From 5f5f9c0122377e38d7a901457aed77e93e906d87 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Tue, 3 Dec 2024 07:33:29 -0500 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- queue-6.1/9p-xen-fix-init-sequence.patch | 56 ++++++ queue-6.1/9p-xen-fix-release-of-irq.patch | 42 +++++ ...return-unsigned-int-from-bdev_io_min.patch | 39 ++++ ...s2-fix-use-of-uninitialized-variable.patch | 57 ++++++ ...move-incorrect-code-in-do_eisa_entry.patch | 86 +++++++++ ...s-ignore-sb_rdonly-when-mounting-nfs.patch | 79 ++++++++ ...e-after-free-problem-in-the-asynchro.patch | 52 ++++++ ...ure-port-and-device-id-bits-are-set-.patch | 50 +++++ ...uv3-fix-lockdep-assert-in-event_init.patch | 68 +++++++ ...t-fail-temperature-reads-on-undervol.patch | 49 +++++ ...dt-bit-position-of-the-status-regist.patch | 39 ++++ ...tc_read_time-was-successful-in-rtc_t.patch | 53 ++++++ ...ix-bcd-to-rtc_time-conversion-errors.patch | 52 ++++++ ...e-irqf_no_autoen-flag-in-request_irq.patch | 50 +++++ queue-6.1/series | 23 +++ ...after-free-bug-in-register_intc_cont.patch | 46 +++++ ...t_sock_upd_timeout-when-reset-transp.patch | 38 ++++ ...duplicate-slab-cache-names-while-att.patch | 104 +++++++++++ ...chedule-fm_work-if-wear-leveling-poo.patch | 98 ++++++++++ ...tion-fix-use-after-free-in-ubifs_tnc.patch | 171 ++++++++++++++++++ ...e-total-block-count-by-deducting-jou.patch | 46 +++++ ...race-for-specified-task-in-show_stac.patch | 37 ++++ ...-integer-overflow-during-physmem-set.patch | 50 +++++ ...n-value-of-elf_core_copy_task_fpregs.patch | 36 ++++ 24 files changed, 1421 insertions(+) create mode 100644 queue-6.1/9p-xen-fix-init-sequence.patch create mode 100644 queue-6.1/9p-xen-fix-release-of-irq.patch create mode 100644 queue-6.1/block-return-unsigned-int-from-bdev_io_min.patch create mode 100644 queue-6.1/jffs2-fix-use-of-uninitialized-variable.patch create mode 100644 queue-6.1/modpost-remove-incorrect-code-in-do_eisa_entry.patch create mode 100644 queue-6.1/nfs-ignore-sb_rdonly-when-mounting-nfs.patch create mode 100644 queue-6.1/nfsv4.0-fix-a-use-after-free-problem-in-the-asynchro.patch create mode 100644 queue-6.1/perf-arm-cmn-ensure-port-and-device-id-bits-are-set-.patch create mode 100644 queue-6.1/perf-arm-smmuv3-fix-lockdep-assert-in-event_init.patch create mode 100644 queue-6.1/rtc-ab-eoz9-don-t-fail-temperature-reads-on-undervol.patch create mode 100644 queue-6.1/rtc-abx80x-fix-wdt-bit-position-of-the-status-regist.patch create mode 100644 queue-6.1/rtc-check-if-__rtc_read_time-was-successful-in-rtc_t.patch create mode 100644 queue-6.1/rtc-rzn1-fix-bcd-to-rtc_time-conversion-errors.patch create mode 100644 queue-6.1/rtc-st-lpc-use-irqf_no_autoen-flag-in-request_irq.patch create mode 100644 queue-6.1/sh-intc-fix-use-after-free-bug-in-register_intc_cont.patch create mode 100644 queue-6.1/sunrpc-clear-xprt_sock_upd_timeout-when-reset-transp.patch create mode 100644 queue-6.1/ubi-fastmap-fix-duplicate-slab-cache-names-while-att.patch create mode 100644 queue-6.1/ubi-fastmap-wl-schedule-fm_work-if-wear-leveling-poo.patch create mode 100644 queue-6.1/ubifs-authentication-fix-use-after-free-in-ubifs_tnc.patch create mode 100644 queue-6.1/ubifs-correct-the-total-block-count-by-deducting-jou.patch create mode 100644 queue-6.1/um-always-dump-trace-for-specified-task-in-show_stac.patch create mode 100644 queue-6.1/um-fix-potential-integer-overflow-during-physmem-set.patch create mode 100644 queue-6.1/um-fix-the-return-value-of-elf_core_copy_task_fpregs.patch diff --git a/queue-6.1/9p-xen-fix-init-sequence.patch b/queue-6.1/9p-xen-fix-init-sequence.patch new file mode 100644 index 00000000000..daef9e9bef6 --- /dev/null +++ b/queue-6.1/9p-xen-fix-init-sequence.patch @@ -0,0 +1,56 @@ +From 4a3d43f6c80f8e2a0711c1155cb9aa25fc635975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 21:16:33 +0000 +Subject: 9p/xen: fix init sequence + +From: Alex Zenla + +[ Upstream commit 7ef3ae82a6ebbf4750967d1ce43bcdb7e44ff74b ] + +Large amount of mount hangs observed during hotplugging of 9pfs devices. The +9pfs Xen driver attempts to initialize itself more than once, causing the +frontend and backend to disagree: the backend listens on a channel that the +frontend does not send on, resulting in stalled processing. + +Only allow initialization of 9p frontend once. + +Fixes: c15fe55d14b3b ("9p/xen: fix connection sequence") +Signed-off-by: Alex Zenla +Signed-off-by: Alexander Merritt +Signed-off-by: Ariadne Conill +Reviewed-by: Juergen Gross +Message-ID: <20241119211633.38321-1-alexander@edera.dev> +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index 68027e4fb4216..f95803736ced0 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -465,6 +465,7 @@ static int xen_9pfs_front_init(struct xenbus_device *dev) + goto error; + } + ++ xenbus_switch_state(dev, XenbusStateInitialised); + return 0; + + error_xenbus: +@@ -512,8 +513,10 @@ static void xen_9pfs_front_changed(struct xenbus_device *dev, + break; + + case XenbusStateInitWait: +- if (!xen_9pfs_front_init(dev)) +- xenbus_switch_state(dev, XenbusStateInitialised); ++ if (dev->state != XenbusStateInitialising) ++ break; ++ ++ xen_9pfs_front_init(dev); + break; + + case XenbusStateConnected: +-- +2.43.0 + diff --git a/queue-6.1/9p-xen-fix-release-of-irq.patch b/queue-6.1/9p-xen-fix-release-of-irq.patch new file mode 100644 index 00000000000..eecc65a120b --- /dev/null +++ b/queue-6.1/9p-xen-fix-release-of-irq.patch @@ -0,0 +1,42 @@ +From d5d3709880e7d0017be25287b281a5637db09396 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Nov 2024 22:51:00 +0000 +Subject: 9p/xen: fix release of IRQ + +From: Alex Zenla + +[ Upstream commit e43c608f40c065b30964f0a806348062991b802d ] + +Kernel logs indicate an IRQ was double-freed. + +Pass correct device ID during IRQ release. + +Fixes: 71ebd71921e45 ("xen/9pfs: connect to the backend") +Signed-off-by: Alex Zenla +Signed-off-by: Alexander Merritt +Signed-off-by: Ariadne Conill +Reviewed-by: Juergen Gross +Message-ID: <20241121225100.5736-1-alexander@edera.dev> +[Dominique: remove confusing variable reset to 0] +Signed-off-by: Dominique Martinet +Signed-off-by: Sasha Levin +--- + net/9p/trans_xen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/9p/trans_xen.c b/net/9p/trans_xen.c +index f95803736ced0..4ad7e7a269ca0 100644 +--- a/net/9p/trans_xen.c ++++ b/net/9p/trans_xen.c +@@ -285,7 +285,7 @@ static void xen_9pfs_front_free(struct xen_9pfs_front_priv *priv) + if (!priv->rings[i].intf) + break; + if (priv->rings[i].irq > 0) +- unbind_from_irqhandler(priv->rings[i].irq, priv->dev); ++ unbind_from_irqhandler(priv->rings[i].irq, ring); + if (priv->rings[i].data.in) { + for (j = 0; + j < (1 << priv->rings[i].intf->ring_order); +-- +2.43.0 + diff --git a/queue-6.1/block-return-unsigned-int-from-bdev_io_min.patch b/queue-6.1/block-return-unsigned-int-from-bdev_io_min.patch new file mode 100644 index 00000000000..04fa2753b46 --- /dev/null +++ b/queue-6.1/block-return-unsigned-int-from-bdev_io_min.patch @@ -0,0 +1,39 @@ +From 487f2efc86623336d344639c00cfadfc2af64dbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Nov 2024 08:26:02 +0100 +Subject: block: return unsigned int from bdev_io_min + +From: Christoph Hellwig + +[ Upstream commit 46fd48ab3ea3eb3bb215684bd66ea3d260b091a9 ] + +The underlying limit is defined as an unsigned int, so return that from +bdev_io_min as well. + +Fixes: ac481c20ef8f ("block: Topology ioctls") +Signed-off-by: Christoph Hellwig +Reviewed-by: Martin K. Petersen +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/20241119072602.1059488-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + include/linux/blkdev.