--- /dev/null
+From edcbdd57de499305e2a3737d4a73fe387f71d84c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Thu, 20 Apr 2023 09:28:11 +0200
+Subject: ARM: dts: qcom: ipq4019: fix broken NAND controller properties override
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit edcbdd57de499305e2a3737d4a73fe387f71d84c upstream.
+
+After renaming NAND controller node name from "qpic-nand" to
+"nand-controller", the board DTS/DTSI also have to be updated:
+
+ Warning (unit_address_vs_reg): /soc/qpic-nand@79b0000: node has a unit name, but no reg or ranges property
+
+Cc: <stable@vger.kernel.org>
+Fixes: 9e1e00f18afc ("ARM: dts: qcom: Fix node name for NAND controller node")
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230420072811.36947-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts | 8 ++++----
+ arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi | 10 +++++-----
+ arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi | 12 ++++++------
+ 3 files changed, 15 insertions(+), 15 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1-c1.dts
+@@ -11,9 +11,9 @@
+ dma-controller@7984000 {
+ status = "okay";
+ };
+-
+- qpic-nand@79b0000 {
+- status = "okay";
+- };
+ };
+ };
++
++&nand {
++ status = "okay";
++};
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk04.1.dtsi
+@@ -102,10 +102,10 @@
+ status = "okay";
+ perst-gpios = <&tlmm 38 GPIO_ACTIVE_LOW>;
+ };
+-
+- qpic-nand@79b0000 {
+- pinctrl-0 = <&nand_pins>;
+- pinctrl-names = "default";
+- };
+ };
+ };
++
++&nand {
++ pinctrl-0 = <&nand_pins>;
++ pinctrl-names = "default";
++};
+--- a/arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi
++++ b/arch/arm/boot/dts/qcom-ipq4019-ap.dk07.1.dtsi
+@@ -65,11 +65,11 @@
+ dma-controller@7984000 {
+ status = "okay";
+ };
+-
+- qpic-nand@79b0000 {
+- pinctrl-0 = <&nand_pins>;
+- pinctrl-names = "default";
+- status = "okay";
+- };
+ };
+ };
++
++&nand {
++ pinctrl-0 = <&nand_pins>;
++ pinctrl-names = "default";
++ status = "okay";
++};
--- /dev/null
+From a0f19091d4f5bbe97485592257b88007eb5b1998 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Fri, 14 Apr 2023 15:57:47 +0200
+Subject: ARM: dts: qcom: msm8660: Fix regulator node names
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit a0f19091d4f5bbe97485592257b88007eb5b1998 upstream.
+
+commit 04715461abf7 altered the node names in a DTSI file
+used by qcom-apq8060-dragonboard.dts breaking the board.
+Align the node names in the DTS file and the board boots
+again.
+
+Cc: stable@vger.kernel.org
+Fixes: 85055a1eecc1 ("ARM: dts: qcom-msm8660: align RPM regulators node name with bindings")
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Bjorn Andersson <andersson@kernel.org>
+Link: https://lore.kernel.org/r/20230414135747.34994-1-linus.walleij@linaro.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/boot/dts/qcom-apq8060-dragonboard.dts | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/qcom-apq8060-dragonboard.dts
++++ b/arch/arm/boot/dts/qcom-apq8060-dragonboard.dts
+@@ -451,7 +451,7 @@
+ * PM8901 supplies "preliminary regulators" whatever
+ * that means
+ */
+- pm8901-regulators {
++ regulators-0 {
+ vdd_l0-supply = <&pm8901_s4>;
+ vdd_l1-supply = <&vph>;
+ vdd_l2-supply = <&vph>;
+@@ -537,7 +537,7 @@
+
+ };
+
+- pm8058-regulators {
++ regulators-1 {
+ vdd_l0_l1_lvs-supply = <&pm8058_s3>;
+ vdd_l2_l11_l12-supply = <&vph>;
+ vdd_l3_l4_l5-supply = <&vph>;
--- /dev/null
+From f8ef1233939495c405a9faa4bd1ae7d3f581bae4 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Tue, 16 May 2023 17:31:05 +0200
+Subject: ARM: orion5x: fix d2net gpio initialization
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit f8ef1233939495c405a9faa4bd1ae7d3f581bae4 upstream.
+
+The DT version of this board has a custom file with the gpio
+device. However, it does nothing because the d2net_init()
+has no caller or prototype:
+
+arch/arm/mach-orion5x/board-d2net.c:101:13: error: no previous prototype for 'd2net_init'
+
+Call it from the board-dt file as intended.
+
+Fixes: 94b0bd366e36 ("ARM: orion5x: convert d2net to Device Tree")
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20230516153109.514251-10-arnd@kernel.org
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-orion5x/board-dt.c | 3 +++
+ arch/arm/mach-orion5x/common.h | 6 ++++++
+ 2 files changed, 9 insertions(+)
+
+--- a/arch/arm/mach-orion5x/board-dt.c
++++ b/arch/arm/mach-orion5x/board-dt.c
+@@ -60,6 +60,9 @@ static void __init orion5x_dt_init(void)
+ if (of_machine_is_compatible("maxtor,shared-storage-2"))
+ mss2_init();
+
++ if (of_machine_is_compatible("lacie,d2-network"))
++ d2net_init();
++
+ of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL);
+ }
+
+--- a/arch/arm/mach-orion5x/common.h
++++ b/arch/arm/mach-orion5x/common.h
+@@ -73,6 +73,12 @@ extern void mss2_init(void);
+ static inline void mss2_init(void) {}
+ #endif
+
++#ifdef CONFIG_MACH_D2NET_DT
++void d2net_init(void);
++#else
++static inline void d2net_init(void) {}
++#endif
++
+ /*****************************************************************************
+ * Helpers to access Orion registers
+ ****************************************************************************/
--- /dev/null
+From f9c058d14f4fe23ef523a7ff73734d51c151683c Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ribalda@chromium.org>
+Date: Mon, 12 Jun 2023 11:05:32 +0200
+Subject: ASoC: mediatek: mt8173: Fix irq error path
+
+From: Ricardo Ribalda Delgado <ribalda@chromium.org>
+
+commit f9c058d14f4fe23ef523a7ff73734d51c151683c upstream.
+
+After reordering the irq probe, the error path was not properly done.
+Lets fix it.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: stable@kernel.org
+Fixes: 4cbb264d4e91 ("ASoC: mediatek: mt8173: Enable IRQ when pdata is ready")
+Signed-off-by: Ricardo Ribalda Delgado <ribalda@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230612-mt8173-fixup-v2-2-432aa99ce24d@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
++++ b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
+@@ -1070,6 +1070,10 @@ static int mt8173_afe_pcm_dev_probe(stru
+
+ afe->dev = &pdev->dev;
+
++ irq_id = platform_get_irq(pdev, 0);
++ if (irq_id <= 0)
++ return irq_id < 0 ? irq_id : -ENXIO;
++
+ afe->base_addr = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(afe->base_addr))
+ return PTR_ERR(afe->base_addr);
+@@ -1175,14 +1179,11 @@ static int mt8173_afe_pcm_dev_probe(stru
+ if (ret)
+ goto err_cleanup_components;
+
+- irq_id = platform_get_irq(pdev, 0);
+- if (irq_id <= 0)
+- return irq_id < 0 ? irq_id : -ENXIO;
+ ret = devm_request_irq(afe->dev, irq_id, mt8173_afe_irq_handler,
+ 0, "Afe_ISR_Handle", (void *)afe);
+ if (ret) {
+ dev_err(afe->dev, "could not request_irq\n");
+- goto err_pm_disable;
++ goto err_cleanup_components;
+ }
+
+ dev_info(&pdev->dev, "MT8173 AFE driver initialized.\n");
--- /dev/null
+From a46d37012a5be1737393b8f82fd35665e4556eee Mon Sep 17 00:00:00 2001
+From: Ricardo Ribalda Delgado <ribalda@chromium.org>
+Date: Mon, 12 Jun 2023 11:05:31 +0200
+Subject: ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
+
+From: Ricardo Ribalda Delgado <ribalda@chromium.org>
+
+commit a46d37012a5be1737393b8f82fd35665e4556eee upstream.
