--- /dev/null
+From 4b21a669ca21ed8f24ef4530b2918be5730114de Mon Sep 17 00:00:00 2001
+From: Kailang Yang <kailang@realtek.com>
+Date: Fri, 10 Nov 2023 15:16:06 +0800
+Subject: ALSA: hda/realtek - Add Dell ALC295 to pin fall back table
+
+From: Kailang Yang <kailang@realtek.com>
+
+commit 4b21a669ca21ed8f24ef4530b2918be5730114de upstream.
+
+Add ALC295 to pin fall back table.
+Remove 5 pin quirks for Dell ALC295.
+ALC295 was only support MIC2 for external MIC function.
+ALC295 assigned model "ALC269_FIXUP_DELL1_MIC_NO_PRESENCE" for pin
+fall back table.
+It was assigned wrong model. So, let's remove it.
+
+Fixes: fbc571290d9f ("ALSA: hda/realtek - Fixed Headphone Mic can't record on Dell platform")
+Signed-off-by: Kailang Yang <kailang@realtek.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/7c1998e873834df98d59bd7e0d08c72e@realtek.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 19 +++----------------
+ 1 file changed, 3 insertions(+), 16 deletions(-)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -10592,22 +10592,6 @@ static const struct snd_hda_pin_quirk al
+ {0x12, 0x90a60130},
+ {0x17, 0x90170110},
+ {0x21, 0x03211020}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+- {0x14, 0x90170110},
+- {0x21, 0x04211020}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+- {0x14, 0x90170110},
+- {0x21, 0x04211030}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+- ALC295_STANDARD_PINS,
+- {0x17, 0x21014020},
+- {0x18, 0x21a19030}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+- ALC295_STANDARD_PINS,
+- {0x17, 0x21014040},
+- {0x18, 0x21a19050}),
+- SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
+- ALC295_STANDARD_PINS),
+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+ ALC298_STANDARD_PINS,
+ {0x17, 0x90170110}),
+@@ -10651,6 +10635,9 @@ static const struct snd_hda_pin_quirk al
+ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
+ {0x19, 0x40000000},
+ {0x1b, 0x40000000}),
++ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE,
++ {0x19, 0x40000000},
++ {0x1b, 0x40000000}),
+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+ {0x19, 0x40000000},
+ {0x1a, 0x40000000}),
--- /dev/null
+From 5d639b60971f003d3a9b2b31f8ec73b0718b5d57 Mon Sep 17 00:00:00 2001
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+Date: Wed, 15 Nov 2023 16:21:16 +0000
+Subject: ALSA: hda/realtek: Add quirks for HP Laptops
+
+From: Stefan Binding <sbinding@opensource.cirrus.com>
+
+commit 5d639b60971f003d3a9b2b31f8ec73b0718b5d57 upstream.
+
+These HP laptops use Realtek HDA codec combined with 2 or 4 CS35L41
+Amplifiers using SPI with Internal Boost.
+
+Signed-off-by: Stefan Binding <sbinding@opensource.cirrus.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231115162116.494968-3-sbinding@opensource.cirrus.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9694,6 +9694,9 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8c70, "HP EliteBook 835 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c71, "HP EliteBook 845 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8c72, "HP EliteBook 865 G11", ALC287_FIXUP_CS35L41_I2C_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8ca4, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8ca7, "HP ZBook Fury", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8cf5, "HP ZBook Studio 16", ALC245_FIXUP_CS35L41_SPI_4_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
--- /dev/null
+From 713f040cd22285fcc506f40a0d259566e6758c3c Mon Sep 17 00:00:00 2001
+From: Chandradeep Dey <codesigning@chandradeepdey.com>
+Date: Sat, 11 Nov 2023 19:25:49 +0100
+Subject: ALSA: hda/realtek - Enable internal speaker of ASUS K6500ZC
+
+From: Chandradeep Dey <codesigning@chandradeepdey.com>
+
+commit 713f040cd22285fcc506f40a0d259566e6758c3c upstream.
+
+Apply the already existing quirk chain ALC294_FIXUP_ASUS_SPK to enable
+the internal speaker of ASUS K6500ZC.
+
+Signed-off-by: Chandradeep Dey <codesigning@chandradeepdey.com>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/NizcVHQ--3-9@chandradeepdey.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9699,6 +9699,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x1043, 0x10a1, "ASUS UX391UA", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x10c0, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC),
+ SND_PCI_QUIRK(0x1043, 0x10d0, "ASUS X540LA/X540LJ", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
++ SND_PCI_QUIRK(0x1043, 0x10d3, "ASUS K6500ZC", ALC294_FIXUP_ASUS_SPK),
+ SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x1043, 0x11c0, "ASUS X556UR", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1043, 0x125e, "ASUS Q524UQK", ALC255_FIXUP_ASUS_MIC_NO_PRESENCE),
--- /dev/null
+From b944aa9d86d5f782bfe5e51336434c960304839c Mon Sep 17 00:00:00 2001
+From: Matus Malych <matus@malych.org>
+Date: Tue, 14 Nov 2023 14:35:25 +0100
+Subject: ALSA: hda/realtek: Enable Mute LED on HP 255 G10
+
+From: Matus Malych <matus@malych.org>
+
+commit b944aa9d86d5f782bfe5e51336434c960304839c upstream.
+
+HP 255 G10 has a mute LED that can be made to work using quirk
+ALC236_FIXUP_HP_MUTE_LED_COEFBIT2.
+Enable already existing quirk - at correct line to keep order
+
+Signed-off-by: Matus Malych <matus@malych.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231114133524.11340-1-matus@malych.org
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9660,6 +9660,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8abb, "HP ZBook Firefly 14 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ad1, "HP EliteBook 840 14 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8ad2, "HP EliteBook 860 16 inch G9 Notebook PC", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
++ SND_PCI_QUIRK(0x103c, 0x8b2f, "HP 255 15.6 inch G10 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8b42, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8b43, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8b44, "HP", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
--- /dev/null
+From 8384c0baf223e1c3bc7b1c711d80a4c6106d210e Mon Sep 17 00:00:00 2001
+From: Eymen Yigit <eymenyg01@gmail.com>
+Date: Fri, 10 Nov 2023 18:07:15 +0300
+Subject: ALSA: hda/realtek: Enable Mute LED on HP 255 G8
+
+From: Eymen Yigit <eymenyg01@gmail.com>
+
+commit 8384c0baf223e1c3bc7b1c711d80a4c6106d210e upstream.
+
+This HP Notebook uses ALC236 codec with COEF 0x07 idx 1 controlling
+the mute LED. Enable already existing quirk for this device.
+
+Signed-off-by: Eymen Yigit <eymenyg01@gmail.com>
+Cc: Luka Guzenko <l.guzenko@web.de>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231110150715.5141-1-eymenyg01@gmail.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/pci/hda/patch_realtek.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -9624,6 +9624,7 @@ static const struct snd_pci_quirk alc269
+ SND_PCI_QUIRK(0x103c, 0x8898, "HP EliteBook 845 G8 Notebook PC", ALC285_FIXUP_HP_LIMIT_INT_MIC_BOOST),
+ SND_PCI_QUIRK(0x103c, 0x88d0, "HP Pavilion 15-eh1xxx (mainboard 88D0)", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x8902, "HP OMEN 16", ALC285_FIXUP_HP_MUTE_LED),
++ SND_PCI_QUIRK(0x103c, 0x890e, "HP 255 G8 Notebook PC", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
+ SND_PCI_QUIRK(0x103c, 0x8919, "HP Pavilion Aero Laptop 13-be0xxx", ALC287_FIXUP_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x896d, "HP ZBook Firefly 16 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
+ SND_PCI_QUIRK(0x103c, 0x896e, "HP EliteBook x360 830 G9", ALC245_FIXUP_CS35L41_SPI_2_HP_GPIO_LED),
--- /dev/null
+From c7a60651953359f98dbf24b43e1bf561e1573ed4 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Thu, 9 Nov 2023 15:19:54 +0100
+Subject: ALSA: info: Fix potential deadlock at disconnection
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit c7a60651953359f98dbf24b43e1bf561e1573ed4 upstream.
+
+As reported recently, ALSA core info helper may cause a deadlock at
+the forced device disconnection during the procfs operation.
+
+The proc_remove() (that is called from the snd_card_disconnect()
+helper) has a synchronization of the pending procfs accesses via
+wait_for_completion(). Meanwhile, ALSA procfs helper takes the global
+mutex_lock(&info_mutex) at both the proc_open callback and
+snd_card_info_disconnect() helper. Since the proc_open can't finish
+due to the mutex lock, wait_for_completion() never returns, either,
+hence it deadlocks.
+
+ TASK#1 TASK#2
+ proc_reg_open()
+ takes use_pde()
+ snd_info_text_entry_open()
+ snd_card_disconnect()
+ snd_info_card_disconnect()
+ takes mutex_lock(&info_mutex)
+ proc_remove()
+ wait_for_completion(unused_pde)
+ ... waiting task#1 closes
+ mutex_lock(&info_mutex)
+ => DEADLOCK
+
+This patch is a workaround for avoiding the deadlock scenario above.
+
+The basic strategy is to move proc_remove() call outside the mutex
+lock. proc_remove() can work gracefully without extra locking, and it
+can delete the tree recursively alone. So, we call proc_remove() at
+snd_info_card_disconnection() at first, then delete the rest resources
+recursively within the info_mutex lock.
+
+After the change, the function snd_info_disconnect() doesn't do
+disconnection by itself any longer, but it merely clears the procfs
+pointer. So rename the function to snd_info_clear_entries() for
+avoiding confusion.
+
+The similar change is applied to snd_info_free_entry(), too. Since
+the proc_remove() is called only conditionally with the non-NULL
+entry->p, it's skipped after the snd_info_clear_entries() call.