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index f77e8785802e2..de013fc37ef83 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1201,7 +1201,7 @@ static inline unsigned int queue_io_min(const struct request_queue *q) + return q->limits.io_min; + } + +-static inline int bdev_io_min(struct block_device *bdev) ++static inline unsigned int bdev_io_min(struct block_device *bdev) + { + return queue_io_min(bdev_get_queue(bdev)); + } +-- +2.43.0 + diff --git a/queue-6.1/jffs2-fix-use-of-uninitialized-variable.patch b/queue-6.1/jffs2-fix-use-of-uninitialized-variable.patch new file mode 100644 index 00000000000..15f6dc9e7aa --- /dev/null +++ b/queue-6.1/jffs2-fix-use-of-uninitialized-variable.patch @@ -0,0 +1,57 @@ +From cf08caf611871108b2ec4191b6513398b4b0d0c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jul 2024 12:52:05 +0800 +Subject: jffs2: fix use of uninitialized variable + +From: Qingfang Deng + +[ Upstream commit 3ba44ee966bc3c41dd8a944f963466c8fcc60dc8 ] + +When building the kernel with -Wmaybe-uninitialized, the compiler +reports this warning: + +In function 'jffs2_mark_erased_block', + inlined from 'jffs2_erase_pending_blocks' at fs/jffs2/erase.c:116:4: +fs/jffs2/erase.c:474:9: warning: 'bad_offset' may be used uninitialized [-Wmaybe-uninitialized] + 474 | jffs2_erase_failed(c, jeb, bad_offset); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +fs/jffs2/erase.c: In function 'jffs2_erase_pending_blocks': +fs/jffs2/erase.c:402:18: note: 'bad_offset' was declared here + 402 | uint32_t bad_offset; + | ^~~~~~~~~~ + +When mtd->point() is used, jffs2_erase_pending_blocks can return -EIO +without initializing bad_offset, which is later used at the filebad +label in jffs2_mark_erased_block. +Fix it by initializing this variable. + +Fixes: 8a0f572397ca ("[JFFS2] Return values of jffs2_block_check_erase error paths") +Signed-off-by: Qingfang Deng +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/jffs2/erase.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c +index acd32f05b5198..ef3a1e1b6cb06 100644 +--- a/fs/jffs2/erase.c ++++ b/fs/jffs2/erase.c +@@ -338,10 +338,9 @@ static int jffs2_block_check_erase(struct jffs2_sb_info *c, struct jffs2_erasebl + } while(--retlen); + mtd_unpoint(c->mtd, jeb->offset, c->sector_size); + if (retlen) { +- pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08tx\n", +- *wordebuf, +- jeb->offset + +- c->sector_size-retlen * sizeof(*wordebuf)); ++ *bad_offset = jeb->offset + c->sector_size - retlen * sizeof(*wordebuf); ++ pr_warn("Newly-erased block contained word 0x%lx at offset 0x%08x\n", ++ *wordebuf, *bad_offset); + return -EIO; + } + return 0; +-- +2.43.0 + diff --git a/queue-6.1/modpost-remove-incorrect-code-in-do_eisa_entry.patch b/queue-6.1/modpost-remove-incorrect-code-in-do_eisa_entry.patch new file mode 100644 index 00000000000..f9461d08611 --- /dev/null +++ b/queue-6.1/modpost-remove-incorrect-code-in-do_eisa_entry.patch @@ -0,0 +1,86 @@ +From 9794384acbb4f73236ddd6a61faa57e1789525ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2024 08:56:39 +0900 +Subject: modpost: remove incorrect code in do_eisa_entry() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masahiro Yamada + +[ Upstream commit 0c3e091319e4748cb36ac9a50848903dc6f54054 ] + +This function contains multiple bugs after the following commits: + + - ac551828993e ("modpost: i2c aliases need no trailing wildcard") + - 6543becf26ff ("mod/file2alias: make modalias generation safe for cross compiling") + +Commit ac551828993e inserted the following code to do_eisa_entry(): + +    else +            strcat(alias, "*"); + +This is incorrect because 'alias' is uninitialized. If it is not +NULL-terminated, strcat() could cause a buffer overrun. + +Even if 'alias' happens to be zero-filled, it would output: + + MODULE_ALIAS("*"); + +This would match anything. As a result, the module could be loaded by +any unrelated uevent from an unrelated subsystem. + +Commit ac551828993e introduced another bug.             + +Prior to that commit, the conditional check was: + +    if (eisa->sig[0]) + +This checked if the first character of eisa_device_id::sig was not '\0'. + +However, commit ac551828993e changed it as follows: + +    if (sig[0]) + +sig[0] is NOT the first character of the eisa_device_id::sig. The +type of 'sig' is 'char (*)[8]', meaning that the type of 'sig[0]' is +'char [8]' instead of 'char'. 'sig[0]' and 'symval' refer to the same +address, which never becomes NULL. + +The correct conversion would have been: + +    if ((*sig)[0]) + +However, this if-conditional was meaningless because the earlier change +in commit ac551828993e was incorrect. + +This commit removes the entire incorrect code, which should never have +been executed. + +Fixes: ac551828993e ("modpost: i2c aliases need no trailing wildcard") +Fixes: 6543becf26ff ("mod/file2alias: make modalias generation safe for cross compiling") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/mod/file2alias.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c +index 39e2c8883ddd4..c08beab14a2e0 100644 +--- a/scripts/mod/file2alias.c ++++ b/scripts/mod/file2alias.c +@@ -808,10 +808,7 @@ static int do_eisa_entry(const char *filename, void *symval, + char *alias) + { + DEF_FIELD_ADDR(symval, eisa_device_id, sig); +- if (sig[0]) +- sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig); +- else +- strcat(alias, "*"); ++ sprintf(alias, EISA_DEVICE_MODALIAS_FMT "*", *sig); + return 1; + } + +-- +2.43.0 + diff --git a/queue-6.1/nfs-ignore-sb_rdonly-when-mounting-nfs.patch b/queue-6.1/nfs-ignore-sb_rdonly-when-mounting-nfs.patch new file mode 100644 index 00000000000..72877be9059 --- /dev/null +++ b/queue-6.1/nfs-ignore-sb_rdonly-when-mounting-nfs.patch @@ -0,0 +1,79 @@ +From 282016a3e5ffdf0e177e105639a40dd028dd5677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Nov 2024 12:53:03 +0800 +Subject: nfs: ignore SB_RDONLY when mounting nfs + +From: Li Lingfeng + +[ Upstream commit 52cb7f8f177878b4f22397b9c4d2c8f743766be3 ] + +When exporting only one file system with fsid=0 on the server side, the +client alternately uses the ro/rw mount options to perform the mount +operation, and a new vfsmount is generated each time. + +It can be reproduced as follows: +[root@localhost ~]# mount /dev/sda /mnt2 +[root@localhost ~]# echo "/mnt2 *(rw,no_root_squash,fsid=0)" >/etc/exports +[root@localhost ~]# systemctl restart nfs-server +[root@localhost ~]# mount -t nfs -o ro,vers=4 127.0.0.1:/ /mnt/sdaa +[root@localhost ~]# mount -t nfs -o rw,vers=4 127.0.0.1:/ /mnt/sdaa +[root@localhost ~]# mount -t nfs -o ro,vers=4 127.0.0.1:/ /mnt/sdaa +[root@localhost ~]# mount -t nfs -o rw,vers=4 127.0.0.1:/ /mnt/sdaa +[root@localhost ~]# mount | grep nfs4 +127.0.0.1:/ on /mnt/sdaa type nfs4 (ro,relatime,vers=4.2,rsize=1048576,... +127.0.0.1:/ on /mnt/sdaa type nfs4 (rw,relatime,vers=4.2,rsize=1048576,... +127.0.0.1:/ on /mnt/sdaa type nfs4 (ro,relatime,vers=4.2,rsize=1048576,... +127.0.0.1:/ on /mnt/sdaa type nfs4 (rw,relatime,vers=4.2,rsize=1048576,... +[root@localhost ~]# + +We expected that after mounting with the ro option, using the rw option to +mount again would return EBUSY, but the actual situation was not the case. + +As shown above, when mounting for the first time, a superblock with the ro +flag will be generated, and at the same time, in do_new_mount_fc --> +do_add_mount, it detects that the superblock corresponding to the current +target directory is inconsistent with the currently generated one +(path->mnt->mnt_sb != newmnt->mnt.mnt_sb), and a new vfsmount will be +generated. + +When mounting with the rw option for the second time, since no matching +superblock can be found in the fs_supers list, a new superblock with the +rw flag will be generated again. The superblock in use (ro) is different +from the newly generated superblock (rw), and a new vfsmount will be +generated again. + +When mounting with the ro option for the third time, the superblock (ro) +is found in fs_supers, the superblock in use (rw) is different from the +found superblock (ro), and a new vfsmount will be generated again. + +We can switch between ro/rw through remount, and only one superblock needs +to be generated, thus avoiding the problem of repeated generation of +vfsmount caused by switching superblocks. + +Furthermore, This can also resolve the issue described in the link. + +Fixes: 275a5d24bf56 ("NFS: Error when mounting the same filesystem with different options") +Link: https://lore.kernel.org/all/20240604112636.236517-3-lilingfeng@huaweicloud.com/ +Signed-off-by: Li Lingfeng +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h +index d921d7b7bec64..7fa23a6368e0b 100644 +--- a/fs/nfs/internal.h ++++ b/fs/nfs/internal.h +@@ -11,7 +11,7 @@ + #include + #include + +-#define NFS_SB_MASK (SB_RDONLY|SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS) ++#define NFS_SB_MASK (SB_NOSUID|SB_NODEV|SB_NOEXEC|SB_SYNCHRONOUS) + + extern const struct export_operations nfs_export_ops; + +-- +2.43.0 + diff --git a/queue-6.1/nfsv4.0-fix-a-use-after-free-problem-in-the-asynchro.patch b/queue-6.1/nfsv4.0-fix-a-use-after-free-problem-in-the-asynchro.patch new file mode 100644 index 00000000000..92e225448be --- /dev/null +++ b/queue-6.1/nfsv4.0-fix-a-use-after-free-problem-in-the-asynchro.patch @@ -0,0 +1,52 @@ +From dd52768816fad22c1964887778f125e73ce4be75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 12:13:31 -0500 +Subject: NFSv4.0: Fix a use-after-free problem in the asynchronous open() + +From: Trond Myklebust + +[ Upstream commit 2fdb05dc0931250574f0cb0ebeb5ed8e20f4a889 ] + +Yang Erkun reports that when two threads are opening files at the same +time, and are forced to abort before a reply is seen, then the call to +nfs_release_seqid() in nfs4_opendata_free() can result in a +use-after-free of the pointer to the defunct rpc task of the other +thread. +The fix is to ensure that if the RPC call is aborted before the call to +nfs_wait_on_sequence() is complete, then we must call nfs_release_seqid() +in nfs4_open_release() before the rpc_task is freed. + +Reported-by: Yang Erkun +Fixes: 24ac23ab88df ("NFSv4: Convert open() into an asynchronous RPC call") +Reviewed-by: Yang Erkun +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 1e97de7c8c204..5b06b8d4e0147 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2528,12 +2528,14 @@ static void nfs4_open_release(void *calldata) + struct nfs4_opendata *data = calldata; + struct nfs4_state *state = NULL; + ++ /* In case of error, no cleanup! */ ++ if (data->rpc_status != 0 || !data->rpc_done) { ++ nfs_release_seqid(data->o_arg.seqid); ++ goto out_free; ++ } + /* If this request hasn't been cancelled, do nothing */ + if (!data->cancelled) + goto out_free; +- /* In case of error, no cleanup! */ +- if (data->rpc_status != 0 || !data->rpc_done) +- goto out_free; + /* In case we need an open_confirm, no cleanup! */ + if (data->o_res.rflags & NFS4_OPEN_RESULT_CONFIRM) + goto out_free; +-- +2.43.0 + diff --git a/queue-6.1/perf-arm-cmn-ensure-port-and-device-id-bits-are-set-.patch b/queue-6.1/perf-arm-cmn-ensure-port-and-device-id-bits-are-set-.patch new file mode 100644 index 00000000000..84f1bf7d617 --- /dev/null +++ b/queue-6.1/perf-arm-cmn-ensure-port-and-device-id-bits-are-set-.patch @@ -0,0 +1,50 @@ +From 79990e34e2b6e9d20296473e3c827e4f19726c9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2024 16:13:34 -0800 +Subject: perf/arm-cmn: Ensure port and device id bits are set properly + +From: Namhyung Kim + +[ Upstream commit dfdf714fed559c09021df1d2a4bb64c0ad5f53bc ] + +The portid_bits and deviceid_bits were set only for XP type nodes in +the arm_cmn_discover() and it confused other nodes to find XP nodes. +Copy the both bits from the XP nodes directly when it sets up a new +node. + +Fixes: e79634b53e39 ("perf/arm-cmn: Refactor node ID handling. Again.") +Signed-off-by: Namhyung Kim +Acked-by: Will Deacon +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/20241121001334.331334-1-namhyung@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index b8983f42e749e..4445cae427b2d 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -1951,8 +1951,6 @@ static int arm_cmn_init_dtcs(struct arm_cmn *cmn) + continue; + + xp = arm_cmn_node_to_xp(cmn, dn); +- dn->portid_bits = xp->portid_bits; +- dn->deviceid_bits = xp->deviceid_bits; + dn->dtc = xp->dtc; + dn->dtm = xp->dtm; + if (cmn->multi_dtm) +@@ -2183,6 +2181,8 @@ static int arm_cmn_discover(struct arm_cmn *cmn, unsigned int rgn_offset) + } + + arm_cmn_init_node_info(cmn, reg & CMN_CHILD_NODE_ADDR, dn); ++ dn->portid_bits = xp->portid_bits; ++ dn->deviceid_bits = xp->deviceid_bits; + + switch (dn->type) { + case CMN_TYPE_DTC: +-- +2.43.0 + diff --git a/queue-6.1/perf-arm-smmuv3-fix-lockdep-assert-in-event_init.patch b/queue-6.1/perf-arm-smmuv3-fix-lockdep-assert-in-event_init.patch new file mode 100644 index 00000000000..01282ab6dde --- /dev/null +++ b/queue-6.1/perf-arm-smmuv3-fix-lockdep-assert-in-event_init.patch @@ -0,0 +1,68 @@ +From 1b6e4ca22a946212ec2cf62a7ef2e580bc9908c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Nov 2024 05:08:05 +0000 +Subject: perf/arm-smmuv3: Fix lockdep assert in ->event_init() + +From: Chun-Tse Shao + +[ Upstream commit 02a55f2743012a8089f09f6867220c3d57f16564 ] + +Same as +https://lore.kernel.org/all/20240514180050.182454-1-namhyung@kernel.org/, +we should skip `for_each_sibling_event()` for group leader since it +doesn't have the ctx yet. + +Fixes: f3c0eba28704 ("perf: Add a few assertions") +Reported-by: Greg Thelen +Cc: Namhyung Kim +Cc: Robin Murphy +Cc: Tuan Phan +Signed-off-by: Chun-Tse Shao +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20241108050806.3730811-1-ctshao@google.