6.6-stable patches

added patches:
	comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch
	ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch

diff --git a/queue-6.6/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch b/queue-6.6/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch
new file mode 100644 (file)
index 0000000..8c0a895
--- /dev/null
+++ b/queue-6.6/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch
@@ -0,0 +1,36 @@
+From 44d9b3f584c59a606b521e7274e658d5b866c699 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Tue, 15 Apr 2025 13:39:01 +0100
+Subject: comedi: jr3_pci: Fix synchronous deletion of timer
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit 44d9b3f584c59a606b521e7274e658d5b866c699 upstream.
+
+When `jr3_pci_detach()` is called during device removal, it calls
+`timer_delete_sync()` to stop the timer, but the timer expiry function
+always reschedules the timer, so the synchronization is ineffective.
+
+Call `timer_shutdown_sync()` instead.  It does not matter that the timer
+expiry function pointer is cleared, because the device is being removed.
+
+Fixes: 07b509e6584a5 ("Staging: comedi: add jr3_pci driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20250415123901.13483-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/comedi/drivers/jr3_pci.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/comedi/drivers/jr3_pci.c
++++ b/drivers/comedi/drivers/jr3_pci.c
+@@ -758,7 +758,7 @@ static void jr3_pci_detach(struct comedi
+       struct jr3_pci_dev_private *devpriv = dev->private;
+ 
+       if (devpriv)
+-              del_timer_sync(&devpriv->timer);
++              timer_shutdown_sync(&devpriv->timer);
+ 
+       comedi_pci_detach(dev);
+ }

diff --git a/queue-6.6/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch b/queue-6.6/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch
new file mode 100644 (file)
index 0000000..dc53054
--- /dev/null
+++ b/queue-6.6/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch
@@ -0,0 +1,57 @@
+From 7e91ae31e2d264155dfd102101afc2de7bd74a64 Mon Sep 17 00:00:00 2001
+From: Baokun Li <libaokun1@huawei.com>
+Date: Thu, 13 Feb 2025 19:22:47 +0800
+Subject: ext4: goto right label 'out_mmap_sem' in ext4_setattr()
+
+From: Baokun Li <libaokun1@huawei.com>
+
+commit 7e91ae31e2d264155dfd102101afc2de7bd74a64 upstream.
+
+Otherwise, if ext4_inode_attach_jinode() fails, a hung task will
+happen because filemap_invalidate_unlock() isn't called to unlock
+mapping->invalidate_lock. Like this:
+
+EXT4-fs error (device sda) in ext4_setattr:5557: Out of memory
+INFO: task fsstress:374 blocked for more than 122 seconds.
+      Not tainted 6.14.0-rc1-next-20250206-xfstests-dirty #726
+"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
+task:fsstress state:D stack:0     pid:374   tgid:374   ppid:373
+                                  task_flags:0x440140 flags:0x00000000
+Call Trace:
+ <TASK>
+ __schedule+0x2c9/0x7f0
+ schedule+0x27/0xa0
+ schedule_preempt_disabled+0x15/0x30
+ rwsem_down_read_slowpath+0x278/0x4c0
+ down_read+0x59/0xb0
+ page_cache_ra_unbounded+0x65/0x1b0
+ filemap_get_pages+0x124/0x3e0
+ filemap_read+0x114/0x3d0
+ vfs_read+0x297/0x360
+ ksys_read+0x6c/0xe0
+ do_syscall_64+0x4b/0x110
+ entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+Fixes: c7fc0366c656 ("ext4: partial zero eof block on unaligned inode size extension")
+Signed-off-by: Baokun Li <libaokun1@huawei.com>
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Brian Foster <bfoster@redhat.com>
+Link: https://patch.msgid.link/20250213112247.3168709-1-libaokun@huaweicloud.com
+Signed-off-by: Theodore Ts'o <tytso@mit.edu>
+Signed-off-by: Ricardo Cañuelo Navarro <rcn@igalia.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ext4/inode.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -5479,7 +5479,7 @@ int ext4_setattr(struct mnt_idmap *idmap
+                           oldsize & (inode->i_sb->s_blocksize - 1)) {
+                               error = ext4_inode_attach_jinode(inode);
+                               if (error)
+-                                      goto err_out;
++                                      goto out_mmap_sem;
+                       }
+ 
+                       handle = ext4_journal_start(inode, EXT4_HT_INODE, 3);

diff --git a/queue-6.6/series b/queue-6.6/series
index 98b1259479fc00e8372d5c069b820735acc7e42d..4c9556a09523397a97fe35120b0cc22a73d2e597 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -191,3 +191,5 @@ revert-drivers-core-synchronize-really_probe-and-dev_uevent.patch
 driver-core-introduce-device_set_driver-helper.patch
 driver-core-fix-potential-null-pointer-dereference-in-dev_uevent.patch
 vmxnet3-fix-malformed-packet-sizing-in-vmxnet3_process_xdp.patch
+comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch
+ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch