--- /dev/null
+From stable+bounces-136671-greg=kroah.com@vger.kernel.org Fri Apr 25 10:13:48 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Fri, 25 Apr 2025 16:12:37 +0800
+Subject: selftests/bpf: Adjust data size to have ETH_HLEN
+To: stable@vger.kernel.org
+Cc: "Shigeru Yoshida" <syoshida@redhat.com>, "Alexis Lothoré" <alexis.lothore@bootlin.com>, "Alexei Starovoitov" <ast@kernel.org>, "Martin KaFai Lau" <martin.lau@kernel.org>, "Shung-Hsi Yu" <shung-hsi.yu@suse.com>
+Message-ID: <20250425081238.60710-5-shung-hsi.yu@suse.com>
+
+From: Shigeru Yoshida <syoshida@redhat.com>
+
+commit c7f2188d68c114095660a950b7e880a1e5a71c8f upstream.
+
+The function bpf_test_init() now returns an error if user_size
+(.data_size_in) is less than ETH_HLEN, causing the tests to
+fail. Adjust the data size to ensure it meets the requirement of
+ETH_HLEN.
+
+Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Link: https://patch.msgid.link/20250121150643.671650-2-syoshida@redhat.com
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Fixes: 972bafed67ca ("bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type()")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c | 4 ++--
+ tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c | 8 ++++----
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
+@@ -52,10 +52,10 @@ static void test_xdp_with_cpumap_helpers
+ ASSERT_EQ(info.id, val.bpf_prog.id, "Match program id to cpumap entry prog_id");
+
+ /* send a packet to trigger any potential bugs in there */
+- char data[10] = {};
++ char data[ETH_HLEN] = {};
+ DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
+ .data_in = &data,
+- .data_size_in = 10,
++ .data_size_in = sizeof(data),
+ .flags = BPF_F_TEST_XDP_LIVE_FRAMES,
+ .repeat = 1,
+ );
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_devmap_attach.c
+@@ -23,7 +23,7 @@ static void test_xdp_with_devmap_helpers
+ __u32 len = sizeof(info);
+ int err, dm_fd, dm_fd_redir, map_fd;
+ struct nstoken *nstoken = NULL;
+- char data[10] = {};
++ char data[ETH_HLEN] = {};
+ __u32 idx = 0;
+
+ SYS(out_close, "ip netns add %s", TEST_NS);
+@@ -58,7 +58,7 @@ static void test_xdp_with_devmap_helpers
+ /* send a packet to trigger any potential bugs in there */
+ DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
+ .data_in = &data,
+- .data_size_in = 10,
++ .data_size_in = sizeof(data),
+ .flags = BPF_F_TEST_XDP_LIVE_FRAMES,
+ .repeat = 1,
+ );
+@@ -158,7 +158,7 @@ static void test_xdp_with_devmap_helpers
+ struct nstoken *nstoken = NULL;
+ __u32 len = sizeof(info);
+ int err, dm_fd, dm_fd_redir, map_fd, ifindex_dst;
+- char data[10] = {};
++ char data[ETH_HLEN] = {};
+ __u32 idx = 0;
+
+ SYS(out_close, "ip netns add %s", TEST_NS);
+@@ -208,7 +208,7 @@ static void test_xdp_with_devmap_helpers
+ /* send a packet to trigger any potential bugs in there */
+ DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
+ .data_in = &data,
+- .data_size_in = 10,
++ .data_size_in = sizeof(data),
+ .flags = BPF_F_TEST_XDP_LIVE_FRAMES,
+ .repeat = 1,
+ );
--- /dev/null
+From stable+bounces-136670-greg=kroah.com@vger.kernel.org Fri Apr 25 10:13:28 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Fri, 25 Apr 2025 16:12:36 +0800
+Subject: selftests/bpf: check program redirect in xdp_cpumap_attach
+To: stable@vger.kernel.org
+Cc: "Shigeru Yoshida" <syoshida@redhat.com>, "Alexis Lothoré" <alexis.lothore@bootlin.com>, "Alexei Starovoitov" <ast@kernel.org>, "Martin KaFai Lau" <martin.lau@kernel.org>, "Shung-Hsi Yu" <shung-hsi.yu@suse.com>
+Message-ID: <20250425081238.60710-4-shung-hsi.yu@suse.com>
+
+From: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+
+commit d124d984c8a2d677e1cea6740a01ccdd0371a38d upstream.
