_err_probe'; did you mean 'device_reprobe'? [-Werror=implicit-function-declaration] 446 | return dev_err_probe(&pdev->dev, PTR_ERR(clk), | ^~~~~~~~~~~~~ | device_reprobe ```

Signed-off-by: Nobuhiro Iwamatsu (CIP) nobuhiro1.iwamatsu@toshiba.co.jp Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/staging/mt7621-spi/spi-mt7621.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)

--- a/drivers/staging/mt7621-spi/spi-mt7621.c +++ b/drivers/staging/mt7621-spi/spi-mt7621.c @@ -442,9 +442,11 @@ static int mt7621_spi_probe(struct platf return PTR_ERR(base);

clk = devm_clk_get(&pdev->dev, NULL); - if (IS_ERR(clk)) - return dev_err_probe(&pdev->dev, PTR_ERR(clk), - "unable to get SYS clock\n"); + if (IS_ERR(clk)) { + dev_err(&pdev->dev, "unable to get SYS clock, err=%d\n", + status); + return PTR_ERR(clk); + }

status = clk_prepare_enable(clk); if (status)

From: xurui xurui@kylinos.cn

[ Upstream commit 109d587a4b4d7ccca2200ab1f808f43ae23e2585 ]

arch/mips/include/asm/mach-rc32434/pci.h:377: cc1: error: result of ‘-117440512 << 16’ requires 44 bits to represent, but ‘int’ only has 32 bits [-Werror=shift-overflow=]

All bits in KORINA_STAT are already at the correct position, so there is no addtional shift needed.

Signed-off-by: xurui xurui@kylinos.cn Signed-off-by: Thomas Bogendoerfer tsbogend@alpha.franken.de Signed-off-by: Sasha Levin sashal@kernel.org --- arch/mips/include/asm/mach-rc32434/pci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/mach-rc32434/pci.h b/arch/mips/include/asm/mach-rc32434/pci.h index 6f40d1515580b..1ff8a987025c8 100644 --- a/arch/mips/include/asm/mach-rc32434/pci.h +++ b/arch/mips/include/asm/mach-rc32434/pci.h @@ -377,7 +377,7 @@ struct pci_msu { PCI_CFG04_STAT_SSE | \ PCI_CFG04_STAT_PE)

-#define KORINA_CNFG1 ((KORINA_STAT<<16)|KORINA_CMD) +#define KORINA_CNFG1 (KORINA_STAT | KORINA_CMD)

#define KORINA_REVID 0 #define KORINA_CLASS_CODE 0

From: Nathan Chancellor nathan@kernel.org

[ Upstream commit 748ea32d2dbd813d3bd958117bde5191182f909a ]

Clang warns:

drivers/macintosh/windfarm_lm75_sensor.c:63:14: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] lm->inited = 1; ^ ~

drivers/macintosh/windfarm_smu_sensors.c:356:19: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] pow->fake_volts = 1; ^ ~ drivers/macintosh/windfarm_smu_sensors.c:368:18: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion] pow->quadratic = 1; ^ ~

There is no bug here since no code checks the actual value of these fields, just whether or not they are zero (boolean context), but this can be easily fixed by switching to an unsigned type.

Signed-off-by: Nathan Chancellor nathan@kernel.org Signed-off-by: Michael Ellerman mpe@ellerman.id.au Link: https://lore.kernel.org/r/20230215-windfarm-wsingle-bit-bitfield-constant-co... Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/macintosh/windfarm_lm75_sensor.c | 4 ++-- drivers/macintosh/windfarm_smu_sensors.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c index f48ad2445ed60..f5b1ac8347db7 100644 --- a/drivers/macintosh/windfarm_lm75_sensor.c +++ b/drivers/macintosh/windfarm_lm75_sensor.c @@ -35,8 +35,8 @@ #endif

