--- /dev/null
+From stable+bounces-208113-greg=kroah.com@vger.kernel.org Mon Jan 12 12:43:02 2026
+From: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
+Date: Mon, 12 Jan 2026 11:39:36 +0000
+Subject: blk-throttle: Set BIO_THROTTLED when bio has been throttled
+To: stable@vger.kernel.org, gregkh@linuxfoundation.org
+Cc: tj@kernel.org, axboe@kernel.dk, cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, ajay.kaher@broadcom.com, alexey.makhalov@broadcom.com, vamsi-krishna.brahmajosyula@broadcom.com, yin.ding@broadcom.com, tapas.kundu@broadcom.com, Laibin Qiu <qiulaibin@huawei.com>, Ming Lei <ming.lei@redhat.com>, Sasha Levin <sashal@kernel.org>, Keerthana K <keerthana.kalyanasundaram@broadcom.com>, Shivani Agarwal <shivani.agarwal@broadcom.com>
+Message-ID: <20260112113936.3291786-1-keerthana.kalyanasundaram@broadcom.com>
+
+From: Laibin Qiu <qiulaibin@huawei.com>
+
+[ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ]
+
+1.In current process, all bio will set the BIO_THROTTLED flag
+after __blk_throtl_bio().
+
+2.If bio needs to be throttled, it will start the timer and
+stop submit bio directly. Bio will submit in
+blk_throtl_dispatch_work_fn() when the timer expires.But in
+the current process, if bio is throttled. The BIO_THROTTLED
+will be set to bio after timer start. If the bio has been
+completed, it may cause use-after-free blow.
+
+BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70
+Read of size 2 at addr ffff88801b8902d4 by task fio/26380
+
+ dump_stack+0x9b/0xce
+ print_address_description.constprop.6+0x3e/0x60
+ kasan_report.cold.9+0x22/0x3a
+ blk_throtl_bio+0x12f0/0x2c70
+ submit_bio_checks+0x701/0x1550
+ submit_bio_noacct+0x83/0xc80
+ submit_bio+0xa7/0x330
+ mpage_readahead+0x380/0x500
+ read_pages+0x1c1/0xbf0
+ page_cache_ra_unbounded+0x471/0x6f0
+ do_page_cache_ra+0xda/0x110
+ ondemand_readahead+0x442/0xae0
+ page_cache_async_ra+0x210/0x300
+ generic_file_buffered_read+0x4d9/0x2130
+ generic_file_read_iter+0x315/0x490
+ blkdev_read_iter+0x113/0x1b0
+ aio_read+0x2ad/0x450
+ io_submit_one+0xc8e/0x1d60
+ __se_sys_io_submit+0x125/0x350
+ do_syscall_64+0x2d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Allocated by task 26380:
+ kasan_save_stack+0x19/0x40
+ __kasan_kmalloc.constprop.2+0xc1/0xd0
+ kmem_cache_alloc+0x146/0x440
+ mempool_alloc+0x125/0x2f0
+ bio_alloc_bioset+0x353/0x590
+ mpage_alloc+0x3b/0x240
+ do_mpage_readpage+0xddf/0x1ef0
+ mpage_readahead+0x264/0x500
+ read_pages+0x1c1/0xbf0
+ page_cache_ra_unbounded+0x471/0x6f0
+ do_page_cache_ra+0xda/0x110
+ ondemand_readahead+0x442/0xae0
+ page_cache_async_ra+0x210/0x300
+ generic_file_buffered_read+0x4d9/0x2130
+ generic_file_read_iter+0x315/0x490
+ blkdev_read_iter+0x113/0x1b0
+ aio_read+0x2ad/0x450
+ io_submit_one+0xc8e/0x1d60
+ __se_sys_io_submit+0x125/0x350
+ do_syscall_64+0x2d/0x40
+ entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Freed by task 0:
+ kasan_save_stack+0x19/0x40
+ kasan_set_track+0x1c/0x30
+ kasan_set_free_info+0x1b/0x30
+ __kasan_slab_free+0x111/0x160
+ kmem_cache_free+0x94/0x460
+ mempool_free+0xd6/0x320
+ bio_free+0xe0/0x130
+ bio_put+0xab/0xe0
+ bio_endio+0x3a6/0x5d0
+ blk_update_request+0x590/0x1370
+ scsi_end_request+0x7d/0x400
+ scsi_io_completion+0x1aa/0xe50
+ scsi_softirq_done+0x11b/0x240
+ blk_mq_complete_request+0xd4/0x120
+ scsi_mq_done+0xf0/0x200
+ virtscsi_vq_done+0xbc/0x150
+ vring_interrupt+0x179/0x390
+ __handle_irq_event_percpu+0xf7/0x490
+ handle_irq_event_percpu+0x7b/0x160
+ handle_irq_event+0xcc/0x170
+ handle_edge_irq+0x215/0xb20
+ common_interrupt+0x60/0x120
+ asm_common_interrupt+0x1e/0x40
+
+Fix this by move BIO_THROTTLED set into the queue_lock.
