From: Greg Kroah-Hartman Date: Thu, 15 Jan 2026 11:56:08 +0000 (+0100) Subject: 5.15-stable patches X-Git-Tag: v6.6.121~19 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=881cd4677d6c690b90ff1ff421be00dc3b818b9e;p=thirdparty%2Fkernel%2Fstable-queue.git 5.15-stable patches added patches: blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch counter-interrupt-cnt-drop-irqf_no_thread-flag.patch nfs-trace-show-timedout-instead-of-0x6e.patch nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch nfsd-provide-locking-for-v4_end_grace.patch nfsd-remove-nfserr_eagain.patch pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch --- diff --git a/queue-5.15/blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch b/queue-5.15/blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch new file mode 100644 index 0000000000..9b82bb5b64 --- /dev/null +++ b/queue-5.15/blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch @@ -0,0 +1,155 @@ +From stable+bounces-208113-greg=kroah.com@vger.kernel.org Mon Jan 12 12:43:02 2026 +From: Keerthana K +Date: Mon, 12 Jan 2026 11:39:36 +0000 +Subject: blk-throttle: Set BIO_THROTTLED when bio has been throttled +To: stable@vger.kernel.org, gregkh@linuxfoundation.org +Cc: tj@kernel.org, axboe@kernel.dk, cgroups@vger.kernel.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, ajay.kaher@broadcom.com, alexey.makhalov@broadcom.com, vamsi-krishna.brahmajosyula@broadcom.com, yin.ding@broadcom.com, tapas.kundu@broadcom.com, Laibin Qiu , Ming Lei , Sasha Levin , Keerthana K , Shivani Agarwal +Message-ID: <20260112113936.3291786-1-keerthana.kalyanasundaram@broadcom.com> + +From: Laibin Qiu + +[ Upstream commit 5a011f889b4832aa80c2a872a5aade5c48d2756f ] + +1.In current process, all bio will set the BIO_THROTTLED flag +after __blk_throtl_bio(). + +2.If bio needs to be throttled, it will start the timer and +stop submit bio directly. Bio will submit in +blk_throtl_dispatch_work_fn() when the timer expires.But in +the current process, if bio is throttled. The BIO_THROTTLED +will be set to bio after timer start. If the bio has been +completed, it may cause use-after-free blow. + +BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 +Read of size 2 at addr ffff88801b8902d4 by task fio/26380 + + dump_stack+0x9b/0xce + print_address_description.constprop.6+0x3e/0x60 + kasan_report.cold.9+0x22/0x3a + blk_throtl_bio+0x12f0/0x2c70 + submit_bio_checks+0x701/0x1550 + submit_bio_noacct+0x83/0xc80 + submit_bio+0xa7/0x330 + mpage_readahead+0x380/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Allocated by task 26380: + kasan_save_stack+0x19/0x40 + __kasan_kmalloc.constprop.2+0xc1/0xd0 + kmem_cache_alloc+0x146/0x440 + mempool_alloc+0x125/0x2f0 + bio_alloc_bioset+0x353/0x590 + mpage_alloc+0x3b/0x240 + do_mpage_readpage+0xddf/0x1ef0 + mpage_readahead+0x264/0x500 + read_pages+0x1c1/0xbf0 + page_cache_ra_unbounded+0x471/0x6f0 + do_page_cache_ra+0xda/0x110 + ondemand_readahead+0x442/0xae0 + page_cache_async_ra+0x210/0x300 + generic_file_buffered_read+0x4d9/0x2130 + generic_file_read_iter+0x315/0x490 + blkdev_read_iter+0x113/0x1b0 + aio_read+0x2ad/0x450 + io_submit_one+0xc8e/0x1d60 + __se_sys_io_submit+0x125/0x350 + do_syscall_64+0x2d/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Freed by task 0: + kasan_save_stack+0x19/0x40 + kasan_set_track+0x1c/0x30 + kasan_set_free_info+0x1b/0x30 + __kasan_slab_free+0x111/0x160 + kmem_cache_free+0x94/0x460 + mempool_free+0xd6/0x320 + bio_free+0xe0/0x130 + bio_put+0xab/0xe0 + bio_endio+0x3a6/0x5d0 + blk_update_request+0x590/0x1370 + scsi_end_request+0x7d/0x400 + scsi_io_completion+0x1aa/0xe50 + scsi_softirq_done+0x11b/0x240 + blk_mq_complete_request+0xd4/0x120 + scsi_mq_done+0xf0/0x200 + virtscsi_vq_done+0xbc/0x150 + vring_interrupt+0x179/0x390 + __handle_irq_event_percpu+0xf7/0x490 + handle_irq_event_percpu+0x7b/0x160 + handle_irq_event+0xcc/0x170 + handle_edge_irq+0x215/0xb20 + common_interrupt+0x60/0x120 + asm_common_interrupt+0x1e/0x40 + +Fix this by move BIO_THROTTLED set into the queue_lock. + +Signed-off-by: Laibin Qiu +Reviewed-by: Ming Lei +Link: https://lore.kernel.org/r/20220301123919.2381579-1-qiulaibin@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +[ Keerthana: Remove 'out' and handle return with reference to commit 81c7a63 ] +Signed-off-by: Keerthana K +Signed-off-by: Shivani Agarwal +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-throttle.