--- /dev/null
+From cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Tue, 29 Jul 2025 18:28:07 +0900
+Subject: ata: libata-scsi: Fix ata_to_sense_error() status handling
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 upstream.
+
+Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()")
+inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in
+the function ata_to_sense_error(). This entry ties a failed qc which has
+a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with
+the additional sense code UNALIGNED WRITE COMMAND. This entry will be
+used to generate a failed qc sense key and sense code when the qc is
+missing sense data and there is no match for the qc error field in the
+sense_table array of ata_to_sense_error().
+
+As a result, for a failed qc for which we failed to get sense data (e.g.
+read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT
+command failed for the non-ncq case, the user very often end up seeing
+the completely misleading "unaligned write command" error, even if qc
+was not a write command. E.g.:
+
+sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
+sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current]
+sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command
+sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
+I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
+
+Fix this by removing the ATA_DRDY entry from the stat_table array so
+that we default to always returning ABORTED COMMAND without any
+additional sense code, since we do not know any better. The entry 0x08
+(ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity
+error is also misleading (as a parity error would likely be signaled
+through a bus error). So for this case, also default to returning
+ABORTED COMMAND without any additional sense code. With this, the
+previous example error case becomes:
+
+sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s
+sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current]
+sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information
+sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00
+I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0
+
+Together with these fixes, refactor stat_table to make it more readable
+by putting the entries comments in front of the entries and using the
+defined status bits macros instead of hardcoded values.
+
+Reported-by: Lorenz Brun <lorenz@brun.one>
+Reported-by: Brandon Schwartz <Brandon.Schwartz@wdc.com>
+Fixes: 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()")
+Cc: stable@vger.kernel.org
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-scsi.c | 20 ++++++++------------
+ 1 file changed, 8 insertions(+), 12 deletions(-)
+
+--- a/drivers/ata/libata-scsi.c
++++ b/drivers/ata/libata-scsi.c
+@@ -984,18 +984,14 @@ static void ata_to_sense_error(unsigned
+ {0xFF, 0xFF, 0xFF, 0xFF}, // END mark
+ };
+ static const unsigned char stat_table[][4] = {
+- /* Must be first because BUSY means no other bits valid */
+- {0x80, ABORTED_COMMAND, 0x47, 0x00},
+- // Busy, fake parity for now
+- {0x40, ILLEGAL_REQUEST, 0x21, 0x04},
+- // Device ready, unaligned write command
+- {0x20, HARDWARE_ERROR, 0x44, 0x00},
+- // Device fault, internal target failure
+- {0x08, ABORTED_COMMAND, 0x47, 0x00},
+- // Timed out in xfer, fake parity for now
+- {0x04, RECOVERED_ERROR, 0x11, 0x00},
+- // Recovered ECC error Medium error, recovered
+- {0xFF, 0xFF, 0xFF, 0xFF}, // END mark
++ /* Busy: must be first because BUSY means no other bits valid */
++ { ATA_BUSY, ABORTED_COMMAND, 0x00, 0x00 },
++ /* Device fault: INTERNAL TARGET FAILURE */
++ { ATA_DF, HARDWARE_ERROR, 0x44, 0x00 },
++ /* Corrected data error */
++ { ATA_CORR, RECOVERED_ERROR, 0x00, 0x00 },
++
++ { 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */
+ };
+
+ /*
--- /dev/null
+From b4cc4a4077268522e3d0d34de4b2dc144e2330fa Mon Sep 17 00:00:00 2001
+From: Andreas Dilger <adilger@dilger.ca>
+Date: Wed, 16 Jul 2025 19:36:42 -0600
+Subject: ext4: check fast symlink for ea_inode correctly
+
+From: Andreas Dilger <adilger@dilger.ca>
+
+commit b4cc4a4077268522e3d0d34de4b2dc144e2330fa upstream.
+
+The check for a fast symlink in the presence of only an
+external xattr inode is incorrect. If a fast symlink does
+not have an xattr block (i_file_acl == 0), but does have
+an external xattr inode that increases inode i_blocks, then
+the check for a fast symlink will incorrectly fail and
+__ext4_iget()->ext4_ind_check_inode() will report the inode
+is corrupt when it "validates" i_data[] on the next read:
+
+ # ln -s foo /mnt/tmp/bar
+ # setfattr -h -n trusted.test \
+ -v "$(yes | head -n 4000)" /mnt/tmp/bar
+ # umount /mnt/tmp
+ # mount /mnt/tmp
+ # ls -l /mnt/tmp
+ ls: cannot access '/mnt/tmp/bar': Structure needs cleaning
+ total 4
+ ? l?????????? ? ? ? ? ? bar
+ # dmesg | tail -1
+ EXT4-fs error (device dm-8): __ext4_iget:5098:
+ inode #24578: block 7303014: comm ls: invalid block
+
+(note that "block 7303014" = 0x6f6f66 = "foo" in LE order).