+
+xdp_cpumap_attach, in its current form, only checks that an xdp cpumap
+program can be executed, but not that it performs correctly the cpu
+redirect as configured by userspace (bpf_prog_test_run_opts will return
+success even if the redirect program returns an error)
+
+Add a check to ensure that the program performs the configured redirect
+as well. The check is based on a global variable incremented by a
+chained program executed only if the redirect program properly executes.
+
+Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+Link: https://lore.kernel.org/r/20241009-convert_xdp_tests-v3-3-51cea913710c@bootlin.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c | 5 ++++-
+ tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c | 5 +++++
+ 2 files changed, 9 insertions(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
+@@ -62,8 +62,11 @@ static void test_xdp_with_cpumap_helpers
+ err = bpf_prog_test_run_opts(prog_redir_fd, &opts);
+ ASSERT_OK(err, "XDP test run");
+
+- /* wait for the packets to be flushed */
++ /* wait for the packets to be flushed, then check that redirect has been
++ * performed
++ */
+ kern_sync_rcu();
++ ASSERT_NEQ(skel->bss->redirect_count, 0, "redirected packets");
+
+ err = bpf_xdp_detach(IFINDEX_LO, XDP_FLAGS_SKB_MODE, NULL);
+ ASSERT_OK(err, "XDP program detach");
+--- a/tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c
++++ b/tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c
+@@ -12,6 +12,8 @@ struct {
+ __uint(max_entries, 4);
+ } cpu_map SEC(".maps");
+
++__u32 redirect_count = 0;
++
+ SEC("xdp")
+ int xdp_redir_prog(struct xdp_md *ctx)
+ {
+@@ -27,6 +29,9 @@ int xdp_dummy_prog(struct xdp_md *ctx)
+ SEC("xdp/cpumap")
+ int xdp_dummy_cm(struct xdp_md *ctx)
+ {
++ if (bpf_get_smp_processor_id() == 0)
++ redirect_count++;
++
+ if (ctx->ingress_ifindex == IFINDEX_LO)
+ return XDP_DROP;
+
--- /dev/null
+From stable+bounces-136668-greg=kroah.com@vger.kernel.org Fri Apr 25 10:13:43 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Fri, 25 Apr 2025 16:12:34 +0800
+Subject: selftests/bpf: fix bpf_map_redirect call for cpu map test
+To: stable@vger.kernel.org
+Cc: "Shigeru Yoshida" <syoshida@redhat.com>, "Alexis Lothoré" <alexis.lothore@bootlin.com>, "Alexei Starovoitov" <ast@kernel.org>, "Martin KaFai Lau" <martin.lau@kernel.org>, "Shung-Hsi Yu" <shung-hsi.yu@suse.com>
+Message-ID: <20250425081238.60710-2-shung-hsi.yu@suse.com>
+
+From: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+
+commit ac8d16b2d3772934f4cba44cb01bad05b4b2864c upstream.
+
+xdp_redir_prog currently redirects packets based on the entry at index 1
+in cpu_map, but the corresponding test only manipulates the entry at
+index 0. This does not really affect the test in its current form since
+the program is detached before having the opportunity to execute, but it
+needs to be fixed before being able improve the corresponding test (ie,
+not only test attach/detach but also the redirect feature)
+
+Fix this XDP program by making it redirect packets based on entry 0 in
+cpu_map instead of entry 1.