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/block/blk-throttle.c ++++ b/block/blk-throttle.c +@@ -2222,8 +2222,10 @@ bool blk_throtl_bio(struct bio *bio) + rcu_read_lock(); + + /* see throtl_charge_bio() */ +- if (bio_flagged(bio, BIO_THROTTLED)) +- goto out; ++ if (bio_flagged(bio, BIO_THROTTLED)) { ++ rcu_read_unlock(); ++ return false; ++ } + + if (!cgroup_subsys_on_dfl(io_cgrp_subsys)) { + blkg_rwstat_add(&tg->stat_bytes, bio->bi_opf, +@@ -2231,8 +2233,10 @@ bool blk_throtl_bio(struct bio *bio) + blkg_rwstat_add(&tg->stat_ios, bio->bi_opf, 1); + } + +- if (!tg->has_rules[rw]) +- goto out; ++ if (!tg->has_rules[rw]) { ++ rcu_read_unlock(); ++ return false; ++ } + + spin_lock_irq(&q->queue_lock); + +@@ -2316,14 +2320,14 @@ again: + } + + out_unlock: +- spin_unlock_irq(&q->queue_lock); +-out: + bio_set_flag(bio, BIO_THROTTLED); + + #ifdef CONFIG_BLK_DEV_THROTTLING_LOW + if (throttled || !td->track_bio_latency) + bio->bi_issue.value |= BIO_ISSUE_THROTL_SKIP_LATENCY; + #endif ++ spin_unlock_irq(&q->queue_lock); ++ + rcu_read_unlock(); + return throttled; + } diff --git a/queue-5.15/counter-interrupt-cnt-drop-irqf_no_thread-flag.patch b/queue-5.15/counter-interrupt-cnt-drop-irqf_no_thread-flag.patch new file mode 100644 index 0000000000..60ad241e7e --- /dev/null +++ b/queue-5.15/counter-interrupt-cnt-drop-irqf_no_thread-flag.patch @@ -0,0 +1,81 @@ +From stable+bounces-208185-greg=kroah.com@vger.kernel.org Mon Jan 12 18:26:31 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 12:26:24 -0500 +Subject: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag +To: stable@vger.kernel.org +Cc: Alexander Sverdlin , Sebastian Andrzej Siewior , Oleksij Rempel , William Breathitt Gray , Sasha Levin +Message-ID: <20260112172624.816367-1-sashal@kernel.org> + +From: Alexander Sverdlin + +[ Upstream commit 23f9485510c338476b9735d516c1d4aacb810d46 ] + +An IRQ handler can either be IRQF_NO_THREAD or acquire spinlock_t, as +CONFIG_PROVE_RAW_LOCK_NESTING warns: +============================= +[ BUG: Invalid wait context ] +6.18.0-rc1+git... #1 +----------------------------- +some-user-space-process/1251 is trying to lock: +(&counter->events_list_lock){....}-{3:3}, at: counter_push_event [counter] +other info that might help us debug this: +context-{2:2} +no locks held by some-user-space-process/.... +stack backtrace: +CPU: 0 UID: 0 PID: 1251 Comm: some-user-space-process 6.18.0-rc1+git... #1 PREEMPT +Call trace: + show_stack (C) + dump_stack_lvl + dump_stack + __lock_acquire + lock_acquire + _raw_spin_lock_irqsave + counter_push_event [counter] + interrupt_cnt_isr [interrupt_cnt] + __handle_irq_event_percpu + handle_irq_event + handle_simple_irq + handle_irq_desc + generic_handle_domain_irq + gpio_irq_handler + handle_irq_desc + generic_handle_domain_irq + gic_handle_irq + call_on_irq_stack + do_interrupt_handler + el0_interrupt + __el0_irq_handler_common + el0t_64_irq_handler + el0t_64_irq + +... and Sebastian correctly points out. Remove IRQF_NO_THREAD as an +alternative to switching to raw_spinlock_t, because the latter would limit +all potential nested locks to raw_spinlock_t only. + +Cc: Sebastian Andrzej Siewior +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/all/20251117151314.xwLAZrWY@linutronix.de/ +Fixes: a55ebd47f21f ("counter: add IRQ or GPIO based counter") +Signed-off-by: Alexander Sverdlin +Reviewed-by: Sebastian Andrzej Siewior +Reviewed-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20251118083603.778626-1-alexander.sverdlin@siemens.com +Signed-off-by: William Breathitt Gray +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/counter/interrupt-cnt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/counter/interrupt-cnt.c ++++ b/drivers/counter/interrupt-cnt.c +@@ -208,8 +208,7 @@ static int interrupt_cnt_probe(struct pl + + irq_set_status_flags(priv->irq, IRQ_NOAUTOEN); + ret = devm_request_irq(dev, priv->irq, interrupt_cnt_isr, +- IRQF_TRIGGER_RISING | IRQF_NO_THREAD, +- dev_name(dev), priv); ++ IRQF_TRIGGER_RISING, dev_name(dev), priv); + if (ret) + return ret; + diff --git a/queue-5.15/nfs-trace-show-timedout-instead-of-0x6e.patch b/queue-5.15/nfs-trace-show-timedout-instead-of-0x6e.patch new file mode 100644 index 0000000000..b1624dcb87 --- /dev/null +++ b/queue-5.15/nfs-trace-show-timedout-instead-of-0x6e.patch @@ -0,0 +1,42 @@ +From stable+bounces-208132-greg=kroah.com@vger.kernel.org Mon Jan 12 15:53:58 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 09:49:37 -0500 +Subject: NFS: trace: show TIMEDOUT instead of 0x6e +To: stable@vger.kernel.org +Cc: Chen Hanxiao , Jeff Layton , Chuck Lever , Sasha Levin +Message-ID: <20260112144939.718289-1-sashal@kernel.org> + +From: Chen Hanxiao + +[ Upstream commit cef48236dfe55fa266d505e8a497963a7bc5ef2a ] + +__nfs_revalidate_inode may return ETIMEDOUT. + +print symbol of ETIMEDOUT in nfs trace: + +before: +cat-5191 [005] 119.331127: nfs_revalidate_inode_exit: error=-110 (0x6e) + +after: +cat-1738 [004] 44.365509: nfs_revalidate_inode_exit: error=-110 (TIMEDOUT) + +Signed-off-by: Chen Hanxiao +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + include/trace/misc/nfs.h | 1 + + 1 file changed, 1 insertion(+) + +--- a/include/trace/misc/nfs.h ++++ b/include/trace/misc/nfs.h +@@ -52,6 +52,7 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX); + { NFSERR_IO, "IO" }, \ + { NFSERR_NXIO, "NXIO" }, \ + { ECHILD, "CHILD" }, \ ++ { ETIMEDOUT, "TIMEDOUT" }, \ + { NFSERR_EAGAIN, "AGAIN" }, \ + { NFSERR_ACCES, "ACCES" }, \ + { NFSERR_EXIST, "EXIST" }, \ diff --git a/queue-5.15/nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch b/queue-5.15/nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch new file mode 100644 index 0000000000..f766e5d371 --- /dev/null +++ b/queue-5.15/nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch @@ -0,0 +1,531 @@ +From stable+bounces-208133-greg=kroah.com@vger.kernel.org Mon Jan 12 16:01:09 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 09:49:38 -0500 +Subject: nfs_common: factor out nfs_errtbl and nfs_stat_to_errno +To: stable@vger.kernel.org +Cc: Mike Snitzer , Jeff Layton , NeilBrown , Anna Schumaker , Sasha Levin +Message-ID: <20260112144939.718289-2-sashal@kernel.org> + +From: Mike Snitzer + +[ Upstream commit 4806ded4c14c5e8fdc6ce885d83221a78c06a428 ] + +Common nfs_stat_to_errno() is used by both fs/nfs/nfs2xdr.c and +fs/nfs/nfs3xdr.c + +Will also be used by fs/nfsd/localio.c + +Signed-off-by: Mike Snitzer +Reviewed-by: Jeff Layton +Reviewed-by: NeilBrown +Signed-off-by: Anna Schumaker +Stable-dep-of: c6c209ceb87f ("NFSD: Remove NFSERR_EAGAIN") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs/Kconfig | 1 + fs/nfs/nfs2xdr.c | 70 ----------------------------- + fs/nfs/nfs3xdr.c | 108 ++++++++------------------------------------- + fs/nfs/nfs4xdr.c | 4 - + fs/nfs_common/Makefile | 2 + fs/nfs_common/common.c | 67 +++++++++++++++++++++++++++ + fs/nfsd/Kconfig | 1 + include/linux/nfs_common.h | 16 ++++++ + 8 files changed, 109 insertions(+), 160 deletions(-) + create mode 100644 fs/nfs_common/common.c + create mode 100644 include/linux/nfs_common.h + +--- a/fs/nfs/Kconfig ++++ b/fs/nfs/Kconfig +@@ -5,6 +5,7 @@ config NFS_FS + select CRC32 + select LOCKD + select SUNRPC ++ select NFS_COMMON + select NFS_ACL_SUPPORT if NFS_V3_ACL + help + Choose Y here if you want to access files residing on other +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -22,14 +22,12 @@ + #include + #include + #include ++#include + #include "nfstrace.h" + #include "internal.h" + + #define NFSDBG_FACILITY NFSDBG_XDR + +-/* Mapping from NFS error code to "errno" error code. */ +-#define errno_NFSERR_IO EIO +- + /* + * Declare the space requirements for NFS arguments and replies as + * number of 32bit-words +@@ -64,8 +62,6 @@ + #define NFS_readdirres_sz (1+NFS_pagepad_sz) + #define NFS_statfsres_sz (1+NFS_info_sz) + +-static int nfs_stat_to_errno(enum nfs_stat); +- + /* + * Encode/decode NFSv2 basic data types + * +@@ -1055,70 +1051,6 @@ out_default: + return nfs_stat_to_errno(status); + } + +- +-/* +- * We need to translate between nfs status return values and +- * the local errno values which may not be the same. +- */ +-static const struct { +- int stat; +- int errno; +-} nfs_errtbl[] = { +- { NFS_OK, 0 }, +- { NFSERR_PERM, -EPERM }, +- { NFSERR_NOENT, -ENOENT }, +- { NFSERR_IO, -errno_NFSERR_IO}, +- { NFSERR_NXIO, -ENXIO }, +-/* { NFSERR_EAGAIN, -EAGAIN }, */ +- { NFSERR_ACCES, -EACCES }, +- { NFSERR_EXIST, -EEXIST }, +- { NFSERR_XDEV, -EXDEV }, +- { NFSERR_NODEV, -ENODEV }, +- { NFSERR_NOTDIR, -ENOTDIR }, +- { NFSERR_ISDIR, -EISDIR }, +- { NFSERR_INVAL, -EINVAL }, +- { NFSERR_FBIG, -EFBIG }, +- { NFSERR_NOSPC, -ENOSPC }, +- { NFSERR_ROFS, -EROFS }, +- { NFSERR_MLINK, -EMLINK }, +- { NFSERR_NAMETOOLONG, -ENAMETOOLONG }, +- { NFSERR_NOTEMPTY, -ENOTEMPTY }, +- { NFSERR_DQUOT, -EDQUOT }, +- { NFSERR_STALE, -ESTALE }, +- { NFSERR_REMOTE, -EREMOTE }, +-#ifdef EWFLUSH +- { NFSERR_WFLUSH, -EWFLUSH }, +-#endif +- { NFSERR_BADHANDLE, -EBADHANDLE }, +- { NFSERR_NOT_SYNC, -ENOTSYNC }, +- { NFSERR_BAD_COOKIE, -EBADCOOKIE }, +- { NFSERR_NOTSUPP, -ENOTSUPP }, +- { NFSERR_TOOSMALL, -ETOOSMALL }, +- { NFSERR_SERVERFAULT, -EREMOTEIO }, +- { NFSERR_BADTYPE, -EBADTYPE }, +- { NFSERR_JUKEBOX, -EJUKEBOX }, +- { -1, -EIO } +-}; +- +-/** +- * nfs_stat_to_errno - convert an NFS status code to a local errno +- * @status: NFS status code to convert +- * +- * Returns a local errno value, or -EIO if the NFS status code is +- * not recognized. This function is used jointly by NFSv2 and NFSv3. +- */ +-static int nfs_stat_to_errno(enum nfs_stat status) +-{ +- int i; +- +- for (i = 0; nfs_errtbl[i].stat != -1; i++) { +- if (nfs_errtbl[i].stat == (int)status) +- return nfs_errtbl[i].errno; +- } +- dprintk("NFS: Unrecognized nfs status value: %u\n", status); +- return nfs_errtbl[i].errno; +-} +- + #define PROC(proc, argtype, restype, timer) \ + [NFSPROC_##proc] = { \ + .p_proc = NFSPROC_##proc, \ +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -21,14 +21,13 @@ + #include + #include + #include ++#include ++ + #include "nfstrace.h" + #include "internal.h" + + #define NFSDBG_FACILITY NFSDBG_XDR + +-/* Mapping from NFS error code to "errno" error code. */ +-#define errno_NFSERR_IO EIO +- + /* + * Declare the space requirements for NFS arguments and replies as + * number of 32bit-words +@@ -91,8 +90,6 @@ + NFS3_pagepad_sz) + #define ACL3_setaclres_sz (1+NFS3_post_op_attr_sz) + +-static