From: Greg Kroah-Hartman Date: Thu, 21 Aug 2025 13:11:04 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v6.16.3~98 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=302060f8c2c0e3d1e49f9e9da9b63ffd03401d4d;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch ext4-check-fast-symlink-for-ea_inode-correctly.patch ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch --- diff --git a/queue-5.4/ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch b/queue-5.4/ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch new file mode 100644 index 0000000000..041a1803f4 --- /dev/null +++ b/queue-5.4/ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch @@ -0,0 +1,90 @@ +From cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 Mon Sep 17 00:00:00 2001 +From: Damien Le Moal +Date: Tue, 29 Jul 2025 18:28:07 +0900 +Subject: ata: libata-scsi: Fix ata_to_sense_error() status handling + +From: Damien Le Moal + +commit cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 upstream. + +Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") +inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in +the function ata_to_sense_error(). This entry ties a failed qc which has +a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with +the additional sense code UNALIGNED WRITE COMMAND. This entry will be +used to generate a failed qc sense key and sense code when the qc is +missing sense data and there is no match for the qc error field in the +sense_table array of ata_to_sense_error(). + +As a result, for a failed qc for which we failed to get sense data (e.g. +read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT +command failed for the non-ncq case, the user very often end up seeing +the completely misleading "unaligned write command" error, even if qc +was not a write command. E.g.: + +sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s +sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current] +sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command +sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 +I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 + +Fix this by removing the ATA_DRDY entry from the stat_table array so +that we default to always returning ABORTED COMMAND without any +additional sense code, since we do not know any better. The entry 0x08 +(ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity +error is also misleading (as a parity error would likely be signaled +through a bus error). So for this case, also default to returning +ABORTED COMMAND without any additional sense code. With this, the +previous example error case becomes: + +sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s +sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current] +sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information +sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 +I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 + +Together with these fixes, refactor stat_table to make it more readable +by putting the entries comments in front of the entries and using the +defined status bits macros instead of hardcoded values. + +Reported-by: Lorenz Brun +Reported-by: Brandon Schwartz +Fixes: 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") +Cc: stable@vger.kernel.org +Signed-off-by: Damien Le Moal +Reviewed-by: Hannes Reinecke +Reviewed-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/libata-scsi.c | 20 ++++++++------------ + 1 file changed, 8 insertions(+), 12 deletions(-) + +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -984,18 +984,14 @@ static void ata_to_sense_error(unsigned + {0xFF, 0xFF, 0xFF, 0xFF}, // END mark + }; + static const unsigned char stat_table[][4] = { +- /* Must be first because BUSY means no other bits valid */ +- {0x80, ABORTED_COMMAND, 0x47, 0x00}, +- // Busy, fake parity for now +- {0x40, ILLEGAL_REQUEST, 0x21, 0x04}, +- // Device ready, unaligned write command +- {0x20, HARDWARE_ERROR, 