+
+Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+Link: https://lore.kernel.org/r/20241009-convert_xdp_tests-v3-1-51cea913710c@bootlin.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c
++++ b/tools/testing/selftests/bpf/progs/test_xdp_with_cpumap_helpers.c
+@@ -15,7 +15,7 @@ struct {
+ SEC("xdp")
+ int xdp_redir_prog(struct xdp_md *ctx)
+ {
+- return bpf_redirect_map(&cpu_map, 1, 0);
++ return bpf_redirect_map(&cpu_map, 0, 0);
+ }
+
+ SEC("xdp")
--- /dev/null
+From stable+bounces-136669-greg=kroah.com@vger.kernel.org Fri Apr 25 10:13:45 2025
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Fri, 25 Apr 2025 16:12:35 +0800
+Subject: selftests/bpf: make xdp_cpumap_attach keep redirect prog attached
+To: stable@vger.kernel.org
+Cc: "Shigeru Yoshida" <syoshida@redhat.com>, "Alexis Lothoré" <alexis.lothore@bootlin.com>, "Alexei Starovoitov" <ast@kernel.org>, "Martin KaFai Lau" <martin.lau@kernel.org>, "Shung-Hsi Yu" <shung-hsi.yu@suse.com>
+Message-ID: <20250425081238.60710-3-shung-hsi.yu@suse.com>
+
+From: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+
+commit d5fbcf46ee82574aee443423f3e4132d1154372b upstream.
+
+Current test only checks attach/detach on cpu map type program, and so
+does not check that it can be properly executed, neither that it
+redirects correctly.
+
+Update the existing test to extend its coverage:
+- keep the redirected program loaded
+- try to execute it through bpf_prog_test_run_opts with some dummy
+ context
+
+While at it, bring the following minor improvements:
+- isolate test interface in its own namespace
+
+Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>
+Link: https://lore.kernel.org/r/20241009-convert_xdp_tests-v3-2-51cea913710c@bootlin.com
+Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
+Stable-dep-of: c7f2188d68c1 ("selftests/bpf: Adjust data size to have ETH_HLEN")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c | 41 ++++++++++---
+ 1 file changed, 33 insertions(+), 8 deletions(-)
+
+--- a/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
++++ b/tools/testing/selftests/bpf/prog_tests/xdp_cpumap_attach.c
+@@ -2,35 +2,41 @@
+ #include <uapi/linux/bpf.h>
+ #include <linux/if_link.h>
+ #include <test_progs.h>
++#include <network_helpers.h>
+
+ #include "test_xdp_with_cpumap_frags_helpers.skel.h"
+ #include "test_xdp_with_cpumap_helpers.skel.h"
+
+ #define IFINDEX_LO 1
++#define TEST_NS "cpu_attach_ns"
+
+ static void test_xdp_with_cpumap_helpers(void)
+ {
+- struct test_xdp_with_cpumap_helpers *skel;
++ struct test_xdp_with_cpumap_helpers *skel = NULL;
+ struct bpf_prog_info info = {};
+ __u32 len = sizeof(info);
+ struct bpf_cpumap_val val = {
+ .qsize = 192,
+ };
+- int err, prog_fd, map_fd;
++ int err, prog_fd, prog_redir_fd, map_fd;
++ struct nstoken *nstoken = NULL;
+ __u32 idx = 0;
+
++ SYS(out_close, "ip netns add %s", TEST_NS);
++ nstoken = open_netns(TEST_NS);
++ if (!ASSERT_OK_PTR(nstoken, "open_netns"))
++ goto out_close;
++ SYS(out_close, "ip link set dev lo up");
++
+ skel = test_xdp_with_cpumap_helpers__open_and_load();
+ if (!ASSERT_OK_PTR(skel, "test_xdp_with_cpumap_helpers__open_and_load"))
+ return;
+
+- prog_fd = bpf_program__fd(skel->progs.xdp_redir_prog);
+- err = bpf_xdp_attach(IFINDEX_LO, prog_fd, XDP_FLAGS_SKB_MODE, NULL);
