--- /dev/null
+From 30479f31d44d47ed00ae0c7453d9b253537005b2 Mon Sep 17 00:00:00 2001
+From: Boris Burkov <boris@bur.io>
+Date: Fri, 19 Jul 2024 16:49:08 -0700
+Subject: btrfs: fix qgroup reserve leaks in cow_file_range
+
+From: Boris Burkov <boris@bur.io>
+
+commit 30479f31d44d47ed00ae0c7453d9b253537005b2 upstream.
+
+In the buffered write path, the dirty page owns the qgroup reserve until
+it creates an ordered_extent.
+
+Therefore, any errors that occur before the ordered_extent is created
+must free that reservation, or else the space is leaked. The fstest
+generic/475 exercises various IO error paths, and is able to trigger
+errors in cow_file_range where we fail to get to allocating the ordered
+extent. Note that because we *do* clear delalloc, we are likely to
+remove the inode from the delalloc list, so the inodes/pages to not have
+invalidate/launder called on them in the commit abort path.
+
+This results in failures at the unmount stage of the test that look like:
+
+ BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure
+ BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure
+ BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672
+ ------------[ cut here ]------------
+ WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs]
+ Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq
+ CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014
+ RIP: 0010:close_ctree+0x222/0x4d0 [btrfs]
+ RSP: 0018:ffffb4465283be00 EFLAGS: 00010202
+ RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001
+ RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8
+ RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000
+ R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c
+ R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0
+ Call Trace:
+ <TASK>
+ ? close_ctree+0x222/0x4d0 [btrfs]
+ ? __warn.cold+0x8e/0xea
+ ? close_ctree+0x222/0x4d0 [btrfs]
+ ? report_bug+0xff/0x140
+ ? handle_bug+0x3b/0x70
+ ? exc_invalid_op+0x17/0x70
+ ? asm_exc_invalid_op+0x1a/0x20
+ ? close_ctree+0x222/0x4d0 [btrfs]
+ generic_shutdown_super+0x70/0x160
+ kill_anon_super+0x11/0x40
+ btrfs_kill_super+0x11/0x20 [btrfs]
+ deactivate_locked_super+0x2e/0xa0
+ cleanup_mnt+0xb5/0x150
+ task_work_run+0x57/0x80
+ syscall_exit_to_user_mode+0x121/0x130
+ do_syscall_64+0xab/0x1a0
+ entry_SYSCALL_64_after_hwframe+0x77/0x7f
+ RIP: 0033:0x7f916847a887
+ ---[ end trace 0000000000000000 ]---
+ BTRFS error (device dm-8 state EA): qgroup reserved space leaked
+
+Cases 2 and 3 in the out_reserve path both pertain to this type of leak
+and must free the reserved qgroup data. Because it is already an error
+path, I opted not to handle the possible errors in
+btrfs_free_qgroup_data.
+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+[Minor conflict resolved due to code context change.]
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/inode.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -1546,6 +1546,7 @@ out_unlock:
+ locked_page,
+ clear_bits,
+ page_ops);
++ btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL);
+ start += cur_alloc_size;
+ }
+
+@@ -1559,6 +1560,7 @@ out_unlock:
+ clear_bits |= EXTENT_CLEAR_DATA_RESV;
+ extent_clear_unlock_delalloc(inode, start, end, locked_page,
+ clear_bits, page_ops);
++ btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL);
+ }
+ return ret;
+ }
+@@ -2222,13 +2224,15 @@ error:
+ */
+ if (cow_start != (u64)-1)
+ cur_offset = cow_start;
+- if (cur_offset < end)
++ if (cur_offset < end) {
+ extent_clear_unlock_delalloc(inode, cur_offset, end,
+ locked_page, EXTENT_LOCKED |
+ EXTENT_DELALLOC | EXTENT_DEFRAG |
+ EXTENT_DO_ACCOUNTING, PAGE_UNLOCK |
+ PAGE_START_WRITEBACK |
+ PAGE_END_WRITEBACK);
++ btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1, NULL);
++ }
+ btrfs_free_path(path);
+ return ret;
+ }
--- /dev/null
+From a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb Mon Sep 17 00:00:00 2001
+From: Yuli Wang <wangyuli@uniontech.com>
+Date: Sat, 8 Mar 2025 13:51:32 +0800
+Subject: LoongArch: Eliminate superfluous get_numa_distances_cnt()
+
+From: Yuli Wang <wangyuli@uniontech.com>
+
+commit a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb upstream.
+
+In LoongArch, get_numa_distances_cnt() isn't in use, resulting in a
+compiler warning.
+
+Fix follow errors with clang-18 when W=1e:
+
+arch/loongarch/kernel/acpi.c:259:28: error: unused function 'get_numa_distances_cnt' [-Werror,-Wunused-function]
+ 259 | static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit)
+ | ^~~~~~~~~~~~~~~~~~~~~~
+1 error generated.