struct wf_lm75_sensor { - int ds1775 : 1; - int inited : 1; + unsigned int ds1775 : 1; + unsigned int inited : 1; struct i2c_client *i2c; struct wf_sensor sens; }; diff --git a/drivers/macintosh/windfarm_smu_sensors.c b/drivers/macintosh/windfarm_smu_sensors.c index 172fd267dcf60..0f4017a8189e5 100644 --- a/drivers/macintosh/windfarm_smu_sensors.c +++ b/drivers/macintosh/windfarm_smu_sensors.c @@ -275,8 +275,8 @@ struct smu_cpu_power_sensor { struct list_head link; struct wf_sensor *volts; struct wf_sensor *amps; - int fake_volts : 1; - int quadratic : 1; + unsigned int fake_volts : 1; + unsigned int quadratic : 1; struct wf_sensor sens; }; #define to_smu_cpu_power(c) container_of(c, struct smu_cpu_power_sensor, sens)

From: Alvaro Karsz alvaro.karsz@solid-run.com

[ Upstream commit d089d69cc1f824936eeaa4fa172f8fa1a0949eaa ]

This patch fixes a FLR bug on the SNET DPU rev 1 by setting the PCI_DEV_FLAGS_NO_FLR_RESET flag.

As there is a quirk to avoid FLR (quirk_no_flr), I added a new quirk to check the rev ID before calling to quirk_no_flr.

Without this patch, a SNET DPU rev 1 may hang when FLR is applied.

Signed-off-by: Alvaro Karsz alvaro.karsz@solid-run.com Acked-by: Bjorn Helgaas bhelgaas@google.com Message-Id: 20230110165638.123745-3-alvaro.karsz@solid-run.com Signed-off-by: Michael S. Tsirkin mst@redhat.com Signed-off-by: Sasha Levin sashal@kernel.org --- drivers/pci/quirks.c | 8 ++++++++ 1 file changed, 8 insertions(+)

diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index afa6acb58eec8..db2faa483d253 100644 --- a/drivers/pci/quirks.c +++ b/drivers/pci/quirks.c @@ -5157,6 +5157,14 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_AMD, 0x7901, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1502, quirk_no_flr); DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x1503, quirk_no_flr);

+/* FLR may cause the SolidRun SNET DPU (rev 0x1) to hang */ +static void quirk_no_flr_snet(struct pci_dev *dev) +{ + if (dev->revision == 0x1) + quirk_no_flr(dev); +} +DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SOLIDRUN, 0x1000, quirk_no_flr_snet); + static void quirk_no_ext_tags(struct pci_dev *pdev) { struct pci_host_bridge *bridge = pci_find_host_bridge(pdev->bus);

From: Tung Nguyen tung.q.nguyen@dektech.com.au

commit 223b7329ec6a0dae1b7f7db7b770e93f4a069ef9 upstream.

Commit 844cf763fba6 ("tipc: make macro tipc_wait_for_cond() smp safe") replaced finish_wait() with remove_wait_queue() but still used prepare_to_wait(). This causes unnecessary conditional checking before adding to wait queue in prepare_to_wait().

This commit replaces prepare_to_wait() with add_wait_queue() as the pair function with remove_wait_queue().

Acked-by: Ying Xue ying.xue@windriver.com Acked-by: Jon Maloy jon.maloy@ericsson.com Signed-off-by: Tung Nguyen tung.q.nguyen@dektech.com.au Signed-off-by: David S. Miller davem@davemloft.net Cc: Lee Jones lee@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/tipc/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -388,7 +388,7 @@ static int tipc_sk_sock_err(struct socke rc_ = tipc_sk_sock_err((sock_), timeo_); \ if (rc_) \ break; \ - prepare_to_wait(sk_sleep(sk_), &wait_, TASK_INTERRUPTIBLE); \ + add_wait_queue(sk_sleep(sk_), &wait_); \ release_sock(sk_); \ *(timeo_) = wait_woken(&wait_, TASK_INTERRUPTIBLE, *(timeo_)); \ sched_annotate_sleep(); \