++ prog_redir_fd = bpf_program__fd(skel->progs.xdp_redir_prog);
++ err = bpf_xdp_attach(IFINDEX_LO, prog_redir_fd, XDP_FLAGS_SKB_MODE, NULL);
+ if (!ASSERT_OK(err, "Generic attach of program with 8-byte CPUMAP"))
+ goto out_close;
+
+- err = bpf_xdp_detach(IFINDEX_LO, XDP_FLAGS_SKB_MODE, NULL);
+- ASSERT_OK(err, "XDP program detach");
+-
+ prog_fd = bpf_program__fd(skel->progs.xdp_dummy_cm);
+ map_fd = bpf_map__fd(skel->maps.cpu_map);
+ err = bpf_prog_get_info_by_fd(prog_fd, &info, &len);
+@@ -45,6 +51,23 @@ static void test_xdp_with_cpumap_helpers
+ ASSERT_OK(err, "Read cpumap entry");
+ ASSERT_EQ(info.id, val.bpf_prog.id, "Match program id to cpumap entry prog_id");
+
++ /* send a packet to trigger any potential bugs in there */
++ char data[10] = {};
++ DECLARE_LIBBPF_OPTS(bpf_test_run_opts, opts,
++ .data_in = &data,
++ .data_size_in = 10,
++ .flags = BPF_F_TEST_XDP_LIVE_FRAMES,
++ .repeat = 1,
++ );
++ err = bpf_prog_test_run_opts(prog_redir_fd, &opts);
++ ASSERT_OK(err, "XDP test run");
++
++ /* wait for the packets to be flushed */
++ kern_sync_rcu();
++
++ err = bpf_xdp_detach(IFINDEX_LO, XDP_FLAGS_SKB_MODE, NULL);
++ ASSERT_OK(err, "XDP program detach");
++
+ /* can not attach BPF_XDP_CPUMAP program to a device */
+ err = bpf_xdp_attach(IFINDEX_LO, prog_fd, XDP_FLAGS_SKB_MODE, NULL);
+ if (!ASSERT_NEQ(err, 0, "Attach of BPF_XDP_CPUMAP program"))
+@@ -65,6 +88,8 @@ static void test_xdp_with_cpumap_helpers
+ ASSERT_NEQ(err, 0, "Add BPF_XDP program with frags to cpumap entry");
+
+ out_close:
++ close_netns(nstoken);
++ SYS_NOFAIL("ip netns del %s", TEST_NS);
+ test_xdp_with_cpumap_helpers__destroy(skel);
+ }
+
+@@ -111,7 +136,7 @@ out_close:
+ test_xdp_with_cpumap_frags_helpers__destroy(skel);
+ }
+
+-void serial_test_xdp_cpumap_attach(void)
++void test_xdp_cpumap_attach(void)
+ {
+ if (test__start_subtest("CPUMAP with programs in entries"))
+ test_xdp_with_cpumap_helpers();
revert-drivers-core-synchronize-really_probe-and-dev_uevent.patch
driver-core-introduce-device_set_driver-helper.patch
driver-core-fix-potential-null-pointer-dereference-in-dev_uevent.patch
+xfs-do-not-check-needsrepair-if-ro-norecovery-mount.patch
+xfs-do-not-allow-norecovery-mount-with-quotacheck.patch
+xfs-rename-xfs_iomap_swapfile_activate-to-xfs_vm_swap_activate.patch
+xfs-flush-inodegc-before-swapon.patch
+selftests-bpf-fix-bpf_map_redirect-call-for-cpu-map-test.patch
+selftests-bpf-make-xdp_cpumap_attach-keep-redirect-prog-attached.patch
+selftests-bpf-check-program-redirect-in-xdp_cpumap_attach.patch
+selftests-bpf-adjust-data-size-to-have-eth_hlen.patch
--- /dev/null
+From stable+bounces-136939-greg=kroah.com@vger.kernel.org Mon Apr 28 20:39:55 2025
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Mon, 28 Apr 2025 11:39:35 -0700
+Subject: xfs: Do not allow norecovery mount with quotacheck
+To: djwong@kernel.org, xfs-stable@lists.linux.dev
+Cc: cem@kernel.org, cmaiolino@redhat.com, stable@vger.kernel.org
+Message-ID: <174586545419.480536.17699094964584987030.stgit@frogsfrogsfrogs>
+
+From: Carlos Maiolino <cem@kernel.org>
+
+Commit 9f0902091c332b2665951cfb970f60ae7cbdc0f3 upstream
+
+Mounting a filesystem that requires quota state changing will generate a
+transaction.
+
+We already check for a read-only device; we should do that for
+norecovery too.