+
+ext4_inode_is_fast_symlink() should check the superblock
+EXT4_FEATURE_INCOMPAT_EA_INODE feature flag, not the inode
+EXT4_EA_INODE_FL, since the latter is only set on the xattr
+inode itself, and not on the inode that uses this xattr.
+
+Cc: stable@vger.kernel.org
+Fixes: fc82228a5e38 ("ext4: support fast symlinks from ext3 file systems")
+Signed-off-by: Andreas Dilger <adilger@whamcloud.com>
+Reviewed-by: Li Dongyang <dongyangli@ddn.com>
+Reviewed-by: Alex Zhuravlev <bzzz@whamcloud.com>
+Reviewed-by: Oleg Drokin <green@whamcloud.com>
+Reviewed-on: https://review.whamcloud.com/59879
+Lustre-bug-id: https://jira.whamcloud.com/browse/LU-19121
+Link: https://patch.msgid.link/20250717063709.757077-1-adilger@dilger.ca
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -150,7 +150,7 @@ static int ext4_meta_trans_blocks(struct
+ */
+ int ext4_inode_is_fast_symlink(struct inode *inode)
+ {
+- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
++ if (!ext4_has_feature_ea_inode(inode->i_sb)) {
+ int ea_blocks = EXT4_I(inode)->i_file_acl ?
+ EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0;
+
--- /dev/null
+From bae76c035bf0852844151e68098c9b7cd63ef238 Mon Sep 17 00:00:00 2001
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Date: Tue, 5 Aug 2025 14:00:30 +0530
+Subject: ext4: fix fsmap end of range reporting with bigalloc
+
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+
+commit bae76c035bf0852844151e68098c9b7cd63ef238 upstream.
+
+With bigalloc enabled, the logic to report last extent has a bug since
+we try to use cluster units instead of block units. This can cause an
+issue where extra incorrect entries might be returned back to the
+user. This was flagged by generic/365 with 64k bs and -O bigalloc.
+
+** Details of issue **
+
+The issue was noticed on 5G 64k blocksize FS with -O bigalloc which has
+only 1 bg.
+
+$ xfs_io -c "fsmap -d" /mnt/scratch
+
+ 0: 253:48 [0..127]: static fs metadata 128 /* sb */
+ 1: 253:48 [128..255]: special 102:1 128 /* gdt */
+ 3: 253:48 [256..383]: special 102:3 128 /* block bitmap */
+ 4: 253:48 [384..2303]: unknown 1920 /* flex bg empty space */
+ 5: 253:48 [2304..2431]: special 102:4 128 /* inode bitmap */
+ 6: 253:48 [2432..4351]: unknown 1920 /* flex bg empty space */
+ 7: 253:48 [4352..6911]: inodes 2560
+ 8: 253:48 [6912..538623]: unknown 531712
+ 9: 253:48 [538624..10485759]: free space 9947136
+
+The issue can be seen with:
+
+$ xfs_io -c "fsmap -d 0 3" /mnt/scratch
+
+ 0: 253:48 [0..127]: static fs metadata 128
+ 1: 253:48 [384..2047]: unknown 1664
+
+Only the first entry was expected to be returned but we get 2. This is
+because:
+
+ext4_getfsmap_datadev()
+ first_cluster, last_cluster = 0
+ ...
+ info->gfi_last = true;
+ ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, 0, info);
+ fsb = C2B(1) = 16
+ fslen = 0
+ ...
+ /* Merge in any relevant extents from the meta_list */
+ list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) {
+ ...
+ // since fsb = 16, considers all metadata which starts before 16 blockno
+ iter 1: error = ext4_getfsmap_helper(sb, info, p); // p = sb (0,1), nop
+ info->gfi_next_fsblk = 1
+ iter 2: error = ext4_getfsmap_helper(sb, info, p); // p = gdt (1,2), nop
+ info->gfi_next_fsblk = 2
+ iter 3: error = ext4_getfsmap_helper(sb, info, p); // p = blk bitmap (2,3), nop
+ info->gfi_next_fsblk = 3
+ iter 4: error = ext4_getfsmap_helper(sb, info, p); // p = ino bitmap (18,19)
+ if (rec_blk > info->gfi_next_fsblk) { // (18 > 3)
+ // emits an extra entry ** BUG **
+ }
+ }
+
+Fix this by directly calling ext4_getfsmap_datadev() with a dummy
+record that has fmr_physical set to (end_fsb + 1) instead of
+last_cluster + 1. By using the block instead of cluster we get the
+correct behavior.
+
+Replacing ext4_getfsmap_datadev_helper() with ext4_getfsmap_helper()
+is okay since the gfi_lastfree and metadata checks in
+ext4_getfsmap_datadev_helper() are anyways redundant when we only want
+to emit the last allocated block of the range, as we have already
+taken care of emitting metadata and any last free blocks.