+
+Signed-off-by: Laibin Qiu <qiulaibin@huawei.com>
+Reviewed-by: Ming Lei <ming.lei@redhat.com>
+Link: https://lore.kernel.org/r/20220301123919.2381579-1-qiulaibin@huawei.com
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+[ Keerthana: Remove 'out' and handle return with reference to commit 81c7a63 ]
+Signed-off-by: Keerthana K <keerthana.kalyanasundaram@broadcom.com>
+Signed-off-by: Shivani Agarwal <shivani.agarwal@broadcom.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ block/blk-throttle.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/block/blk-throttle.c
++++ b/block/blk-throttle.c
+@@ -2222,8 +2222,10 @@ bool blk_throtl_bio(struct bio *bio)
+ rcu_read_lock();
+
+ /* see throtl_charge_bio() */
+- if (bio_flagged(bio, BIO_THROTTLED))
+- goto out;
++ if (bio_flagged(bio, BIO_THROTTLED)) {
++ rcu_read_unlock();
++ return false;
++ }
+
+ if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) {
+ blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf,
+@@ -2231,8 +2233,10 @@ bool blk_throtl_bio(struct bio *bio)
+ blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1);
+ }
+
+- if (!tg->has_rules[rw])
+- goto out;
++ if (!tg->has_rules[rw]) {
++ rcu_read_unlock();
++ return false;
++ }
+
+ spin_lock_irq(&q->queue_lock);
+
+@@ -2316,14 +2320,14 @@ again:
+ }
+
+ out_unlock:
+- spin_unlock_irq(&q->queue_lock);
+-out:
+ bio_set_flag(bio, BIO_THROTTLED);
+
+ #ifdef CONFIG_BLK_DEV_THROTTLING_LOW
+ if (throttled || !td->track_bio_latency)
+ bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY;
+ #endif
++ spin_unlock_irq(&q->queue_lock);
++
+ rcu_read_unlock();
+ return throttled;
+ }
--- /dev/null
+From stable+bounces-208185-greg=kroah.com@vger.kernel.org Mon Jan 12 18:26:31 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 12:26:24 -0500
+Subject: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag
+To: stable@vger.kernel.org
+Cc: Alexander Sverdlin <alexander.sverdlin@siemens.com>, Sebastian Andrzej Siewior <bigeasy@linutronix.de>, Oleksij Rempel <o.rempel@pengutronix.de>, William Breathitt Gray <wbg@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112172624.816367-1-sashal@kernel.org>
+
+From: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+
+[ Upstream commit 23f9485510c338476b9735d516c1d4aacb810d46 ]
+
+An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as
+CONFIG_PROVE_RAW_LOCK_NESTING warns:
+=============================
+[ BUG: Invalid wait context ]
+6.18.0-rc1+git... #1
+-----------------------------
+some-user-space-process/1251 is trying to lock:
+(&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter]
+other info that might help us debug this:
+context-{2:2}
+no locks held by some-user-space-process/....
+stack backtrace:
+CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT
+Call trace:
+ show_stack (C)
+ dump_stack_lvl
+ dump_stack
+ __lock_acquire
+ lock_acquire
+ _raw_spin_lock_irqsave
+ counter_push_event [counter]
+ interrupt_cnt_isr [interrupt_cnt]
+ __handle_irq_event_percpu
+ handle_irq_event
+ handle_simple_irq
+ handle_irq_desc
+ generic_handle_domain_irq
+ gpio_irq_handler
+ handle_irq_desc
+ generic_handle_domain_irq
+ gic_handle_irq
+ call_on_irq_stack
+ do_interrupt_handler
+ el0_interrupt
+ __el0_irq_handler_common
+ el0t_64_irq_handler
+ el0t_64_irq
+
+... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an
+alternative to switching to raw_spinlock_t, because the latter would limit
+all potential nested locks to raw_spinlock_t only.
+
+Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/all/20251117151314.xwLAZrWY@linutronix.de/
+Fixes: a55ebd47f21f ("counter: add IRQ or GPIO based counter")
+Signed-off-by: Alexander Sverdlin <alexander.sverdlin@siemens.com>
+Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Reviewed-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Link: https://lore.kernel.org/r/20251118083603.778626-1-alexander.sverdlin@siemens.com
+Signed-off-by: William Breathitt Gray <wbg@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/counter/interrupt-cnt.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/drivers/counter/interrupt-cnt.c
++++ b/drivers/counter/interrupt-cnt.c
+@@ -208,8 +208,7 @@ static int interrupt_cnt_probe(struct pl
+
+ irq_set_status_flags(priv->irq, IRQ_NOAUTOEN);
+ ret = devm_request_irq(dev, priv->irq, interrupt_cnt_isr,
+- IRQF_TRIGGER_RISING | IRQF_NO_THREAD,
+- dev_name(dev), priv);
++ IRQF_TRIGGER_RISING, dev_name(dev), priv);
+ if (ret)
+ return ret;
+
--- /dev/null
+From stable+bounces-208132-greg=kroah.com@vger.kernel.org Mon Jan 12 15:53:58 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 09:49:37 -0500
+Subject: NFS: trace: show TIMEDOUT instead of 0x6e
+To: stable@vger.kernel.org
+Cc: Chen Hanxiao <chenhx.fnst@fujitsu.com>, Jeff Layton <jlayton@kernel.org>, Chuck Lever <chuck.lever@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112144939.718289-1-sashal@kernel.org>
+
+From: Chen Hanxiao <chenhx.fnst@fujitsu.com>
+
+[ Upstream commit cef48236dfe55fa266d505e8a497963a7bc5ef2a ]
+
+__nfs_revalidate_inode may return ETIMEDOUT.