+
+A quotacheck on a norecovery mount, and with the right log size, will cause
+the mount process to hang on:
+
+[<0>] xlog_grant_head_wait+0x5d/0x2a0 [xfs]
+[<0>] xlog_grant_head_check+0x112/0x180 [xfs]
+[<0>] xfs_log_reserve+0xe3/0x260 [xfs]
+[<0>] xfs_trans_reserve+0x179/0x250 [xfs]
+[<0>] xfs_trans_alloc+0x101/0x260 [xfs]
+[<0>] xfs_sync_sb+0x3f/0x80 [xfs]
+[<0>] xfs_qm_mount_quotas+0xe3/0x2f0 [xfs]
+[<0>] xfs_mountfs+0x7ad/0xc20 [xfs]
+[<0>] xfs_fs_fill_super+0x762/0xa50 [xfs]
+[<0>] get_tree_bdev_flags+0x131/0x1d0
+[<0>] vfs_get_tree+0x26/0xd0
+[<0>] vfs_cmd_create+0x59/0xe0
+[<0>] __do_sys_fsconfig+0x4e3/0x6b0
+[<0>] do_syscall_64+0x82/0x160
+[<0>] entry_SYSCALL_64_after_hwframe+0x76/0x7e
+
+This is caused by a transaction running with bogus initialized head/tail
+
+I initially hit this while running generic/050, with random log
+sizes, but I managed to reproduce it reliably here with the steps
+below:
+
+mkfs.xfs -f -lsize=1025M -f -b size=4096 -m crc=1,reflink=1,rmapbt=1, -i
+sparse=1 /dev/vdb2 > /dev/null
+mount -o usrquota,grpquota,prjquota /dev/vdb2 /mnt
+xfs_io -x -c 'shutdown -f' /mnt
+umount /mnt
+mount -o ro,norecovery,usrquota,grpquota,prjquota /dev/vdb2 /mnt
+
+Last mount hangs up
+
+As we add yet another validation if quota state is changing, this also
+add a new helper named xfs_qm_validate_state_change(), factoring the
+quota state changes out of xfs_qm_newmount() to reduce cluttering
+within it.
+
+Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_qm_bhv.c | 49 ++++++++++++++++++++++++++++++++++---------------
+ 1 file changed, 34 insertions(+), 15 deletions(-)
+
+
+--- a/fs/xfs/xfs_qm_bhv.c
++++ b/fs/xfs/xfs_qm_bhv.c
+@@ -79,6 +79,28 @@ xfs_qm_statvfs(
+ }
+ }
+
++STATIC int
++xfs_qm_validate_state_change(
++ struct xfs_mount *mp,
++ uint uqd,
++ uint gqd,
++ uint pqd)
++{
++ int state;
++
++ /* Is quota state changing? */
++ state = ((uqd && !XFS_IS_UQUOTA_ON(mp)) ||
++ (!uqd && XFS_IS_UQUOTA_ON(mp)) ||
++ (gqd && !XFS_IS_GQUOTA_ON(mp)) ||
++ (!gqd && XFS_IS_GQUOTA_ON(mp)) ||
++ (pqd && !XFS_IS_PQUOTA_ON(mp)) ||
++ (!pqd && XFS_IS_PQUOTA_ON(mp)));
++
++ return state &&
++ (xfs_dev_is_read_only(mp, "changing quota state") ||
++ xfs_has_norecovery(mp));
++}
++
+ int
+ xfs_qm_newmount(
+ xfs_mount_t *mp,
+@@ -98,24 +120,21 @@ xfs_qm_newmount(
+ }
+
+ /*
+- * If the device itself is read-only, we can't allow
+- * the user to change the state of quota on the mount -
+- * this would generate a transaction on the ro device,
+- * which would lead to an I/O error and shutdown
++ * If the device itself is read-only and/or in norecovery
++ * mode, we can't allow the user to change the state of
++ * quota on the mount - this would generate a transaction
++ * on the ro device, which would lead to an I/O error and
++ * shutdown.