int nfs3_stat_to_errno(enum nfs_stat); +- + /* + * Map file type to S_IFMT bits + */ +@@ -1405,7 +1402,7 @@ static int nfs3_xdr_dec_getattr3res(stru + out: + return error; + out_default: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1444,7 +1441,7 @@ static int nfs3_xdr_dec_setattr3res(stru + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1494,7 +1491,7 @@ out_default: + error = decode_post_op_attr(xdr, result->dir_attr, userns); + if (unlikely(error)) + goto out; +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1536,7 +1533,7 @@ static int nfs3_xdr_dec_access3res(struc + out: + return error; + out_default: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1577,7 +1574,7 @@ static int nfs3_xdr_dec_readlink3res(str + out: + return error; + out_default: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1657,7 +1654,7 @@ static int nfs3_xdr_dec_read3res(struct + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1727,7 +1724,7 @@ static int nfs3_xdr_dec_write3res(struct + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1794,7 +1791,7 @@ out_default: + error = decode_wcc_data(xdr, result->dir_attr, userns); + if (unlikely(error)) + goto out; +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1834,7 +1831,7 @@ static int nfs3_xdr_dec_remove3res(struc + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1880,7 +1877,7 @@ static int nfs3_xdr_dec_rename3res(struc + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -1925,7 +1922,7 @@ static int nfs3_xdr_dec_link3res(struct + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /** +@@ -2101,7 +2098,7 @@ out_default: + error = decode_post_op_attr(xdr, result->dir_attr, rpc_rqst_userns(req)); + if (unlikely(error)) + goto out; +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -2167,7 +2164,7 @@ static int nfs3_xdr_dec_fsstat3res(struc + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -2243,7 +2240,7 @@ static int nfs3_xdr_dec_fsinfo3res(struc + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -2304,7 +2301,7 @@ static int nfs3_xdr_dec_pathconf3res(str + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + /* +@@ -2350,7 +2347,7 @@ static int nfs3_xdr_dec_commit3res(struc + out: + return error; + out_status: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + #ifdef CONFIG_NFS_V3_ACL +@@ -2416,7 +2413,7 @@ static int nfs3_xdr_dec_getacl3res(struc + out: + return error; + out_default: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + static int nfs3_xdr_dec_setacl3res(struct rpc_rqst *req, +@@ -2435,76 +2432,11 @@ static int nfs3_xdr_dec_setacl3res(struc + out: + return error; + out_default: +- return nfs3_stat_to_errno(status); ++ return nfs_stat_to_errno(status); + } + + #endif /* CONFIG_NFS_V3_ACL */ + +- +-/* +- * We need to translate between nfs status return values and +- * the local errno values which may not be the same. +- */ +-static const struct { +- int stat; +- int errno; +-} nfs_errtbl[] = { +- { NFS_OK, 0 }, +- { NFSERR_PERM, -EPERM }, +- { NFSERR_NOENT, -ENOENT }, +- { NFSERR_IO, -errno_NFSERR_IO}, +- { NFSERR_NXIO, -ENXIO }, +-/* { NFSERR_EAGAIN, -EAGAIN }, */ +- { NFSERR_ACCES, -EACCES }, +- { NFSERR_EXIST, -EEXIST }, +- { NFSERR_XDEV, -EXDEV }, +- { NFSERR_NODEV, -ENODEV }, +- { NFSERR_NOTDIR, -ENOTDIR }, +- { NFSERR_ISDIR, -EISDIR }, +- { NFSERR_INVAL, -EINVAL }, +- { NFSERR_FBIG, -EFBIG }, +- { NFSERR_NOSPC, -ENOSPC }, +- { NFSERR_ROFS, -EROFS }, +- { NFSERR_MLINK, -EMLINK }, +- { NFSERR_NAMETOOLONG, -ENAMETOOLONG }, +- { NFSERR_NOTEMPTY, -ENOTEMPTY }, +- { NFSERR_DQUOT, -EDQUOT }, +- { NFSERR_STALE, -ESTALE }, +- { NFSERR_REMOTE, -EREMOTE }, +-#ifdef EWFLUSH +- { NFSERR_WFLUSH, -EWFLUSH }, +-#endif +- { NFSERR_BADHANDLE, -EBADHANDLE }, +- { NFSERR_NOT_SYNC, -ENOTSYNC }, +- { NFSERR_BAD_COOKIE, -EBADCOOKIE }, +- { NFSERR_NOTSUPP, -ENOTSUPP }, +- { NFSERR_TOOSMALL, -ETOOSMALL }, +- { NFSERR_SERVERFAULT, -EREMOTEIO }, +- { NFSERR_BADTYPE, -EBADTYPE }, +- { NFSERR_JUKEBOX, -EJUKEBOX }, +- { -1, -EIO } +-}; +- +-/** +- * nfs3_stat_to_errno - convert an NFS status code to a local errno +- * @status: NFS status code to convert +- * +- * Returns a local errno value, or -EIO if the NFS status code is +- * not recognized. This function is used jointly by NFSv2 and NFSv3. +- */ +-static int nfs3_stat_to_errno(enum nfs_stat status) +-{ +- int i; +- +- for (i = 0; nfs_errtbl[i].stat != -1; i++) { +- if (nfs_errtbl[i].stat == (int)status) +- return nfs_errtbl[i].errno; +- } +- dprintk("NFS: Unrecognized nfs status value: %u\n", status); +- return nfs_errtbl[i].errno; +-} +- +- + #define PROC(proc, argtype, restype, timer) \ + [NFS3PROC_##proc] = { \ + .p_proc = NFS3PROC_##proc, \ +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -52,6 +52,7 @@ + #include + #include + #include ++#include + + #include "nfs4_fs.h" + #include "nfs4trace.h" +@@ -63,9 +64,6 @@ + + #define NFSDBG_FACILITY NFSDBG_XDR + +-/* Mapping from NFS error code to "errno" error