+
+Link: https://lore.kernel.org/all/Z7bHPVUH4lAezk0E@kernel.org/
+Signed-off-by: Yuli Wang <wangyuli@uniontech.com>
+Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/loongarch/kernel/acpi.c | 12 ------------
+ 1 file changed, 12 deletions(-)
+
+--- a/arch/loongarch/kernel/acpi.c
++++ b/arch/loongarch/kernel/acpi.c
+@@ -216,18 +216,6 @@ static __init int setup_node(int pxm)
+ return acpi_map_pxm_to_node(pxm);
+ }
+
+-/*
+- * Callback for SLIT parsing. pxm_to_node() returns NUMA_NO_NODE for
+- * I/O localities since SRAT does not list them. I/O localities are
+- * not supported at this point.
+- */
+-unsigned int numa_distance_cnt;
+-
+-static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit)
+-{
+- return slit->locality_count;
+-}
+-
+ void __init numa_set_distance(int from, int to, int distance)
+ {
+ if ((u8)distance != distance || (from == to && distance != LOCAL_DISTANCE)) {
x86-split_lock-fix-the-delayed-detection-logic.patch
nvme-rdma-unquiesce-admin_q-before-destroy-it.patch
powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch
+loongarch-eliminate-superfluous-get_numa_distances_cnt.patch
+usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch
+usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch
+btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch
+wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch
+wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch
--- /dev/null
+From b0e525d7a22ea350e75e2aec22e47fcfafa4cacd Mon Sep 17 00:00:00 2001
+From: GONG Ruiqi <gongruiqi1@huawei.com>
+Date: Tue, 7 Jan 2025 09:57:50 +0800
+Subject: usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control()
+
+From: GONG Ruiqi <gongruiqi1@huawei.com>
+
+commit b0e525d7a22ea350e75e2aec22e47fcfafa4cacd upstream.
+
+The error handling for the case `con_index == 0` should involve dropping
+the pm usage counter, as ucsi_ccg_sync_control() gets it at the
+beginning. Fix it.
+
+Cc: stable <stable@kernel.org>
+Fixes: e56aac6e5a25 ("usb: typec: fix potential array underflow in ucsi_ccg_sync_control()")
+Signed-off-by: GONG Ruiqi <gongruiqi1@huawei.com>
+Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/20250107015750.2778646-1-gongruiqi1@huawei.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[Minor context change fixed]
+Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
+@@ -587,7 +587,7 @@ static int ucsi_ccg_sync_write(struct uc
+ UCSI_CMD_CONNECTOR_MASK;
+ if (con_index == 0) {
+ ret = -EINVAL;
+- goto unlock;
++ goto err_put;
+ }
+ con = &uc->ucsi->connector[con_index - 1];
+ ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val);
+@@ -603,8 +603,8 @@ static int ucsi_ccg_sync_write(struct uc
+
+ err_clear_bit:
+ clear_bit(DEV_CMD_PENDING, &uc->flags);
++err_put:
+ pm_runtime_put_sync(uc->dev);
+-unlock:
+ mutex_unlock(&uc->lock);
+
+ return ret;
--- /dev/null
+From e56aac6e5a25630645607b6856d4b2a17b2311a5 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Mon, 11 Nov 2024 14:08:06 +0300
+Subject: usb: typec: fix potential array underflow in ucsi_ccg_sync_control()
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit e56aac6e5a25630645607b6856d4b2a17b2311a5 upstream.
+
+The "command" variable can be controlled by the user via debugfs. The
+worry is that if con_index is zero then "&uc->ucsi->connector[con_index
+- 1]" would be an array underflow.
+
+Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
+Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.mountain
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[Minor context change fixed.
+ 13f2ec3115c8 ("usb: typec: ucsi: simplify command sending API") rename
+ ucsi_ccg_sync_write to ucsi_ccg_sync_control in v6.11, so this patch is
+ applied in ucsi_ccg_sync_write in v6.6.]
+Signed-off-by: Bin Lan <bin.lan.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
+@@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct uc
+ uc->has_multiple_dp) {
+ con_index = (uc->last_cmd_sent >> 16) &
+ UCSI_CMD_CONNECTOR_MASK;
++ if (con_index == 0) {
++ ret = -EINVAL;
++ goto unlock;
++ }
+ con = &uc->ucsi->connector[con_index - 1];
+ ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val);
+ }
+@@ -600,6 +604,7 @@ static int ucsi_ccg_sync_write(struct uc
+ err_clear_bit:
+ clear_bit(DEV_CMD_PENDING, &uc->flags);
+ pm_runtime_put_sync(uc->dev);
++unlock:
+ mutex_unlock(&uc->lock);
+
+ return ret;
--- /dev/null
+From 9e1aff437a560cd72cb6a60ee33fe162b0afdaf1 Mon Sep 17 00:00:00 2001
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Fri, 10 Nov 2023 09:23:15 +0800
+Subject: wifi: rtw89: pci: add pre_deinit to be called after probe complete
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+commit 9e1aff437a560cd72cb6a60ee33fe162b0afdaf1 upstream.