+
+If the second component fails to initialize, cleanup the first on.
+
+Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
+Cc: stable@kernel.org
+Fixes: f1b5bf07365d ("ASoC: mt2701/mt8173: replace platform to component")
+Signed-off-by: Ricardo Ribalda Delgado <ribalda@chromium.org>
+Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
+Link: https://lore.kernel.org/r/20230612-mt8173-fixup-v2-1-432aa99ce24d@chromium.org
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/soc/mediatek/mt8173/mt8173-afe-pcm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
++++ b/sound/soc/mediatek/mt8173/mt8173-afe-pcm.c
+@@ -1160,14 +1160,14 @@ static int mt8173_afe_pcm_dev_probe(stru
+ comp_hdmi = devm_kzalloc(&pdev->dev, sizeof(*comp_hdmi), GFP_KERNEL);
+ if (!comp_hdmi) {
+ ret = -ENOMEM;
+- goto err_pm_disable;
++ goto err_cleanup_components;
+ }
+
+ ret = snd_soc_component_initialize(comp_hdmi,
+ &mt8173_afe_hdmi_dai_component,
+ &pdev->dev);
+ if (ret)
+- goto err_pm_disable;
++ goto err_cleanup_components;
+
+ #ifdef CONFIG_DEBUG_FS
+ comp_hdmi->debugfs_prefix = "hdmi";
--- /dev/null
+From 1a1b0e729d227f9f758f7b5f1c997e874e94156e Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Thu, 1 Jun 2023 00:33:01 +0200
+Subject: btrfs: add block-group tree to lockdep classes
+
+From: David Sterba <dsterba@suse.com>
+
+commit 1a1b0e729d227f9f758f7b5f1c997e874e94156e upstream.
+
+The block group tree was not present among the lockdep classes. We could
+get potentially lockdep warnings but so far none has been seen, also
+because block-group-tree is a relatively new feature.
+
+CC: stable@vger.kernel.org # 6.1+
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/locking.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/locking.c
++++ b/fs/btrfs/locking.c
+@@ -57,8 +57,8 @@
+
+ static struct btrfs_lockdep_keyset {
+ u64 id; /* root objectid */
+- /* Longest entry: btrfs-free-space-00 */
+- char names[BTRFS_MAX_LEVEL][20];
++ /* Longest entry: btrfs-block-group-00 */
++ char names[BTRFS_MAX_LEVEL][24];
+ struct lock_class_key keys[BTRFS_MAX_LEVEL];
+ } btrfs_lockdep_keysets[] = {
+ { .id = BTRFS_ROOT_TREE_OBJECTID, DEFINE_NAME("root") },
+@@ -72,6 +72,7 @@ static struct btrfs_lockdep_keyset {
+ { .id = BTRFS_DATA_RELOC_TREE_OBJECTID, DEFINE_NAME("dreloc") },
+ { .id = BTRFS_UUID_TREE_OBJECTID, DEFINE_NAME("uuid") },
+ { .id = BTRFS_FREE_SPACE_TREE_OBJECTID, DEFINE_NAME("free-space") },
++ { .id = BTRFS_BLOCK_GROUP_TREE_OBJECTID, DEFINE_NAME("block-group") },
+ { .id = 0, DEFINE_NAME("tree") },
+ };
+
--- /dev/null
+From 160fe8f6fdb13da6111677be6263e5d65e875987 Mon Sep 17 00:00:00 2001
+From: Matt Corallo <blnxfsl@bluematt.me>
+Date: Mon, 5 Jun 2023 16:49:45 -0700
+Subject: btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
+
+From: Matt Corallo <blnxfsl@bluematt.me>
+
+commit 160fe8f6fdb13da6111677be6263e5d65e875987 upstream.
+
+Callers of `btrfs_reduce_alloc_profile` expect it to return exactly
+one allocation profile flag, and failing to do so may ultimately
+result in a WARN_ON and remount-ro when allocating new blocks, like
+the below transaction abort on 6.1.
+
+`btrfs_reduce_alloc_profile` has two ways of determining the profile,
+first it checks if a conversion balance is currently running and
+uses the profile we're converting to. If no balance is currently
+running, it returns the max-redundancy profile which at least one
+block in the selected block group has.
+
+This works by simply checking each known allocation profile bit in
+redundancy order. However, `btrfs_reduce_alloc_profile` has not been
+updated as new flags have been added - first with the `DUP` profile
+and later with the RAID1C34 profiles.
+
+Because of the way it checks, if we have blocks with different
+profiles and at least one is known, that profile will be selected.
+However, if none are known we may return a flag set with multiple
+allocation profiles set.
+
+This is currently only possible when a balance from one of the three
+unhandled profiles to another of the unhandled profiles is canceled
+after allocating at least one block using the new profile.
+
+In that case, a transaction abort like the below will occur and the
+filesystem will need to be mounted with -o skip_balance to get it
+mounted rw again (but the balance cannot be resumed without a
+similar abort).
+
+ [770.648] ------------[ cut here ]------------
+ [770.648] BTRFS: Transaction aborted (error -22)
+ [770.648] WARNING: CPU: 43 PID: 1159593 at fs/btrfs/extent-tree.c:4122 find_free_extent+0x1d94/0x1e00 [btrfs]
+ [770.648] CPU: 43 PID: 1159593 Comm: btrfs Tainted: G W 6.1.0-0.deb11.7-powerpc64le #1 Debian 6.1.20-2~bpo11+1a~test
+ [770.648] Hardware name: T2P9D01 REV 1.00 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV
+ [770.648] NIP: c00800000f6784fc LR: c00800000f6784f8 CTR: c000000000d746c0
+ [770.648] REGS: c000200089afe9a0 TRAP: 0700 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
+ [770.648] MSR: 9000000002029033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE> CR: 28848282 XER: 20040000
+ [770.648] CFAR: c000000000135110 IRQMASK: 0
+ GPR00: c00800000f6784f8 c000200089afec40 c00800000f7ea800 0000000000000026
+ GPR04: 00000001004820c2 c000200089afea00 c000200089afe9f8 0000000000000027
+ GPR08: c000200ffbfe7f98 c000000002127f90 ffffffffffffffd8 0000000026d6a6e8
+ GPR12: 0000000028848282 c000200fff7f3800 5deadbeef0000122 c00000002269d000
+ GPR16: c0002008c7797c40 c000200089afef17 0000000000000000 0000000000000000
+ GPR20: 0000000000000000 0000000000000001 c000200008bc5a98 0000000000000001
+ GPR24: 0000000000000000 c0000003c73088d0 c000200089afef17 c000000016d3a800
+ GPR28: c0000003c7308800 c00000002269d000 ffffffffffffffea 0000000000000001
+ [770.648] NIP [c00800000f6784fc] find_free_extent+0x1d94/0x1e00 [btrfs]
+ [770.648] LR [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs]
+ [770.648] Call Trace:
+ [770.648] [c000200089afec40] [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs] (unreliable)
+ [770.648] [c000200089afed30] [c00800000f681398] btrfs_reserve_extent+0x1a0/0x2f0 [btrfs]
+ [770.648] [c000200089afeea0] [c00800000f681bf0] btrfs_alloc_tree_block+0x108/0x670 [btrfs]
+ [770.648] [c000200089afeff0] [c00800000f66bd68] __btrfs_cow_block+0x170/0x850 [btrfs]
+ [770.648] [c000200089aff100] [c00800000f66c58c] btrfs_cow_block+0x144/0x288 [btrfs]
+ [770.648] [c000200089aff1b0] [c00800000f67113c] btrfs_search_slot+0x6b4/0xcb0 [btrfs]
+ [770.648] [c000200089aff2a0] [c00800000f679f60] lookup_inline_extent_backref+0x128/0x7c0 [btrfs]
+ [770.648] [c000200089aff3b0] [c00800000f67b338] lookup_extent_backref+0x70/0x190 [btrfs]
+ [770.648] [c000200089aff470] [c00800000f67b54c] __btrfs_free_extent+0xf4/0x1490 [btrfs]