0x44, 0x00}, +- // Device fault, internal target failure +- {0x08, ABORTED_COMMAND, 0x47, 0x00}, +- // Timed out in xfer, fake parity for now +- {0x04, RECOVERED_ERROR, 0x11, 0x00}, +- // Recovered ECC error Medium error, recovered +- {0xFF, 0xFF, 0xFF, 0xFF}, // END mark ++ /* Busy: must be first because BUSY means no other bits valid */ ++ { ATA_BUSY, ABORTED_COMMAND, 0x00, 0x00 }, ++ /* Device fault: INTERNAL TARGET FAILURE */ ++ { ATA_DF, HARDWARE_ERROR, 0x44, 0x00 }, ++ /* Corrected data error */ ++ { ATA_CORR, RECOVERED_ERROR, 0x00, 0x00 }, ++ ++ { 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */ + }; + + /* diff --git a/queue-5.4/ext4-check-fast-symlink-for-ea_inode-correctly.patch b/queue-5.4/ext4-check-fast-symlink-for-ea_inode-correctly.patch new file mode 100644 index 0000000000..bae908876b --- /dev/null +++ b/queue-5.4/ext4-check-fast-symlink-for-ea_inode-correctly.patch @@ -0,0 +1,63 @@ +From b4cc4a4077268522e3d0d34de4b2dc144e2330fa Mon Sep 17 00:00:00 2001 +From: Andreas Dilger +Date: Wed, 16 Jul 2025 19:36:42 -0600 +Subject: ext4: check fast symlink for ea_inode correctly + +From: Andreas Dilger + +commit b4cc4a4077268522e3d0d34de4b2dc144e2330fa upstream. + +The check for a fast symlink in the presence of only an +external xattr inode is incorrect. If a fast symlink does +not have an xattr block (i_file_acl == 0), but does have +an external xattr inode that increases inode i_blocks, then +the check for a fast symlink will incorrectly fail and +__ext4_iget()->ext4_ind_check_inode() will report the inode +is corrupt when it "validates" i_data[] on the next read: + + # ln -s foo /mnt/tmp/bar + # setfattr -h -n trusted.test \ + -v "$(yes | head -n 4000)" /mnt/tmp/bar + # umount /mnt/tmp + # mount /mnt/tmp + # ls -l /mnt/tmp + ls: cannot access '/mnt/tmp/bar': Structure needs cleaning + total 4 + ? l?????????? ? ? ? ? ? bar + # dmesg | tail -1 + EXT4-fs error (device dm-8): __ext4_iget:5098: + inode #24578: block 7303014: comm ls: invalid block + +(note that "block 7303014" = 0x6f6f66 = "foo" in LE order). + +ext4_inode_is_fast_symlink() should check the superblock +EXT4_FEATURE_INCOMPAT_EA_INODE feature flag, not the inode +EXT4_EA_INODE_FL, since the latter is only set on the xattr +inode itself, and not on the inode that uses this xattr. + +Cc: stable@vger.kernel.org +Fixes: fc82228a5e38 ("ext4: support fast symlinks from ext3 file systems") +Signed-off-by: Andreas Dilger +Reviewed-by: Li Dongyang +Reviewed-by: Alex Zhuravlev +Reviewed-by: Oleg Drokin +Reviewed-on: https://review.whamcloud.com/59879 +Lustre-bug-id: https://jira.whamcloud.com/browse/LU-19121 +Link: https://patch.msgid.link/20250717063709.757077-1-adilger@dilger.ca +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -150,7 +150,7 @@ static int ext4_meta_trans_blocks(struct + */ + int ext4_inode_is_fast_symlink(struct inode *inode) + { +- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) { ++ if (!ext4_has_feature_ea_inode(inode->i_sb)) { + int ea_blocks = EXT4_I(inode)->i_file_acl ? + EXT4_CLUSTER_SIZE(inode->i_sb) >> 9 : 0; + diff --git a/queue-5.4/ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch b/queue-5.4/ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch new file mode 100644 index 0000000000..ad1a346b01 --- /dev/null +++ b/queue-5.4/ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch @@ -0,0 +1,120 @@ +From bae76c035bf0852844151e68098c9b7cd63ef238 Mon Sep 17 00:00:00 2001 +From: Ojaswin Mujoo +Date: Tue, 5 Aug 2025 14:00:30 +0530 +Subject: ext4: fix fsmap end of range reporting with bigalloc + +From: Ojaswin Mujoo + +commit bae76c035bf0852844151e68098c9b7cd63ef238 upstream. + +With bigalloc enabled, the logic to report last extent has a bug since +we try to use cluster units instead of block units. This can cause an +issue where extra incorrect entries might be returned back to the +user. This was flagged by generic/365 with 64k bs and -O