code. */ +-#define errno_NFSERR_IO EIO +- + struct compound_hdr; + static int nfs4_stat_to_errno(int); + static void encode_layoutget(struct xdr_stream *xdr, +--- a/fs/nfs_common/Makefile ++++ b/fs/nfs_common/Makefile +@@ -8,3 +8,5 @@ nfs_acl-objs := nfsacl.o + + obj-$(CONFIG_GRACE_PERIOD) += grace.o + obj-$(CONFIG_NFS_V4_2_SSC_HELPER) += nfs_ssc.o ++ ++obj-$(CONFIG_NFS_COMMON) += common.o +--- /dev/null ++++ b/fs/nfs_common/common.c +@@ -0,0 +1,67 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++ ++#include ++#include ++ ++/* ++ * We need to translate between nfs status return values and ++ * the local errno values which may not be the same. ++ */ ++static const struct { ++ int stat; ++ int errno; ++} nfs_errtbl[] = { ++ { NFS_OK, 0 }, ++ { NFSERR_PERM, -EPERM }, ++ { NFSERR_NOENT, -ENOENT }, ++ { NFSERR_IO, -errno_NFSERR_IO}, ++ { NFSERR_NXIO, -ENXIO }, ++/* { NFSERR_EAGAIN, -EAGAIN }, */ ++ { NFSERR_ACCES, -EACCES }, ++ { NFSERR_EXIST, -EEXIST }, ++ { NFSERR_XDEV, -EXDEV }, ++ { NFSERR_NODEV, -ENODEV }, ++ { NFSERR_NOTDIR, -ENOTDIR }, ++ { NFSERR_ISDIR, -EISDIR }, ++ { NFSERR_INVAL, -EINVAL }, ++ { NFSERR_FBIG, -EFBIG }, ++ { NFSERR_NOSPC, -ENOSPC }, ++ { NFSERR_ROFS, -EROFS }, ++ { NFSERR_MLINK, -EMLINK }, ++ { NFSERR_NAMETOOLONG, -ENAMETOOLONG }, ++ { NFSERR_NOTEMPTY, -ENOTEMPTY }, ++ { NFSERR_DQUOT, -EDQUOT }, ++ { NFSERR_STALE, -ESTALE }, ++ { NFSERR_REMOTE, -EREMOTE }, ++#ifdef EWFLUSH ++ { NFSERR_WFLUSH, -EWFLUSH }, ++#endif ++ { NFSERR_BADHANDLE, -EBADHANDLE }, ++ { NFSERR_NOT_SYNC, -ENOTSYNC }, ++ { NFSERR_BAD_COOKIE, -EBADCOOKIE }, ++ { NFSERR_NOTSUPP, -ENOTSUPP }, ++ { NFSERR_TOOSMALL, -ETOOSMALL }, ++ { NFSERR_SERVERFAULT, -EREMOTEIO }, ++ { NFSERR_BADTYPE, -EBADTYPE }, ++ { NFSERR_JUKEBOX, -EJUKEBOX }, ++ { -1, -EIO } ++}; ++ ++/** ++ * nfs_stat_to_errno - convert an NFS status code to a local errno ++ * @status: NFS status code to convert ++ * ++ * Returns a local errno value, or -EIO if the NFS status code is ++ * not recognized. This function is used jointly by NFSv2 and NFSv3. ++ */ ++int nfs_stat_to_errno(enum nfs_stat status) ++{ ++ int i; ++ ++ for (i = 0; nfs_errtbl[i].stat != -1; i++) { ++ if (nfs_errtbl[i].stat == (int)status) ++ return nfs_errtbl[i].errno; ++ } ++ return nfs_errtbl[i].errno; ++} ++EXPORT_SYMBOL_GPL(nfs_stat_to_errno); +--- a/fs/nfsd/Kconfig ++++ b/fs/nfsd/Kconfig +@@ -8,6 +8,7 @@ config NFSD + select LOCKD + select SUNRPC + select EXPORTFS ++ select NFS_COMMON + select NFS_ACL_SUPPORT if NFSD_V2_ACL + select NFS_ACL_SUPPORT if NFSD_V3_ACL + depends on MULTIUSER +--- /dev/null ++++ b/include/linux/nfs_common.h +@@ -0,0 +1,16 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* ++ * This file contains constants and methods used by both NFS client and server. ++ */ ++#ifndef _LINUX_NFS_COMMON_H ++#define _LINUX_NFS_COMMON_H ++ ++#include ++#include ++ ++/* Mapping from NFS error code to "errno" error code. */ ++#define errno_NFSERR_IO EIO ++ ++int nfs_stat_to_errno(enum nfs_stat status); ++ ++#endif /* _LINUX_NFS_COMMON_H */ diff --git a/queue-5.15/nfsd-provide-locking-for-v4_end_grace.patch b/queue-5.15/nfsd-provide-locking-for-v4_end_grace.patch new file mode 100644 index 0000000000..f30fefe335 --- /dev/null +++ b/queue-5.15/nfsd-provide-locking-for-v4_end_grace.patch @@ -0,0 +1,186 @@ +From stable+bounces-208172-greg=kroah.com@vger.kernel.org Mon Jan 12 16:50:22 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 10:46:42 -0500 +Subject: nfsd: provide locking for v4_end_grace +To: stable@vger.kernel.org +Cc: NeilBrown , Li Lingfeng , Jeff Layton , Chuck Lever , Sasha Levin +Message-ID: <20260112154642.746166-1-sashal@kernel.org> + +From: NeilBrown + +[ Upstream commit 2857bd59feb63fcf40fe4baf55401baea6b4feb4 ] + +Writing to v4_end_grace can race with server shutdown and result in +memory being accessed after it was freed - reclaim_str_hashtbl in +particularly. + +We cannot hold nfsd_mutex across the nfsd4_end_grace() call as that is +held while client_tracking_op->init() is called and that can wait for +an upcall to nfsdcltrack which can write to v4_end_grace, resulting in a +deadlock. + +nfsd4_end_grace() is also called by the landromat work queue and this +doesn't require locking as server shutdown will stop the work and wait +for it before freeing anything that nfsd4_end_grace() might access. + +However, we must be sure that writing to v4_end_grace doesn't restart +the work item after shutdown has already waited for it. For this we +add a new flag protected with nn->client_lock. It is set only while it +is safe to make client tracking calls, and v4_end_grace only schedules +work while the flag is set with the spinlock held. + +So this patch adds a nfsd_net field "client_tracking_active" which is +set as described. Another field "grace_end_forced", is set when +v4_end_grace is written. After this is set, and providing +client_tracking_active is set, the laundromat is scheduled. +This "grace_end_forced" field