From: Juri Lelli juri.lelli@redhat.com

commit d74b27d63a8bebe2fe634944e4ebdc7b10db7a39 upstream.

cpuset_rwsem is going to be acquired from sched_setscheduler() with a following patch. There are however paths (e.g., spawn_ksoftirqd) in which sched_scheduler() is eventually called while holding hotplug lock; this creates a dependecy between hotplug lock (to be always acquired first) and cpuset_rwsem (to be always acquired after hotplug lock).

Fix paths which currently take the two locks in the wrong order (after a following patch is applied).

Tested-by: Dietmar Eggemann dietmar.eggemann@arm.com Signed-off-by: Juri Lelli juri.lelli@redhat.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Cc: Linus Torvalds torvalds@linux-foundation.org Cc: Peter Zijlstra peterz@infradead.org Cc: Thomas Gleixner tglx@linutronix.de Cc: bristot@redhat.com Cc: claudio@evidence.eu.com Cc: lizefan@huawei.com Cc: longman@redhat.com Cc: luca.abeni@santannapisa.it Cc: mathieu.poirier@linaro.org Cc: rostedt@goodmis.org Cc: tj@kernel.org Cc: tommaso.cucinotta@santannapisa.it Link: https://lkml.kernel.org/r/20190719140000.31694-7-juri.lelli@redhat.com Signed-off-by: Ingo Molnar mingo@kernel.org Signed-off-by: Cai Xinchen caixinchen1@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- include/linux/cpuset.h | 8 ++++---- kernel/cgroup/cpuset.c | 18 ++++++++++++++---- 2 files changed, 18 insertions(+), 8 deletions(-)

--- a/include/linux/cpuset.h +++ b/include/linux/cpuset.h @@ -40,14 +40,14 @@ static inline bool cpusets_enabled(void)

static inline void cpuset_inc(void) { - static_branch_inc(&cpusets_pre_enable_key); - static_branch_inc(&cpusets_enabled_key); + static_branch_inc_cpuslocked(&cpusets_pre_enable_key); + static_branch_inc_cpuslocked(&cpusets_enabled_key); }

static inline void cpuset_dec(void) { - static_branch_dec(&cpusets_enabled_key); - static_branch_dec(&cpusets_pre_enable_key); + static_branch_dec_cpuslocked(&cpusets_enabled_key); + static_branch_dec_cpuslocked(&cpusets_pre_enable_key); }

extern int cpuset_init(void); --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -830,8 +830,8 @@ static void rebuild_sched_domains_locked cpumask_var_t *doms; int ndoms;

+ lockdep_assert_cpus_held(); lockdep_assert_held(&cpuset_mutex); - get_online_cpus();

/* * We have raced with CPU hotplug. Don't do anything to avoid @@ -839,15 +839,13 @@ static void rebuild_sched_domains_locked * Anyways, hotplug work item will rebuild sched domains. */ if (!cpumask_equal(top_cpuset.effective_cpus, cpu_active_mask)) - goto out; + return;

/* Generate domain masks and attrs */ ndoms = generate_sched_domains(&doms, &attr);

/* Have scheduler rebuild the domains */ partition_sched_domains(ndoms, doms, attr); -out: - put_online_cpus(); } #else /* !CONFIG_SMP */ static void rebuild_sched_domains_locked(void) @@ -857,9 +855,11 @@ static void rebuild_sched_domains_locked

void rebuild_sched_domains(void) { + get_online_cpus(); mutex_lock(&cpuset_mutex); rebuild_sched_domains_locked(); mutex_unlock(&cpuset_mutex); + put_online_cpus(); }

/** @@ -1617,6 +1617,7 @@ static int cpuset_write_u64(struct cgrou cpuset_filetype_t type = cft->private; int retval = 0;