bigalloc. + +** Details of issue ** + +The issue was noticed on 5G 64k blocksize FS with -O bigalloc which has +only 1 bg. + +$ xfs_io -c "fsmap -d" /mnt/scratch + + 0: 253:48 [0..127]: static fs metadata 128 /* sb */ + 1: 253:48 [128..255]: special 102:1 128 /* gdt */ + 3: 253:48 [256..383]: special 102:3 128 /* block bitmap */ + 4: 253:48 [384..2303]: unknown 1920 /* flex bg empty space */ + 5: 253:48 [2304..2431]: special 102:4 128 /* inode bitmap */ + 6: 253:48 [2432..4351]: unknown 1920 /* flex bg empty space */ + 7: 253:48 [4352..6911]: inodes 2560 + 8: 253:48 [6912..538623]: unknown 531712 + 9: 253:48 [538624..10485759]: free space 9947136 + +The issue can be seen with: + +$ xfs_io -c "fsmap -d 0 3" /mnt/scratch + + 0: 253:48 [0..127]: static fs metadata 128 + 1: 253:48 [384..2047]: unknown 1664 + +Only the first entry was expected to be returned but we get 2. This is +because: + +ext4_getfsmap_datadev() + first_cluster, last_cluster = 0 + ... + info->gfi_last = true; + ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, 0, info); + fsb = C2B(1) = 16 + fslen = 0 + ... + /* Merge in any relevant extents from the meta_list */ + list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) { + ... + // since fsb = 16, considers all metadata which starts before 16 blockno + iter 1: error = ext4_getfsmap_helper(sb, info, p); // p = sb (0,1), nop + info->gfi_next_fsblk = 1 + iter 2: error = ext4_getfsmap_helper(sb, info, p); // p = gdt (1,2), nop + info->gfi_next_fsblk = 2 + iter 3: error = ext4_getfsmap_helper(sb, info, p); // p = blk bitmap (2,3), nop + info->gfi_next_fsblk = 3 + iter 4: error = ext4_getfsmap_helper(sb, info, p); // p = ino bitmap (18,19) + if (rec_blk > info->gfi_next_fsblk) { // (18 > 3) + // emits an extra entry ** BUG ** + } + } + +Fix this by directly calling ext4_getfsmap_datadev() with a dummy +record that has fmr_physical set to (end_fsb + 1) instead of +last_cluster + 1. By using the block instead of cluster we get the +correct behavior. + +Replacing ext4_getfsmap_datadev_helper() with ext4_getfsmap_helper() +is okay since the gfi_lastfree and metadata checks in +ext4_getfsmap_datadev_helper() are anyways redundant when we only want +to emit the last allocated block of the range, as we have already +taken care of emitting metadata and any last free blocks. + +Cc: stable@kernel.org +Reported-by: Disha Goel +Fixes: 4a622e4d477b ("ext4: fix FS_IOC_GETFSMAP handling") +Signed-off-by: Ojaswin Mujoo +Reviewed-by: Darrick J. Wong +Link: https://patch.msgid.link/e7472c8535c9c5ec10f425f495366864ea12c9da.1754377641.git.ojaswin@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/fsmap.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +--- a/fs/ext4/fsmap.c ++++ b/fs/ext4/fsmap.c +@@ -526,6 +526,7 @@ static int ext4_getfsmap_datadev(struct + ext4_group_t end_ag; + ext4_grpblk_t first_cluster; + ext4_grpblk_t last_cluster; ++ struct ext4_fsmap irec; + int error = 0; + + bofs = le32_to_cpu(sbi->s_es->s_first_data_block); +@@ -609,10 +610,18 @@ static int ext4_getfsmap_datadev(struct + goto err; + } + +- /* Report any gaps at the end of the bg */ ++ /* ++ * The dummy record below will cause ext4_getfsmap_helper() to report ++ * any allocated blocks at the end of the range. ++ */ ++ irec.fmr_device = 0; ++ irec.fmr_physical = end_fsb + 1; ++ irec.fmr_length = 0; ++ irec.fmr_owner = EXT4_FMR_OWN_FREE; ++ irec.fmr_flags = 0; ++ + info->gfi_last = true; +- error = ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, +- 0, info); ++ error = ext4_getfsmap_helper(sb, info, &irec); + if (error) + goto err; + diff --git a/queue-5.4/ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch b/queue-5.4/ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch new file mode 100644 index 0000000000..14a3792072 --- /dev/null +++ b/queue-5.4/ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch @@ -0,0 +1,53 @@ +From 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 Mon Sep 