+
+Reported-by: Shinhyung Kang <s47.kang@samsung.com>
+Closes: https://lore.kernel.org/r/664457955.21699345385931.JavaMail.epsvc@epcpadp4
+Reviewed-by: Jaroslav Kysela <perex@perex.cz>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20231109141954.4283-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/core/info.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -56,7 +56,7 @@ struct snd_info_private_data {
+ };
+
+ static int snd_info_version_init(void);
+-static void snd_info_disconnect(struct snd_info_entry *entry);
++static void snd_info_clear_entries(struct snd_info_entry *entry);
+
+ /*
+
+@@ -569,11 +569,16 @@ void snd_info_card_disconnect(struct snd
+ {
+ if (!card)
+ return;
+- mutex_lock(&info_mutex);
++
+ proc_remove(card->proc_root_link);
+- card->proc_root_link = NULL;
+ if (card->proc_root)
+- snd_info_disconnect(card->proc_root);
++ proc_remove(card->proc_root->p);
++
++ mutex_lock(&info_mutex);
++ if (card->proc_root)
++ snd_info_clear_entries(card->proc_root);
++ card->proc_root_link = NULL;
++ card->proc_root = NULL;
+ mutex_unlock(&info_mutex);
+ }
+
+@@ -745,15 +750,14 @@ struct snd_info_entry *snd_info_create_c
+ }
+ EXPORT_SYMBOL(snd_info_create_card_entry);
+
+-static void snd_info_disconnect(struct snd_info_entry *entry)
++static void snd_info_clear_entries(struct snd_info_entry *entry)
+ {
+ struct snd_info_entry *p;
+
+ if (!entry->p)
+ return;
+ list_for_each_entry(p, &entry->children, list)
+- snd_info_disconnect(p);
+- proc_remove(entry->p);
++ snd_info_clear_entries(p);
+ entry->p = NULL;
+ }
+
+@@ -770,8 +774,9 @@ void snd_info_free_entry(struct snd_info
+ if (!entry)
+ return;
+ if (entry->p) {
++ proc_remove(entry->p);
+ mutex_lock(&info_mutex);
+- snd_info_disconnect(entry);
++ snd_info_clear_entries(entry);
+ mutex_unlock(&info_mutex);
+ }
+
--- /dev/null
+From 776a838f1fa95670c1c1cf7109a898090b473fa3 Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naohiro.aota@wdc.com>
+Date: Tue, 17 Oct 2023 17:00:31 +0900
+Subject: btrfs: zoned: wait for data BG to be finished on direct IO allocation
+
+From: Naohiro Aota <naohiro.aota@wdc.com>
+
+commit 776a838f1fa95670c1c1cf7109a898090b473fa3 upstream.
+
+Running the fio command below on a ZNS device results in "Resource
+temporarily unavailable" error.
+
+ $ sudo fio --name=w --directory=/mnt --filesize=1GB --bs=16MB --numjobs=16 \
+ --rw=write --ioengine=libaio --iodepth=128 --direct=1
+
+ fio: io_u error on file /mnt/w.2.0: Resource temporarily unavailable: write offset=117440512, buflen=16777216
+ fio: io_u error on file /mnt/w.2.0: Resource temporarily unavailable: write offset=134217728, buflen=16777216
+ ...
+
+This happens because -EAGAIN error returned from btrfs_reserve_extent()
+called from btrfs_new_extent_direct() is spilling over to the userland.
+
+btrfs_reserve_extent() returns -EAGAIN when there is no active zone
+available. Then, the caller should wait for some other on-going IO to
+finish a zone and retry the allocation.
+
+This logic is already implemented for buffered write in cow_file_range(),
+but it is missing for the direct IO counterpart. Implement the same logic
+for it.
+
+Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Fixes: 2ce543f47843 ("btrfs: zoned: wait until zone is finished when allocation didn't progress")
+CC: stable@vger.kernel.org # 6.1+
+Tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -7166,8 +7166,15 @@ static struct extent_map *btrfs_new_exte
+ int ret;
+
+ alloc_hint = get_extent_allocation_hint(inode, start, len);
++again:
+ ret = btrfs_reserve_extent(root, len, len, fs_info->sectorsize,
+ 0, alloc_hint, &ins, 1, 1);
++ if (ret == -EAGAIN) {
++ ASSERT(btrfs_is_zoned(fs_info));
++ wait_on_bit_io(&inode->root->fs_info->flags, BTRFS_FS_NEED_ZONE_FINISH,
++ TASK_UNINTERRUPTIBLE);
++ goto again;
++ }
+ if (ret)
+ return ERR_PTR(ret);
+
--- /dev/null
+From 6e5e64c9477d58e73cb1a0e83eacad1f8df247cf Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Mon, 30 Oct 2023 11:00:10 +0000
+Subject: cifs: do not reset chan_max if multichannel is not supported at mount
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit 6e5e64c9477d58e73cb1a0e83eacad1f8df247cf upstream.
+
+If the mount command has specified multichannel as a mount option,
+but multichannel is found to be unsupported by the server at the time
+of mount, we set chan_max to 1. Which means that the user needs to
+remount the share if the server starts supporting multichannel.