+
+print symbol of ETIMEDOUT in nfs trace:
+
+before:
+cat-5191 [005] 119.331127: nfs_revalidate_inode_exit: error=-110 (0x6e)
+
+after:
+cat-1738 [004] 44.365509: nfs_revalidate_inode_exit: error=-110 (TIMEDOUT)
+
+Signed-off-by: Chen Hanxiao <chenhx.fnst@fujitsu.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/trace/misc/nfs.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/include/trace/misc/nfs.h
++++ b/include/trace/misc/nfs.h
+@@ -52,6 +52,7 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX);
+ { NFSERR_IO, "IO" }, \
+ { NFSERR_NXIO, "NXIO" }, \
+ { ECHILD, "CHILD" }, \
++ { ETIMEDOUT, "TIMEDOUT" }, \
+ { NFSERR_EAGAIN, "AGAIN" }, \
+ { NFSERR_ACCES, "ACCES" }, \
+ { NFSERR_EXIST, "EXIST" }, \
--- /dev/null
+From stable+bounces-208133-greg=kroah.com@vger.kernel.org Mon Jan 12 16:01:09 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 09:49:38 -0500
+Subject: nfs_common: factor out nfs_errtbl and nfs_stat_to_errno
+To: stable@vger.kernel.org
+Cc: Mike Snitzer <snitzer@kernel.org>, Jeff Layton <jlayton@kernel.org>, NeilBrown <neilb@suse.de>, Anna Schumaker <anna.schumaker@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112144939.718289-2-sashal@kernel.org>
+
+From: Mike Snitzer <snitzer@kernel.org>
+
+[ Upstream commit 4806ded4c14c5e8fdc6ce885d83221a78c06a428 ]
+
+Common nfs_stat_to_errno() is used by both fs/nfs/nfs2xdr.c and
+fs/nfs/nfs3xdr.c
+
+Will also be used by fs/nfsd/localio.c
+
+Signed-off-by: Mike Snitzer <snitzer@kernel.org>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Reviewed-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
+Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs/Kconfig | 1
+ fs/nfs/nfs2xdr.c | 70 -----------------------------
+ fs/nfs/nfs3xdr.c | 108 ++++++++-------------------------------------
+ fs/nfs/nfs4xdr.c | 4 -
+ fs/nfs_common/Makefile | 2
+ fs/nfs_common/common.c | 67 +++++++++++++++++++++++++++
+ fs/nfsd/Kconfig | 1
+ include/linux/nfs_common.h | 16 ++++++
+ 8 files changed, 109 insertions(+), 160 deletions(-)
+ create mode 100644 fs/nfs_common/common.c
+ create mode 100644 include/linux/nfs_common.h
+
+--- a/fs/nfs/Kconfig
++++ b/fs/nfs/Kconfig
+@@ -5,6 +5,7 @@ config NFS_FS
+ select CRC32
+ select LOCKD
+ select SUNRPC
++ select NFS_COMMON
+ select NFS_ACL_SUPPORT if NFS_V3_ACL
+ help
+ Choose Y here if you want to access files residing on other
+--- a/fs/nfs/nfs2xdr.c
++++ b/fs/nfs/nfs2xdr.c
+@@ -22,14 +22,12 @@
+ #include <linux/nfs.h>
+ #include <linux/nfs2.h>
+ #include <linux/nfs_fs.h>
++#include <linux/nfs_common.h>
+ #include "nfstrace.h"
+ #include "internal.h"
+
+ #define NFSDBG_FACILITY NFSDBG_XDR
+
+-/* Mapping from NFS error code to "errno" error code. */
+-#define errno_NFSERR_IO EIO
+-
+ /*
+ * Declare the space requirements for NFS arguments and replies as
+ * number of 32bit-words
+@@ -64,8 +62,6 @@
+ #define NFS_readdirres_sz (1+NFS_pagepad_sz)
+ #define NFS_statfsres_sz (1+NFS_info_sz)
+
+-static int nfs_stat_to_errno(enum nfs_stat);
+-
+ /*
+ * Encode/decode NFSv2 basic data types
+ *
+@@ -1055,70 +1051,6 @@ out_default:
+ return nfs_stat_to_errno(status);
+ }
+
+-
+-/*
+- * We need to translate between nfs status return values and
+- * the local errno values which may not be the same.
+- */
+-static const struct {
+- int stat;
+- int errno;
+-} nfs_errtbl[] = {
+- { NFS_OK, 0 },
+- { NFSERR_PERM, -EPERM },
+- { NFSERR_NOENT, -ENOENT },
+- { NFSERR_IO, -errno_NFSERR_IO},
+- { NFSERR_NXIO, -ENXIO },
+-/* { NFSERR_EAGAIN, -EAGAIN }, */
+- { NFSERR_ACCES, -EACCES },
+- { NFSERR_EXIST, -EEXIST },
+- { NFSERR_XDEV, -EXDEV },
+- { NFSERR_NODEV, -ENODEV },
+- { NFSERR_NOTDIR, -ENOTDIR },
+- { NFSERR_ISDIR, -EISDIR },
+- { NFSERR_INVAL, -EINVAL },
+- { NFSERR_FBIG, -EFBIG },
+- { NFSERR_NOSPC, -ENOSPC },
+- { NFSERR_ROFS, -EROFS },
+- { NFSERR_MLINK, -EMLINK },
+- { NFSERR_NAMETOOLONG, -ENAMETOOLONG },
+- { NFSERR_NOTEMPTY, -ENOTEMPTY },
+- { NFSERR_DQUOT, -EDQUOT },
+- { NFSERR_STALE, -ESTALE },
+- { NFSERR_REMOTE, -EREMOTE },
+-#ifdef EWFLUSH
+- { NFSERR_WFLUSH, -EWFLUSH },
+-#endif
+- { NFSERR_BADHANDLE, -EBADHANDLE },
+- { NFSERR_NOT_SYNC, -ENOTSYNC },
+- { NFSERR_BAD_COOKIE, -EBADCOOKIE },
+- { NFSERR_NOTSUPP, -ENOTSUPP },
+- { NFSERR_TOOSMALL, -ETOOSMALL },
+- { NFSERR_SERVERFAULT, -EREMOTEIO },
+- { NFSERR_BADTYPE, -EBADTYPE },
+- { NFSERR_JUKEBOX, -EJUKEBOX },
+- { -1, -EIO }
+-};
+-
+-/**
+- * nfs_stat_to_errno - convert an NFS status code to a local errno
+- * @status: NFS status code to convert
+- *
+- * Returns a local errno value, or -EIO if the NFS status code is
+- * not recognized. This function is used jointly by NFSv2 and NFSv3.
