From: Greg Kroah-Hartman Date: Thu, 17 Feb 2022 19:24:33 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.303~86 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=60b7fe33311d77cba1bbafd083c9daadab808594;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: btrfs-send-in-case-of-io-error-log-it.patch parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch parisc-fix-sglist-access-in-ccio-dma.c.patch serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch --- diff --git a/queue-4.19/btrfs-send-in-case-of-io-error-log-it.patch b/queue-4.19/btrfs-send-in-case-of-io-error-log-it.patch new file mode 100644 index 00000000000..7fd9fcf79ac --- /dev/null +++ b/queue-4.19/btrfs-send-in-case-of-io-error-log-it.patch @@ -0,0 +1,38 @@ +From 2e7be9db125a0bf940c5d65eb5c40d8700f738b5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?D=C4=81vis=20Mos=C4=81ns?= +Date: Sat, 5 Feb 2022 20:48:23 +0200 +Subject: btrfs: send: in case of IO error log it +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dāvis Mosāns + +commit 2e7be9db125a0bf940c5d65eb5c40d8700f738b5 upstream. + +Currently if we get IO error while doing send then we abort without +logging information about which file caused issue. So log it to help +with debugging. + +CC: stable@vger.kernel.org # 4.9+ +Signed-off-by: Dāvis Mosāns +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/send.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -4956,6 +4956,10 @@ static ssize_t fill_read_buf(struct send + lock_page(page); + if (!PageUptodate(page)) { + unlock_page(page); ++ btrfs_err(fs_info, ++ "send: IO error at offset %llu for inode %llu root %llu", ++ page_offset(page), sctx->cur_ino, ++ sctx->send_root->root_key.objectid); + put_page(page); + ret = -EIO; + break; diff --git a/queue-4.19/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch b/queue-4.19/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch new file mode 100644 index 00000000000..0d486391e8d --- /dev/null +++ b/queue-4.19/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch @@ -0,0 +1,86 @@ +From b7d6f44a0fa716a82969725516dc0b16bc7cd514 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Wed, 26 Jan 2022 20:39:05 +0000 +Subject: parisc: Fix data TLB miss in sba_unmap_sg + +From: John David Anglin + +commit b7d6f44a0fa716a82969725516dc0b16bc7cd514 upstream. + +Rolf Eike Beer reported the following bug: + +[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 +[1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 +[1274934.746891] Hardware name: 9000/785/C8000 +[1274934.746891] +[1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI +[1274934.746891] PSW: 00001000000001001111111000001110 Not tainted +[1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 +[1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 +[1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 +[1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 +[1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 +[1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 +[1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 +[1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 +[1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 +[1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[1274934.746891] +[1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec +[1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 +[1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff +[1274934.746891] ORIG_R28: 0000000040acdd58 +[1274934.746891] IAOQ[0]: sba_unmap_sg+0xb0/0x118 +[1274934.746891] IAOQ[1]: sba_unmap_sg+0xb4/0x118 +[1274934.746891] RP(r2): sba_unmap_sg+0xac/0x118 +[1274934.746891] Backtrace: +[1274934.746891] [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70 +[1274934.746891] [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60 +[1274934.746891] [<00000000407a3488>] mptscsih_io_done+0x150/0xd70 +[1274934.746891] [<0000000040798600>] mpt_interrupt+0x168/0xa68 +[1274934.746891] [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278 +[1274934.746891] [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8 +[1274934.746891] [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0 +[1274934.746891] [<00000000402548e0>] generic_handle_irq+0x50/0x70 +[1274934.746891] [<000000004019a254>] call_on_stack+0x18/0x24 +[1274934.746891] +[1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?) + +The bug is caused by overrunning the sglist and incorrectly testing +sg_dma_len(sglist) before nents. Normally this doesn't cause a crash, +but in this case sglist crossed a page