From: Greg Kroah-Hartman Date: Tue, 29 Apr 2025 13:09:45 +0000 (+0200) Subject: 6.12-stable patches X-Git-Tag: v5.4.293~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b196cda7536fe26a9babba44381aacbea8250f3b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.12-stable patches added patches: comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch --- diff --git a/queue-6.12/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch b/queue-6.12/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch new file mode 100644 index 0000000000..8c0a89537c --- /dev/null +++ b/queue-6.12/comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch @@ -0,0 +1,36 @@ +From 44d9b3f584c59a606b521e7274e658d5b866c699 Mon Sep 17 00:00:00 2001 +From: Ian Abbott +Date: Tue, 15 Apr 2025 13:39:01 +0100 +Subject: comedi: jr3_pci: Fix synchronous deletion of timer + +From: Ian Abbott + +commit 44d9b3f584c59a606b521e7274e658d5b866c699 upstream. + +When `jr3_pci_detach()` is called during device removal, it calls +`timer_delete_sync()` to stop the timer, but the timer expiry function +always reschedules the timer, so the synchronization is ineffective. + +Call `timer_shutdown_sync()` instead. It does not matter that the timer +expiry function pointer is cleared, because the device is being removed. + +Fixes: 07b509e6584a5 ("Staging: comedi: add jr3_pci driver") +Cc: stable +Signed-off-by: Ian Abbott +Link: https://lore.kernel.org/r/20250415123901.13483-1-abbotti@mev.co.uk +Signed-off-by: Greg Kroah-Hartman +--- + drivers/comedi/drivers/jr3_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/comedi/drivers/jr3_pci.c ++++ b/drivers/comedi/drivers/jr3_pci.c +@@ -758,7 +758,7 @@ static void jr3_pci_detach(struct comedi + struct jr3_pci_dev_private *devpriv = dev->private; + + if (devpriv) +- del_timer_sync(&devpriv->timer); ++ timer_shutdown_sync(&devpriv->timer); + + comedi_pci_detach(dev); + } diff --git a/queue-6.12/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch b/queue-6.12/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch new file mode 100644 index 0000000000..bc56defdf3 --- /dev/null +++ b/queue-6.12/ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch @@ -0,0 +1,57 @@ +From 7e91ae31e2d264155dfd102101afc2de7bd74a64 Mon Sep 17 00:00:00 2001 +From: Baokun Li +Date: Thu, 13 Feb 2025 19:22:47 +0800 +Subject: ext4: goto right label 'out_mmap_sem' in ext4_setattr() + +From: Baokun Li + +commit 7e91ae31e2d264155dfd102101afc2de7bd74a64 upstream. + +Otherwise, if ext4_inode_attach_jinode() fails, a hung task will +happen because filemap_invalidate_unlock() isn't called to unlock +mapping->invalidate_lock. Like this: + +EXT4-fs error (device sda) in ext4_setattr:5557: Out of memory +INFO: task fsstress:374 blocked for more than 122 seconds. + Not tainted 6.14.0-rc1-next-20250206-xfstests-dirty #726 +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +task:fsstress state:D stack:0 pid:374 tgid:374 ppid:373 + task_flags:0x440140 flags:0x00000000 +Call Trace: + + __schedule+0x2c9/0x7f0 + schedule+0x27/0xa0 + schedule_preempt_disabled+0x15/0x30 + rwsem_down_read_slowpath+0x278/0x4c0 + down_read+0x59/0xb0 + page_cache_ra_unbounded+0x65/0x1b0 + filemap_get_pages+0x124/0x3e0 + filemap_read+0x114/0x3d0 + vfs_read+0x297/0x360 + ksys_read+0x6c/0xe0 + do_syscall_64+0x4b/0x110 + entry_SYSCALL_64_after_hwframe+0x76/0x7e + +Fixes: c7fc0366c656 ("ext4: partial zero eof block on unaligned inode size extension") +Signed-off-by: Baokun Li +Reviewed-by: Jan Kara +Reviewed-by: Brian Foster +Link: https://patch.msgid.link/20250213112247.3168709-1-libaokun@huaweicloud.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Ricardo Cañuelo Navarro +Signed-off-by: Greg Kroah-Hartman +--- + fs/ext4/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5468,7 +5468,7 @@ int ext4_setattr(struct mnt_idmap *idmap + oldsize & (inode->i_sb->s_blocksize - 1)) { + error = ext4_inode_attach_jinode(inode); + if (error) +- goto err_out; ++ goto out_mmap_sem; + } + + handle = ext4_journal_start(inode, EXT4_HT_INODE, 3); diff --git a/queue-6.12/series b/queue-6.12/series index b15441c2cf..a2cb2917c0 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -258,3 +258,5 @@ selftests-bpf-check-program-redirect-in-xdp_cpumap_attach.patch selftests-bpf-adjust-data-size-to-have-eth_hlen.patch usb-typec-class-fix-null-pointer-access.patch vmxnet3-fix-malformed-packet-sizing-in-vmxnet3_process_xdp.patch +comedi-jr3_pci-fix-synchronous-deletion-of-timer.patch +ext4-goto-right-label-out_mmap_sem-in-ext4_setattr.patch