17 00:00:00 2001 +From: Ojaswin Mujoo +Date: Tue, 5 Aug 2025 14:00:31 +0530 +Subject: ext4: fix reserved gdt blocks handling in fsmap + +From: Ojaswin Mujoo + +commit 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 upstream. + +In some cases like small FSes with no meta_bg and where the resize +doesn't need extra gdt blocks as it can fit in the current one, +s_reserved_gdt_blocks is set as 0, which causes fsmap to emit a 0 +length entry, which is incorrect. + + $ mkfs.ext4 -b 65536 -O bigalloc /dev/sda 5G + $ mount /dev/sda /mnt/scratch + $ xfs_io -c "fsmap -d" /mnt/scartch + + 0: 253:48 [0..127]: static fs metadata 128 + 1: 253:48 [128..255]: special 102:1 128 + 2: 253:48 [256..255]: special 102:2 0 <---- 0 len entry + 3: 253:48 [256..383]: special 102:3 128 + +Fix this by adding a check for this case. + +Cc: stable@kernel.org +Fixes: 0c9ec4beecac ("ext4: support GETFSMAP ioctls") +Signed-off-by: Ojaswin Mujoo +Reviewed-by: Darrick J. Wong +Link: https://patch.msgid.link/08781b796453a5770112aa96ad14c864fbf31935.1754377641.git.ojaswin@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/fsmap.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/fs/ext4/fsmap.c ++++ b/fs/ext4/fsmap.c +@@ -393,6 +393,14 @@ static unsigned int ext4_getfsmap_find_s + /* Reserved GDT blocks */ + if (!ext4_has_feature_meta_bg(sb) || metagroup < first_meta_bg) { + len = le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks); ++ ++ /* ++ * mkfs.ext4 can set s_reserved_gdt_blocks as 0 in some cases, ++ * check for that. ++ */ ++ if (!len) ++ return 0; ++ + error = ext4_getfsmap_fill(meta_list, fsb, len, + EXT4_FMR_OWN_RESV_GDT); + if (error) diff --git a/queue-5.4/revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch b/queue-5.4/revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch new file mode 100644 index 0000000000..8b5165a055 --- /dev/null +++ b/queue-5.4/revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch @@ -0,0 +1,40 @@ +From e4fc307d8e24f122402907ebf585248cad52841d Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 2 Aug 2025 21:34:37 +0200 +Subject: Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" + +From: Helge Deller + +commit e4fc307d8e24f122402907ebf585248cad52841d upstream. + +This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003. + +The patch is wrong as it checks vc_origin against vc_screenbuf, +while in text mode it should compare against vga_vram_base. + +As such it broke VGA text scrolling, which can be reproduced like this: +(1) boot a kernel that is configured to use text mode VGA-console +(2) type commands: ls -l /usr/bin | less -S +(3) scroll up/down with cursor-down/up keys + +Reported-by: Jari Ruusu +Cc: stable@vger.kernel.org +Cc: Yi Yang +Cc: GONG Ruiqi +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/video/console/vgacon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -1198,7 +1198,7 @@ static bool vgacon_scroll(struct vc_data + c->vc_screenbuf_size - delta); + c->vc_origin = vga_vram_end - c->vc_screenbuf_size; + vga_rolled_over = 0; +- } else if (oldo - delta >= (unsigned long)c->vc_screenbuf) ++ } else + c->vc_origin -= delta; + c->vc_scr_end = c->vc_origin + c->vc_screenbuf_size; + scr_memsetw((u16 *) (c->vc_origin), c->vc_video_erase_char, diff --git a/queue-5.4/series b/queue-5.4/series index 40f14c9260..7ba5d6ed28 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -288,3 +288,8 @@ usb-gadget-udc-renesas_usb3-fix-device-leak-at-unbind.patch usb-dwc3-meson-g12a-fix-device-leaks-at-unbind.patch vt-keyboard-don-t-process-unicode-characters-in-k_off-mode.patch vt-defkeymap-map-keycodes-above-127-to-k_hole.patch +revert-vgacon-add-check-for-vc_origin-address-range-in-vgacon_scroll.patch +ext4-check-fast-symlink-for-ea_inode-correctly.patch +ext4-fix-fsmap-end-of-range-reporting-with-bigalloc.patch +ext4-fix-reserved-gdt-blocks-handling-in-fsmap.patch +ata-libata-scsi-fix-ata_to_sense_error-status-handling.patch