+
+This change removes this reset. What it means is that if the user
+specified multichannel or max_channels during mount, and at this
+time, multichannel is not supported, but the server starts supporting
+it at a later point, the client will be capable of scaling out the
+number of channels.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/sess.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/smb/client/sess.c
++++ b/fs/smb/client/sess.c
+@@ -186,7 +186,6 @@ int cifs_try_adding_channels(struct cifs
+ }
+
+ if (!(server->capabilities & SMB2_GLOBAL_CAP_MULTI_CHANNEL)) {
+- ses->chan_max = 1;
+ spin_unlock(&ses->chan_lock);
+ cifs_server_dbg(VFS, "no multichannel support\n");
+ return 0;
--- /dev/null
+From d9a6d78096056a3cb5c5f07a730ab92f2f9ac4e6 Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Mon, 30 Oct 2023 11:00:11 +0000
+Subject: cifs: force interface update before a fresh session setup
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit d9a6d78096056a3cb5c5f07a730ab92f2f9ac4e6 upstream.
+
+During a session reconnect, it is possible that the
+server moved to another physical server (happens in case
+of Azure files). So at this time, force a query of server
+interfaces again (in case of multichannel session), such
+that the secondary channels connect to the right
+IP addresses (possibly updated now).
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/connect.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -4205,8 +4205,12 @@ cifs_setup_session(const unsigned int xi
+ is_binding = !CIFS_ALL_CHANS_NEED_RECONNECT(ses);
+ spin_unlock(&ses->chan_lock);
+
+- if (!is_binding)
++ if (!is_binding) {
+ ses->ses_status = SES_IN_SETUP;
++
++ /* force iface_list refresh */
++ ses->iface_last_update = 0;
++ }
+ spin_unlock(&ses->ses_lock);
+
+ /* update ses ip_addr only for primary chan */
--- /dev/null
+From c3326a61cdbf3ce1273d9198b6cbf90965d7e029 Mon Sep 17 00:00:00 2001
+From: Shyam Prasad N <sprasad@microsoft.com>
+Date: Mon, 30 Oct 2023 11:00:09 +0000
+Subject: cifs: reconnect helper should set reconnect for the right channel
+
+From: Shyam Prasad N <sprasad@microsoft.com>
+
+commit c3326a61cdbf3ce1273d9198b6cbf90965d7e029 upstream.
+
+We introduced a helper function to be used by non-cifsd threads to
+mark the connection for reconnect. For multichannel, when only
+a particular channel needs to be reconnected, this had a bug.
+
+This change fixes that by marking that particular channel
+for reconnect.
+
+Fixes: dca65818c80c ("cifs: use a different reconnect helper for non-cifsd threads")
+Cc: stable@vger.kernel.org
+Signed-off-by: Shyam Prasad N <sprasad@microsoft.com>
+Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/connect.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/fs/smb/client/connect.c
++++ b/fs/smb/client/connect.c
+@@ -205,13 +205,14 @@ cifs_signal_cifsd_for_reconnect(struct T
+ /* If server is a channel, select the primary channel */
+ pserver = CIFS_SERVER_IS_CHAN(server) ? server->primary_server : server;
+
+- spin_lock(&pserver->srv_lock);
++ /* if we need to signal just this channel */
+ if (!all_channels) {
+- pserver->tcpStatus = CifsNeedReconnect;
+- spin_unlock(&pserver->srv_lock);
++ spin_lock(&server->srv_lock);
++ if (server->tcpStatus != CifsExiting)
++ server->tcpStatus = CifsNeedReconnect;
++ spin_unlock(&server->srv_lock);
+ return;
+ }
+- spin_unlock(&pserver->srv_lock);
+
+ spin_lock(&cifs_tcp_ses_lock);
+ list_for_each_entry(ses, &pserver->smb_ses_list, smb_ses_list) {
--- /dev/null
+From 9b6304c1d53745c300b86f202d0dcff395e2d2db Mon Sep 17 00:00:00 2001
+From: Jeff Layton <jlayton@kernel.org>
+Date: Wed, 5 Jul 2023 14:58:10 -0400
+Subject: fs: add ctime accessors infrastructure
+
+From: Jeff Layton <jlayton@kernel.org>
+
+commit 9b6304c1d53745c300b86f202d0dcff395e2d2db upstream.
+
+struct timespec64 has unused bits in the tv_nsec field that can be used
+for other purposes. In future patches, we're going to change how the
+inode->i_ctime is accessed in certain inodes in order to make use of
+them. In order to do that safely though, we'll need to eradicate raw
+accesses of the inode->i_ctime field from the kernel.
+
+Add new accessor functions for the ctime that we use to replace them.
+
+Reviewed-by: Jan Kara <jack@suse.cz>
+Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
+Signed-off-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+Message-Id: <20230705185812.579118-2-jlayton@kernel.org>
+Signed-off-by: Christian Brauner <brauner@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/inode.c | 16 ++++++++++++++++
+ include/linux/fs.h | 45 ++++++++++++++++++++++++++++++++++++++++++++-
+ 2 files changed, 60 insertions(+), 1 deletion(-)
+
+--- a/fs/inode.c
++++ b/fs/inode.c
+@@ -2502,6 +2502,22 @@ struct timespec64 current_time(struct in
+ EXPORT_SYMBOL(current_time);
+
+ /**
++ * inode_set_ctime_current - set the ctime to current_time
++ * @inode: inode
++ *
++ * Set the inode->i_ctime to the current value for the inode. Returns
++ * the current value that was assigned to i_ctime.