+ */
+
+- if (((uquotaondisk && !XFS_IS_UQUOTA_ON(mp)) ||
+- (!uquotaondisk && XFS_IS_UQUOTA_ON(mp)) ||
+- (gquotaondisk && !XFS_IS_GQUOTA_ON(mp)) ||
+- (!gquotaondisk && XFS_IS_GQUOTA_ON(mp)) ||
+- (pquotaondisk && !XFS_IS_PQUOTA_ON(mp)) ||
+- (!pquotaondisk && XFS_IS_PQUOTA_ON(mp))) &&
+- xfs_dev_is_read_only(mp, "changing quota state")) {
++ if (xfs_qm_validate_state_change(mp, uquotaondisk,
++ gquotaondisk, pquotaondisk)) {
++
+ xfs_warn(mp, "please mount with%s%s%s%s.",
+- (!quotaondisk ? "out quota" : ""),
+- (uquotaondisk ? " usrquota" : ""),
+- (gquotaondisk ? " grpquota" : ""),
+- (pquotaondisk ? " prjquota" : ""));
++ (!quotaondisk ? "out quota" : ""),
++ (uquotaondisk ? " usrquota" : ""),
++ (gquotaondisk ? " grpquota" : ""),
++ (pquotaondisk ? " prjquota" : ""));
+ return -EPERM;
+ }
+
--- /dev/null
+From stable+bounces-136938-greg=kroah.com@vger.kernel.org Mon Apr 28 20:39:33 2025
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Mon, 28 Apr 2025 11:39:19 -0700
+Subject: xfs: do not check NEEDSREPAIR if ro,norecovery mount.
+To: djwong@kernel.org, xfs-stable@lists.linux.dev
+Cc: cem@kernel.org, dchinner@redhat.com, lukas@herbolt.com, sandeen@redhat.com, stable@vger.kernel.org
+Message-ID: <174586545399.480536.11556523767440235148.stgit@frogsfrogsfrogs>
+
+From: Lukas Herbolt <lukas@herbolt.com>
+
+Commit 9e00163c31676c6b43d2334fdf5b406232f42dee upstream
+
+If there is corrutpion on the filesystem andxfs_repair
+fails to repair it. The last resort of getting the data
+is to use norecovery,ro mount. But if the NEEDSREPAIR is
+set the filesystem cannot be mounted. The flag must be
+cleared out manually using xfs_db, to get access to what
+left over of the corrupted fs.
+
+Signed-off-by: Lukas Herbolt <lukas@herbolt.com>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Eric Sandeen <sandeen@redhat.com>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_super.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+
+--- a/fs/xfs/xfs_super.c
++++ b/fs/xfs/xfs_super.c
+@@ -1619,8 +1619,12 @@ xfs_fs_fill_super(
+ #endif
+ }
+
+- /* Filesystem claims it needs repair, so refuse the mount. */
+- if (xfs_has_needsrepair(mp)) {
++ /*
++ * Filesystem claims it needs repair, so refuse the mount unless
++ * norecovery is also specified, in which case the filesystem can
++ * be mounted with no risk of further damage.
++ */
++ if (xfs_has_needsrepair(mp) && !xfs_has_norecovery(mp)) {
+ xfs_warn(mp, "Filesystem needs repair. Please run xfs_repair.");
+ error = -EFSCORRUPTED;
+ goto out_free_sb;
--- /dev/null
+From stable+bounces-136941-greg=kroah.com@vger.kernel.org Mon Apr 28 20:40:13 2025
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Mon, 28 Apr 2025 11:40:06 -0700
+Subject: xfs: flush inodegc before swapon
+To: djwong@kernel.org, xfs-stable@lists.linux.dev
+Cc: cem@kernel.org, dchinner@redhat.com, hch@lst.de, stable@vger.kernel.org
+Message-ID: <174586545460.480536.4621928282923794223.stgit@frogsfrogsfrogs>
+
+From: Christoph Hellwig <hch@lst.de>
+
+Commit 2d873efd174bae9005776937d5ac6a96050266db upstream
+
+Fix the brand new xfstest that tries to swapon on a recently unshared
+file and use the chance to document the other bit of magic in this
+function.
+
+The big comment is taken from a mailinglist post by Dave Chinner.