+ [770.648] [c000200089aff5a0] [c00800000f67d770] __btrfs_run_delayed_refs+0x328/0x1530 [btrfs]
+ [770.648] [c000200089aff740] [c00800000f67ea2c] btrfs_run_delayed_refs+0xb4/0x3e0 [btrfs]
+ [770.648] [c000200089aff800] [c00800000f699aa4] btrfs_commit_transaction+0x8c/0x12b0 [btrfs]
+ [770.648] [c000200089aff8f0] [c00800000f6dc628] reset_balance_state+0x1c0/0x290 [btrfs]
+ [770.648] [c000200089aff9a0] [c00800000f6e2f7c] btrfs_balance+0x1164/0x1500 [btrfs]
+ [770.648] [c000200089affb40] [c00800000f6f8e4c] btrfs_ioctl+0x2b54/0x3100 [btrfs]
+ [770.648] [c000200089affc80] [c00000000053be14] sys_ioctl+0x794/0x1310
+ [770.648] [c000200089affd70] [c00000000002af98] system_call_exception+0x138/0x250
+ [770.648] [c000200089affe10] [c00000000000c654] system_call_common+0xf4/0x258
+ [770.648] --- interrupt: c00 at 0x7fff94126800
+ [770.648] NIP: 00007fff94126800 LR: 0000000107e0b594 CTR: 0000000000000000
+ [770.648] REGS: c000200089affe80 TRAP: 0c00 Tainted: G W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
+ [770.648] MSR: 900000000000d033 <SF,HV,EE,PR,ME,IR,DR,RI,LE> CR: 24002848 XER: 00000000
+ [770.648] IRQMASK: 0
+ GPR00: 0000000000000036 00007fffc9439da0 00007fff94217100 0000000000000003
+ GPR04: 00000000c4009420 00007fffc9439ee8 0000000000000000 0000000000000000
+ GPR08: 00000000803c7416 0000000000000000 0000000000000000 0000000000000000
+ GPR12: 0000000000000000 00007fff9467d120 0000000107e64c9c 0000000107e64d0a
+ GPR16: 0000000107e64d06 0000000107e64cf1 0000000107e64cc4 0000000107e64c73
+ GPR20: 0000000107e64c31 0000000107e64bf1 0000000107e64be7 0000000000000000
+ GPR24: 0000000000000000 00007fffc9439ee0 0000000000000003 0000000000000001
+ GPR28: 00007fffc943f713 0000000000000000 00007fffc9439ee8 0000000000000000
+ [770.648] NIP [00007fff94126800] 0x7fff94126800
+ [770.648] LR [0000000107e0b594] 0x107e0b594
+ [770.648] --- interrupt: c00
+ [770.648] Instruction dump:
+ [770.648] 3b00ffe4 e8898828 481175f5 60000000 4bfff4fc 3be00000 4bfff570 3d220000
+ [770.648] 7fc4f378 e8698830 4811cd95 e8410018 <0fe00000> f9c10060 f9e10068 fa010070
+ [770.648] ---[ end trace 0000000000000000 ]---
+ [770.648] BTRFS: error (device dm-2: state A) in find_free_extent_update_loop:4122: errno=-22 unknown
+ [770.648] BTRFS info (device dm-2: state EA): forced readonly
+ [770.648] BTRFS: error (device dm-2: state EA) in __btrfs_free_extent:3070: errno=-22 unknown
+ [770.648] BTRFS error (device dm-2: state EA): failed to run delayed ref for logical 17838685708288 num_bytes 24576 type 184 action 2 ref_mod 1: -22
+ [770.648] BTRFS: error (device dm-2: state EA) in btrfs_run_delayed_refs:2144: errno=-22 unknown
+ [770.648] BTRFS: error (device dm-2: state EA) in reset_balance_state:3599: errno=-22 unknown
+
+Fixes: 47e6f7423b91 ("btrfs: add support for 3-copy replication (raid1c3)")
+Fixes: 8d6fac0087e5 ("btrfs: add support for 4-copy replication (raid1c4)")
+CC: stable@vger.kernel.org # 5.10+
+Signed-off-by: Matt Corallo <blnxfsl@bluematt.me>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -95,14 +95,21 @@ static u64 btrfs_reduce_alloc_profile(st
+ }
+ allowed &= flags;
+
+- if (allowed & BTRFS_BLOCK_GROUP_RAID6)
++ /* Select the highest-redundancy RAID level. */
++ if (allowed & BTRFS_BLOCK_GROUP_RAID1C4)
++ allowed = BTRFS_BLOCK_GROUP_RAID1C4;
++ else if (allowed & BTRFS_BLOCK_GROUP_RAID6)
+ allowed = BTRFS_BLOCK_GROUP_RAID6;
++ else if (allowed & BTRFS_BLOCK_GROUP_RAID1C3)
++ allowed = BTRFS_BLOCK_GROUP_RAID1C3;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID5)
+ allowed = BTRFS_BLOCK_GROUP_RAID5;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID10)
+ allowed = BTRFS_BLOCK_GROUP_RAID10;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID1)
+ allowed = BTRFS_BLOCK_GROUP_RAID1;
++ else if (allowed & BTRFS_BLOCK_GROUP_DUP)
++ allowed = BTRFS_BLOCK_GROUP_DUP;
+ else if (allowed & BTRFS_BLOCK_GROUP_RAID0)
+ allowed = BTRFS_BLOCK_GROUP_RAID0;
+
--- /dev/null
+From d09c51521f22f9cbdfb1cf63e5c456077c622c84 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 8 Jun 2023 11:27:37 +0100
+Subject: btrfs: add missing error handling when logging operation while COWing extent buffer
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit d09c51521f22f9cbdfb1cf63e5c456077c622c84 upstream.
+
+When COWing an extent buffer that is not the root node, we need to log in
+the tree mod log that we replaced a pointer in the parent node, otherwise
+a tree mod log user doing a search on the b+tree can return incorrect
+results (that miss something). We are doing the call to
+btrfs_tree_mod_log_insert_key() but we totally ignore its return value.
+
+So fix this by adding the missing error handling, resulting in a
+transaction abort and freeing the COWed extent buffer.
+
+Fixes: f230475e62f7 ("Btrfs: put all block modifications into the tree mod log")
+CC: stable@vger.kernel.org # 5.4+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -594,8 +594,14 @@ static noinline int __btrfs_cow_block(st
+ add_root_to_dirty_list(root);
+ } else {
+ WARN_ON(trans->transid != btrfs_header_generation(parent));
+- btrfs_tree_mod_log_insert_key(parent, parent_slot,
+- BTRFS_MOD_LOG_KEY_REPLACE);
++ ret = btrfs_tree_mod_log_insert_key(parent, parent_slot,
++ BTRFS_MOD_LOG_KEY_REPLACE);
++ if (ret) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
++ btrfs_abort_transaction(trans, ret);
++ return ret;
++ }
+ btrfs_set_node_blockptr(parent, parent_slot,
+ cow->start);
+ btrfs_set_node_ptr_generation(parent, parent_slot,
--- /dev/null
+From 93463ff7b54626f8276c0bd3d3f968fbf8d5d380 Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naota@elisp.net>
+Date: Tue, 6 Jun 2023 14:36:35 +0900
+Subject: btrfs: bail out reclaim process if filesystem is read-only
+
+From: Naohiro Aota <naota@elisp.net>
+
+commit 93463ff7b54626f8276c0bd3d3f968fbf8d5d380 upstream.
+
+When a filesystem is read-only, we cannot reclaim a block group as it
+cannot rewrite the data. Just bail out in that case.
+
+Note that it can drop block groups in this case. As we did
+sb_start_write(), read-only filesystem means we got a fatal error and
+forced read-only. There is no chance to reclaim them again.
+
+Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1798,8 +1798,15 @@ void btrfs_reclaim_bgs_work(struct work_
+ }
+ spin_unlock(&bg->lock);
+
+- /* Get out fast, in case we're unmounting the filesystem */
+- if (btrfs_fs_closing(fs_info)) {
++ /*
++ * Get out fast, in case we're read-only or unmounting the
++ * filesystem. It is OK to drop block groups from the list even
++ * for the read-only case. As we did sb_start_write(),
++ * "mount -o remount,ro" won't happen and read-only filesystem
++ * means it is forced read-only due to a fatal error. So, it
++ * never gets back to read-write to let us reclaim again.