++ */
++struct timespec64 inode_set_ctime_current(struct inode *inode)
++{
++ struct timespec64 now = current_time(inode);
++
++ inode_set_ctime(inode, now.tv_sec, now.tv_nsec);
++ return now;
++}
++EXPORT_SYMBOL(inode_set_ctime_current);
++
++/**
+ * in_group_or_capable - check whether caller is CAP_FSETID privileged
+ * @mnt_userns: user namespace of the mount @inode was found from
+ * @inode: inode to check
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1812,7 +1812,50 @@ static inline bool fsuidgid_has_mapping(
+ kgid_has_mapping(fs_userns, kgid);
+ }
+
+-extern struct timespec64 current_time(struct inode *inode);
++struct timespec64 current_time(struct inode *inode);
++struct timespec64 inode_set_ctime_current(struct inode *inode);
++
++/**
++ * inode_get_ctime - fetch the current ctime from the inode
++ * @inode: inode from which to fetch ctime
++ *
++ * Grab the current ctime from the inode and return it.
++ */
++static inline struct timespec64 inode_get_ctime(const struct inode *inode)
++{
++ return inode->i_ctime;
++}
++
++/**
++ * inode_set_ctime_to_ts - set the ctime in the inode
++ * @inode: inode in which to set the ctime
++ * @ts: value to set in the ctime field
++ *
++ * Set the ctime in @inode to @ts
++ */
++static inline struct timespec64 inode_set_ctime_to_ts(struct inode *inode,
++ struct timespec64 ts)
++{
++ inode->i_ctime = ts;
++ return ts;
++}
++
++/**
++ * inode_set_ctime - set the ctime in the inode
++ * @inode: inode in which to set the ctime
++ * @sec: tv_sec value to set
++ * @nsec: tv_nsec value to set
++ *
++ * Set the ctime in @inode to { @sec, @nsec }
++ */
++static inline struct timespec64 inode_set_ctime(struct inode *inode,
++ time64_t sec, long nsec)
++{
++ struct timespec64 ts = { .tv_sec = sec,
++ .tv_nsec = nsec };
++
++ return inode_set_ctime_to_ts(inode, ts);
++}
+
+ /*
+ * Snapshotting support.
parisc-pgtable-do-not-drop-upper-5-address-bits-of-physical-address.patch
parisc-power-fix-power-soft-off-when-running-on-qemu.patch
xhci-enable-rpm-on-controllers-that-support-low-power-states.patch
+fs-add-ctime-accessors-infrastructure.patch
+smb3-fix-creating-fifos-when-mounting-with-sfu-mount-option.patch
+smb3-fix-touch-h-of-symlink.patch
+smb3-fix-caching-of-ctime-on-setxattr.patch
+smb-client-fix-use-after-free-bug-in-cifs_debug_data_proc_show.patch
+smb-client-fix-potential-deadlock-when-releasing-mids.patch
+cifs-reconnect-helper-should-set-reconnect-for-the-right-channel.patch
+cifs-force-interface-update-before-a-fresh-session-setup.patch
+cifs-do-not-reset-chan_max-if-multichannel-is-not-supported-at-mount.patch
+xfs-recovery-should-not-clear-di_flushiter-unconditionally.patch
+btrfs-zoned-wait-for-data-bg-to-be-finished-on-direct-io-allocation.patch
+alsa-info-fix-potential-deadlock-at-disconnection.patch
+alsa-hda-realtek-enable-mute-led-on-hp-255-g8.patch
+alsa-hda-realtek-add-dell-alc295-to-pin-fall-back-table.patch
+alsa-hda-realtek-enable-internal-speaker-of-asus-k6500zc.patch
+alsa-hda-realtek-enable-mute-led-on-hp-255-g10.patch
+alsa-hda-realtek-add-quirks-for-hp-laptops.patch
pmdomain-bcm-bcm2835-power-check-if-the-asb-register.patch
pmdomain-imx-make-imx-pgc-power-domain-also-set-the-.patch
cpufreq-stats-fix-buffer-overflow-detection-in-trans.patch
--- /dev/null
+From e6322fd177c6885a21dd4609dc5e5c973d1a2eb7 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@manguebit.com>
+Date: Wed, 25 Oct 2023 14:58:35 -0300
+Subject: smb: client: fix potential deadlock when releasing mids
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+commit e6322fd177c6885a21dd4609dc5e5c973d1a2eb7 upstream.
+
+All release_mid() callers seem to hold a reference of @mid so there is
+no need to call kref_put(&mid->refcount, __release_mid) under
+@server->mid_lock spinlock. If they don't, then an use-after-free bug
+would have occurred anyways.