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + drivers/perf/arm_smmuv3_pmu.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/perf/arm_smmuv3_pmu.c b/drivers/perf/arm_smmuv3_pmu.c +index 0e17c57ddb876..feaf79b980017 100644 +--- a/drivers/perf/arm_smmuv3_pmu.c ++++ b/drivers/perf/arm_smmuv3_pmu.c +@@ -431,6 +431,17 @@ static int smmu_pmu_event_init(struct perf_event *event) + return -EINVAL; + } + ++ /* ++ * Ensure all events are on the same cpu so all events are in the ++ * same cpu context, to avoid races on pmu_enable etc. ++ */ ++ event->cpu = smmu_pmu->on_cpu; ++ ++ hwc->idx = -1; ++ ++ if (event->group_leader == event) ++ return 0; ++ + for_each_sibling_event(sibling, event->group_leader) { + if (is_software_event(sibling)) + continue; +@@ -442,14 +453,6 @@ static int smmu_pmu_event_init(struct perf_event *event) + return -EINVAL; + } + +- hwc->idx = -1; +- +- /* +- * Ensure all events are on the same cpu so all events are in the +- * same cpu context, to avoid races on pmu_enable etc. +- */ +- event->cpu = smmu_pmu->on_cpu; +- + return 0; + } + +-- +2.43.0 + diff --git a/queue-6.1/rtc-ab-eoz9-don-t-fail-temperature-reads-on-undervol.patch b/queue-6.1/rtc-ab-eoz9-don-t-fail-temperature-reads-on-undervol.patch new file mode 100644 index 00000000000..a956d34fe35 --- /dev/null +++ b/queue-6.1/rtc-ab-eoz9-don-t-fail-temperature-reads-on-undervol.patch @@ -0,0 +1,49 @@ +From a72d820e3be56559efc294f0fd38c36cc6bd19d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Nov 2024 11:10:30 +0100 +Subject: rtc: ab-eoz9: don't fail temperature reads on undervoltage + notification + +From: Maxime Chevallier + +[ Upstream commit e0779a0dcf41a6452ac0a169cd96863feb5787c7 ] + +The undervoltage flags reported by the RTC are useful to know if the +time and date are reliable after a reboot. Although the threshold VLOW1 +indicates that the thermometer has been shutdown and time compensation +is off, it doesn't mean that the temperature readout is currently +impossible. + +As the system is running, the RTC voltage is now fully established and +we can read the temperature. + +Fixes: 67075b63cce2 ("rtc: add AB-RTCMC-32.768kHz-EOZ9 RTC support") +Signed-off-by: Maxime Chevallier +Link: https://lore.kernel.org/r/20241122101031.68916-3-maxime.chevallier@bootlin.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ab-eoz9.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/drivers/rtc/rtc-ab-eoz9.c b/drivers/rtc/rtc-ab-eoz9.c +index 2f8deb8c4cd3e..da710a29e9620 100644 +--- a/drivers/rtc/rtc-ab-eoz9.c ++++ b/drivers/rtc/rtc-ab-eoz9.c +@@ -396,13 +396,6 @@ static int abeoz9z3_temp_read(struct device *dev, + if (ret < 0) + return ret; + +- if ((val & ABEOZ9_REG_CTRL_STATUS_V1F) || +- (val & ABEOZ9_REG_CTRL_STATUS_V2F)) { +- dev_err(dev, +- "thermometer might be disabled due to low voltage\n"); +- return -EINVAL; +- } +- + switch (attr) { + case hwmon_temp_input: + ret = regmap_read(regmap, ABEOZ9_REG_REG_TEMP, &val); +-- +2.43.0 + diff --git a/queue-6.1/rtc-abx80x-fix-wdt-bit-position-of-the-status-regist.patch b/queue-6.1/rtc-abx80x-fix-wdt-bit-position-of-the-status-regist.patch new file mode 100644 index 00000000000..054ca34966b --- /dev/null +++ b/queue-6.1/rtc-abx80x-fix-wdt-bit-position-of-the-status-regist.patch @@ -0,0 +1,39 @@ +From 68b4c3be41505311dfcf02a8f3f326709275af49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Oct 2024 13:17:37 +0900 +Subject: rtc: abx80x: Fix WDT bit position of the status register + +From: Nobuhiro Iwamatsu + +[ Upstream commit 10e078b273ee7a2b8b4f05a64ac458f5e652d18d ] + +The WDT bit in the status register is 5, not 6. This fixes from 6 to 5. + +Link: https://abracon.com/Support/AppsManuals/Precisiontiming/AB08XX-Application-Manual.pdf +Link: https://www.microcrystal.com/fileadmin/Media/Products/RTC/App.Manual/RV-1805-C3_App-Manual.pdf +Fixes: 749e36d0a0d7 ("rtc: abx80x: add basic watchdog support") +Cc: Jeremy Gebben +Signed-off-by: Nobuhiro Iwamatsu +Link: https://lore.kernel.org/r/20241008041737.1640633-1-iwamatsu@nigauri.org +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-abx80x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rtc/rtc-abx80x.c b/drivers/rtc/rtc-abx80x.c +index 9b0138d07232d..2ea6fdd2ae984 100644 +--- a/drivers/rtc/rtc-abx80x.c ++++ b/drivers/rtc/rtc-abx80x.c +@@ -37,7 +37,7 @@ + #define ABX8XX_REG_STATUS 0x0f + #define ABX8XX_STATUS_AF BIT(2) + #define ABX8XX_STATUS_BLF BIT(4) +-#define ABX8XX_STATUS_WDT BIT(6) ++#define ABX8XX_STATUS_WDT BIT(5) + + #define ABX8XX_REG_CTRL1 0x10 + #define ABX8XX_CTRL_WRITE BIT(0) +-- +2.43.0 + diff --git a/queue-6.1/rtc-check-if-__rtc_read_time-was-successful-in-rtc_t.patch b/queue-6.1/rtc-check-if-__rtc_read_time-was-successful-in-rtc_t.patch new file mode 100644 index 00000000000..2250d438e3c --- /dev/null +++ b/queue-6.1/rtc-check-if-__rtc_read_time-was-successful-in-rtc_t.patch @@ -0,0 +1,53 @@ +From 06da50cd36d4c20fe3bc588f281d2bc9c380e146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2024 12:31:53 +0800 +Subject: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() + +From: Yongliang Gao + +[ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ] + +If the __rtc_read_time call fails,, the struct rtc_time tm; may contain +uninitialized data, or an illegal date/time read from the RTC hardware. + +When calling rtc_tm_to_ktime later, the result may be a very large value +(possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue, +they will continually expire, may causing kernel softlockup. + +Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events") +Signed-off-by: Yongliang Gao +Acked-by: Jingqun Li +Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/interface.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index c928037bf6f3a..04ce689dae92b 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -904,13 +904,18 @@ void rtc_timer_do_work(struct work_struct *work) + struct timerqueue_node *next; + ktime_t now; + struct rtc_time tm; ++ int err; + + struct rtc_device *rtc = + container_of(work, struct rtc_device, irqwork); + + mutex_lock(&rtc->ops_lock); + again: +- __rtc_read_time(rtc, &tm); ++ err = __rtc_read_time(rtc, &tm); ++ if (err) { ++ mutex_unlock(&rtc->ops_lock); ++ return; ++ } + now = rtc_tm_to_ktime(tm); + while ((next = timerqueue_getnext(&rtc->timerqueue))) { + if (next->expires > now) +-- +2.43.0 + diff --git a/queue-6.1/rtc-rzn1-fix-bcd-to-rtc_time-conversion-errors.patch b/queue-6.1/rtc-rzn1-fix-bcd-to-rtc_time-conversion-errors.patch new file mode 100644 index 00000000000..0b7db7f85eb --- /dev/null +++ b/queue-6.1/rtc-rzn1-fix-bcd-to-rtc_time-conversion-errors.patch @@ -0,0 +1,52 @@ +From 8658927b1e9cb56768b2359bd372c7717cb25f09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Nov 2024 12:30:32 +0100 +Subject: rtc: rzn1: fix BCD to rtc_time conversion errors + +From: Wolfram Sang + +[ Upstream commit 55727188dfa3572aecd946e58fab9e4a64f06894 ] + +tm_mon describes months from 0 to 11, but the register contains BCD from +1 to 12. tm_year contains years since 1900, but the BCD contains 20XX. +Apply the offsets when converting these numbers. + +Fixes: deeb4b5393e1 ("rtc: rzn1: Add new RTC driver") +Signed-off-by: Wolfram Sang +Reviewed-by: Miquel Raynal +Link: https://lore.kernel.org/r/20241113113032.27409-1-wsa+renesas@sang-engineering.