+
+Fixes: 5e672cd69f0a53 ("xfs: introduce xfs_inodegc_push()")
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_aops.c | 35 ++++++++++++++++++++++++++++++++++-
+ 1 file changed, 34 insertions(+), 1 deletion(-)
+
+
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -19,6 +19,7 @@
+ #include "xfs_reflink.h"
+ #include "xfs_errortag.h"
+ #include "xfs_error.h"
++#include "xfs_icache.h"
+
+ struct xfs_writepage_ctx {
+ struct iomap_writepage_ctx ctx;
+@@ -533,7 +534,39 @@ xfs_vm_swap_activate(
+ struct file *swap_file,
+ sector_t *span)
+ {
+- sis->bdev = xfs_inode_buftarg(XFS_I(file_inode(swap_file)))->bt_bdev;
++ struct xfs_inode *ip = XFS_I(file_inode(swap_file));
++
++ /*
++ * Swap file activation can race against concurrent shared extent
++ * removal in files that have been cloned. If this happens,
++ * iomap_swapfile_iter() can fail because it encountered a shared
++ * extent even though an operation is in progress to remove those
++ * shared extents.
++ *
++ * This race becomes problematic when we defer extent removal
++ * operations beyond the end of a syscall (i.e. use async background
++ * processing algorithms). Users think the extents are no longer
++ * shared, but iomap_swapfile_iter() still sees them as shared
++ * because the refcountbt entries for the extents being removed have
++ * not yet been updated. Hence the swapon call fails unexpectedly.
++ *
++ * The race condition is currently most obvious from the unlink()
++ * operation as extent removal is deferred until after the last
++ * reference to the inode goes away. We then process the extent
++ * removal asynchronously, hence triggers the "syscall completed but
++ * work not done" condition mentioned above. To close this race
++ * window, we need to flush any pending inodegc operations to ensure
++ * they have updated the refcountbt records before we try to map the
++ * swapfile.
++ */
++ xfs_inodegc_flush(ip->i_mount);
++
++ /*
++ * Direct the swap code to the correct block device when this file
++ * sits on the RT device.
++ */
++ sis->bdev = xfs_inode_buftarg(ip)->bt_bdev;
++
+ return iomap_swapfile_activate(sis, swap_file, span,
+ &xfs_read_iomap_ops);
+ }
--- /dev/null
+From stable+bounces-136940-greg=kroah.com@vger.kernel.org Mon Apr 28 20:39:56 2025
+From: "Darrick J. Wong" <djwong@kernel.org>
+Date: Mon, 28 Apr 2025 11:39:51 -0700
+Subject: xfs: rename xfs_iomap_swapfile_activate to xfs_vm_swap_activate
+To: djwong@kernel.org, xfs-stable@lists.linux.dev
+Cc: cem@kernel.org, dchinner@redhat.com, hch@lst.de, stable@vger.kernel.org
+Message-ID: <174586545440.480536.11026423037943384392.stgit@frogsfrogsfrogs>
+
+From: Christoph Hellwig <hch@lst.de>
+
+Commit 3cd6a8056f5a2e794c42fc2114ee2611e358b357 upstream
+
+Match the method name and the naming convention or address_space
+operations.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Darrick J. Wong <djwong@kernel.org>
+Reviewed-by: Dave Chinner <dchinner@redhat.com>
+Signed-off-by: Carlos Maiolino <cem@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/xfs/xfs_aops.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+
+--- a/fs/xfs/xfs_aops.c
++++ b/fs/xfs/xfs_aops.c
+@@ -528,7 +528,7 @@ xfs_vm_readahead(
+ }
+
+ static int
+-xfs_iomap_swapfile_activate(
++xfs_vm_swap_activate(
+ struct swap_info_struct *sis,
+ struct file *swap_file,
+ sector_t *span)
+@@ -549,11 +549,11 @@ const struct address_space_operations xf
+ .migrate_folio = filemap_migrate_folio,
+ .is_partially_uptodate = iomap_is_partially_uptodate,
+ .error_remove_folio = generic_error_remove_folio,
+- .swap_activate = xfs_iomap_swapfile_activate,
++ .swap_activate = xfs_vm_swap_activate,
+ };
+
+ const struct address_space_operations xfs_dax_aops = {
+ .writepages = xfs_dax_writepages,
+ .dirty_folio = noop_dirty_folio,
+- .swap_activate = xfs_iomap_swapfile_activate,
++ .swap_activate = xfs_vm_swap_activate,
+ };