+ get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) { retval = -ENODEV; @@ -1654,6 +1655,7 @@ static int cpuset_write_u64(struct cgrou } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; }

@@ -1664,6 +1666,7 @@ static int cpuset_write_s64(struct cgrou cpuset_filetype_t type = cft->private; int retval = -ENODEV;

+ get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1678,6 +1681,7 @@ static int cpuset_write_s64(struct cgrou } out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return retval; }

@@ -1716,6 +1720,7 @@ static ssize_t cpuset_write_resmask(stru kernfs_break_active_protection(of->kn); flush_work(&cpuset_hotplug_work);

+ get_online_cpus(); mutex_lock(&cpuset_mutex); if (!is_cpuset_online(cs)) goto out_unlock; @@ -1741,6 +1746,7 @@ static ssize_t cpuset_write_resmask(stru free_trial_cpuset(trialcs); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); kernfs_unbreak_active_protection(of->kn); css_put(&cs->css); flush_workqueue(cpuset_migrate_mm_wq); @@ -1985,6 +1991,7 @@ static int cpuset_css_online(struct cgro if (!parent) return 0;

+ get_online_cpus(); mutex_lock(&cpuset_mutex);

set_bit(CS_ONLINE, &cs->flags); @@ -2035,6 +2042,7 @@ static int cpuset_css_online(struct cgro spin_unlock_irq(&callback_lock); out_unlock: mutex_unlock(&cpuset_mutex); + put_online_cpus(); return 0; }

@@ -2048,6 +2056,7 @@ static void cpuset_css_offline(struct cg { struct cpuset *cs = css_cs(css);

+ get_online_cpus(); mutex_lock(&cpuset_mutex);

if (is_sched_load_balance(cs)) @@ -2057,6 +2066,7 @@ static void cpuset_css_offline(struct cg clear_bit(CS_ONLINE, &cs->flags);

mutex_unlock(&cpuset_mutex); + put_online_cpus(); }

static void cpuset_css_free(struct cgroup_subsys_state *css)

From: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp

commit 43626dade36fa74d3329046f4ae2d7fdefe401c6 upstream.

syzbot is hitting percpu_rwsem_assert_held(&cpu_hotplug_lock) warning at cpuset_attach() [1], for commit 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") missed that cpuset_attach() is also called from cgroup_attach_task_all(). Add cpus_read_lock() like what cgroup_procs_write_start() does.

Link: https://syzkaller.appspot.com/bug?extid=29d3a3b4d86c8136ad9e [1] Reported-by: syzbot syzbot+29d3a3b4d86c8136ad9e@syzkaller.appspotmail.com Signed-off-by: Tetsuo Handa penguin-kernel@I-love.SAKURA.ne.jp Fixes: 4f7e7236435ca0ab ("cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock") Signed-off-by: Tejun Heo tj@kernel.org Signed-off-by: Cai Xinchen caixinchen1@huawei.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- kernel/cgroup/cgroup-v1.c | 3 +++ 1 file changed, 3 insertions(+)

--- a/kernel/cgroup/cgroup-v1.c +++ b/kernel/cgroup/cgroup-v1.c @@ -13,6 +13,7 @@ #include <linux/delayacct.h> #include <linux/pid_namespace.h> #include <linux/cgroupstats.h> +#include <linux/cpu.h>

#include <trace/events/cgroup.h>

@@ -55,6 +56,7 @@ int cgroup_attach_task_all(struct task_s int retval = 0;

mutex_lock(&cgroup_mutex); + get_online_cpus(); percpu_down_write(&cgroup_threadgroup_rwsem); for_each_root(root) { struct cgroup *from_cgrp; @@ -71,6 +73,7 @@ int cgroup_attach_task_all(struct task_s break; } percpu_up_write(&cgroup_threadgroup_rwsem); + put_online_cpus(); mutex_unlock(&cgroup_mutex);

return retval;