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-rzn1.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/rtc/rtc-rzn1.c b/drivers/rtc/rtc-rzn1.c +index 0d36bc50197c1..ff094b3ce9e3c 100644 +--- a/drivers/rtc/rtc-rzn1.c ++++ b/drivers/rtc/rtc-rzn1.c +@@ -111,8 +111,8 @@ static int rzn1_rtc_read_time(struct device *dev, struct rtc_time *tm) + tm->tm_hour = bcd2bin(tm->tm_hour); + tm->tm_wday = bcd2bin(tm->tm_wday); + tm->tm_mday = bcd2bin(tm->tm_mday); +- tm->tm_mon = bcd2bin(tm->tm_mon); +- tm->tm_year = bcd2bin(tm->tm_year); ++ tm->tm_mon = bcd2bin(tm->tm_mon) - 1; ++ tm->tm_year = bcd2bin(tm->tm_year) + 100; + + return 0; + } +@@ -128,8 +128,8 @@ static int rzn1_rtc_set_time(struct device *dev, struct rtc_time *tm) + tm->tm_hour = bin2bcd(tm->tm_hour); + tm->tm_wday = bin2bcd(rzn1_rtc_tm_to_wday(tm)); + tm->tm_mday = bin2bcd(tm->tm_mday); +- tm->tm_mon = bin2bcd(tm->tm_mon); +- tm->tm_year = bin2bcd(tm->tm_year); ++ tm->tm_mon = bin2bcd(tm->tm_mon + 1); ++ tm->tm_year = bin2bcd(tm->tm_year - 100); + + val = readl(rtc->base + RZN1_RTC_CTL2); + if (!(val & RZN1_RTC_CTL2_STOPPED)) { +-- +2.43.0 + diff --git a/queue-6.1/rtc-st-lpc-use-irqf_no_autoen-flag-in-request_irq.patch b/queue-6.1/rtc-st-lpc-use-irqf_no_autoen-flag-in-request_irq.patch new file mode 100644 index 00000000000..462f9dddc3e --- /dev/null +++ b/queue-6.1/rtc-st-lpc-use-irqf_no_autoen-flag-in-request_irq.patch @@ -0,0 +1,50 @@ +From 79220576b300fa2185f0952d2e5e72073de81b9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Sep 2024 11:37:27 +0800 +Subject: rtc: st-lpc: Use IRQF_NO_AUTOEN flag in request_irq() + +From: Jinjie Ruan + +[ Upstream commit b6cd7adec0cf03f0aefc55676e71dd721cbc71a8 ] + +If request_irq() fails in st_rtc_probe(), there is no need to enable +the irq, and if it succeeds, disable_irq() after request_irq() still has +a time gap in which interrupts can come. + +request_irq() with IRQF_NO_AUTOEN flag will disable IRQ auto-enable when +request IRQ. + +Fixes: b5b2bdfc2893 ("rtc: st: Add new driver for ST's LPC RTC") +Signed-off-by: Jinjie Ruan +Link: https://lore.kernel.org/r/20240912033727.3013951-1-ruanjinjie@huawei.com +Signed-off-by: Alexandre Belloni +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-st-lpc.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/rtc/rtc-st-lpc.c b/drivers/rtc/rtc-st-lpc.c +index d04d46f9cc65a..23fbe25edeff1 100644 +--- a/drivers/rtc/rtc-st-lpc.c ++++ b/drivers/rtc/rtc-st-lpc.c +@@ -218,15 +218,14 @@ static int st_rtc_probe(struct platform_device *pdev) + return -EINVAL; + } + +- ret = devm_request_irq(&pdev->dev, rtc->irq, st_rtc_handler, 0, +- pdev->name, rtc); ++ ret = devm_request_irq(&pdev->dev, rtc->irq, st_rtc_handler, ++ IRQF_NO_AUTOEN, pdev->name, rtc); + if (ret) { + dev_err(&pdev->dev, "Failed to request irq %i\n", rtc->irq); + return ret; + } + + enable_irq_wake(rtc->irq); +- disable_irq(rtc->irq); + + rtc->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(rtc->clk)) { +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index a3332b2da54..7734c935714 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -432,3 +432,26 @@ lib-string_helpers-silence-snprintf-output-truncation-warning.patch ipc-fix-memleak-if-msg_init_ns-failed-in-create_ipc_ns.patch nfsd-prevent-a-potential-integer-overflow.patch sunrpc-make-sure-cache-entry-active-before-cache_show.patch +um-fix-potential-integer-overflow-during-physmem-set.patch +um-fix-the-return-value-of-elf_core_copy_task_fpregs.patch +um-always-dump-trace-for-specified-task-in-show_stac.patch +nfsv4.0-fix-a-use-after-free-problem-in-the-asynchro.patch +rtc-st-lpc-use-irqf_no_autoen-flag-in-request_irq.patch +rtc-abx80x-fix-wdt-bit-position-of-the-status-regist.patch +rtc-check-if-__rtc_read_time-was-successful-in-rtc_t.patch +ubi-fastmap-wl-schedule-fm_work-if-wear-leveling-poo.patch +ubifs-correct-the-total-block-count-by-deducting-jou.patch +ubi-fastmap-fix-duplicate-slab-cache-names-while-att.patch +ubifs-authentication-fix-use-after-free-in-ubifs_tnc.patch +jffs2-fix-use-of-uninitialized-variable.patch +rtc-rzn1-fix-bcd-to-rtc_time-conversion-errors.patch +block-return-unsigned-int-from-bdev_io_min.patch +9p-xen-fix-init-sequence.patch +9p-xen-fix-release-of-irq.patch +perf-arm-smmuv3-fix-lockdep-assert-in-event_init.patch +perf-arm-cmn-ensure-port-and-device-id-bits-are-set-.patch +rtc-ab-eoz9-don-t-fail-temperature-reads-on-undervol.patch +modpost-remove-incorrect-code-in-do_eisa_entry.patch +nfs-ignore-sb_rdonly-when-mounting-nfs.patch +sunrpc-clear-xprt_sock_upd_timeout-when-reset-transp.patch +sh-intc-fix-use-after-free-bug-in-register_intc_cont.patch diff --git a/queue-6.1/sh-intc-fix-use-after-free-bug-in-register_intc_cont.patch b/queue-6.1/sh-intc-fix-use-after-free-bug-in-register_intc_cont.patch new file mode 100644 index 00000000000..baa8225ea5a --- /dev/null +++ b/queue-6.1/sh-intc-fix-use-after-free-bug-in-register_intc_cont.patch @@ -0,0 +1,46 @@ +From 2422f8c81bc0c703e5ac73e465a5008dff682f8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Oct 2024 11:41:59 +0300 +Subject: sh: intc: Fix use-after-free bug in register_intc_controller() + +From: Dan Carpenter + +[ Upstream commit 63e72e551942642c48456a4134975136cdcb9b3c ] + +In the error handling for this function, d is freed without ever +removing it from intc_list which would lead to a use after free. +To fix this, let's only add it to the list after everything has +succeeded. + +Fixes: 2dcec7a988a1 ("sh: intc: set_irq_wake() support") +Signed-off-by: Dan Carpenter +Reviewed-by: John Paul Adrian Glaubitz +Signed-off-by: John Paul Adrian Glaubitz +Signed-off-by: Sasha Levin +--- + drivers/sh/intc/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/sh/intc/core.c b/drivers/sh/intc/core.c +index ca4f4ca413f11..b19388b349be3 100644 +--- a/drivers/sh/intc/core.c ++++ b/drivers/sh/intc/core.c +@@ -209,7 +209,6 @@ int __init register_intc_controller(struct intc_desc *desc) + goto err0; + + INIT_LIST_HEAD(&d->list); +- list_add_tail(&d->list, &intc_list); + + raw_spin_lock_init(&d->lock); + INIT_RADIX_TREE(&d->tree, GFP_ATOMIC); +@@ -369,6 +368,7 @@ int __init register_intc_controller(struct intc_desc *desc) + + d->skip_suspend = desc->skip_syscore_suspend; + ++ list_add_tail(&d->list, &intc_list); + nr_intc_controllers++; + + return 0; +-- +2.43.0 + diff --git a/queue-6.1/sunrpc-clear-xprt_sock_upd_timeout-when-reset-transp.patch b/queue-6.1/sunrpc-clear-xprt_sock_upd_timeout-when-reset-transp.patch new file mode 100644 index 00000000000..d6ba51ba2ea --- /dev/null +++ b/queue-6.1/sunrpc-clear-xprt_sock_upd_timeout-when-reset-transp.patch @@ -0,0 +1,38 @@ +From 282ee6cfe5e7b713fd48f87988bdc4d3e32c4bcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Nov 2024 17:38:04 +0800 +Subject: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport + +From: Liu Jian + +[ Upstream commit 4db9ad82a6c823094da27de4825af693a3475d51 ] + +Since transport->sock has been set to NULL during reset transport, +XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the +xs_tcp_set_socket_timeouts() may be triggered in xs_tcp_send_request() +to dereference the transport->sock that has been set to NULL. + +Fixes: 7196dbb02ea0 ("SUNRPC: Allow changing of the TCP timeout parameters on the fly") +Signed-off-by: Li Lingfeng +Signed-off-by: Liu Jian +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 190dae11f634a..b9dc8e197dde8 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1130,6 +1130,7 @@ static void xs_sock_reset_state_flags(struct rpc_xprt *xprt) + clear_bit(XPRT_SOCK_WAKE_WRITE, &transport->sock_state); + clear_bit(XPRT_SOCK_WAKE_DISCONNECT, &transport->sock_state); + clear_bit(XPRT_SOCK_NOSPACE, &transport->sock_state); ++ clear_bit(XPRT_SOCK_UPD_TIMEOUT, &transport->sock_state); + } + + static void xs_run_error_worker(struct sock_xprt *transport, unsigned int nr) +-- +2.43.0 + diff --git a/queue-6.1/ubi-fastmap-fix-duplicate-slab-cache-names-while-att.patch b/queue-6.1/ubi-fastmap-fix-duplicate-slab-cache-names-while-att.patch new file mode 100644 index 00000000000..589d1adb440 --- /dev/null +++ b/queue-6.1/ubi-fastmap-fix-duplicate-slab-cache-names-while-att.patch @@ -0,0 +1,104 @@ +From bb95cb361d06f901633a692af649cd465056aa6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Oct 2024 12:50:02 +0800 +Subject: ubi: fastmap: Fix duplicate slab cache names while attaching + +From: Zhihao Cheng + +[ Upstream commit bcddf52b7a17adcebc768d26f4e27cf79adb424c ] + +Since commit 4c39529663b9 ("slab: Warn on duplicate cache names when +DEBUG_VM=y"), the duplicate slab cache names can be detected and a +kernel WARNING is thrown out. +In UBI fast attaching process, alloc_ai() could be invoked twice +with the same slab cache name 'ubi_aeb_slab_cache', which will trigger +following warning messages: + kmem_cache of name 'ubi_aeb_slab_cache' already exists + WARNING: CPU: 0 PID: 7519 at mm/slab_common.c:107 + __kmem_cache_create_args+0x100/0x5f0 + Modules linked in: ubi(+) nandsim [last unloaded: nandsim] + CPU: 0 UID: 0 PID: 7519 Comm: modprobe Tainted: G 6.12.0-rc2 + RIP: 0010:__kmem_cache_create_args+0x100/0x5f0 + Call Trace: + __kmem_cache_create_args+0x100/0x5f0 + alloc_ai+0x295/0x3f0 [ubi] + ubi_attach+0x3c3/0xcc0 [ubi] + ubi_attach_mtd_dev+0x17cf/0x3fa0 [ubi] + ubi_init+0x3fb/0x800 [ubi] + do_init_module+0x265/0x7d0 + __x64_sys_finit_module+0x7a/0xc0 + +The problem could be easily reproduced by loading UBI device by fastmap +with CONFIG_DEBUG_VM=y. +Fix it by using different slab names for alloc_ai() callers. + +Fixes: d2158f69a7d4 ("UBI: Remove alloc_ai() slab name from parameter list") +Fixes: fdf10ed710c0 ("ubi: Rework Fastmap attach base code") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/attach.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/ubi/attach.c b/drivers/mtd/ubi/attach.c +index ae5abe492b52a..adc47b87b38a5 100644 +--- a/drivers/mtd/ubi/attach.c ++++ b/drivers/mtd/ubi/attach.c +@@ -1447,7 +1447,7 @@ static int scan_all(struct ubi_device *ubi, struct ubi_attach_info *ai, + return err; + } + +-static struct ubi_attach_info *alloc_ai(void) ++static struct ubi_attach_info *alloc_ai(const char *slab_name) + { + struct ubi_attach_info *ai; + +@@ -1461,7 +1461,7 @@ static struct ubi_attach_info *alloc_ai(void) + INIT_LIST_HEAD(&ai->alien); + INIT_LIST_HEAD(&ai->fastmap); + ai->volumes = RB_ROOT; +- ai->aeb_slab_cache = kmem_cache_create("ubi_aeb_slab_cache", ++ ai->aeb_slab_cache = kmem_cache_create(slab_name, + sizeof(struct ubi_ainf_peb), + 0, 0, NULL); + if (!ai->aeb_slab_cache) { +@@ -1491,7 +1491,7 @@ static int scan_fast(struct ubi_device *ubi, struct ubi_attach_info **ai) + + err = -ENOMEM; + +- scan_ai = alloc_ai(); ++ scan_ai = alloc_ai("ubi_aeb_slab_cache_fastmap"); + if (!scan_ai) + goto out; + +@@ -1557,7 +1557,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan) + int err; + struct ubi_attach_info *ai; + +- ai = alloc_ai(); ++ ai = alloc_ai("ubi_aeb_slab_cache"); + if (!ai) + return -ENOMEM; + +@@ -1575,7 +1575,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan) + if (err > 0 || mtd_is_eccerr(err)) { + if (err != UBI_NO_FASTMAP) { + destroy_ai(ai); +- ai = alloc_ai(); ++ ai = alloc_ai("ubi_aeb_slab_cache"); + if (!ai) + return -ENOMEM; + +@@ -1614,7 +1614,7 @@ int ubi_attach(struct ubi_device *ubi, int force_scan) + if (ubi->fm && ubi_dbg_chk_fastmap(ubi)) { + struct ubi_attach_info *scan_ai; + +- scan_ai = alloc_ai(); ++ scan_ai = alloc_ai("ubi_aeb_slab_cache_dbg_chk_fastmap"); + if (!scan_ai) { + err = -ENOMEM; + goto out_wl; +-- +2.43.0 + diff --git a/queue-6.1/ubi-fastmap-wl-schedule-fm_work-if-wear-leveling-poo.patch b/queue-6.1/ubi-fastmap-wl-schedule-fm_work-if-wear-leveling-poo.patch new file mode 100644 index 00000000000..4cfdc6d095f --- /dev/null +++ b/queue-6.1/ubi-fastmap-wl-schedule-fm_work-if-wear-leveling-poo.patch @@ -0,0 +1,98 @@ +From 935e578fe6e8a1f25e0e319350d3f90ac8a1ebcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Aug 2024 11:26:22 +0800 +Subject: ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty + +From: Zhihao Cheng + +[ Upstream commit c4595fe394a289927077e3da561db27811919ee0 ] + +Since commit 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb +before wear leveling"), wear_leveling_worker() won't schedule fm_work +if wear-leveling pool is empty, which could temporarily disable the +wear-leveling until the fastmap is updated(eg. pool becomes empty). +Fix it by scheduling fm_work if wl_pool is empty during wear-leveing. + +Fixes: 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb before wear leveling") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + drivers/mtd/ubi/fastmap-wl.c | 19 ++++++++++++++++--- + drivers/mtd/ubi/wl.c | 2 +- + drivers/mtd/ubi/wl.h | 3 ++- + 3 files changed, 19 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c +index 863f571f1adb5..79733163ab7d0 100644 +--- a/drivers/mtd/ubi/fastmap-wl.c ++++ b/drivers/mtd/ubi/fastmap-wl.c +@@ -282,14 +282,27 @@ int ubi_wl_get_peb(struct ubi_device *ubi) + * WL sub-system. + * + * @ubi: UBI device description object ++ * @need_fill: whether to fill wear-leveling pool when no PEBs are found + */ +-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi) ++static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, ++ bool need_fill) + { + struct ubi_fm_pool *pool = &ubi->fm_wl_pool; + int pnum; + +- if (pool->used == pool->size) ++ if (pool->used == pool->size) { ++ if (need_fill && !ubi->fm_work_scheduled) { ++ /* ++ * We cannot update the fastmap here because this ++ * function is called in atomic context. ++ * Let's fail here and refill/update it as soon as ++ * possible. ++ */ ++ ubi->fm_work_scheduled = 1; ++ schedule_work(&ubi->fm_work); ++ } + return NULL; ++ } + + pnum = pool->pebs[pool->used]; + return ubi->lookuptbl[pnum]; +@@ -311,7 +324,7 @@ static bool need_wear_leveling(struct ubi_device *ubi) + if (!ubi->used.rb_node) + return false; + +- e = next_peb_for_wl(ubi); ++ e = next_peb_for_wl(ubi, false); + if (!e) { + if (!ubi->free.rb_node) + return false; +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 3e37c9981e716..c1d3472cdc9ad 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -671,7 +671,7 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, + ubi_assert(!ubi->move_to_put); + + #ifdef CONFIG_MTD_UBI_FASTMAP +- if (!next_peb_for_wl(ubi) || ++ if (!next_peb_for_wl(ubi, true) || + #else + if (!ubi->free.rb_node || + #endif +diff --git a/drivers/mtd/ubi/wl.h b/drivers/mtd/ubi/wl.h +index 5ebe374a08aed..1d83e552533a5 100644 +--- a/drivers/mtd/ubi/wl.h ++++ b/drivers/mtd/ubi/wl.h +@@ -5,7 +5,8 @@ + static void update_fastmap_work_fn(struct work_struct *wrk); + static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root); + static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi); +-static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi); ++static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, ++ bool need_fill); + static bool need_wear_leveling(struct ubi_device *ubi); + static void ubi_fastmap_close(struct ubi_device *ubi); + static inline void ubi_fastmap_init(struct ubi_device *ubi, int *count) +-- +2.43.0 + diff --git a/queue-6.1/ubifs-authentication-fix-use-after-free-in-ubifs_tnc.patch b/queue-6.1/ubifs-authentication-fix-use-after-free-in-ubifs_tnc.patch new file mode 100644 index 00000000000..6be5c6a4745 --- /dev/null +++ b/queue-6.1/ubifs-authentication-fix-use-after-free-in-ubifs_tnc.patch @@ -0,0 +1,171 @@ +From 135cba4d15e2ba3d01c8aa5f3612f7e9a58d4380 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Oct 2024 16:46:59 +0200 +Subject: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit + +From: Waqar Hameed + +[ Upstream commit 4617fb8fc15effe8eda4dd898d4e33eb537a7140 ] + +After an insertion in TNC, the tree might split and cause a node to +change its `znode->parent`. A further deletion of other nodes in the +tree (which also could free the nodes), the aforementioned node's +`znode->cparent` could still point to a freed node. This +`znode->cparent` may not be updated when getting nodes to commit in +`ubifs_tnc_start_commit()`. This could then trigger a use-after-free +when accessing the `znode->cparent` in `write_index()` in +`ubifs_tnc_end_commit()`. + +This can be triggered by running + + rm -f /etc/test-file.bin + dd if=/dev/urandom of=/etc/test-file.bin bs=1M count=60 conv=fsync + +in a loop, and with `CONFIG_UBIFS_FS_AUTHENTICATION`. KASAN then +reports: + + BUG: KASAN: use-after-free in ubifs_tnc_end_commit+0xa5c/0x1950 + Write of size 32 at addr ffffff800a3af86c by task ubifs_bgt0_20/153 + + Call trace: + dump_backtrace+0x0/0x340 + show_stack+0x18/0x24 + dump_stack_lvl+0x9c/0xbc + print_address_description.constprop.0+0x74/0x2b0 + kasan_report+0x1d8/0x1f0 + kasan_check_range+0xf8/0x1a0 + memcpy+0x84/0xf4 + ubifs_tnc_end_commit+0xa5c/0x1950 + do_commit+0x4e0/0x1340 + ubifs_bg_thread+0x234/0x2e0 + kthread+0x36c/0x410 + ret_from_fork+0x10/0x20 + + Allocated by task 401: + kasan_save_stack+0x38/0x70 + __kasan_kmalloc+0x8c/0xd0 + __kmalloc+0x34c/0x5bc + tnc_insert+0x140/0x16a4 + ubifs_tnc_add+0x370/0x52c + ubifs_jnl_write_data+0x5d8/0x870 + do_writepage+0x36c/0x510 + ubifs_writepage+0x190/0x4dc + __writepage+0x58/0x154 + write_cache_pages+0x394/0x830 + do_writepages+0x1f0/0x5b0 + filemap_fdatawrite_wbc+0x170/0x25c + file_write_and_wait_range+0x140/0x190 + ubifs_fsync+0xe8/0x290 + vfs_fsync_range+0xc0/0x1e4 + do_fsync+0x40/0x90 + __arm64_sys_fsync+0x34/0x50 + invoke_syscall.constprop.0+0xa8/0x260 + do_el0_svc+0xc8/0x1f0 + el0_svc+0x34/0x70 + el0t_64_sync_handler+0x108/0x114 + el0t_64_sync+0x1a4/0x1a8 + + Freed by task 403: + kasan_save_stack+0x38/0x70 + kasan_set_track+0x28/0x40 + kasan_set_free_info+0x28/0x4c + __kasan_slab_free+0xd4/0x13c + kfree+0xc4/0x3a0 + tnc_delete+0x3f4/0xe40 + ubifs_tnc_remove_range+0x368/0x73c + ubifs_tnc_remove_ino+0x29c/0x2e0 + ubifs_jnl_delete_inode+0x150/0x260 + ubifs_evict_inode+0x1d4/0x2e4 + evict+0x1c8/0x450 + iput+0x2a0/0x3c4 + do_unlinkat+0x2cc/0x490 + __arm64_sys_unlinkat+0x90/0x100 + invoke_syscall.constprop.0+0xa8/0x260 + do_el0_svc+0xc8/0x1f0 + el0_svc+0x34/0x70 + el0t_64_sync_handler+0x108/0x114 + el0t_64_sync+0x1a4/0x1a8 + +The offending `memcpy()` in `ubifs_copy_hash()` has a use-after-free +when a node becomes root in TNC but still has a `cparent` to an already +freed node. More specifically, consider the following TNC: + + zroot + / + / + zp1 + / + / + zn + +Inserting a new node `zn_new` with a key smaller then `zn` will trigger +a split in `tnc_insert()` if `zp1` is full: + + zroot + / \ + / \ + zp1 zp2 + / \ + / \ + zn_new zn + +`zn->parent` has now been moved to `zp2`, *but* `zn->cparent` still +points to `zp1`. + +Now, consider a removal of all the nodes _except_ `zn`. Just when +`tnc_delete()` is about to delete `zroot` and `zp2`: + + zroot + \ + \ + zp2 + \ + \ + zn + +`zroot` and `zp2` get freed and the tree collapses: + + zn + +`zn` now becomes the new `zroot`. + +`get_znodes_to_commit()` will now only find `zn`, the new `zroot`, and +`write_index()` will check its `znode->cparent` that wrongly points to +the already freed `zp1`. `ubifs_copy_hash()` thus gets wrongly called +with `znode->cparent->zbranch[znode->iip].hash` that triggers the +use-after-free! + +Fix this by explicitly setting `znode->cparent` to `NULL` in +`get_znodes_to_commit()` for the root node. The search for the dirty +nodes is bottom-up in the tree. Thus, when `find_next_dirty(znode)` +returns NULL, the current `znode` _is_ the root node. Add an assert for +this. + +Fixes: 16a26b20d2af ("ubifs: authentication: Add hashes to index nodes") +Tested-by: Waqar Hameed +Co-developed-by: Zhihao Cheng +Signed-off-by: Zhihao Cheng +Signed-off-by: Waqar Hameed +Reviewed-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/tnc_commit.