+- */
+-static int nfs_stat_to_errno(enum nfs_stat status)
+-{
+- int i;
+-
+- for (i = 0; nfs_errtbl[i].stat != -1; i++) {
+- if (nfs_errtbl[i].stat == (int)status)
+- return nfs_errtbl[i].errno;
+- }
+- dprintk("NFS: Unrecognized nfs status value: %u\n", status);
+- return nfs_errtbl[i].errno;
+-}
+-
+ #define PROC(proc, argtype, restype, timer) \
+ [NFSPROC_##proc] = { \
+ .p_proc = NFSPROC_##proc, \
+--- a/fs/nfs/nfs3xdr.c
++++ b/fs/nfs/nfs3xdr.c
+@@ -21,14 +21,13 @@
+ #include <linux/nfs3.h>
+ #include <linux/nfs_fs.h>
+ #include <linux/nfsacl.h>
++#include <linux/nfs_common.h>
++
+ #include "nfstrace.h"
+ #include "internal.h"
+
+ #define NFSDBG_FACILITY NFSDBG_XDR
+
+-/* Mapping from NFS error code to "errno" error code. */
+-#define errno_NFSERR_IO EIO
+-
+ /*
+ * Declare the space requirements for NFS arguments and replies as
+ * number of 32bit-words
+@@ -91,8 +90,6 @@
+ NFS3_pagepad_sz)
+ #define ACL3_setaclres_sz (1+NFS3_post_op_attr_sz)
+
+-static int nfs3_stat_to_errno(enum nfs_stat);
+-
+ /*
+ * Map file type to S_IFMT bits
+ */
+@@ -1405,7 +1402,7 @@ static int nfs3_xdr_dec_getattr3res(stru
+ out:
+ return error;
+ out_default:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1444,7 +1441,7 @@ static int nfs3_xdr_dec_setattr3res(stru
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1494,7 +1491,7 @@ out_default:
+ error = decode_post_op_attr(xdr, result->dir_attr, userns);
+ if (unlikely(error))
+ goto out;
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1536,7 +1533,7 @@ static int nfs3_xdr_dec_access3res(struc
+ out:
+ return error;
+ out_default:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1577,7 +1574,7 @@ static int nfs3_xdr_dec_readlink3res(str
+ out:
+ return error;
+ out_default:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1657,7 +1654,7 @@ static int nfs3_xdr_dec_read3res(struct
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1727,7 +1724,7 @@ static int nfs3_xdr_dec_write3res(struct
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1794,7 +1791,7 @@ out_default:
+ error = decode_wcc_data(xdr, result->dir_attr, userns);
+ if (unlikely(error))
+ goto out;
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1834,7 +1831,7 @@ static int nfs3_xdr_dec_remove3res(struc
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1880,7 +1877,7 @@ static int nfs3_xdr_dec_rename3res(struc
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -1925,7 +1922,7 @@ static int nfs3_xdr_dec_link3res(struct
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /**
+@@ -2101,7 +2098,7 @@ out_default:
+ error = decode_post_op_attr(xdr, result->dir_attr, rpc_rqst_userns(req));
+ if (unlikely(error))
+ goto out;
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -2167,7 +2164,7 @@ static int nfs3_xdr_dec_fsstat3res(struc
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -2243,7 +2240,7 @@ static int nfs3_xdr_dec_fsinfo3res(struc
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -2304,7 +2301,7 @@ static int nfs3_xdr_dec_pathconf3res(str
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ /*
+@@ -2350,7 +2347,7 @@ static int nfs3_xdr_dec_commit3res(struc
+ out:
+ return error;
+ out_status:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ #ifdef CONFIG_NFS_V3_ACL
+@@ -2416,7 +2413,7 @@ static int nfs3_xdr_dec_getacl3res(struc
+ out:
+ return error;
+ out_default:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ static int nfs3_xdr_dec_setacl3res(struct rpc_rqst *req,
+@@ -2435,76 +2432,11 @@ static int nfs3_xdr_dec_setacl3res(struc
+ out:
+ return error;
+ out_default:
+- return nfs3_stat_to_errno(status);
++ return nfs_stat_to_errno(status);
+ }
+
+ #endif /* CONFIG_NFS_V3_ACL */
+
+-
+-/*
+- * We need to translate between nfs status return values and
+- * the local errno values which may not be the same.
+- */
+-static const struct {
+- int stat;
+- int errno;
+-} nfs_errtbl[] = {
+- { NFS_OK, 0 },
+- { NFSERR_PERM, -EPERM },
+- { NFSERR_NOENT, -ENOENT },
+- { NFSERR_IO, -errno_NFSERR_IO},
+- { NFSERR_NXIO, -ENXIO },
+-/* { NFSERR_EAGAIN, -EAGAIN }, */
+- { NFSERR_ACCES, -EACCES },
+- { NFSERR_EXIST, -EEXIST },
+- { NFSERR_XDEV, -EXDEV },
+- { NFSERR_NODEV, -ENODEV },
+- { NFSERR_NOTDIR, -ENOTDIR },
+- { NFSERR_ISDIR, -EISDIR },
+- { NFSERR_INVAL, -EINVAL },
+- { NFSERR_FBIG, -EFBIG },
+- { NFSERR_NOSPC, -ENOSPC },
+- { NFSERR_ROFS, -EROFS },
+- { NFSERR_MLINK, -EMLINK },
+- { NFSERR_NAMETOOLONG, -ENAMETOOLONG },
+- { NFSERR_NOTEMPTY, -ENOTEMPTY },
+- { NFSERR_DQUOT, -EDQUOT },
+- { NFSERR_STALE, -ESTALE },
+- { NFSERR_REMOTE, -EREMOTE },
+-#ifdef EWFLUSH
+- { NFSERR_WFLUSH, -EWFLUSH },
+-#endif
+- { NFSERR_BADHANDLE, -EBADHANDLE },
+- { NFSERR_NOT_SYNC, -ENOTSYNC },
+- { NFSERR_BAD_COOKIE, -EBADCOOKIE },
+- { NFSERR_NOTSUPP, -ENOTSUPP },
+- { NFSERR_TOOSMALL, -ETOOSMALL },
+- { NFSERR_SERVERFAULT, -EREMOTEIO },
+- { NFSERR_BADTYPE, -EBADTYPE },
+- { NFSERR_JUKEBOX, -EJUKEBOX },
+- { -1, -EIO }
+-};
+-
+-/**
+- * nfs3_stat_to_errno - convert an NFS status code to a local errno
+- * @status: NFS status code to convert
+- *
+- * Returns a local errno value, or -EIO if the NFS status code is
+- * not recognized. This function is used jointly by NFSv2 and NFSv3.