bypasses other checks for whether the +grace period has finished. + +This resolves a race which can result in use-after-free. + +Reported-by: Li Lingfeng +Closes: https://lore.kernel.org/linux-nfs/20250623030015.2353515-1-neil@brown.name/T/#t +Fixes: 7f5ef2e900d9 ("nfsd: add a v4_end_grace file to /proc/fs/nfsd") +Cc: stable@vger.kernel.org +Signed-off-by: NeilBrown +Tested-by: Li Lingfeng +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +[ Adjust context ] +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/netns.h | 2 ++ + fs/nfsd/nfs4state.c | 42 ++++++++++++++++++++++++++++++++++++++++-- + fs/nfsd/nfsctl.c | 3 +-- + fs/nfsd/state.h | 2 +- + 4 files changed, 44 insertions(+), 5 deletions(-) + +--- a/fs/nfsd/netns.h ++++ b/fs/nfsd/netns.h +@@ -64,6 +64,8 @@ struct nfsd_net { + + struct lock_manager nfsd4_manager; + bool grace_ended; ++ bool grace_end_forced; ++ bool client_tracking_active; + time64_t boot_time; + + struct dentry *nfsd_client_dir; +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -84,7 +84,7 @@ static u64 current_sessionid = 1; + /* forward declarations */ + static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); + static void nfs4_free_ol_stateid(struct nfs4_stid *stid); +-void nfsd4_end_grace(struct nfsd_net *nn); ++static void nfsd4_end_grace(struct nfsd_net *nn); + static void _free_cpntf_state_locked(struct nfsd_net *nn, struct nfs4_cpntf_state *cps); + static void nfsd4_file_hash_remove(struct nfs4_file *fi); + +@@ -5883,7 +5883,7 @@ nfsd4_renew(struct svc_rqst *rqstp, stru + return nfs_ok; + } + +-void ++static void + nfsd4_end_grace(struct nfsd_net *nn) + { + /* do nothing if grace period already ended */ +@@ -5916,6 +5916,33 @@ nfsd4_end_grace(struct nfsd_net *nn) + */ + } + ++/** ++ * nfsd4_force_end_grace - forcibly end the NFSv4 grace period ++ * @nn: network namespace for the server instance to be updated ++ * ++ * Forces bypass of normal grace period completion, then schedules ++ * the laundromat to end the grace period immediately. Does not wait ++ * for the grace period to fully terminate before returning. ++ * ++ * Return values: ++ * %true: Grace termination schedule ++ * %false: No action was taken ++ */ ++bool nfsd4_force_end_grace(struct nfsd_net *nn) ++{ ++ if (!nn->client_tracking_ops) ++ return false; ++ spin_lock(&nn->client_lock); ++ if (nn->grace_ended || !nn->client_tracking_active) { ++ spin_unlock(&nn->client_lock); ++ return false; ++ } ++ WRITE_ONCE(nn->grace_end_forced, true); ++ mod_delayed_work(laundry_wq, &nn->laundromat_work, 0); ++ spin_unlock(&nn->client_lock); ++ return true; ++} ++ + /* + * If we've waited a lease period but there are still clients trying to + * reclaim, wait a little longer to give them a chance to finish. +@@ -5925,6 +5952,8 @@ static bool clients_still_reclaiming(str + time64_t double_grace_period_end = nn->boot_time + + 2 * nn->nfsd4_lease; + ++ if (READ_ONCE(nn->grace_end_forced)) ++ return false; + if (nn->track_reclaim_completes && + atomic_read(&nn->nr_reclaim_complete) == + nn->reclaim_str_hashtbl_size) +@@ -8132,6 +8161,8 @@ static int nfs4_state_create_net(struct + nn->unconf_name_tree = RB_ROOT; + nn->boot_time = ktime_get_real_seconds(); + nn->grace_ended = false; ++ nn->grace_end_forced = false; ++ nn->client_tracking_active = false; + nn->nfsd4_manager.block_opens = true; + INIT_LIST_HEAD(&nn->nfsd4_manager.list); + INIT_LIST_HEAD(&nn->client_lru); +@@ -8208,6 +8239,10 @@ nfs4_state_start_net(struct net *net) + return ret; + locks_start_grace(net, &nn->nfsd4_manager); + nfsd4_client_tracking_init(net); ++ /* safe for laundromat to run now */ ++ spin_lock(&nn->client_lock); ++ nn->client_tracking_active = true; ++ spin_unlock(&nn->client_lock); + if (nn->track_reclaim_completes && nn->reclaim_str_hashtbl_size == 0) + goto skip_grace; + printk(KERN_INFO "NFSD: starting %lld-second grace period (net %x)\n", +@@ -8254,6 +8289,9 @@ nfs4_state_shutdown_net(struct net *net) + + unregister_shrinker(&nn->nfsd_client_shrinker); + cancel_work_sync(&nn->nfsd_shrinker_work); ++ spin_lock(&nn->client_lock); ++ nn->client_tracking_active = false; ++ spin_unlock(&nn->client_lock); + cancel_delayed_work_sync(&nn->laundromat_work); + locks_end_grace(&nn->nfsd4_manager); + +--- a/fs/nfsd/nfsctl.c ++++ b/fs/nfsd/nfsctl.c +@@ -1117,9 +1117,8 @@ static ssize_t write_v4_end_grace(struct + case 'Y': + case 'y': + case '1': +- if (!nn->nfsd_serv) ++ if (!nfsd4_force_end_grace(nn)) + return -EBUSY; +- nfsd4_end_grace(nn); + break; + default: + return -EINVAL; +--- a/fs/nfsd/state.h ++++ b/fs/nfsd/state.h +@@ -719,7 +719,7 @@ static inline void get_nfs4_file(struct + struct nfsd_file *find_any_file(struct nfs4_file *f); + + /* grace period management */ +-void nfsd4_end_grace(struct nfsd_net *nn); ++bool nfsd4_force_end_grace(struct nfsd_net *nn); + + /* nfs4recover operations */ + extern int nfsd4_client_tracking_init(struct net *net); diff --git a/queue-5.15/nfsd-remove-nfserr_eagain.patch