boundary. This occurs in the +following code: + + while (sg_dma_len(sglist) && nents--) { + +The fix is simply to test nents first and move the decrement of nents +into the loop. + +Reported-by: Rolf Eike Beer +Signed-off-by: John David Anglin +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/sba_iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/sba_iommu.c ++++ b/drivers/parisc/sba_iommu.c +@@ -1063,7 +1063,7 @@ sba_unmap_sg(struct device *dev, struct + spin_unlock_irqrestore(&ioc->res_lock, flags); + #endif + +- while (sg_dma_len(sglist) && nents--) { ++ while (nents && sg_dma_len(sglist)) { + + sba_unmap_page(dev, sg_dma_address(sglist), sg_dma_len(sglist), + direction, 0); +@@ -1072,6 +1072,7 @@ sba_unmap_sg(struct device *dev, struct + ioc->usingle_calls--; /* kluge since call is unmap_sg() */ + #endif + ++sglist; ++ nents--; + } + + DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); diff --git a/queue-4.19/parisc-fix-sglist-access-in-ccio-dma.c.patch b/queue-4.19/parisc-fix-sglist-access-in-ccio-dma.c.patch new file mode 100644 index 00000000000..09bf3113e20 --- /dev/null +++ b/queue-4.19/parisc-fix-sglist-access-in-ccio-dma.c.patch @@ -0,0 +1,39 @@ +From d7da660cab47183cded65e11b64497d0f56c6edf Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Thu, 27 Jan 2022 22:33:41 +0000 +Subject: parisc: Fix sglist access in ccio-dma.c + +From: John David Anglin + +commit d7da660cab47183cded65e11b64497d0f56c6edf upstream. + +This patch implements the same bug fix to ccio-dma.c as to sba_iommu.c. +It ensures that only the allocated entries of the sglist are accessed. + +Signed-off-by: John David Anglin +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/ccio-dma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/ccio-dma.c ++++ b/drivers/parisc/ccio-dma.c +@@ -1010,7 +1010,7 @@ ccio_unmap_sg(struct device *dev, struct + ioc->usg_calls++; + #endif + +- while(sg_dma_len(sglist) && nents--) { ++ while (nents && sg_dma_len(sglist)) { + + #ifdef CCIO_COLLECT_STATS + ioc->usg_pages += sg_dma_len(sglist) >> PAGE_SHIFT; +@@ -1018,6 +1018,7 @@ ccio_unmap_sg(struct device *dev, struct + ccio_unmap_page(dev, sg_dma_address(sglist), + sg_dma_len(sglist), direction, 0); + ++sglist; ++ nents--; + } + + DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); diff --git a/queue-4.19/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch b/queue-4.19/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch new file mode 100644 index 00000000000..10812286ca8 --- /dev/null +++ b/queue-4.19/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch @@ -0,0 +1,54 @@ +From 6e8793674bb0d1135ca0e5c9f7e16fecbf815926 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 14 Feb 2022 10:00:19 -0800 +Subject: serial: parisc: GSC: fix build when IOSAPIC is not set + +From: Randy Dunlap + +commit 6e8793674bb0d1135ca0e5c9f7e16fecbf815926 upstream. + +There is a build error when using a kernel .config file from +'kernel test robot' for a different build problem: + +hppa64-linux-ld: drivers/tty/serial/8250/8250_gsc.o: in function `.LC3': +(.data.rel.ro+0x18): undefined reference to `iosapic_serial_irq' + +when: + CONFIG_GSC=y + CONFIG_SERIO_GSCPS2=y + CONFIG_SERIAL_8250_GSC=y + CONFIG_PCI is not set + and hence PCI_LBA is not set. + IOSAPIC depends on PCI_LBA, so IOSAPIC is not set/enabled. + +Make the use of iosapic_serial_irq() conditional to fix the build error. + +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: "James E.J. Bottomley" +Cc: Helge Deller +Cc: linux-parisc@vger.kernel.org +Cc: Greg Kroah-Hartman +Cc: linux-serial@vger.kernel.org +Cc: Jiri Slaby +Cc: Johan Hovold +Suggested-by: Helge Deller +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_gsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_gsc.c ++++ b/drivers/tty/serial/8250/8250_gsc.c +@@ -26,7 +26,7 @@ static int __init serial_init_chip(struc + unsigned long address; + int err; + +-#ifdef CONFIG_64BIT ++#if defined(CONFIG_64BIT) && defined(CONFIG_IOSAPIC) + if (!dev->irq && (dev->id.sversion == 0xad)) + dev->irq = iosapic_serial_irq(dev); + #endif diff --git a/queue-4.19/series b/queue-4.19/series index d8f98fe6660..9bccfc9bb45 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -1,2 +1,6 @@ makefile.extrawarn-move-wunaligned-access-to-w-1.patch net-usb-ax88179_178a-fix-out-of-bounds-accesses-in-rx-fixup.patch +serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch +parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch +parisc-fix-sglist-access-in-ccio-dma.c.patch +btrfs-send-in-case-of-io-error-log-it.patch