++ */
++ if (btrfs_need_cleaner_sleep(fs_info)) {
+ up_write(&space_info->groups_sem);
+ goto next;
+ }
--- /dev/null
+From 3ed01616bad6c7e3de196676b542ae3df8058592 Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naota@elisp.net>
+Date: Tue, 6 Jun 2023 14:36:33 +0900
+Subject: btrfs: delete unused BGs while reclaiming BGs
+
+From: Naohiro Aota <naota@elisp.net>
+
+commit 3ed01616bad6c7e3de196676b542ae3df8058592 upstream.
+
+The reclaiming process only starts after the filesystem volumes are
+allocated to a certain level (75% by default). Thus, the list of
+reclaiming target block groups can build up so huge at the time the
+reclaim process kicks in. On a test run, there were over 1000 BGs in the
+reclaim list.
+
+As the reclaim involves rewriting the data, it takes really long time to
+reclaim the BGs. While the reclaim is running, btrfs_delete_unused_bgs()
+won't proceed because the reclaim side is holding
+fs_info->reclaim_bgs_lock. As a result, we will have a large number of
+unused BGs kept in the unused list. On my test run, I got 1057 unused BGs.
+
+Since deleting a block group is relatively easy and fast work, we can call
+btrfs_delete_unused_bgs() while it reclaims BGs, to avoid building up
+unused BGs.
+
+Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 14 ++++++++++++++
+ 1 file changed, 14 insertions(+)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1831,10 +1831,24 @@ void btrfs_reclaim_bgs_work(struct work_
+
+ next:
+ btrfs_put_block_group(bg);
++
++ mutex_unlock(&fs_info->reclaim_bgs_lock);
++ /*
++ * Reclaiming all the block groups in the list can take really
++ * long. Prioritize cleaning up unused block groups.
++ */
++ btrfs_delete_unused_bgs(fs_info);
++ /*
++ * If we are interrupted by a balance, we can just bail out. The
++ * cleaner thread restart again if necessary.
++ */
++ if (!mutex_trylock(&fs_info->reclaim_bgs_lock))
++ goto end;
+ spin_lock(&fs_info->unused_bgs_lock);
+ }
+ spin_unlock(&fs_info->unused_bgs_lock);
+ mutex_unlock(&fs_info->reclaim_bgs_lock);
++end:
+ btrfs_exclop_finish(fs_info);
+ sb_end_write(fs_info->sb);
+ }
--- /dev/null
+From 40b0a749388517de244643c09bdbb98f7dcb6ef1 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 8 Jun 2023 11:27:40 +0100
+Subject: btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block()
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit 40b0a749388517de244643c09bdbb98f7dcb6ef1 upstream.
+
+At __btrfs_cow_block(), instead of doing a BUG_ON() in case we fail to
+record a tree mod log root insertion operation, do a transaction abort
+instead. There's really no need for the BUG_ON(), we can properly
+release all resources in this context and turn the filesystem to RO mode
+and in an error state instead.
+
+CC: stable@vger.kernel.org # 5.4+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -583,9 +583,14 @@ static noinline int __btrfs_cow_block(st
+ btrfs_header_backref_rev(buf) < BTRFS_MIXED_BACKREF_REV)
+ parent_start = buf->start;
+
+- atomic_inc(&cow->refs);
+ ret = btrfs_tree_mod_log_insert_root(root->node, cow, true);
+- BUG_ON(ret < 0);
++ if (ret < 0) {
++ btrfs_tree_unlock(cow);
++ free_extent_buffer(cow);
++ btrfs_abort_transaction(trans, ret);
++ return ret;
++ }
++ atomic_inc(&cow->refs);
+ rcu_assign_pointer(root->node, cow);
+
+ btrfs_free_tree_block(trans, btrfs_root_id(root), buf,
--- /dev/null
+From f18cc97845aa4ae0e795c088c979fe1642b3b8e5 Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Mon, 8 May 2023 07:58:38 -0700
+Subject: btrfs: fix dirty_metadata_bytes for redirtied buffers
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit f18cc97845aa4ae0e795c088c979fe1642b3b8e5 upstream.
+
+dirty_metadata_bytes is decremented in both places that clear the dirty
+bit in a buffer, but only incremented in btrfs_mark_buffer_dirty, which
+means that a buffer that is redirtied using btrfs_redirty_list_add won't
+be added to dirty_metadata_bytes, but it will be subtracted when written
+out, leading an inconsistency in the counter.
+
+Move the dirty_metadata_bytes from btrfs_mark_buffer_dirty into
+set_extent_buffer_dirty to also account for the redirty case, and remove
+the now unused set_extent_buffer_dirty return value.
+
+Fixes: d3575156f662 ("btrfs: zoned: redirty released extent buffers")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/disk-io.c | 7 +------
+ fs/btrfs/extent_io.c | 7 ++++---
+ fs/btrfs/extent_io.h | 2 +-
+ 3 files changed, 6 insertions(+), 10 deletions(-)
+
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -4683,7 +4683,6 @@ void btrfs_mark_buffer_dirty(struct exte
+ {
+ struct btrfs_fs_info *fs_info = buf->fs_info;
+ u64 transid = btrfs_header_generation(buf);
+- int was_dirty;
+
+ #ifdef CONFIG_BTRFS_FS_RUN_SANITY_TESTS
+ /*
+@@ -4698,11 +4697,7 @@ void btrfs_mark_buffer_dirty(struct exte
+ if (transid != fs_info->generation)
+ WARN(1, KERN_CRIT "btrfs transid mismatch buffer %llu, found %llu running %llu\n",
+ buf->start, transid, fs_info->generation);
+- was_dirty = set_extent_buffer_dirty(buf);
+- if (!was_dirty)
+- percpu_counter_add_batch(&fs_info->dirty_metadata_bytes,
+- buf->len,
+- fs_info->dirty_metadata_batch);
++ set_extent_buffer_dirty(buf);
+ #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+ /*
+ * Since btrfs_mark_buffer_dirty() can be called with item pointer set
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -4064,7 +4064,7 @@ void btrfs_clear_buffer_dirty(struct btr
+ WARN_ON(atomic_read(&eb->refs) == 0);
+ }
+
+-bool set_extent_buffer_dirty(struct extent_buffer *eb)
++void set_extent_buffer_dirty(struct extent_buffer *eb)
+ {
+ int i;
+ int num_pages;
+@@ -4099,13 +4099,14 @@ bool set_extent_buffer_dirty(struct exte
+ eb->start, eb->len);
+ if (subpage)
+ unlock_page(eb->pages[0]);
++ percpu_counter_add_batch(&eb->fs_info->dirty_metadata_bytes,
++ eb->len,
++ eb->fs_info->dirty_metadata_batch);
+ }
+ #ifdef CONFIG_BTRFS_DEBUG
+ for (i = 0; i < num_pages; i++)
+ ASSERT(PageDirty(eb->pages[i]));
+ #endif
+-
+- return was_dirty;
+ }
+
+ void clear_extent_buffer_uptodate(struct extent_buffer *eb)
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -263,7 +263,7 @@ void extent_buffer_bitmap_set(const stru
+ void extent_buffer_bitmap_clear(const struct extent_buffer *eb,
+ unsigned long start, unsigned long pos,
+ unsigned long len);
+-bool set_extent_buffer_dirty(struct extent_buffer *eb);
++void set_extent_buffer_dirty(struct extent_buffer *eb);
+ void set_extent_buffer_uptodate(struct extent_buffer *eb);
+ void clear_extent_buffer_uptodate(struct extent_buffer *eb);
+ int extent_buffer_under_io(const struct extent_buffer *eb);
--- /dev/null
+From ede600e497b1461d06d22a7d17703d9096868bc3 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Thu, 8 Jun 2023 11:27:38 +0100
+Subject: btrfs: fix extent buffer leak after tree mod log failure at split_node()
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit ede600e497b1461d06d22a7d17703d9096868bc3 upstream.
+
+At split_node(), if we fail to log the tree mod log copy operation, we
+return without unlocking the split extent buffer we just allocated and
+without decrementing the reference we own on it. Fix this by unlocking
+it and decrementing the ref count before returning.
