4.14-stable patches

added patches:
	arm-orion5x-fix-d2net-gpio-initialization.patch
	btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch

diff --git a/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch b/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch
new file mode 100644 (file)
index 0000000..f0266df
--- /dev/null
+++ b/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch
@@ -0,0 +1,55 @@
+From f8ef1233939495c405a9faa4bd1ae7d3f581bae4 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 16 May 2023 17:31:05 +0200
+Subject: ARM: orion5x: fix d2net gpio initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit f8ef1233939495c405a9faa4bd1ae7d3f581bae4 upstream.
+
+The DT version of this board has a custom file with the gpio
+device. However, it does nothing because the d2net_init()
+has no caller or prototype:
+
+arch/arm/mach-orion5x/board-d2net.c:101:13: error: no previous prototype for 'd2net_init'
+
+Call it from the board-dt file as intended.
+
+Fixes: 94b0bd366e36 ("ARM: orion5x: convert d2net to Device Tree")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230516153109.514251-10-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-orion5x/board-dt.c |    3 +++
+ arch/arm/mach-orion5x/common.h   |    6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/mach-orion5x/board-dt.c
++++ b/arch/arm/mach-orion5x/board-dt.c
+@@ -63,6 +63,9 @@ static void __init orion5x_dt_init(void)
+       if (of_machine_is_compatible("maxtor,shared-storage-2"))
+               mss2_init();
+ 
++      if (of_machine_is_compatible("lacie,d2-network"))
++              d2net_init();
++
+       of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL);
+ }
+ 
+--- a/arch/arm/mach-orion5x/common.h
++++ b/arch/arm/mach-orion5x/common.h
+@@ -75,6 +75,12 @@ extern void mss2_init(void);
+ static inline void mss2_init(void) {}
+ #endif
+ 
++#ifdef CONFIG_MACH_D2NET_DT
++void d2net_init(void);
++#else
++static inline void d2net_init(void) {}
++#endif
++
+ /*****************************************************************************
+  * Helpers to access Orion registers
+  ****************************************************************************/

diff --git a/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch b/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch
new file mode 100644 (file)
index 0000000..db5fe1e
--- /dev/null
+++ b/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch
@@ -0,0 +1,84 @@
+From b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 19 Jun 2023 17:21:47 +0100
+Subject: btrfs: fix race when deleting quota root from the dirty cow roots list
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 upstream.
+
+When disabling quotas we are deleting the quota root from the list
+fs_info->dirty_cowonly_roots without taking the lock that protects it,
+which is struct btrfs_fs_info::trans_lock. This unsynchronized list
+manipulation may cause chaos if there's another concurrent manipulation
+of this list, such as when adding a root to it with
+ctree.c:add_root_to_dirty_list().
+
+This can result in all sorts of weird failures caused by a race, such as
+the following crash:
+
+  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
+  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
+  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
+  [337571.279928] Code: 85 38 06 00 (...)
+  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
+  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
+  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
+  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
+  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
+  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
+  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
+  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
+  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+  [337571.282874] Call Trace:
+  [337571.283101]  <TASK>
+  [337571.283327]  ? __die_body+0x1b/0x60
+  [337571.283570]  ? die_addr+0x39/0x60
+  [337571.283796]  ? exc_general_protection+0x22e/0x430
+  [337571.284022]  ? asm_exc_general_protection+0x22/0x30
+  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]
+  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]
+  [337571.284803]  ? _raw_spin_unlock+0x15/0x30
+  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]
+  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]
+  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]
+  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410
+  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]
+  [337571.286358]  ? mod_objcg_state+0xd2/0x360
+  [337571.286577]  ? refill_obj_stock+0xb0/0x160
+  [337571.286798]  ? seq_release+0x25/0x30
+  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0
+  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0
+  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0
+  [337571.287675]  __x64_sys_ioctl+0x88/0xc0
+  [337571.287901]  do_syscall_64+0x38/0x90
+  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
+  [337571.288352] RIP: 0033:0x7f478aaffe9b
+
+So fix this by locking struct btrfs_fs_info::trans_lock before deleting
+the quota root from that list.
+
+Fixes: bed92eae26cc ("Btrfs: qgroup implementation and prototypes")
+CC: stable@vger.kernel.org # 4.14+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/qgroup.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -969,7 +969,9 @@ int btrfs_quota_disable(struct btrfs_tra
+       if (ret)
+               goto out;
+ 
++      spin_lock(&fs_info->trans_lock);
+       list_del(&quota_root->dirty_list);
++      spin_unlock(&fs_info->trans_lock);
+ 
+       btrfs_tree_lock(quota_root->node);
+       clean_tree_block(fs_info, quota_root->node);

diff --git a/queue-4.14/series b/queue-4.14/series
index f5a1eeeef5d80fcfe3fe1766a4c05cf58f82f098..bf7f4324b9c8c702aa039094bbf22ef940d28172 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -80,3 +80,5 @@ mmc-core-disable-trim-on-kingston-emmc04g-m627.patch
 mmc-core-disable-trim-on-micron-mtfc4gacajcn-1m.patch
 integrity-fix-possible-multiple-allocation-in-integrity_inode_get.patch
 jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsystem.patch
+btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch
+arm-orion5x-fix-d2net-gpio-initialization.patch