b/queue-5.15/nfsd-remove-nfserr_eagain.patch new file mode 100644 index 0000000000..3399704ac9 --- /dev/null +++ b/queue-5.15/nfsd-remove-nfserr_eagain.patch @@ -0,0 +1,101 @@ +From stable+bounces-208134-greg=kroah.com@vger.kernel.org Mon Jan 12 15:54:01 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 09:49:39 -0500 +Subject: NFSD: Remove NFSERR_EAGAIN +To: stable@vger.kernel.org +Cc: Chuck Lever , NeilBrown , Jeff Layton , Sasha Levin +Message-ID: <20260112144939.718289-3-sashal@kernel.org> + +From: Chuck Lever + +[ Upstream commit c6c209ceb87f64a6ceebe61761951dcbbf4a0baa ] + +I haven't found an NFSERR_EAGAIN in RFCs 1094, 1813, 7530, or 8881. +None of these RFCs have an NFS status code that match the numeric +value "11". + +Based on the meaning of the EAGAIN errno, I presume the use of this +status in NFSD means NFS4ERR_DELAY. So replace the one usage of +nfserr_eagain, and remove it from NFSD's NFS status conversion +tables. + +As far as I can tell, NFSERR_EAGAIN has existed since the pre-git +era, but was not actually used by any code until commit f4e44b393389 +("NFSD: delay unmount source's export after inter-server copy +completed."), at which time it become possible for NFSD to return +a status code of 11 (which is not valid NFS protocol). + +Fixes: f4e44b393389 ("NFSD: delay unmount source's export after inter-server copy completed.") +Cc: stable@vger.kernel.org +Reviewed-by: NeilBrown +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfs_common/common.c | 1 - + fs/nfsd/nfs4proc.c | 2 +- + fs/nfsd/nfsd.h | 1 - + include/trace/misc/nfs.h | 2 -- + include/uapi/linux/nfs.h | 1 - + 5 files changed, 1 insertion(+), 6 deletions(-) + +--- a/fs/nfs_common/common.c ++++ b/fs/nfs_common/common.c +@@ -16,7 +16,6 @@ static const struct { + { NFSERR_NOENT, -ENOENT }, + { NFSERR_IO, -errno_NFSERR_IO}, + { NFSERR_NXIO, -ENXIO }, +-/* { NFSERR_EAGAIN, -EAGAIN }, */ + { NFSERR_ACCES, -EACCES }, + { NFSERR_EXIST, -EEXIST }, + { NFSERR_XDEV, -EXDEV }, +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1322,7 +1322,7 @@ try_again: + (freezable_schedule_timeout(20*HZ) == 0)) { + finish_wait(&nn->nfsd_ssc_waitq, &wait); + kfree(work); +- return nfserr_eagain; ++ return nfserr_jukebox; + } + finish_wait(&nn->nfsd_ssc_waitq, &wait); + goto try_again; +--- a/fs/nfsd/nfsd.h ++++ b/fs/nfsd/nfsd.h +@@ -201,7 +201,6 @@ void nfsd_lockd_shutdown(void); + #define nfserr_noent cpu_to_be32(NFSERR_NOENT) + #define nfserr_io cpu_to_be32(NFSERR_IO) + #define nfserr_nxio cpu_to_be32(NFSERR_NXIO) +-#define nfserr_eagain cpu_to_be32(NFSERR_EAGAIN) + #define nfserr_acces cpu_to_be32(NFSERR_ACCES) + #define nfserr_exist cpu_to_be32(NFSERR_EXIST) + #define nfserr_xdev cpu_to_be32(NFSERR_XDEV) +--- a/include/trace/misc/nfs.h ++++ b/include/trace/misc/nfs.h +@@ -16,7 +16,6 @@ TRACE_DEFINE_ENUM(NFSERR_PERM); + TRACE_DEFINE_ENUM(NFSERR_NOENT); + TRACE_DEFINE_ENUM(NFSERR_IO); + TRACE_DEFINE_ENUM(NFSERR_NXIO); +-TRACE_DEFINE_ENUM(NFSERR_EAGAIN); + TRACE_DEFINE_ENUM(NFSERR_ACCES); + TRACE_DEFINE_ENUM(NFSERR_EXIST); + TRACE_DEFINE_ENUM(NFSERR_XDEV); +@@ -53,7 +52,6 @@ TRACE_DEFINE_ENUM(NFSERR_JUKEBOX); + { NFSERR_NXIO, "NXIO" }, \ + { ECHILD, "CHILD" }, \ + { ETIMEDOUT, "TIMEDOUT" }, \ +- { NFSERR_EAGAIN, "AGAIN" }, \ + { NFSERR_ACCES, "ACCES" }, \ + { NFSERR_EXIST, "EXIST" }, \ + { NFSERR_XDEV, "XDEV" }, \ +--- a/include/uapi/linux/nfs.h ++++ b/include/uapi/linux/nfs.h +@@ -49,7 +49,6 @@ + NFSERR_NOENT = 2, /* v2 v3 v4 */ + NFSERR_IO = 5, /* v2 v3 v4 */ + NFSERR_NXIO = 6, /* v2 v3 v4 */ +- NFSERR_EAGAIN = 11, /* v2 v3 */ + NFSERR_ACCES = 13, /* v2 v3 v4 */ + NFSERR_EXIST = 17, /* v2 v3 v4 */ + NFSERR_XDEV = 18, /* v3 v4 */ diff --git a/queue-5.15/pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch b/queue-5.15/pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch new file mode 100644 index 0000000000..f814fd097e --- /dev/null +++ b/queue-5.15/pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch @@ -0,0 +1,91 @@ +From stable+bounces-208196-greg=kroah.com@vger.kernel.org Mon Jan 12 19:24:49 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:24:00 -0500 +Subject: pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping +To: stable@vger.kernel.org +Cc: Bartosz Golaszewski , Val Packett , Dmitry Baryshkov , Bjorn Andersson , Linus Walleij , Sasha Levin +Message-ID: <20260112182400.841200-2-sashal@kernel.org> + +From: Bartosz Golaszewski + +[ Upstream commit ebc18e9854e5a2b62a041fb57b216a903af45b85 ] + +The gpio_chip settings in this driver say the controller can't sleep +but it actually uses a mutex for synchronization. This triggers the +following BUG(): + +[ 9.233659] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:281 +[ 9.233665] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 554, name: (udev-worker) +[ 9.233669] preempt_count: 1, expected: 0 +[ 9.233673] RCU nest depth: 0, expected: 0 +[ 9.233688] Tainted: [W]=WARN +[ 9.233690] Hardware