+
+At probe stage, we only do partial initialization to enable ability to
+download firmware and read capabilities. After that, we use this pre_deinit
+to disable HCI to save power.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Signed-off-by: Kalle Valo <kvalo@kernel.org>
+Link: https://lore.kernel.org/r/20231110012319.12727-4-pkshih@realtek.com
+[ Zenm: The rtw89 driver in recent kernel versions supports both Wi-Fi 6/6E
+ and Wi-Fi 7, however the rtw89 driver in kernel 6.6 supports
+ Wi-Fi 6/6E only, so remove the unnecessary code for Wi-Fi 7 from
+ the upstream patch to make it apply on 6.6.y. ]
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtw89/core.c | 2 ++
+ drivers/net/wireless/realtek/rtw89/core.h | 6 ++++++
+ drivers/net/wireless/realtek/rtw89/pci.c | 8 ++++++++
+ 3 files changed, 16 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw89/core.c
++++ b/drivers/net/wireless/realtek/rtw89/core.c
+@@ -3807,6 +3807,8 @@ static int rtw89_chip_efuse_info_setup(s
+ rtw89_core_setup_phycap(rtwdev);
+ rtw89_core_setup_rfe_parms(rtwdev);
+
++ rtw89_hci_mac_pre_deinit(rtwdev);
++
+ rtw89_mac_pwr_off(rtwdev);
+
+ return 0;
+--- a/drivers/net/wireless/realtek/rtw89/core.h
++++ b/drivers/net/wireless/realtek/rtw89/core.h
+@@ -2989,6 +2989,7 @@ struct rtw89_hci_ops {
+ void (*write32)(struct rtw89_dev *rtwdev, u32 addr, u32 data);
+
+ int (*mac_pre_init)(struct rtw89_dev *rtwdev);
++ int (*mac_pre_deinit)(struct rtw89_dev *rtwdev);
+ int (*mac_post_init)(struct rtw89_dev *rtwdev);
+ int (*deinit)(struct rtw89_dev *rtwdev);
+
+@@ -4515,6 +4516,11 @@ static inline void rtw89_hci_tx_kick_off
+ return rtwdev->hci.ops->tx_kick_off(rtwdev, txch);
+ }
+
++static inline int rtw89_hci_mac_pre_deinit(struct rtw89_dev *rtwdev)
++{
++ return rtwdev->hci.ops->mac_pre_deinit(rtwdev);
++}
++
+ static inline void rtw89_hci_flush_queues(struct rtw89_dev *rtwdev, u32 queues,
+ bool drop)
+ {
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -2568,6 +2568,13 @@ static int rtw89_pci_ops_mac_pre_init(st
+ return 0;
+ }
+
++static int rtw89_pci_ops_mac_pre_deinit(struct rtw89_dev *rtwdev)
++{
++ rtw89_pci_power_wake(rtwdev, false);
++
++ return 0;
++}
++
+ int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en)
+ {
+ u32 val;
+@@ -3812,6 +3819,7 @@ static const struct rtw89_hci_ops rtw89_
+ .write32 = rtw89_pci_ops_write32,
+
+ .mac_pre_init = rtw89_pci_ops_mac_pre_init,
++ .mac_pre_deinit = rtw89_pci_ops_mac_pre_deinit,
+ .mac_post_init = rtw89_pci_ops_mac_post_init,
+ .deinit = rtw89_pci_ops_deinit,
+
--- /dev/null
+From 9c1df813e08832c3836c254bc8a2f83ff22dbc06 Mon Sep 17 00:00:00 2001
+From: Ping-Ke Shih <pkshih@realtek.com>
+Date: Mon, 11 Nov 2024 14:38:35 +0800
+Subject: wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit
+
+From: Ping-Ke Shih <pkshih@realtek.com>
+
+commit 9c1df813e08832c3836c254bc8a2f83ff22dbc06 upstream.
+
+The PCIE wake bit is to control PCIE wake signal to host. When PCIE is
+going down, clear this bit to prevent waking up host unexpectedly.
+
+Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
+Link: https://patch.msgid.link/20241111063835.15454-1-pkshih@realtek.com
+[ Zenm: The rtw89 driver in recent kernel versions supports both Wi-Fi 6/6E
+ and Wi-Fi 7, however the rtw89 driver in kernel 6.6 supports
+ Wi-Fi 6/6E only, so remove the unnecessary code for Wi-Fi 7 from
+ the upstream patch to make it apply on 6.6.y. ]
+Signed-off-by: Zenm Chen <zenmchen@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/wireless/realtek/rtw89/pci.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/wireless/realtek/rtw89/pci.c
++++ b/drivers/net/wireless/realtek/rtw89/pci.c
+@@ -2482,6 +2482,8 @@ static int rtw89_pci_ops_deinit(struct r
+ {
+ const struct rtw89_pci_info *info = rtwdev->pci_info;
+
++ rtw89_pci_power_wake(rtwdev, false);
++
+ if (rtwdev->chip->chip_id == RTL8852A) {
+ /* ltr sw trigger */
+ rtw89_write32_set(rtwdev, R_AX_LTR_CTRL_0, B_AX_APP_LTR_IDLE);
projects / thirdparty / kernel / stable-queue.git / commitdiff
