6.6-stable patches

added patches:
	btrfs-handle-errors-from-btrfs_dec_ref-properly.patch
	kunit-overflow-fix-ub-in-overflow_allocation_test.patch

diff --git a/queue-6.6/btrfs-handle-errors-from-btrfs_dec_ref-properly.patch b/queue-6.6/btrfs-handle-errors-from-btrfs_dec_ref-properly.patch
new file mode 100644 (file)
index 0000000..a7d3652
--- /dev/null
+++ b/queue-6.6/btrfs-handle-errors-from-btrfs_dec_ref-properly.patch
@@ -0,0 +1,36 @@
+From 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 Mon Sep 17 00:00:00 2001
+From: Josef Bacik <josef@toxicpanda.com>
+Date: Tue, 7 May 2024 14:12:15 -0400
+Subject: btrfs: handle errors from btrfs_dec_ref() properly
+
+From: Josef Bacik <josef@toxicpanda.com>
+
+commit 5eb178f373b4f16f3b42d55ff88fc94dd95b93b1 upstream.
+
+In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref().  This is
+incorrect, we have proper error handling here, return the error.
+
+Signed-off-by: Josef Bacik <josef@toxicpanda.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/btrfs/extent-tree.c |    5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -5540,7 +5540,10 @@ static noinline int walk_up_proc(struct
+                               ret = btrfs_dec_ref(trans, root, eb, 1);
+                       else
+                               ret = btrfs_dec_ref(trans, root, eb, 0);
+-                      BUG_ON(ret); /* -ENOMEM */
++                      if (ret) {
++                              btrfs_abort_transaction(trans, ret);
++                              return ret;
++                      }
+                       if (is_fstree(root->root_key.objectid)) {
+                               ret = btrfs_qgroup_trace_leaf_items(trans, eb);
+                               if (ret) {

diff --git a/queue-6.6/kunit-overflow-fix-ub-in-overflow_allocation_test.patch b/queue-6.6/kunit-overflow-fix-ub-in-overflow_allocation_test.patch
new file mode 100644 (file)
index 0000000..d2ee4b8
--- /dev/null
+++ b/queue-6.6/kunit-overflow-fix-ub-in-overflow_allocation_test.patch
@@ -0,0 +1,48 @@
+From 92e9bac18124682c4b99ede9ee3bcdd68f121e92 Mon Sep 17 00:00:00 2001
+From: Ivan Orlov <ivan.orlov0322@gmail.com>
+Date: Thu, 15 Aug 2024 01:04:31 +0100
+Subject: kunit/overflow: Fix UB in overflow_allocation_test
+
+From: Ivan Orlov <ivan.orlov0322@gmail.com>
+
+commit 92e9bac18124682c4b99ede9ee3bcdd68f121e92 upstream.
+
+The 'device_name' array doesn't exist out of the
+'overflow_allocation_test' function scope. However, it is being used as
+a driver name when calling 'kunit_driver_create' from
+'kunit_device_register'. It produces the kernel panic with KASAN
+enabled.
+
+Since this variable is used in one place only, remove it and pass the
+device name into kunit_device_register directly as an ascii string.
+
+Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
+Reviewed-by: David Gow <davidgow@google.com>
+Link: https://lore.kernel.org/r/20240815000431.401869-1-ivan.orlov0322@gmail.com
+Signed-off-by: Kees Cook <kees@kernel.org>
+Signed-off-by: Jianqi Ren <jianqi.ren.cn@windriver.com>
+Signed-off-by: He Zhe <zhe.he@windriver.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/overflow_kunit.c |    3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/lib/overflow_kunit.c
++++ b/lib/overflow_kunit.c
+@@ -608,7 +608,6 @@ DEFINE_TEST_ALLOC(devm_kzalloc,  devm_kf
+ 
+ static void overflow_allocation_test(struct kunit *test)
+ {
+-      const char device_name[] = "overflow-test";
+       struct device *dev;
+       int count = 0;
+ 
+@@ -618,7 +617,7 @@ static void overflow_allocation_test(str
+ } while (0)
+ 
+       /* Create dummy device for devm_kmalloc()-family tests. */
+-      dev = root_device_register(device_name);
++      dev = root_device_register("overflow-test");
+       KUNIT_ASSERT_FALSE_MSG(test, IS_ERR(dev),
+                              "Cannot register test device\n");
+ 

diff --git a/queue-6.6/series b/queue-6.6/series
index bbff02ed1056f48f34397f28a42e73a2e7bf6236..2ab42b3a1ac949e06490e2a71095102d9a2694fb 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -239,3 +239,5 @@ platform-x86-isst-correct-command-storage-data-length.patch
 ntb_perf-delete-duplicate-dmaengine_unmap_put-call-in-perf_copy_chunk.patch
 perf-x86-intel-apply-static-call-for-drain_pebs.patch
 perf-x86-intel-avoid-disable-pmu-if-cpuc-enabled-in-sample-read.patch
+kunit-overflow-fix-ub-in-overflow_allocation_test.patch
+btrfs-handle-errors-from-btrfs_dec_ref-properly.patch