+- */
+-static int nfs3_stat_to_errno(enum nfs_stat status)
+-{
+- int i;
+-
+- for (i = 0; nfs_errtbl[i].stat != -1; i++) {
+- if (nfs_errtbl[i].stat == (int)status)
+- return nfs_errtbl[i].errno;
+- }
+- dprintk("NFS: Unrecognized nfs status value: %u\n", status);
+- return nfs_errtbl[i].errno;
+-}
+-
+-
+ #define PROC(proc, argtype, restype, timer) \
+ [NFS3PROC_##proc] = { \
+ .p_proc = NFS3PROC_##proc, \
+--- a/fs/nfs/nfs4xdr.c
++++ b/fs/nfs/nfs4xdr.c
+@@ -52,6 +52,7 @@
+ #include <linux/nfs.h>
+ #include <linux/nfs4.h>
+ #include <linux/nfs_fs.h>
++#include <linux/nfs_common.h>
+
+ #include "nfs4_fs.h"
+ #include "nfs4trace.h"
+@@ -63,9 +64,6 @@
+
+ #define NFSDBG_FACILITY NFSDBG_XDR
+
+-/* Mapping from NFS error code to "errno" error code. */
+-#define errno_NFSERR_IO EIO
+-
+ struct compound_hdr;
+ static int nfs4_stat_to_errno(int);
+ static void encode_layoutget(struct xdr_stream *xdr,
+--- a/fs/nfs_common/Makefile
++++ b/fs/nfs_common/Makefile
+@@ -8,3 +8,5 @@ nfs_acl-objs := nfsacl.o
+
+ obj-$(CONFIG_GRACE_PERIOD) += grace.o
+ obj-$(CONFIG_NFS_V4_2_SSC_HELPER) += nfs_ssc.o
++
++obj-$(CONFIG_NFS_COMMON) += common.o
+--- /dev/null
++++ b/fs/nfs_common/common.c
+@@ -0,0 +1,67 @@
++// SPDX-License-Identifier: GPL-2.0-only
++
++#include <linux/module.h>
++#include <linux/nfs_common.h>
++
++/*
++ * We need to translate between nfs status return values and
++ * the local errno values which may not be the same.
++ */
++static const struct {
++ int stat;
++ int errno;
++} nfs_errtbl[] = {
++ { NFS_OK, 0 },
++ { NFSERR_PERM, -EPERM },
++ { NFSERR_NOENT, -ENOENT },
++ { NFSERR_IO, -errno_NFSERR_IO},
++ { NFSERR_NXIO, -ENXIO },
++/* { NFSERR_EAGAIN, -EAGAIN }, */
++ { NFSERR_ACCES, -EACCES },
++ { NFSERR_EXIST, -EEXIST },
++ { NFSERR_XDEV, -EXDEV },
++ { NFSERR_NODEV, -ENODEV },
++ { NFSERR_NOTDIR, -ENOTDIR },
++ { NFSERR_ISDIR, -EISDIR },
++ { NFSERR_INVAL, -EINVAL },
++ { NFSERR_FBIG, -EFBIG },
++ { NFSERR_NOSPC, -ENOSPC },
++ { NFSERR_ROFS, -EROFS },
++ { NFSERR_MLINK, -EMLINK },
++ { NFSERR_NAMETOOLONG, -ENAMETOOLONG },
++ { NFSERR_NOTEMPTY, -ENOTEMPTY },
++ { NFSERR_DQUOT, -EDQUOT },
++ { NFSERR_STALE, -ESTALE },
++ { NFSERR_REMOTE, -EREMOTE },
++#ifdef EWFLUSH
++ { NFSERR_WFLUSH, -EWFLUSH },
++#endif
++ { NFSERR_BADHANDLE, -EBADHANDLE },
++ { NFSERR_NOT_SYNC, -ENOTSYNC },
++ { NFSERR_BAD_COOKIE, -EBADCOOKIE },
++ { NFSERR_NOTSUPP, -ENOTSUPP },
++ { NFSERR_TOOSMALL, -ETOOSMALL },
++ { NFSERR_SERVERFAULT, -EREMOTEIO },
++ { NFSERR_BADTYPE, -EBADTYPE },
++ { NFSERR_JUKEBOX, -EJUKEBOX },
++ { -1, -EIO }
++};
++
++/**
++ * nfs_stat_to_errno - convert an NFS status code to a local errno
++ * @status: NFS status code to convert
++ *
++ * Returns a local errno value, or -EIO if the NFS status code is
++ * not recognized. This function is used jointly by NFSv2 and NFSv3.
++ */
++int nfs_stat_to_errno(enum nfs_stat status)
++{
++ int i;
++
++ for (i = 0; nfs_errtbl[i].stat != -1; i++) {
++ if (nfs_errtbl[i].stat == (int)status)
++ return nfs_errtbl[i].errno;
++ }
++ return nfs_errtbl[i].errno;
++}
++EXPORT_SYMBOL_GPL(nfs_stat_to_errno);
+--- a/fs/nfsd/Kconfig
++++ b/fs/nfsd/Kconfig
+@@ -8,6 +8,7 @@ config NFSD
+ select LOCKD
+ select SUNRPC
+ select EXPORTFS
++ select NFS_COMMON
+ select NFS_ACL_SUPPORT if NFSD_V2_ACL
+ select NFS_ACL_SUPPORT if NFSD_V3_ACL
+ depends on MULTIUSER
+--- /dev/null
++++ b/include/linux/nfs_common.h
+@@ -0,0 +1,16 @@
++/* SPDX-License-Identifier: GPL-2.0 */
++/*
++ * This file contains constants and methods used by both NFS client and server.
++ */
++#ifndef _LINUX_NFS_COMMON_H
++#define _LINUX_NFS_COMMON_H
++
++#include <linux/errno.h>
++#include <uapi/linux/nfs.h>
++
++/* Mapping from NFS error code to "errno" error code. */
++#define errno_NFSERR_IO EIO
++
++int nfs_stat_to_errno(enum nfs_stat status);
++
++#endif /* _LINUX_NFS_COMMON_H */
--- /dev/null
+From stable+bounces-208172-greg=kroah.com@vger.kernel.org Mon Jan 12 16:50:22 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 10:46:42 -0500
+Subject: nfsd: provide locking for v4_end_grace
+To: stable@vger.kernel.org
+Cc: NeilBrown <neil@brown.name>, Li Lingfeng <lilingfeng3@huawei.com>, Jeff Layton <jlayton@kernel.org>, Chuck Lever <chuck.lever@oracle.com>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112154642.746166-1-sashal@kernel.org>
+
+From: NeilBrown <neil@brown.name>
+
+[ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ]
+
+Writing to v4_end_grace can race with server shutdown and result in
+memory being accessed after it was freed - reclaim_str_hashtbl in
+particularly.
+
+We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is
+held while client_tracking_op->init() is called and that can wait for
+an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a
+deadlock.