+
+By getting rid of such spinlock also fixes a potential deadlock as
+shown below
+
+CPU 0 CPU 1
+------------------------------------------------------------------
+cifs_demultiplex_thread() cifs_debug_data_proc_show()
+ release_mid()
+ spin_lock(&server->mid_lock);
+ spin_lock(&cifs_tcp_ses_lock)
+ spin_lock(&server->mid_lock)
+ __release_mid()
+ smb2_find_smb_tcon()
+ spin_lock(&cifs_tcp_ses_lock) *deadlock*
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifsproto.h | 7 ++++++-
+ fs/smb/client/smb2misc.c | 2 +-
+ fs/smb/client/transport.c | 11 +----------
+ 3 files changed, 8 insertions(+), 12 deletions(-)
+
+--- a/fs/smb/client/cifsproto.h
++++ b/fs/smb/client/cifsproto.h
+@@ -79,7 +79,7 @@ extern char *cifs_compose_mount_options(
+ const char *fullpath, const struct dfs_info3_param *ref,
+ char **devname);
+ extern void delete_mid(struct mid_q_entry *mid);
+-extern void release_mid(struct mid_q_entry *mid);
++void __release_mid(struct kref *refcount);
+ extern void cifs_wake_up_task(struct mid_q_entry *mid);
+ extern int cifs_handle_standard(struct TCP_Server_Info *server,
+ struct mid_q_entry *mid);
+@@ -694,4 +694,9 @@ struct super_block *cifs_get_tcon_super(
+ void cifs_put_tcon_super(struct super_block *sb);
+ int cifs_wait_for_server_reconnect(struct TCP_Server_Info *server, bool retry);
+
++static inline void release_mid(struct mid_q_entry *mid)
++{
++ kref_put(&mid->refcount, __release_mid);
++}
++
+ #endif /* _CIFSPROTO_H */
+--- a/fs/smb/client/smb2misc.c
++++ b/fs/smb/client/smb2misc.c
+@@ -787,7 +787,7 @@ __smb2_handle_cancelled_cmd(struct cifs_
+ {
+ struct close_cancelled_open *cancelled;
+
+- cancelled = kzalloc(sizeof(*cancelled), GFP_ATOMIC);
++ cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL);
+ if (!cancelled)
+ return -ENOMEM;
+
+--- a/fs/smb/client/transport.c
++++ b/fs/smb/client/transport.c
+@@ -76,7 +76,7 @@ alloc_mid(const struct smb_hdr *smb_buff
+ return temp;
+ }
+
+-static void __release_mid(struct kref *refcount)
++void __release_mid(struct kref *refcount)
+ {
+ struct mid_q_entry *midEntry =
+ container_of(refcount, struct mid_q_entry, refcount);
+@@ -156,15 +156,6 @@ static void __release_mid(struct kref *r
+ mempool_free(midEntry, cifs_mid_poolp);
+ }
+
+-void release_mid(struct mid_q_entry *mid)
+-{
+- struct TCP_Server_Info *server = mid->server;
+-
+- spin_lock(&server->mid_lock);
+- kref_put(&mid->refcount, __release_mid);
+- spin_unlock(&server->mid_lock);
+-}
+-
+ void
+ delete_mid(struct mid_q_entry *mid)
+ {
--- /dev/null
+From d328c09ee9f15ee5a26431f5aad7c9239fa85e62 Mon Sep 17 00:00:00 2001
+From: Paulo Alcantara <pc@manguebit.com>
+Date: Tue, 24 Oct 2023 13:49:15 -0300
+Subject: smb: client: fix use-after-free bug in cifs_debug_data_proc_show()
+
+From: Paulo Alcantara <pc@manguebit.com>
+
+commit d328c09ee9f15ee5a26431f5aad7c9239fa85e62 upstream.
+
+Skip SMB sessions that are being teared down
+(e.g. @ses->ses_status == SES_EXITING) in cifs_debug_data_proc_show()
+to avoid use-after-free in @ses.
+
+This fixes the following GPF when reading from /proc/fs/cifs/DebugData
+while mounting and umounting
+
+ [ 816.251274] general protection fault, probably for non-canonical
+ address 0x6b6b6b6b6b6b6d81: 0000 [#1] PREEMPT SMP NOPTI
+ ...
+ [ 816.260138] Call Trace:
+ [ 816.260329] <TASK>
+ [ 816.260499] ? die_addr+0x36/0x90
+ [ 816.260762] ? exc_general_protection+0x1b3/0x410
+ [ 816.261126] ? asm_exc_general_protection+0x26/0x30
+ [ 816.261502] ? cifs_debug_tcon+0xbd/0x240 [cifs]
+ [ 816.261878] ? cifs_debug_tcon+0xab/0x240 [cifs]
+ [ 816.262249] cifs_debug_data_proc_show+0x516/0xdb0 [cifs]
+ [ 816.262689] ? seq_read_iter+0x379/0x470
+ [ 816.262995] seq_read_iter+0x118/0x470
+ [ 816.263291] proc_reg_read_iter+0x53/0x90
+ [ 816.263596] ? srso_alias_return_thunk+0x5/0x7f
+ [ 816.263945] vfs_read+0x201/0x350
+ [ 816.264211] ksys_read+0x75/0x100
+ [ 816.264472] do_syscall_64+0x3f/0x90
+ [ 816.264750] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
+ [ 816.265135] RIP: 0033:0x7fd5e669d381
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifs_debug.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/fs/smb/client/cifs_debug.c
++++ b/fs/smb/client/cifs_debug.c
+@@ -380,6 +380,11 @@ skip_rdma:
+ seq_printf(m, "\n\n\tSessions: ");
+ i = 0;
+ list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) {
++ spin_lock(&ses->ses_lock);
++ if (ses->ses_status == SES_EXITING) {
++ spin_unlock(&ses->ses_lock);
++ continue;
++ }
+ i++;
+ if ((ses->serverDomain == NULL) ||
+ (ses->serverOS == NULL) ||
+@@ -400,6 +405,7 @@ skip_rdma:
+ ses->ses_count, ses->serverOS, ses->serverNOS,
+ ses->capabilities, ses->ses_status);
+ }
++ spin_unlock(&ses->ses_lock);
+
+ seq_printf(m, "\n\tSecurity type: %s ",
+ get_security_type_str(server->ops->select_sectype(server, ses->sectype)));
--- /dev/null
+From 5923d6686a100c2b4cabd4c2ca9d5a12579c7614 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Tue, 7 Nov 2023 21:38:13 -0600
+Subject: smb3: fix caching of ctime on setxattr
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 5923d6686a100c2b4cabd4c2ca9d5a12579c7614 upstream.