name: Dell Inc. Latitude 7455/0FK7MX, BIOS 2.10.1 05/20/2025 +[ 9.233694] Call trace: +[ 9.233696] show_stack+0x24/0x38 (C) +[ 9.233709] dump_stack_lvl+0x40/0x88 +[ 9.233716] dump_stack+0x18/0x24 +[ 9.233722] __might_resched+0x148/0x160 +[ 9.233731] __might_sleep+0x38/0x98 +[ 9.233736] mutex_lock+0x30/0xd8 +[ 9.233749] lpi_config_set+0x2e8/0x3c8 [pinctrl_lpass_lpi] +[ 9.233757] lpi_gpio_direction_output+0x58/0x90 [pinctrl_lpass_lpi] +[ 9.233761] gpiod_direction_output_raw_commit+0x110/0x428 +[ 9.233772] gpiod_direction_output_nonotify+0x234/0x358 +[ 9.233779] gpiod_direction_output+0x38/0xd0 +[ 9.233786] gpio_shared_proxy_direction_output+0xb8/0x2a8 [gpio_shared_proxy] +[ 9.233792] gpiod_direction_output_raw_commit+0x110/0x428 +[ 9.233799] gpiod_direction_output_nonotify+0x234/0x358 +[ 9.233806] gpiod_configure_flags+0x2c0/0x580 +[ 9.233812] gpiod_find_and_request+0x358/0x4f8 +[ 9.233819] gpiod_get_index+0x7c/0x98 +[ 9.233826] devm_gpiod_get+0x34/0xb0 +[ 9.233829] reset_gpio_probe+0x58/0x128 [reset_gpio] +[ 9.233836] auxiliary_bus_probe+0xb0/0xf0 +[ 9.233845] really_probe+0x14c/0x450 +[ 9.233853] __driver_probe_device+0xb0/0x188 +[ 9.233858] driver_probe_device+0x4c/0x250 +[ 9.233863] __driver_attach+0xf8/0x2a0 +[ 9.233868] bus_for_each_dev+0xf8/0x158 +[ 9.233872] driver_attach+0x30/0x48 +[ 9.233876] bus_add_driver+0x158/0x2b8 +[ 9.233880] driver_register+0x74/0x118 +[ 9.233886] __auxiliary_driver_register+0x94/0xe8 +[ 9.233893] init_module+0x34/0xfd0 [reset_gpio] +[ 9.233898] do_one_initcall+0xec/0x300 +[ 9.233903] do_init_module+0x64/0x260 +[ 9.233910] load_module+0x16c4/0x1900 +[ 9.233915] __arm64_sys_finit_module+0x24c/0x378 +[ 9.233919] invoke_syscall+0x4c/0xe8 +[ 9.233925] el0_svc_common+0x8c/0xf0 +[ 9.233929] do_el0_svc+0x28/0x40 +[ 9.233934] el0_svc+0x38/0x100 +[ 9.233938] el0t_64_sync_handler+0x84/0x130 +[ 9.233943] el0t_64_sync+0x17c/0x180 + +Mark the controller as sleeping. + +Fixes: 6e261d1090d6 ("pinctrl: qcom: Add sm8250 lpass lpi pinctrl driver") +Cc: stable@vger.kernel.org +Reported-by: Val Packett +Closes: https://lore.kernel.org/all/98c0f185-b0e0-49ea-896c-f3972dd011ca@packett.cool/ +Signed-off-by: Bartosz Golaszewski +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Bjorn Andersson +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -644,7 +644,7 @@ static int lpi_pinctrl_probe(struct plat + pctrl->chip.base = -1; + pctrl->chip.ngpio = data->npins; + pctrl->chip.label = dev_name(dev); +- pctrl->chip.can_sleep = false; ++ pctrl->chip.can_sleep = true; + + mutex_init(&pctrl->lock); + diff --git a/queue-5.15/pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch b/queue-5.15/pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch new file mode 100644 index 0000000000..5e63438bf6 --- /dev/null +++ b/queue-5.15/pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch @@ -0,0 +1,35 @@ +From stable+bounces-208195-greg=kroah.com@vger.kernel.org Mon Jan 12 19:24:41 2026 +From: Sasha Levin +Date: Mon, 12 Jan 2026 13:23:59 -0500 +Subject: pinctrl: qcom: lpass-lpi: Remove duplicate assignment of of_gpio_n_cells +To: stable@vger.kernel.org +Cc: Andy Shevchenko , Linus Walleij , Sasha Levin +Message-ID: <20260112182400.841200-1-sashal@kernel.org> + +From: Andy Shevchenko + +[ Upstream commit a3fc976a2d68cb74ae4234314002e4e398e4c337 ] + +The of_gpio_n_cells default is 2 when ->of_xlate() callback is +not defined. No need to assign it explicitly in the driver. + +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20230112184923.80442-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Linus Walleij +Stable-dep-of: ebc18e9854e5 ("pinctrl: qcom: lpass-lpi: mark the GPIO controller as sleeping") +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/qcom/pinctrl-lpass-lpi.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c ++++ b/drivers/pinctrl/qcom/pinctrl-lpass-lpi.c +@@ -644,7 +644,6 @@ static int lpi_pinctrl_probe(struct plat + pctrl->chip.base = -1; + pctrl->chip.ngpio = data->npins; + pctrl->chip.label = dev_name(dev); +- pctrl->chip.of_gpio_n_cells = 2; + pctrl->chip.can_sleep = false; + + mutex_init(&pctrl->lock); diff --git a/queue-5.15/series b/queue-5.15/series index 46c5202652..eff6734a62 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -543,3 +543,11 @@ net-sched-sch_qfq-fix-null-deref-when-deactivating-i.patch net-usb-pegasus-fix-memory-leak-in-update_eth_regs_a.patch net-enetc-fix-build-warning-when-page_size-is-greate.patch arp-do-not-assume-dev_hard_header-does-not-change-sk.patch +nfs-trace-show-timedout-instead-of-0x6e.patch +nfs_common-factor-out-nfs_errtbl-and-nfs_stat_to_errno.patch +nfsd-remove-nfserr_eagain.patch +nfsd-provide-locking-for-v4_end_grace.patch +counter-interrupt-cnt-drop-irqf_no_thread-flag.patch +pinctrl-qcom-lpass-lpi-remove-duplicate-assignment-of-of_gpio_n_cells.patch +pinctrl-qcom-lpass-lpi-mark-the-gpio-controller-as-sleeping.patch +blk-throttle-set-bio_throttled-when-bio-has-been-throttled.patch