+
+nfsd4_end_grace() is also called by the landromat work queue and this
+doesn't require locking as server shutdown will stop the work and wait
+for it before freeing anything that nfsd4_end_grace() might access.
+
+However, we must be sure that writing to v4_end_grace doesn't restart
+the work item after shutdown has already waited for it. For this we
+add a new flag protected with nn->client_lock. It is set only while it
+is safe to make client tracking calls, and v4_end_grace only schedules
+work while the flag is set with the spinlock held.
+
+So this patch adds a nfsd_net field "client_tracking_active" which is
+set as described. Another field "grace_end_forced", is set when
+v4_end_grace is written. After this is set, and providing
+client_tracking_active is set, the laundromat is scheduled.
+This "grace_end_forced" field bypasses other checks for whether the
+grace period has finished.
+
+This resolves a race which can result in use-after-free.
+
+Reported-by: Li Lingfeng <lilingfeng3@huawei.com>
+Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/T/#t
+Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd")
+Cc: stable@vger.kernel.org
+Signed-off-by: NeilBrown <neil@brown.name>
+Tested-by: Li Lingfeng <lilingfeng3@huawei.com>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+[ Adjust context ]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfsd/netns.h | 2 ++
+ fs/nfsd/nfs4state.c | 42 ++++++++++++++++++++++++++++++++++++++++--
+ fs/nfsd/nfsctl.c | 3 +--
+ fs/nfsd/state.h | 2 +-
+ 4 files changed, 44 insertions(+), 5 deletions(-)
+
+--- a/fs/nfsd/netns.h
++++ b/fs/nfsd/netns.h
+@@ -64,6 +64,8 @@ struct nfsd_net {
+
+ struct lock_manager nfsd4_manager;
+ bool grace_ended;
++ bool grace_end_forced;
++ bool client_tracking_active;
+ time64_t boot_time;
+
+ struct dentry *nfsd_client_dir;
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -84,7 +84,7 @@ static u64 current_sessionid = 1;
+ /* forward declarations */
+ static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner);
+ static void nfs4_free_ol_stateid(struct nfs4_stid *stid);
+-void nfsd4_end_grace(struct nfsd_net *nn);
++static void nfsd4_end_grace(struct nfsd_net *nn);
+ static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps);
+ static void nfsd4_file_hash_remove(struct nfs4_file *fi);
+
+@@ -5883,7 +5883,7 @@ nfsd4_renew(struct svc_rqst *rqstp, stru
+ return nfs_ok;
+ }
+
+-void
++static void
+ nfsd4_end_grace(struct nfsd_net *nn)
+ {
+ /* do nothing if grace period already ended */
+@@ -5916,6 +5916,33 @@ nfsd4_end_grace(struct nfsd_net *nn)
+ */
+ }
+
++/**
++ * nfsd4_force_end_grace - forcibly end the NFSv4 grace period
++ * @nn: network namespace for the server instance to be updated
++ *
++ * Forces bypass of normal grace period completion, then schedules
++ * the laundromat to end the grace period immediately. Does not wait
++ * for the grace period to fully terminate before returning.
++ *
++ * Return values:
++ * %true: Grace termination schedule
++ * %false: No action was taken
++ */
++bool nfsd4_force_end_grace(struct nfsd_net *nn)
++{
++ if (!nn->client_tracking_ops)
++ return false;
++ spin_lock(&nn->client_lock);
++ if (nn->grace_ended || !nn->client_tracking_active) {
++ spin_unlock(&nn->client_lock);
++ return false;
++ }
++ WRITE_ONCE(nn->grace_end_forced, true);
++ mod_delayed_work(laundry_wq, &nn->laundromat_work, 0);
++ spin_unlock(&nn->client_lock);
++ return true;
++}
++
+ /*
+ * If we've waited a lease period but there are still clients trying to
+ * reclaim, wait a little longer to give them a chance to finish.
+@@ -5925,6 +5952,8 @@ static bool clients_still_reclaiming(str
+ time64_t double_grace_period_end = nn->boot_time +
+ 2 * nn->nfsd4_lease;
+
++ if (READ_ONCE(nn->grace_end_forced))
++ return false;
+ if (nn->track_reclaim_completes &&
+ atomic_read(&nn->nr_reclaim_complete) ==
+ nn->reclaim_str_hashtbl_size)
+@@ -8132,6 +8161,8 @@ static int nfs4_state_create_net(struct
+ nn->unconf_name_tree = RB_ROOT;
+ nn->boot_time = ktime_get_real_seconds();
+ nn->grace_ended = false;
++ nn->grace_end_forced = false;
++ nn->client_tracking_active = false;
+ nn->nfsd4_manager.block_opens = true;
+ INIT_LIST_HEAD(&nn->nfsd4_manager.list);
+ INIT_LIST_HEAD(&nn->client_lru);
+@@ -8208,6 +8239,10 @@ nfs4_state_start_net(struct net *net)
+ return ret;
+ locks_start_grace(net, &nn->nfsd4_manager);
+ nfsd4_client_tracking_init(net);
++ /* safe for laundromat to run now */
++ spin_lock(&nn->client_lock);
++ nn->client_tracking_active = true;
++ spin_unlock(&nn->client_lock);
+ if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0)
+ goto skip_grace;
+ printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n",
+@@ -8254,6 +8289,9 @@ nfs4_state_shutdown_net(struct net *net)
+
+ unregister_shrinker(&nn->nfsd_client_shrinker);
+ cancel_work_sync(&nn->nfsd_shrinker_work);
++ spin_lock(&nn->client_lock);
++ nn->client_tracking_active = false;
++ spin_unlock(&nn->client_lock);
+ cancel_delayed_work_sync(&nn->laundromat_work);
+ locks_end_grace(&nn->nfsd4_manager);
+
+--- a/fs/nfsd/nfsctl.c
++++ b/fs/nfsd/nfsctl.c
+@@ -1117,9 +1117,8 @@ static ssize_t write_v4_end_grace(struct
+ case 'Y':
+ case 'y':
+ case '1':
+- if (!nn->nfsd_serv)
++ if (!nfsd4_force_end_grace(nn))
+ return -EBUSY;
+- nfsd4_end_grace(nn);
+ break;
+ default:
+ return -EINVAL;
+--- a/fs/nfsd/state.h
++++ b/fs/nfsd/state.h
+@@ -719,7 +719,7 @@ static inline void get_nfs4_file(struct
+ struct nfsd_file *find_any_file(struct nfs4_file *f);
+
+ /* grace period management */
+-void nfsd4_end_grace(struct nfsd_net *nn);
++bool nfsd4_force_end_grace(struct nfsd_net *nn);
+
+ /* nfs4recover operations */
+ extern int nfsd4_client_tracking_init(struct net *net);
--- /dev/null
+From stable+bounces-208134-greg=kroah.com@vger.kernel.org Mon Jan 12 15:54:01 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 09:49:39 -0500
+Subject: NFSD: Remove NFSERR_EAGAIN
+To: stable@vger.kernel.org
+Cc: Chuck Lever <chuck.lever@oracle.com>, NeilBrown <neil@brown.name>, Jeff Layton <jlayton@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112144939.718289-3-sashal@kernel.org>
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+[ Upstream commit c6c209ceb87f64a6ceebe61761951dcbbf4a0baa ]
+
+I haven't found an NFSERR_EAGAIN in RFCs 1094, 1813, 7530, or 8881.