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/ubifs/tnc_commit.c b/fs/ubifs/tnc_commit.c +index 01362ad5f804a..efd52cc534364 100644 +--- a/fs/ubifs/tnc_commit.c ++++ b/fs/ubifs/tnc_commit.c +@@ -657,6 +657,8 @@ static int get_znodes_to_commit(struct ubifs_info *c) + znode->alt = 0; + cnext = find_next_dirty(znode); + if (!cnext) { ++ ubifs_assert(c, !znode->parent); ++ znode->cparent = NULL; + znode->cnext = c->cnext; + break; + } +-- +2.43.0 + diff --git a/queue-6.1/ubifs-correct-the-total-block-count-by-deducting-jou.patch b/queue-6.1/ubifs-correct-the-total-block-count-by-deducting-jou.patch new file mode 100644 index 00000000000..a0c93987e34 --- /dev/null +++ b/queue-6.1/ubifs-correct-the-total-block-count-by-deducting-jou.patch @@ -0,0 +1,46 @@ +From d8391257d327fe9113579e20294cca57da98297a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2024 09:09:09 +0800 +Subject: ubifs: Correct the total block count by deducting journal reservation + +From: Zhihao Cheng + +[ Upstream commit 84a2bee9c49769310efa19601157ef50a1df1267 ] + +Since commit e874dcde1cbf ("ubifs: Reserve one leb for each journal +head while doing budget"), available space is calulated by deducting +reservation for all journal heads. However, the total block count ( +which is only used by statfs) is not updated yet, which will cause +the wrong displaying for used space(total - available). +Fix it by deducting reservation for all journal heads from total +block count. + +Fixes: e874dcde1cbf ("ubifs: Reserve one leb for each journal head while doing budget") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/super.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c +index 32cb147597960..d4c3948a7f863 100644 +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -777,10 +777,10 @@ static void init_constants_master(struct ubifs_info *c) + * necessary to report something for the 'statfs()' call. + * + * Subtract the LEB reserved for GC, the LEB which is reserved for +- * deletions, minimum LEBs for the index, and assume only one journal +- * head is available. ++ * deletions, minimum LEBs for the index, the LEBs which are reserved ++ * for each journal head. + */ +- tmp64 = c->main_lebs - 1 - 1 - MIN_INDEX_LEBS - c->jhead_cnt + 1; ++ tmp64 = c->main_lebs - 1 - 1 - MIN_INDEX_LEBS - c->jhead_cnt; + tmp64 *= (long long)c->leb_size - c->leb_overhead; + tmp64 = ubifs_reported_space(c, tmp64); + c->block_cnt = tmp64 >> UBIFS_BLOCK_SHIFT; +-- +2.43.0 + diff --git a/queue-6.1/um-always-dump-trace-for-specified-task-in-show_stac.patch b/queue-6.1/um-always-dump-trace-for-specified-task-in-show_stac.patch new file mode 100644 index 00000000000..961352be1b7 --- /dev/null +++ b/queue-6.1/um-always-dump-trace-for-specified-task-in-show_stac.patch @@ -0,0 +1,37 @@ +From 27c64ccc92582dc7b5c7525aca5cd0eb9c4cf217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Nov 2024 18:39:33 +0800 +Subject: um: Always dump trace for specified task in show_stack + +From: Tiwei Bie + +[ Upstream commit 0f659ff362eac69777c4c191b7e5ccb19d76c67d ] + +Currently, show_stack() always dumps the trace of the current task. +However, it should dump the trace of the specified task if one is +provided. Otherwise, things like running "echo t > sysrq-trigger" +won't work as expected. + +Fixes: 970e51feaddb ("um: Add support for CONFIG_STACKTRACE") +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20241106103933.1132365-1-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/kernel/sysrq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/kernel/sysrq.c b/arch/um/kernel/sysrq.c +index 746715379f12a..7e897e44a03da 100644 +--- a/arch/um/kernel/sysrq.c ++++ b/arch/um/kernel/sysrq.c +@@ -53,5 +53,5 @@ void show_stack(struct task_struct *task, unsigned long *stack, + } + + printk("%sCall Trace:\n", loglvl); +- dump_trace(current, &stackops, (void *)loglvl); ++ dump_trace(task ?: current, &stackops, (void *)loglvl); + } +-- +2.43.0 + diff --git a/queue-6.1/um-fix-potential-integer-overflow-during-physmem-set.patch b/queue-6.1/um-fix-potential-integer-overflow-during-physmem-set.patch new file mode 100644 index 00000000000..969df555564 --- /dev/null +++ b/queue-6.1/um-fix-potential-integer-overflow-during-physmem-set.patch @@ -0,0 +1,50 @@ +From 140af08ed952bd1cd991f9b2f84bb3f81364ab7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Sep 2024 12:59:48 +0800 +Subject: um: Fix potential integer overflow during physmem setup + +From: Tiwei Bie + +[ Upstream commit a98b7761f697e590ed5d610d87fa12be66f23419 ] + +This issue happens when the real map size is greater than LONG_MAX, +which can be easily triggered on UML/i386. + +Fixes: fe205bdd1321 ("um: Print minimum physical memory requirement") +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20240916045950.508910-3-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/kernel/physmem.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/um/kernel/physmem.c b/arch/um/kernel/physmem.c +index 91485119ae67a..4339580f5a4f6 100644 +--- a/arch/um/kernel/physmem.c ++++ b/arch/um/kernel/physmem.c +@@ -80,10 +80,10 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, + unsigned long len, unsigned long long highmem) + { + unsigned long reserve = reserve_end - start; +- long map_size = len - reserve; ++ unsigned long map_size = len - reserve; + int err; + +- if(map_size <= 0) { ++ if (len <= reserve) { + os_warn("Too few physical memory! Needed=%lu, given=%lu\n", + reserve, len); + exit(1); +@@ -94,7 +94,7 @@ void __init setup_physmem(unsigned long start, unsigned long reserve_end, + err = os_map_memory((void *) reserve_end, physmem_fd, reserve, + map_size, 1, 1, 1); + if (err < 0) { +- os_warn("setup_physmem - mapping %ld bytes of memory at 0x%p " ++ os_warn("setup_physmem - mapping %lu bytes of memory at 0x%p " + "failed - errno = %d\n", map_size, + (void *) reserve_end, err); + exit(1); +-- +2.43.0 + diff --git a/queue-6.1/um-fix-the-return-value-of-elf_core_copy_task_fpregs.patch b/queue-6.1/um-fix-the-return-value-of-elf_core_copy_task_fpregs.patch new file mode 100644 index 00000000000..6b289df5507 --- /dev/null +++ b/queue-6.1/um-fix-the-return-value-of-elf_core_copy_task_fpregs.patch @@ -0,0 +1,36 @@ +From 6f5e242983b4bec18678058209d925f7be813d25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Sep 2024 10:33:02 +0800 +Subject: um: Fix the return value of elf_core_copy_task_fpregs + +From: Tiwei Bie + +[ Upstream commit 865e3845eeaa21e9a62abc1361644e67124f1ec0 ] + +This function is expected to return a boolean value, which should be +true on success and false on failure. + +Fixes: d1254b12c93e ("uml: fix x86_64 core dump crash") +Signed-off-by: Tiwei Bie +Link: https://patch.msgid.link/20240913023302.130300-1-tiwei.btw@antgroup.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + arch/um/kernel/process.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/kernel/process.c b/arch/um/kernel/process.c +index a351c87db2488..c5281ce31685d 100644 +--- a/arch/um/kernel/process.c ++++ b/arch/um/kernel/process.c +@@ -397,6 +397,6 @@ int elf_core_copy_fpregs(struct task_struct *t, elf_fpregset_t *fpu) + { + int cpu = current_thread_info()->cpu; + +- return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu); ++ return save_i387_registers(userspace_pid[cpu], (unsigned long *) fpu) == 0; + } + +-- +2.43.0 + -- 2.47.3