+
+Fixes: 5de865eebb83 ("Btrfs: fix tree mod logging")
+CC: stable@vger.kernel.org # 5.4+
+Reviewed-by: Qu Wenruo <wqu@suse.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2982,6 +2982,8 @@ static noinline int split_node(struct bt
+
+ ret = btrfs_tree_mod_log_eb_copy(split, c, 0, mid, c_nritems - mid);
+ if (ret) {
++ btrfs_tree_unlock(split);
++ free_extent_buffer(split);
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
--- /dev/null
+From b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 Mon Sep 17 00:00:00 2001
+From: Filipe Manana <fdmanana@suse.com>
+Date: Mon, 19 Jun 2023 17:21:47 +0100
+Subject: btrfs: fix race when deleting quota root from the dirty cow roots list
+
+From: Filipe Manana <fdmanana@suse.com>
+
+commit b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 upstream.
+
+When disabling quotas we are deleting the quota root from the list
+fs_info->dirty_cowonly_roots without taking the lock that protects it,
+which is struct btrfs_fs_info::trans_lock. This unsynchronized list
+manipulation may cause chaos if there's another concurrent manipulation
+of this list, such as when adding a root to it with
+ctree.c:add_root_to_dirty_list().
+
+This can result in all sorts of weird failures caused by a race, such as
+the following crash:
+
+ [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
+ [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1
+ [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
+ [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
+ [337571.279928] Code: 85 38 06 00 (...)
+ [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
+ [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
+ [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
+ [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
+ [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
+ [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
+ [337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
+ [337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
+ [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [337571.282874] Call Trace:
+ [337571.283101] <TASK>
+ [337571.283327] ? __die_body+0x1b/0x60
+ [337571.283570] ? die_addr+0x39/0x60
+ [337571.283796] ? exc_general_protection+0x22e/0x430
+ [337571.284022] ? asm_exc_general_protection+0x22/0x30
+ [337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs]
+ [337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs]
+ [337571.284803] ? _raw_spin_unlock+0x15/0x30
+ [337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs]
+ [337571.285305] reset_balance_state+0x152/0x1b0 [btrfs]
+ [337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs]
+ [337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410
+ [337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs]
+ [337571.286358] ? mod_objcg_state+0xd2/0x360
+ [337571.286577] ? refill_obj_stock+0xb0/0x160
+ [337571.286798] ? seq_release+0x25/0x30
+ [337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0
+ [337571.287235] ? percpu_counter_add_batch+0x2e/0xa0
+ [337571.287455] ? __x64_sys_ioctl+0x88/0xc0
+ [337571.287675] __x64_sys_ioctl+0x88/0xc0
+ [337571.287901] do_syscall_64+0x38/0x90
+ [337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc
+ [337571.288352] RIP: 0033:0x7f478aaffe9b
+
+So fix this by locking struct btrfs_fs_info::trans_lock before deleting
+the quota root from that list.
+
+Fixes: bed92eae26cc ("Btrfs: qgroup implementation and prototypes")
+CC: stable@vger.kernel.org # 4.14+
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/qgroup.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1301,7 +1301,9 @@ int btrfs_quota_disable(struct btrfs_fs_
+ goto out;
+ }
+
++ spin_lock(&fs_info->trans_lock);
+ list_del("a_root->dirty_list);
++ spin_unlock(&fs_info->trans_lock);
+
+ btrfs_tree_lock(quota_root->node);
+ btrfs_clear_buffer_dirty(trans, quota_root->node);
--- /dev/null
+From 5cead5422a0e3d13b0bcee986c0f5c4ebb94100b Mon Sep 17 00:00:00 2001
+From: Boris Burkov <boris@bur.io>
+Date: Thu, 1 Jun 2023 11:55:14 -0700
+Subject: btrfs: insert tree mod log move in push_node_left
+
+From: Boris Burkov <boris@bur.io>
+
+commit 5cead5422a0e3d13b0bcee986c0f5c4ebb94100b upstream.
+
+There is a fairly unlikely race condition in tree mod log rewind that
+can result in a kernel panic which has the following trace:
+
+ [530.569] BTRFS critical (device sda3): unable to find logical 0 length 4096
+ [530.585] BTRFS critical (device sda3): unable to find logical 0 length 4096
+ [530.602] BUG: kernel NULL pointer dereference, address: 0000000000000002
+ [530.618] #PF: supervisor read access in kernel mode
+ [530.629] #PF: error_code(0x0000) - not-present page
+ [530.641] PGD 0 P4D 0
+ [530.647] Oops: 0000 [#1] SMP
+ [530.654] CPU: 30 PID: 398973 Comm: below Kdump: loaded Tainted: G S O K 5.12.0-0_fbk13_clang_7455_gb24de3bdb045 #1
+ [530.680] Hardware name: Quanta Mono Lake-M.2 SATA 1HY9U9Z001G/Mono Lake-M.2 SATA, BIOS F20_3A15 08/16/2017
+ [530.703] RIP: 0010:__btrfs_map_block+0xaa/0xd00
+ [530.755] RSP: 0018:ffffc9002c2f7600 EFLAGS: 00010246
+ [530.767] RAX: ffffffffffffffea RBX: ffff888292e41000 RCX: f2702d8b8be15100
+ [530.784] RDX: ffff88885fda6fb8 RSI: ffff88885fd973c8 RDI: ffff88885fd973c8
+ [530.800] RBP: ffff888292e410d0 R08: ffffffff82fd7fd0 R09: 00000000fffeffff
+ [530.816] R10: ffffffff82e57fd0 R11: ffffffff82e57d70 R12: 0000000000000000
+ [530.832] R13: 0000000000001000 R14: 0000000000001000 R15: ffffc9002c2f76f0
+ [530.848] FS: 00007f38d64af000(0000) GS:ffff88885fd80000(0000) knlGS:0000000000000000
+ [530.866] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ [530.880] CR2: 0000000000000002 CR3: 00000002b6770004 CR4: 00000000003706e0
+ [530.896] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ [530.912] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
+ [530.928] Call Trace:
+ [530.934] ? btrfs_printk+0x13b/0x18c
+ [530.943] ? btrfs_bio_counter_inc_blocked+0x3d/0x130
+ [530.955] btrfs_map_bio+0x75/0x330
+ [530.963] ? kmem_cache_alloc+0x12a/0x2d0
+ [530.973] ? btrfs_submit_metadata_bio+0x63/0x100
+ [530.984] btrfs_submit_metadata_bio+0xa4/0x100
+ [530.995] submit_extent_page+0x30f/0x360
+ [531.004] read_extent_buffer_pages+0x49e/0x6d0
+ [531.015] ? submit_extent_page+0x360/0x360
+ [531.025] btree_read_extent_buffer_pages+0x5f/0x150
+ [531.037] read_tree_block+0x37/0x60
+ [531.046] read_block_for_search+0x18b/0x410
+ [531.056] btrfs_search_old_slot+0x198/0x2f0
+ [531.066] resolve_indirect_ref+0xfe/0x6f0
+ [531.076] ? ulist_alloc+0x31/0x60
+ [531.084] ? kmem_cache_alloc_trace+0x12e/0x2b0
+ [531.095] find_parent_nodes+0x720/0x1830
+ [531.105] ? ulist_alloc+0x10/0x60
+ [531.113] iterate_extent_inodes+0xea/0x370
+ [531.123] ? btrfs_previous_extent_item+0x8f/0x110
+ [531.134] ? btrfs_search_path_in_tree+0x240/0x240
+ [531.146] iterate_inodes_from_logical+0x98/0xd0
+ [531.157] ? btrfs_search_path_in_tree+0x240/0x240
+ [531.168] btrfs_ioctl_logical_to_ino+0xd9/0x180
+ [531.179] btrfs_ioctl+0xe2/0x2eb0
+
+This occurs when logical inode resolution takes a tree mod log sequence
+number, and then while backref walking hits a rewind on a busy node
+which has the following sequence of tree mod log operations (numbers
+filled in from a specific example, but they are somewhat arbitrary)
+
+ REMOVE_WHILE_FREEING slot 532
+ REMOVE_WHILE_FREEING slot 531
+ REMOVE_WHILE_FREEING slot 530
+ ...
