6.12-stable patches

added patches:
	md-fix-linear_set_limits.patch
	md-md-linear-fix-a-null-vs-is_err-bug-in-linear_add.patch
	x86-mm-convert-unreachable-to-bug.patch

diff --git a/queue-6.12/md-fix-linear_set_limits.patch b/queue-6.12/md-fix-linear_set_limits.patch
new file mode 100644 (file)
index 0000000..4be3e0f
--- /dev/null
+++ b/queue-6.12/md-fix-linear_set_limits.patch
@@ -0,0 +1,46 @@
+From a572593ac80e51eb69ecede7e614289fcccdbf8d Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 29 Jan 2025 14:56:35 -0800
+Subject: md: Fix linear_set_limits()
+
+From: Bart Van Assche <bvanassche@acm.org>
+
+commit a572593ac80e51eb69ecede7e614289fcccdbf8d upstream.
+
+queue_limits_cancel_update() must only be called if
+queue_limits_start_update() is called first. Remove the
+queue_limits_cancel_update() call from linear_set_limits() because
+there is no corresponding queue_limits_start_update() call.
+
+This bug was discovered by annotating all mutex operations with clang
+thread-safety attributes and by building the kernel with clang and
+-Wthread-safety.
+
+Cc: Yu Kuai <yukuai3@huawei.com>
+Cc: Coly Li <colyli@kernel.org>
+Cc: Mike Snitzer <snitzer@kernel.org>
+Cc: Christoph Hellwig <hch@lst.de>
+Fixes: 127186cfb184 ("md: reintroduce md-linear")
+Signed-off-by: Bart Van Assche <bvanassche@acm.org>
+Reviewed-by: Christoph Hellwig <hch@lst.de>
+Link: https://lore.kernel.org/r/20250129225636.2667932-1-bvanassche@acm.org
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md-linear.c |    4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/md/md-linear.c
++++ b/drivers/md/md-linear.c
+@@ -76,10 +76,8 @@ static int linear_set_limits(struct mdde
+       lim.max_write_zeroes_sectors = mddev->chunk_sectors;
+       lim.io_min = mddev->chunk_sectors << 9;
+       err = mddev_stack_rdev_limits(mddev, &lim, MDDEV_STACK_INTEGRITY);
+-      if (err) {
+-              queue_limits_cancel_update(mddev->gendisk->queue);
++      if (err)
+               return err;
+-      }
+ 
+       return queue_limits_set(mddev->gendisk->queue, &lim);
+ }

diff --git a/queue-6.12/md-md-linear-fix-a-null-vs-is_err-bug-in-linear_add.patch b/queue-6.12/md-md-linear-fix-a-null-vs-is_err-bug-in-linear_add.patch
new file mode 100644 (file)
index 0000000..40944c9
--- /dev/null
+++ b/queue-6.12/md-md-linear-fix-a-null-vs-is_err-bug-in-linear_add.patch
@@ -0,0 +1,35 @@
+From 62c552070a980363d55a6082b432ebd1cade7a6e Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Wed, 15 Jan 2025 09:53:52 +0300
+Subject: md/md-linear: Fix a NULL vs IS_ERR() bug in linear_add()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit 62c552070a980363d55a6082b432ebd1cade7a6e upstream.
+
+The linear_conf() returns error pointers, it doesn't return NULL.  Update
+the error checking to match.
+
+Fixes: 127186cfb184 ("md: reintroduce md-linear")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Link: https://lore.kernel.org/r/add654be-759f-4b2d-93ba-a3726dae380c@stanley.mountain
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/md/md-linear.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/md-linear.c
++++ b/drivers/md/md-linear.c
+@@ -204,8 +204,8 @@ static int linear_add(struct mddev *mdde
+       rdev->saved_raid_disk = -1;
+ 
+       newconf = linear_conf(mddev, mddev->raid_disks + 1);
+-      if (!newconf)
+-              return -ENOMEM;
++      if (IS_ERR(newconf))
++              return PTR_ERR(newconf);
+ 
+       /* newconf->raid_disks already keeps a copy of * the increased
+        * value of mddev->raid_disks, WARN_ONCE() is just used to make

diff --git a/queue-6.12/series b/queue-6.12/series
index 5284c74a36fa6168eacccc90b777d83014c8855a..3a035da477b4e05c1693d1494c7fa49cc2b40071 100644 (file)
--- a/queue-6.12/series
+++ b/queue-6.12/series
@@ -409,3 +409,6 @@ spi-atmel-qspi-memory-barriers-after-memory-mapped-i-o.patch
 revert-btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
 btrfs-avoid-monopolizing-a-core-when-activating-a-swap-file.patch
 mptcp-prevent-excessive-coalescing-on-receive.patch
+x86-mm-convert-unreachable-to-bug.patch
+md-md-linear-fix-a-null-vs-is_err-bug-in-linear_add.patch
+md-fix-linear_set_limits.patch

diff --git a/queue-6.12/x86-mm-convert-unreachable-to-bug.patch b/queue-6.12/x86-mm-convert-unreachable-to-bug.patch
new file mode 100644 (file)
index 0000000..81f6ab5
--- /dev/null
+++ b/queue-6.12/x86-mm-convert-unreachable-to-bug.patch
@@ -0,0 +1,37 @@
+From 41a1e976623eb430f7b5a8619d3810b44e6235ad Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Mon, 16 Dec 2024 11:08:12 +0100
+Subject: x86/mm: Convert unreachable() to BUG()
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 41a1e976623eb430f7b5a8619d3810b44e6235ad upstream.
+
+Commit 2190966fbc14 ("x86: Convert unreachable() to BUG()") missed
+one.
+
+And after commit 06e24745985c ("objtool: Remove
+annotate_{,un}reachable()") the invalid use of unreachable()
+(rightfully) triggers warnings:
+
+  vmlinux.o: warning: objtool: page_fault_oops() falls through to next function is_prefetch()
+
+Fixes: 2190966fbc14 ("x86: Convert unreachable() to BUG()")
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lkml.kernel.org/r/20241216093215.GD12338@noisy.programming.kicks-ass.net
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/x86/mm/fault.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/mm/fault.c
++++ b/arch/x86/mm/fault.c
+@@ -678,7 +678,7 @@ page_fault_oops(struct pt_regs *regs, un
+                             ASM_CALL_ARG3,
+                             , [arg1] "r" (regs), [arg2] "r" (address), [arg3] "r" (&info));
+ 
+-              unreachable();
++              BUG();
+       }
+ #endif
+