+
+Cc: stable@kernel.org
+Reported-by: Disha Goel <disgoel@linux.ibm.com>
+Fixes: 4a622e4d477b ("ext4: fix FS_IOC_GETFSMAP handling")
+Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Link: https://patch.msgid.link/e7472c8535c9c5ec10f425f495366864ea12c9da.1754377641.git.ojaswin@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/fsmap.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/fs/ext4/fsmap.c
++++ b/fs/ext4/fsmap.c
+@@ -526,6 +526,7 @@ static int ext4_getfsmap_datadev(struct
+ ext4_group_t end_ag;
+ ext4_grpblk_t first_cluster;
+ ext4_grpblk_t last_cluster;
++ struct ext4_fsmap irec;
+ int error = 0;
+
+ bofs = le32_to_cpu(sbi->s_es->s_first_data_block);
+@@ -609,10 +610,18 @@ static int ext4_getfsmap_datadev(struct
+ goto err;
+ }
+
+- /* Report any gaps at the end of the bg */
++ /*
++ * The dummy record below will cause ext4_getfsmap_helper() to report
++ * any allocated blocks at the end of the range.
++ */
++ irec.fmr_device = 0;
++ irec.fmr_physical = end_fsb + 1;
++ irec.fmr_length = 0;
++ irec.fmr_owner = EXT4_FMR_OWN_FREE;
++ irec.fmr_flags = 0;
++
+ info->gfi_last = true;
+- error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1,
+- 0, info);
++ error = ext4_getfsmap_helper(sb, info, &irec);
+ if (error)
+ goto err;
+
--- /dev/null
+From 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 Mon Sep 17 00:00:00 2001
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Date: Tue, 5 Aug 2025 14:00:31 +0530
+Subject: ext4: fix reserved gdt blocks handling in fsmap
+
+From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+
+commit 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 upstream.
+
+In some cases like small FSes with no meta_bg and where the resize
+doesn't need extra gdt blocks as it can fit in the current one,
+s_reserved_gdt_blocks is set as 0, which causes fsmap to emit a 0
+length entry, which is incorrect.
+
+ $ mkfs.ext4 -b 65536 -O bigalloc /dev/sda 5G
+ $ mount /dev/sda /mnt/scratch
+ $ xfs_io -c "fsmap -d" /mnt/scartch
+
+ 0: 253:48 [0..127]: static fs metadata 128
+ 1: 253:48 [128..255]: special 102:1 128
+ 2: 253:48 [256..255]: special 102:2 0 <---- 0 len entry
+ 3: 253:48 [256..383]: special 102:3 128
+
+Fix this by adding a check for this case.
+
+Cc: stable@kernel.org
+Fixes: 0c9ec4beecac ("ext4: support GETFSMAP ioctls")
+Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Link: https://patch.msgid.link/08781b796453a5770112aa96ad14c864fbf31935.1754377641.git.ojaswin@linux.ibm.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/fsmap.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/fs/ext4/fsmap.c
++++ b/fs/ext4/fsmap.c
+@@ -393,6 +393,14 @@ static unsigned int ext4_getfsmap_find_s
+ /* Reserved GDT blocks */
+ if (!ext4_has_feature_meta_bg(sb) || metagroup < first_meta_bg) {
+ len = le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks);
++
++ /*
++ * mkfs.ext4 can set s_reserved_gdt_blocks as 0 in some cases,
++ * check for that.
++ */
++ if (!len)
++ return 0;
++
+ error = ext4_getfsmap_fill(meta_list, fsb, len,
+ EXT4_FMR_OWN_RESV_GDT);
+ if (error)
--- /dev/null
+From e4fc307d8e24f122402907ebf585248cad52841d Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 2 Aug 2025 21:34:37 +0200
+Subject: Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()"
+
+From: Helge Deller <deller@gmx.de>
+
+commit e4fc307d8e24f122402907ebf585248cad52841d upstream.
+
+This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003.
+
+The patch is wrong as it checks vc_origin against vc_screenbuf,
+while in text mode it should compare against vga_vram_base.
+
+As such it broke VGA text scrolling, which can be reproduced like this:
+(1) boot a kernel that is configured to use text mode VGA-console
+(2) type commands: ls -l /usr/bin | less -S
+(3) scroll up/down with cursor-down/up keys
+
+Reported-by: Jari Ruusu <jariruusu@protonmail.com>
+Cc: stable@vger.kernel.org
+Cc: Yi Yang <yiyang13@huawei.com>
+Cc: GONG Ruiqi <gongruiqi1@huawei.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/video/console/vgacon.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -1198,7 +1198,7 @@ static bool vgacon_scroll(struct vc_data
+ c->vc_screenbuf_size - delta);
+ c->vc_origin = vga_vram_end - c->vc_screenbuf_size;
+ vga_rolled_over = 0;
+- } else if (oldo - delta >= (unsigned long)c->vc_screenbuf)
++ } else
+ c->vc_origin -= delta;
+ c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size;
+ scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char,
usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch
vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch
vt-defkeymap-map-keycodes-above-127-to-k_hole.patch
+revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch
+ext4-check-fast-symlink-for-ea_inode-correctly.patch
+ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch
+ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch
+ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