+
+Fixes xfstest generic/728 which had been failing due to incorrect
+ctime after setxattr and removexattr
+
+Update ctime on successful set of xattr
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/xattr.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/smb/client/xattr.c
++++ b/fs/smb/client/xattr.c
+@@ -150,10 +150,13 @@ static int cifs_xattr_set(const struct x
+ if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NO_XATTR)
+ goto out;
+
+- if (pTcon->ses->server->ops->set_EA)
++ if (pTcon->ses->server->ops->set_EA) {
+ rc = pTcon->ses->server->ops->set_EA(xid, pTcon,
+ full_path, name, value, (__u16)size,
+ cifs_sb->local_nls, cifs_sb);
++ if (rc == 0)
++ inode_set_ctime_current(inode);
++ }
+ break;
+
+ case XATTR_CIFS_ACL:
--- /dev/null
+From 72bc63f5e23a38b65ff2a201bdc11401d4223fa9 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Thu, 19 Oct 2023 23:01:49 -0500
+Subject: smb3: fix creating FIFOs when mounting with "sfu" mount option
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 72bc63f5e23a38b65ff2a201bdc11401d4223fa9 upstream.
+
+Fixes some xfstests including generic/564 and generic/157
+
+The "sfu" mount option can be useful for creating special files (character
+and block devices in particular) but could not create FIFOs. It did
+recognize existing empty files with the "system" attribute flag as FIFOs
+but this is too general, so to support creating FIFOs more safely use a new
+tag (but the same length as those for char and block devices ie "IntxLNK"
+and "IntxBLK") "LnxFIFO" to indicate that the file should be treated as a
+FIFO (when mounted with the "sfu"). For some additional context note that
+"sfu" followed the way that "Services for Unix" on Windows handled these
+special files (at least for character and block devices and symlinks),
+which is different than newer Windows which can handle special files
+as reparse points (which isn't an option to many servers).
+
+Cc: stable@vger.kernel.org
+Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifspdu.h | 2 +-
+ fs/smb/client/inode.c | 4 ++++
+ fs/smb/client/smb2ops.c | 8 +++++++-
+ 3 files changed, 12 insertions(+), 2 deletions(-)
+
+--- a/fs/smb/client/cifspdu.h
++++ b/fs/smb/client/cifspdu.h
+@@ -2570,7 +2570,7 @@ typedef struct {
+
+
+ struct win_dev {
+- unsigned char type[8]; /* IntxCHR or IntxBLK */
++ unsigned char type[8]; /* IntxCHR or IntxBLK or LnxFIFO*/
+ __le64 major;
+ __le64 minor;
+ } __attribute__((packed));
+--- a/fs/smb/client/inode.c
++++ b/fs/smb/client/inode.c
+@@ -567,6 +567,10 @@ cifs_sfu_type(struct cifs_fattr *fattr,
+ cifs_dbg(FYI, "Symlink\n");
+ fattr->cf_mode |= S_IFLNK;
+ fattr->cf_dtype = DT_LNK;
++ } else if (memcmp("LnxFIFO", pbuf, 8) == 0) {
++ cifs_dbg(FYI, "FIFO\n");
++ fattr->cf_mode |= S_IFIFO;
++ fattr->cf_dtype = DT_FIFO;
+ } else {
+ fattr->cf_mode |= S_IFREG; /* file? */
+ fattr->cf_dtype = DT_REG;
+--- a/fs/smb/client/smb2ops.c
++++ b/fs/smb/client/smb2ops.c
+@@ -5215,7 +5215,7 @@ smb2_make_node(unsigned int xid, struct
+ * over SMB2/SMB3 and Samba will do this with SMB3.1.1 POSIX Extensions
+ */
+
+- if (!S_ISCHR(mode) && !S_ISBLK(mode))
++ if (!S_ISCHR(mode) && !S_ISBLK(mode) && !S_ISFIFO(mode))
+ return rc;
+
+ cifs_dbg(FYI, "sfu compat create special file\n");
+@@ -5263,6 +5263,12 @@ smb2_make_node(unsigned int xid, struct
+ pdev->minor = cpu_to_le64(MINOR(dev));
+ rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
+ &bytes_written, iov, 1);
++ } else if (S_ISFIFO(mode)) {
++ memcpy(pdev->type, "LnxFIFO", 8);
++ pdev->major = 0;
++ pdev->minor = 0;
++ rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms,
++ &bytes_written, iov, 1);
+ }
+ tcon->ses->server->ops->close(xid, tcon, &fid);
+ d_drop(dentry);
--- /dev/null
+From 475efd9808a3094944a56240b2711349e433fb66 Mon Sep 17 00:00:00 2001
+From: Steve French <stfrench@microsoft.com>
+Date: Mon, 16 Oct 2023 12:18:23 -0500
+Subject: smb3: fix touch -h of symlink
+
+From: Steve French <stfrench@microsoft.com>
+
+commit 475efd9808a3094944a56240b2711349e433fb66 upstream.