+ REMOVE_WHILE_FREEING slot 0
+ REMOVE slot 455
+ REMOVE slot 454
+ REMOVE slot 453
+ ...
+ REMOVE slot 0
+ ADD slot 455
+ ADD slot 454
+ ADD slot 453
+ ...
+ ADD slot 0
+ MOVE src slot 0 -> dst slot 456 nritems 533
+ REMOVE slot 455
+ REMOVE slot 454
+ REMOVE slot 453
+ ...
+ REMOVE slot 0
+
+When this sequence gets applied via btrfs_tree_mod_log_rewind, it
+allocates a fresh rewind eb, and first inserts the correct key info for
+the 533 elements, then overwrites the first 456 of them, then decrements
+the count by 456 via the add ops, then rewinds the move by doing a
+memmove from 456:988->0:532. We have never written anything past 532, so
+that memmove writes garbage into the 0:532 range. In practice, this
+results in a lot of fully 0 keys. The rewind then puts valid keys into
+slots 0:455 with the last removes, but 456:532 are still invalid.
+
+When search_old_slot uses this eb, if it uses one of those invalid
+slots, it can then read the extent buffer and issue a bio for offset 0
+which ultimately panics looking up extent mappings.
+
+This bad tree mod log sequence gets generated when the node balancing
+code happens to do a balance_node_right followed by a push_node_left
+while logging in the tree mod log. Illustrated for ebs L and R (left and
+right):
+
+ L R
+ start:
+ [XXX|YYY|...] [ZZZ|...|...]
+ balance_node_right:
+ [XXX|YYY|...] [...|ZZZ|...] move Z to make room for Y
+ [XXX|...|...] [YYY|ZZZ|...] copy Y from L to R
+ push_node_left:
+ [XXX|YYY|...] [...|ZZZ|...] copy Y from R to L
+ [XXX|YYY|...] [ZZZ|...|...] move Z into emptied space (NOT LOGGED!)
+
+This is because balance_node_right logs a move, but push_node_left
+explicitly doesn't. That is because logging the move would remove the
+overwritten src < dst range in the right eb, which was already logged
+when we called btrfs_tree_mod_log_eb_copy. The correct sequence would
+include a move from 456:988 to 0:532 after remove 0:455 and before
+removing 0:532. Reversing that sequence would entail creating keys for
+0:532, then moving those keys out to 456:988, then creating more keys
+for 0:455.
+
+i.e.,
+
+ REMOVE_WHILE_FREEING slot 532
+ REMOVE_WHILE_FREEING slot 531
+ REMOVE_WHILE_FREEING slot 530
+ ...
+ REMOVE_WHILE_FREEING slot 0
+ MOVE src slot 456 -> dst slot 0 nritems 533
+ REMOVE slot 455
+ REMOVE slot 454
+ REMOVE slot 453
+ ...
+ REMOVE slot 0
+ ADD slot 455
+ ADD slot 454
+ ADD slot 453
+ ...
+ ADD slot 0
+ MOVE src slot 0 -> dst slot 456 nritems 533
+ REMOVE slot 455
+ REMOVE slot 454
+ REMOVE slot 453
+ ...
+ REMOVE slot 0
+
+Fix this to log the move but avoid the double remove by putting all the
+logging logic in btrfs_tree_mod_log_eb_copy which has enough information
+to detect these cases and properly log moves, removes, and adds. Leave
+btrfs_tree_mod_log_insert_move to handle insert_ptr and delete_ptr's
+tree mod logging.
+
+(Un)fortunately, this is quite difficult to reproduce, and I was only
+able to reproduce it by adding sleeps in btrfs_search_old_slot that
+would encourage more log rewinding during ino_to_logical ioctls. I was
+able to hit the warning in the previous patch in the series without the
+fix quite quickly, but not after this patch.
+
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/ctree.c | 11 ++++---
+ fs/btrfs/tree-mod-log.c | 73 ++++++++++++++++++++++++++++++++++++++++++------
+ 2 files changed, 71 insertions(+), 13 deletions(-)
+
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -2714,8 +2714,8 @@ static int push_node_left(struct btrfs_t
+
+ if (push_items < src_nritems) {
+ /*
+- * Don't call btrfs_tree_mod_log_insert_move() here, key removal
+- * was already fully logged by btrfs_tree_mod_log_eb_copy() above.
++ * btrfs_tree_mod_log_eb_copy handles logging the move, so we
++ * don't need to do an explicit tree mod log operation for it.
+ */
+ memmove_extent_buffer(src, btrfs_node_key_ptr_offset(src, 0),
+ btrfs_node_key_ptr_offset(src, push_items),
+@@ -2776,8 +2776,11 @@ static int balance_node_right(struct btr
+ btrfs_abort_transaction(trans, ret);
+ return ret;
+ }
+- ret = btrfs_tree_mod_log_insert_move(dst, push_items, 0, dst_nritems);
+- BUG_ON(ret < 0);
++
++ /*
++ * btrfs_tree_mod_log_eb_copy handles logging the move, so we don't
++ * need to do an explicit tree mod log operation for it.
++ */
+ memmove_extent_buffer(dst, btrfs_node_key_ptr_offset(dst, push_items),
+ btrfs_node_key_ptr_offset(dst, 0),
+ (dst_nritems) *
+--- a/fs/btrfs/tree-mod-log.c
++++ b/fs/btrfs/tree-mod-log.c
+@@ -248,6 +248,26 @@ int btrfs_tree_mod_log_insert_key(struct
+ return ret;
+ }
+
++static struct tree_mod_elem *tree_mod_log_alloc_move(struct extent_buffer *eb,
++ int dst_slot, int src_slot,
++ int nr_items)
++{
++ struct tree_mod_elem *tm;
++
++ tm = kzalloc(sizeof(*tm), GFP_NOFS);
++ if (!tm)
++ return ERR_PTR(-ENOMEM);
++
++ tm->logical = eb->start;
++ tm->slot = src_slot;
++ tm->move.dst_slot = dst_slot;
++ tm->move.nr_items = nr_items;
++ tm->op = BTRFS_MOD_LOG_MOVE_KEYS;
++ RB_CLEAR_NODE(&tm->node);
++
++ return tm;
++}
++
+ int btrfs_tree_mod_log_insert_move(struct extent_buffer *eb,
+ int dst_slot, int src_slot,
+ int nr_items)
+@@ -265,18 +285,13 @@ int btrfs_tree_mod_log_insert_move(struc
+ if (!tm_list)
+ return -ENOMEM;
+
+- tm = kzalloc(sizeof(*tm), GFP_NOFS);
+- if (!tm) {
+- ret = -ENOMEM;
++ tm = tree_mod_log_alloc_move(eb, dst_slot, src_slot, nr_items);
++ if (IS_ERR(tm)) {
++ ret = PTR_ERR(tm);
++ tm = NULL;
+ goto free_tms;
+ }
+
+- tm->logical = eb->start;
+- tm->slot = src_slot;
+- tm->move.dst_slot = dst_slot;
+- tm->move.nr_items = nr_items;
+- tm->op = BTRFS_MOD_LOG_MOVE_KEYS;
+-
+ for (i = 0; i + dst_slot < src_slot && i < nr_items; i++) {
+ tm_list[i] = alloc_tree_mod_elem(eb, i + dst_slot,
+ BTRFS_MOD_LOG_KEY_REMOVE_WHILE_MOVING);
+@@ -489,6 +504,10 @@ int btrfs_tree_mod_log_eb_copy(struct ex
+ struct tree_mod_elem **tm_list_add, **tm_list_rem;
+ int i;
+ bool locked = false;
++ struct tree_mod_elem *dst_move_tm = NULL;
++ struct tree_mod_elem *src_move_tm = NULL;
++ u32 dst_move_nr_items = btrfs_header_nritems(dst) - dst_offset;
++ u32 src_move_nr_items = btrfs_header_nritems(src) - (src_offset + nr_items);
+
+ if (!tree_mod_need_log(fs_info, NULL))
+ return 0;
+@@ -501,6 +520,26 @@ int btrfs_tree_mod_log_eb_copy(struct ex
+ if (!tm_list)
+ return -ENOMEM;
+
++ if (dst_move_nr_items) {
++ dst_move_tm = tree_mod_log_alloc_move(dst, dst_offset + nr_items,