+None of these RFCs have an NFS status code that match the numeric
+value "11".
+
+Based on the meaning of the EAGAIN errno, I presume the use of this
+status in NFSD means NFS4ERR_DELAY. So replace the one usage of
+nfserr_eagain, and remove it from NFSD's NFS status conversion
+tables.
+
+As far as I can tell, NFSERR_EAGAIN has existed since the pre-git
+era, but was not actually used by any code until commit f4e44b393389
+("NFSD: delay unmount source's export after inter-server copy
+completed."), at which time it become possible for NFSD to return
+a status code of 11 (which is not valid NFS protocol).
+
+Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.")
+Cc: stable@vger.kernel.org
+Reviewed-by: NeilBrown <neil@brown.name>
+Reviewed-by: Jeff Layton <jlayton@kernel.org>
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/nfs_common/common.c | 1 -
+ fs/nfsd/nfs4proc.c | 2 +-
+ fs/nfsd/nfsd.h | 1 -
+ include/trace/misc/nfs.h | 2 --
+ include/uapi/linux/nfs.h | 1 -
+ 5 files changed, 1 insertion(+), 6 deletions(-)
+
+--- a/fs/nfs_common/common.c
++++ b/fs/nfs_common/common.c
+@@ -16,7 +16,6 @@ static const struct {
+ { NFSERR_NOENT, -ENOENT },
+ { NFSERR_IO, -errno_NFSERR_IO},
+ { NFSERR_NXIO, -ENXIO },
+-/* { NFSERR_EAGAIN, -EAGAIN }, */
+ { NFSERR_ACCES, -EACCES },
+ { NFSERR_EXIST, -EEXIST },
+ { NFSERR_XDEV, -EXDEV },
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1322,7 +1322,7 @@ try_again:
+ (freezable_schedule_timeout(20*HZ) == 0)) {
+ finish_wait(&nn->nfsd_ssc_waitq, &wait);
+ kfree(work);
+- return nfserr_eagain;
++ return nfserr_jukebox;
+ }
+ finish_wait(&nn->nfsd_ssc_waitq, &wait);
+ goto try_again;
+--- a/fs/nfsd/nfsd.h
++++ b/fs/nfsd/nfsd.h
+@@ -201,7 +201,6 @@ void nfsd_lockd_shutdown(void);
+ #define nfserr_noent cpu_to_be32(NFSERR_NOENT)
+ #define nfserr_io cpu_to_be32(NFSERR_IO)
+ #define nfserr_nxio cpu_to_be32(NFSERR_NXIO)
+-#define nfserr_eagain cpu_to_be32(NFSERR_EAGAIN)
+ #define nfserr_acces cpu_to_be32(NFSERR_ACCES)
+ #define nfserr_exist cpu_to_be32(NFSERR_EXIST)
+ #define nfserr_xdev cpu_to_be32(NFSERR_XDEV)
+--- a/include/trace/misc/nfs.h
++++ b/include/trace/misc/nfs.h
+@@ -16,7 +16,6 @@ TRACE_DEFINE_ENUM(NFSERR_PERM);
+ TRACE_DEFINE_ENUM(NFSERR_NOENT);
+ TRACE_DEFINE_ENUM(NFSERR_IO);
+ TRACE_DEFINE_ENUM(NFSERR_NXIO);
+-TRACE_DEFINE_ENUM(NFSERR_EAGAIN);
+ TRACE_DEFINE_ENUM(NFSERR_ACCES);
+ TRACE_DEFINE_ENUM(NFSERR_EXIST);
+ TRACE_DEFINE_ENUM(NFSERR_XDEV);
+@@ -53,7 +52,6 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX);
+ { NFSERR_NXIO, "NXIO" }, \
+ { ECHILD, "CHILD" }, \
+ { ETIMEDOUT, "TIMEDOUT" }, \
+- { NFSERR_EAGAIN, "AGAIN" }, \
+ { NFSERR_ACCES, "ACCES" }, \
+ { NFSERR_EXIST, "EXIST" }, \
+ { NFSERR_XDEV, "XDEV" }, \
+--- a/include/uapi/linux/nfs.h
++++ b/include/uapi/linux/nfs.h
+@@ -49,7 +49,6 @@
+ NFSERR_NOENT = 2, /* v2 v3 v4 */
+ NFSERR_IO = 5, /* v2 v3 v4 */
+ NFSERR_NXIO = 6, /* v2 v3 v4 */
+- NFSERR_EAGAIN = 11, /* v2 v3 */
+ NFSERR_ACCES = 13, /* v2 v3 v4 */
+ NFSERR_EXIST = 17, /* v2 v3 v4 */
+ NFSERR_XDEV = 18, /* v3 v4 */
--- /dev/null
+From stable+bounces-208196-greg=kroah.com@vger.kernel.org Mon Jan 12 19:24:49 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:24:00 -0500
+Subject: pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping
+To: stable@vger.kernel.org
+Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>, Val Packett <val@packett.cool>, Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>, Bjorn Andersson <andersson@kernel.org>, Linus Walleij <linusw@kernel.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112182400.841200-2-sashal@kernel.org>
+
+From: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+
+[ Upstream commit ebc18e9854e5a2b62a041fb57b216a903af45b85 ]
+
+The gpio_chip settings in this driver say the controller can't sleep
+but it actually uses a mutex for synchronization. This triggers the
+following BUG():
+
+[ 9.233659] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281
+[ 9.233665] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 554, name: (udev-worker)
+[ 9.233669] preempt_count: 1, expected: 0
+[ 9.233673] RCU nest depth: 0, expected: 0
+[ 9.233688] Tainted: [W]=WARN
+[ 9.233690] Hardware name: Dell Inc. Latitude 7455/0FK7MX, BIOS 2.10.1 05/20/2025
+[ 9.233694] Call trace:
+[ 9.233696] show_stack+0x24/0x38 (C)