+
+For example:
+ touch -h -t 02011200 testfile
+where testfile is a symlink would not change the timestamp, but
+ touch -t 02011200 testfile
+does work to change the timestamp of the target
+
+Suggested-by: David Howells <dhowells@redhat.com>
+Reported-by: Micah Veilleux <micah.veilleux@iba-group.com>
+Closes: https://bugzilla.samba.org/show_bug.cgi?id=14476
+Cc: stable@vger.kernel.org
+Signed-off-by: Steve French <stfrench@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/smb/client/cifsfs.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/smb/client/cifsfs.c
++++ b/fs/smb/client/cifsfs.c
+@@ -1186,6 +1186,7 @@ const char *cifs_get_link(struct dentry
+
+ const struct inode_operations cifs_symlink_inode_ops = {
+ .get_link = cifs_get_link,
++ .setattr = cifs_setattr,
+ .permission = cifs_permission,
+ .listxattr = cifs_listxattr,
+ };
--- /dev/null
+From 7930d9e103700cde15833638855b750715c12091 Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Fri, 10 Nov 2023 15:33:14 +1100
+Subject: xfs: recovery should not clear di_flushiter unconditionally
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit 7930d9e103700cde15833638855b750715c12091 upstream.
+
+Because on v3 inodes, di_flushiter doesn't exist. It overlaps with
+zero padding in the inode, except when NREXT64=1 configurations are
+in use and the zero padding is no longer padding but holds the 64
+bit extent counter.
+
+This manifests obviously on big endian platforms (e.g. s390) because
+the log dinode is in host order and the overlap is the LSBs of the
+extent count field. It is not noticed on little endian machines
+because the overlap is at the MSB end of the extent count field and
+we need to get more than 2^^48 extents in the inode before it
+manifests. i.e. the heat death of the universe will occur before we
+see the problem in little endian machines.
+
+This is a zero-day issue for NREXT64=1 configuraitons on big endian
+machines. Fix it by only clearing di_flushiter on v2 inodes during
+recovery.
+
+Fixes: 9b7d16e34bbe ("xfs: Introduce XFS_DIFLAG2_NREXT64 and associated helpers")
+cc: stable@kernel.org # 5.19+
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: "Darrick J. Wong" <djwong@kernel.org>
+Signed-off-by: Chandan Babu R <chandanbabu@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_inode_item_recover.c | 32 +++++++++++++++++---------------
+ 1 file changed, 17 insertions(+), 15 deletions(-)
+
+--- a/fs/xfs/xfs_inode_item_recover.c
++++ b/fs/xfs/xfs_inode_item_recover.c
+@@ -369,24 +369,26 @@ xlog_recover_inode_commit_pass2(
+ * superblock flag to determine whether we need to look at di_flushiter
+ * to skip replay when the on disk inode is newer than the log one
+ */
+- if (!xfs_has_v3inodes(mp) &&
+- ldip->di_flushiter < be16_to_cpu(dip->di_flushiter)) {
+- /*
+- * Deal with the wrap case, DI_MAX_FLUSH is less
+- * than smaller numbers
+- */
+- if (be16_to_cpu(dip->di_flushiter) == DI_MAX_FLUSH &&
+- ldip->di_flushiter < (DI_MAX_FLUSH >> 1)) {
+- /* do nothing */
+- } else {
+- trace_xfs_log_recover_inode_skip(log, in_f);
+- error = 0;
+- goto out_release;
++ if (!xfs_has_v3inodes(mp)) {
++ if (ldip->di_flushiter < be16_to_cpu(dip->di_flushiter)) {
++ /*
++ * Deal with the wrap case, DI_MAX_FLUSH is less
++ * than smaller numbers
++ */
++ if (be16_to_cpu(dip->di_flushiter) == DI_MAX_FLUSH &&
++ ldip->di_flushiter < (DI_MAX_FLUSH >> 1)) {
++ /* do nothing */
++ } else {
++ trace_xfs_log_recover_inode_skip(log, in_f);
++ error = 0;
++ goto out_release;
++ }
+ }
++
++ /* Take the opportunity to reset the flush iteration count */
++ ldip->di_flushiter = 0;
+ }
+
+- /* Take the opportunity to reset the flush iteration count */
+- ldip->di_flushiter = 0;
+
+ if (unlikely(S_ISREG(ldip->di_mode))) {
+ if ((ldip->di_format != XFS_DINODE_FMT_EXTENTS) &&
projects / thirdparty / kernel / stable-queue.git / commitdiff