++ dst_offset, dst_move_nr_items);
++ if (IS_ERR(dst_move_tm)) {
++ ret = PTR_ERR(dst_move_tm);
++ dst_move_tm = NULL;
++ goto free_tms;
++ }
++ }
++ if (src_move_nr_items) {
++ src_move_tm = tree_mod_log_alloc_move(src, src_offset,
++ src_offset + nr_items,
++ src_move_nr_items);
++ if (IS_ERR(src_move_tm)) {
++ ret = PTR_ERR(src_move_tm);
++ src_move_tm = NULL;
++ goto free_tms;
++ }
++ }
++
+ tm_list_add = tm_list;
+ tm_list_rem = tm_list + nr_items;
+ for (i = 0; i < nr_items; i++) {
+@@ -523,6 +562,11 @@ int btrfs_tree_mod_log_eb_copy(struct ex
+ goto free_tms;
+ locked = true;
+
++ if (dst_move_tm) {
++ ret = tree_mod_log_insert(fs_info, dst_move_tm);
++ if (ret)
++ goto free_tms;
++ }
+ for (i = 0; i < nr_items; i++) {
+ ret = tree_mod_log_insert(fs_info, tm_list_rem[i]);
+ if (ret)
+@@ -531,6 +575,11 @@ int btrfs_tree_mod_log_eb_copy(struct ex
+ if (ret)
+ goto free_tms;
+ }
++ if (src_move_tm) {
++ ret = tree_mod_log_insert(fs_info, src_move_tm);
++ if (ret)
++ goto free_tms;
++ }
+
+ write_unlock(&fs_info->tree_mod_log_lock);
+ kfree(tm_list);
+@@ -538,6 +587,12 @@ int btrfs_tree_mod_log_eb_copy(struct ex
+ return 0;
+
+ free_tms:
++ if (dst_move_tm && !RB_EMPTY_NODE(&dst_move_tm->node))
++ rb_erase(&dst_move_tm->node, &fs_info->tree_mod_log);
++ kfree(dst_move_tm);
++ if (src_move_tm && !RB_EMPTY_NODE(&src_move_tm->node))
++ rb_erase(&src_move_tm->node, &fs_info->tree_mod_log);
++ kfree(src_move_tm);
+ for (i = 0; i < nr_items * 2; i++) {
+ if (tm_list[i] && !RB_EMPTY_NODE(&tm_list[i]->node))
+ rb_erase(&tm_list[i]->node, &fs_info->tree_mod_log);
--- /dev/null
+From a9f189716cf15913c453299d72f69c51a9b0f86b Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naota@elisp.net>
+Date: Tue, 6 Jun 2023 14:36:34 +0900
+Subject: btrfs: move out now unused BG from the reclaim list
+
+From: Naohiro Aota <naota@elisp.net>
+
+commit a9f189716cf15913c453299d72f69c51a9b0f86b upstream.
+
+An unused block group is easy to remove to free up space and should be
+reclaimed fast. Such block group can often already be a target of the
+reclaim process. As we check list_empty(&bg->bg_list), we keep it in the
+reclaim list. That block group is never reclaimed until the file system
+is filled e.g. up to 75%.
+
+Instead, we can move unused block group to the unused list and delete it
+fast.
+
+Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1640,11 +1640,14 @@ void btrfs_mark_bg_unused(struct btrfs_b
+ {
+ struct btrfs_fs_info *fs_info = bg->fs_info;
+
++ trace_btrfs_add_unused_block_group(bg);
+ spin_lock(&fs_info->unused_bgs_lock);
+ if (list_empty(&bg->bg_list)) {
+ btrfs_get_block_group(bg);
+- trace_btrfs_add_unused_block_group(bg);
+ list_add_tail(&bg->bg_list, &fs_info->unused_bgs);
++ } else {
++ /* Pull out the block group from the reclaim_bgs list. */
++ list_move_tail(&bg->bg_list, &fs_info->unused_bgs);
+ }
+ spin_unlock(&fs_info->unused_bgs_lock);
+ }
--- /dev/null
+From 7e27180994383b7c741ad87749db01e4989a02ba Mon Sep 17 00:00:00 2001
+From: Naohiro Aota <naota@elisp.net>
+Date: Tue, 6 Jun 2023 14:36:36 +0900
+Subject: btrfs: reinsert BGs failed to reclaim
+
+From: Naohiro Aota <naota@elisp.net>
+
+commit 7e27180994383b7c741ad87749db01e4989a02ba upstream.
+
+The reclaim process can temporarily fail. For example, if the space is
+getting tight, it fails to make the block group read-only. If there are no
+further writes on that block group, the block group will never get back to
+the reclaim list, and the BG never gets reclaimed. In a certain workload,
+we can leave many such block groups never reclaimed.
+
+So, let's get it back to the list and give it a chance to be reclaimed.
+
+Fixes: 18bb8bbf13c1 ("btrfs: zoned: automatically reclaim zones")
+CC: stable@vger.kernel.org # 5.15+
+Signed-off-by: Naohiro Aota <naohiro.aota@wdc.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/block-group.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -1837,6 +1837,8 @@ void btrfs_reclaim_bgs_work(struct work_
+ }
+
+ next:
++ if (ret)
++ btrfs_mark_bg_to_reclaim(bg);
+ btrfs_put_block_group(bg);
+
+ mutex_unlock(&fs_info->reclaim_bgs_lock);
--- /dev/null
+From 95c8e349d8e8f190e28854e7ca96de866d2dc5a4 Mon Sep 17 00:00:00 2001
+From: Boris Burkov <boris@bur.io>
+Date: Thu, 1 Jun 2023 11:55:13 -0700
+Subject: btrfs: warn on invalid slot in tree mod log rewind
+
+From: Boris Burkov <boris@bur.io>
+
+commit 95c8e349d8e8f190e28854e7ca96de866d2dc5a4 upstream.
+
+The way that tree mod log tracks the ultimate length of the eb, the
+variable 'n', eventually turns up the correct value, but at intermediate
+steps during the rewind, n can be inaccurate as a representation of the
+end of the eb. For example, it doesn't get updated on move rewinds, and
+it does get updated for add/remove in the middle of the eb.
+
+To detect cases with invalid moves, introduce a separate variable called
+max_slot which tries to track the maximum valid slot in the rewind eb.
+We can then warn if we do a move whose src range goes beyond the max
+valid slot.
+
+There is a commented caveat that it is possible to have this value be an
+overestimate due to the challenge of properly handling 'add' operations
+in the middle of the eb, but in practice it doesn't cause enough of a
+problem to throw out the max idea in favor of tracking every valid slot.
+
+CC: stable@vger.kernel.org # 5.15+
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Signed-off-by: Boris Burkov <boris@bur.io>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/tree-mod-log.c | 42 ++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 42 insertions(+)
+
+--- a/fs/btrfs/tree-mod-log.c
++++ b/fs/btrfs/tree-mod-log.c
+@@ -719,10 +719,27 @@ static void tree_mod_log_rewind(struct b
+ unsigned long o_dst;
+ unsigned long o_src;
+ unsigned long p_size = sizeof(struct btrfs_key_ptr);
++ /*
++ * max_slot tracks the maximum valid slot of the rewind eb at every
++ * step of the rewind. This is in contrast with 'n' which eventually
++ * matches the number of items, but can be wrong during moves or if
++ * removes overlap on already valid slots (which is probably separately
++ * a bug). We do this to validate the offsets of memmoves for rewinding
++ * moves and detect invalid memmoves.
++ *
++ * Since a rewind eb can start empty, max_slot is a signed integer with
++ * a special meaning for -1, which is that no slot is valid to move out
++ * of. Any other negative value is invalid.