+[ 9.233709] dump_stack_lvl+0x40/0x88
+[ 9.233716] dump_stack+0x18/0x24
+[ 9.233722] __might_resched+0x148/0x160
+[ 9.233731] __might_sleep+0x38/0x98
+[ 9.233736] mutex_lock+0x30/0xd8
+[ 9.233749] lpi_config_set+0x2e8/0x3c8 [pinctrl_lpass_lpi]
+[ 9.233757] lpi_gpio_direction_output+0x58/0x90 [pinctrl_lpass_lpi]
+[ 9.233761] gpiod_direction_output_raw_commit+0x110/0x428
+[ 9.233772] gpiod_direction_output_nonotify+0x234/0x358
+[ 9.233779] gpiod_direction_output+0x38/0xd0
+[ 9.233786] gpio_shared_proxy_direction_output+0xb8/0x2a8 [gpio_shared_proxy]
+[ 9.233792] gpiod_direction_output_raw_commit+0x110/0x428
+[ 9.233799] gpiod_direction_output_nonotify+0x234/0x358
+[ 9.233806] gpiod_configure_flags+0x2c0/0x580
+[ 9.233812] gpiod_find_and_request+0x358/0x4f8
+[ 9.233819] gpiod_get_index+0x7c/0x98
+[ 9.233826] devm_gpiod_get+0x34/0xb0
+[ 9.233829] reset_gpio_probe+0x58/0x128 [reset_gpio]
+[ 9.233836] auxiliary_bus_probe+0xb0/0xf0
+[ 9.233845] really_probe+0x14c/0x450
+[ 9.233853] __driver_probe_device+0xb0/0x188
+[ 9.233858] driver_probe_device+0x4c/0x250
+[ 9.233863] __driver_attach+0xf8/0x2a0
+[ 9.233868] bus_for_each_dev+0xf8/0x158
+[ 9.233872] driver_attach+0x30/0x48
+[ 9.233876] bus_add_driver+0x158/0x2b8
+[ 9.233880] driver_register+0x74/0x118
+[ 9.233886] __auxiliary_driver_register+0x94/0xe8
+[ 9.233893] init_module+0x34/0xfd0 [reset_gpio]
+[ 9.233898] do_one_initcall+0xec/0x300
+[ 9.233903] do_init_module+0x64/0x260
+[ 9.233910] load_module+0x16c4/0x1900
+[ 9.233915] __arm64_sys_finit_module+0x24c/0x378
+[ 9.233919] invoke_syscall+0x4c/0xe8
+[ 9.233925] el0_svc_common+0x8c/0xf0
+[ 9.233929] do_el0_svc+0x28/0x40
+[ 9.233934] el0_svc+0x38/0x100
+[ 9.233938] el0t_64_sync_handler+0x84/0x130
+[ 9.233943] el0t_64_sync+0x17c/0x180
+
+Mark the controller as sleeping.
+
+Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver")
+Cc: stable@vger.kernel.org
+Reported-by: Val Packett <val@packett.cool>
+Closes: https://lore.kernel.org/all/98c0f185-b0e0-49ea-896c-f3972dd011ca@packett.cool/
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
+Reviewed-by: Bjorn Andersson <andersson@kernel.org>
+Signed-off-by: Linus Walleij <linusw@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+@@ -644,7 +644,7 @@ static int lpi_pinctrl_probe(struct plat
+ pctrl->chip.base = -1;
+ pctrl->chip.ngpio = data->npins;
+ pctrl->chip.label = dev_name(dev);
+- pctrl->chip.can_sleep = false;
++ pctrl->chip.can_sleep = true;
+
+ mutex_init(&pctrl->lock);
+
--- /dev/null
+From stable+bounces-208195-greg=kroah.com@vger.kernel.org Mon Jan 12 19:24:41 2026
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 12 Jan 2026 13:23:59 -0500
+Subject: pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells
+To: stable@vger.kernel.org
+Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Linus Walleij <linus.walleij@linaro.org>, Sasha Levin <sashal@kernel.org>
+Message-ID: <20260112182400.841200-1-sashal@kernel.org>
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+[ Upstream commit a3fc976a2d68cb74ae4234314002e4e398e4c337 ]
+
+The of_gpio_n_cells default is 2 when ->of_xlate() callback is
+not defined. No need to assign it explicitly in the driver.
+
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20230112184923.80442-1-andriy.shevchenko@linux.intel.com
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Stable-dep-of: ebc18e9854e5 ("pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping")
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c
+@@ -644,7 +644,6 @@ static int lpi_pinctrl_probe(struct plat
+ pctrl->chip.base = -1;
+ pctrl->chip.ngpio = data->npins;
+ pctrl->chip.label = dev_name(dev);
+- pctrl->chip.of_gpio_n_cells = 2;
+ pctrl->chip.can_sleep = false;
+
+ mutex_init(&pctrl->lock);
net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch
net-enetc-fix-build-warning-when-page_size-is-greate.patch
arp-do-not-assume-dev_hard_header-does-not-change-sk.patch
+nfs-trace-show-timedout-instead-of-0x6e.patch
+nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch
+nfsd-remove-nfserr_eagain.patch
+nfsd-provide-locking-for-v4_end_grace.patch
+counter-interrupt-cnt-drop-irqf_no_thread-flag.patch
+pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch
+pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch
+blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