++ */
++ int max_slot;
++ int move_src_end_slot;
++ int move_dst_end_slot;
+
+ n = btrfs_header_nritems(eb);
++ max_slot = n - 1;
+ read_lock(&fs_info->tree_mod_log_lock);
+ while (tm && tm->seq >= time_seq) {
++ ASSERT(max_slot >= -1);
+ /*
+ * All the operations are recorded with the operator used for
+ * the modification. As we're going backwards, we do the
+@@ -739,6 +756,8 @@ static void tree_mod_log_rewind(struct b
+ btrfs_set_node_ptr_generation(eb, tm->slot,
+ tm->generation);
+ n++;
++ if (tm->slot > max_slot)
++ max_slot = tm->slot;
+ break;
+ case BTRFS_MOD_LOG_KEY_REPLACE:
+ BUG_ON(tm->slot >= n);
+@@ -748,14 +767,37 @@ static void tree_mod_log_rewind(struct b
+ tm->generation);
+ break;
+ case BTRFS_MOD_LOG_KEY_ADD:
++ /*
++ * It is possible we could have already removed keys
++ * behind the known max slot, so this will be an
++ * overestimate. In practice, the copy operation
++ * inserts them in increasing order, and overestimating
++ * just means we miss some warnings, so it's OK. It
++ * isn't worth carefully tracking the full array of
++ * valid slots to check against when moving.
++ */
++ if (tm->slot == max_slot)
++ max_slot--;
+ /* if a move operation is needed it's in the log */
+ n--;
+ break;
+ case BTRFS_MOD_LOG_MOVE_KEYS:
++ ASSERT(tm->move.nr_items > 0);
++ move_src_end_slot = tm->move.dst_slot + tm->move.nr_items - 1;
++ move_dst_end_slot = tm->slot + tm->move.nr_items - 1;
+ o_dst = btrfs_node_key_ptr_offset(eb, tm->slot);
+ o_src = btrfs_node_key_ptr_offset(eb, tm->move.dst_slot);
++ if (WARN_ON(move_src_end_slot > max_slot ||
++ tm->move.nr_items <= 0)) {
++ btrfs_warn(fs_info,
++"move from invalid tree mod log slot eb %llu slot %d dst_slot %d nr_items %d seq %llu n %u max_slot %d",
++ eb->start, tm->slot,
++ tm->move.dst_slot, tm->move.nr_items,
++ tm->seq, n, max_slot);
++ }
+ memmove_extent_buffer(eb, o_dst, o_src,
+ tm->move.nr_items * p_size);
++ max_slot = move_dst_end_slot;
+ break;
+ case BTRFS_MOD_LOG_ROOT_REPLACE:
+ /*
--- /dev/null
+From cee4bd16c3195a701be683f7da9e88c6e11acb73 Mon Sep 17 00:00:00 2001
+From: Christian Marangi <ansuelsmth@gmail.com>
+Date: Wed, 19 Apr 2023 23:07:39 +0200
+Subject: leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
+
+From: Christian Marangi <ansuelsmth@gmail.com>
+
+commit cee4bd16c3195a701be683f7da9e88c6e11acb73 upstream.
+
+Dev can be renamed also while up for supported device. We currently
+wrongly clear the NETDEV_LED_MODE_LINKUP flag on NETDEV_CHANGENAME
+event.
+
+Fix this by rechecking if the carrier is ok on NETDEV_CHANGENAME and
+correctly set the NETDEV_LED_MODE_LINKUP bit.
+
+Fixes: 5f820ed52371 ("leds: trigger: netdev: fix handling on interface rename")
+Cc: stable@vger.kernel.org # v5.5+
+Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Lee Jones <lee@kernel.org>
+Link: https://lore.kernel.org/r/20230419210743.3594-2-ansuelsmth@gmail.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/leds/trigger/ledtrig-netdev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/leds/trigger/ledtrig-netdev.c
++++ b/drivers/leds/trigger/ledtrig-netdev.c
+@@ -318,6 +318,9 @@ static int netdev_trig_notify(struct not
+ clear_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
+ switch (evt) {
+ case NETDEV_CHANGENAME:
++ if (netif_carrier_ok(dev))
++ set_bit(NETDEV_LED_MODE_LINKUP, &trigger_data->mode);
++ fallthrough;
+ case NETDEV_REGISTER:
+ if (trigger_data->net_dev)
+ dev_put(trigger_data->net_dev);
--- /dev/null
+From f050e56de80591fee55bedbdf5b6b998c740cd0c Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Date: Sun, 7 May 2023 16:46:56 +0200
+Subject: regulator: tps65219: Fix matching interrupts for their regulators
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+
+commit f050e56de80591fee55bedbdf5b6b998c740cd0c upstream.
+
+The driver's probe() first registers regulators in a loop and then in a
+second loop passes them as irq data to the interrupt handlers. However
+the function to get the regulator for given name
+tps65219_get_rdev_by_name() was a no-op due to argument passed by value,
+not pointer, thus the second loop assigned always same value - from
+previous loop. The interrupts, when fired, where executed with wrong
+data. Compiler also noticed it:
+
+ drivers/regulator/tps65219-regulator.c: In function ‘tps65219_get_rdev_by_name’:
+ drivers/regulator/tps65219-regulator.c:292:60: error: parameter ‘dev’ set but not used [-Werror=unused-but-set-parameter]
+
+Fixes: c12ac5fc3e0a ("regulator: drivers: Add TI TPS65219 PMIC regulators support")
+Cc: <stable@vger.kernel.org
+Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org
+Reviewed-by: Markus Schneider-Pargmann <msp@baylibre.com
+Link: https://lore.kernel.org/r/20230507144656.192800-1-krzysztof.kozlowski@linaro.org
+Signed-off-by: Mark Brown <broonie@kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/regulator/tps65219-regulator.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/regulator/tps65219-regulator.c
++++ b/drivers/regulator/tps65219-regulator.c
+@@ -289,13 +289,13 @@ static irqreturn_t tps65219_regulator_ir
+
+ static int tps65219_get_rdev_by_name(const char *regulator_name,
+ struct regulator_dev *rdevtbl[7],
+- struct regulator_dev *dev)
++ struct regulator_dev **dev)
+ {
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(regulators); i++) {
+ if (strcmp(regulator_name, regulators[i].name) == 0) {
+- dev = rdevtbl[i];
++ *dev = rdevtbl[i];
+ return 0;
+ }
+ }
+@@ -348,7 +348,7 @@ static int tps65219_regulator_probe(stru
+ irq_data[i].dev = tps->dev;
+ irq_data[i].type = irq_type;
+
+- tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, rdev);
++ tps65219_get_rdev_by_name(irq_type->regulator_name, rdevtbl, &rdev);
+ if (IS_ERR(rdev)) {
+ dev_err(tps->dev, "Failed to get rdev for %s\n",
+ irq_type->regulator_name);
fs-lock-moved-directories.patch
usb-typec-ucsi-mark-dgpus-as-device-scope.patch
ipvs-increase-ip_vs_conn_tab_bits-range-for-64bit.patch
+btrfs-add-handling-for-raid1c23-dup-to-btrfs_reduce_alloc_profile.patch
+btrfs-fix-dirty_metadata_bytes-for-redirtied-buffers.patch
+btrfs-insert-tree-mod-log-move-in-push_node_left.patch
+btrfs-warn-on-invalid-slot-in-tree-mod-log-rewind.patch
+btrfs-delete-unused-bgs-while-reclaiming-bgs.patch
+btrfs-bail-out-reclaim-process-if-filesystem-is-read-only.patch
+btrfs-add-block-group-tree-to-lockdep-classes.patch
+btrfs-reinsert-bgs-failed-to-reclaim.patch
+btrfs-move-out-now-unused-bg-from-the-reclaim-list.patch
+btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch
+btrfs-add-missing-error-handling-when-logging-operation-while-cowing-extent-buffer.patch
+btrfs-fix-extent-buffer-leak-after-tree-mod-log-failure-at-split_node.patch
+btrfs-do-not-bug_on-on-tree-mod-log-failure-at-__btrfs_cow_block.patch
+asoc-mediatek-mt8173-fix-irq-error-path.patch
+asoc-mediatek-mt8173-fix-snd_soc_component_initialize-error-path.patch
+regulator-tps65219-fix-matching-interrupts-for-their-regulators.patch
+arm-dts-qcom-msm8660-fix-regulator-node-names.patch
+arm-dts-qcom-ipq4019-fix-broken-nand-controller-properties-override.patch
+arm-orion5x-fix-d2net-gpio-initialization.patch
+leds-trigger-netdev-recheck-netdev_led_mode_linkup-on-dev-rename.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
