From: Greg Kroah-Hartman Date: Sat, 16 Sep 2023 12:29:35 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.10.195~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=15dc913c31c1065a3bccc785bc2605de8b21edd1;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: btrfs-don-t-start-transaction-when-joining-with-trans_join_nostart.patch mtd-rawnand-brcmnand-fix-crash-during-the-panic_write.patch mtd-rawnand-brcmnand-fix-potential-false-time-out-warning.patch mtd-rawnand-brcmnand-fix-potential-out-of-bounds-access-in-oob-write.patch perf-hists-browser-fix-hierarchy-mode-header.patch --- diff --git a/queue-4.19/btrfs-don-t-start-transaction-when-joining-with-trans_join_nostart.patch b/queue-4.19/btrfs-don-t-start-transaction-when-joining-with-trans_join_nostart.patch new file mode 100644 index 00000000000..74af2633c28 --- /dev/null +++ b/queue-4.19/btrfs-don-t-start-transaction-when-joining-with-trans_join_nostart.patch @@ -0,0 +1,43 @@ +From 4490e803e1fe9fab8db5025e44e23b55df54078b Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Wed, 26 Jul 2023 16:56:57 +0100 +Subject: btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART + +From: Filipe Manana + +commit 4490e803e1fe9fab8db5025e44e23b55df54078b upstream. + +When joining a transaction with TRANS_JOIN_NOSTART, if we don't find a +running transaction we end up creating one. This goes against the purpose +of TRANS_JOIN_NOSTART which is to join a running transaction if its state +is at or below the state TRANS_STATE_COMMIT_START, otherwise return an +-ENOENT error and don't start a new transaction. So fix this to not create +a new transaction if there's no running transaction at or below that +state. + +CC: stable@vger.kernel.org # 4.14+ +Fixes: a6d155d2e363 ("Btrfs: fix deadlock between fiemap and transaction commits") +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/transaction.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -200,10 +200,11 @@ loop: + spin_unlock(&fs_info->trans_lock); + + /* +- * If we are ATTACH, we just want to catch the current transaction, +- * and commit it. If there is no transaction, just return ENOENT. ++ * If we are ATTACH or TRANS_JOIN_NOSTART, we just want to catch the ++ * current transaction, and commit it. If there is no transaction, just ++ * return ENOENT. + */ +- if (type == TRANS_ATTACH) ++ if (type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART) + return -ENOENT; + + /* diff --git a/queue-4.19/mtd-rawnand-brcmnand-fix-crash-during-the-panic_write.patch b/queue-4.19/mtd-rawnand-brcmnand-fix-crash-during-the-panic_write.patch new file mode 100644 index 00000000000..6fcee684544 --- /dev/null +++ b/queue-4.19/mtd-rawnand-brcmnand-fix-crash-during-the-panic_write.patch @@ -0,0 +1,47 @@ +From e66dd317194daae0475fe9e5577c80aa97f16cb9 Mon Sep 17 00:00:00 2001 +From: William Zhang +Date: Thu, 6 Jul 2023 11:29:07 -0700 +Subject: mtd: rawnand: brcmnand: Fix crash during the panic_write + +From: William Zhang + +commit e66dd317194daae0475fe9e5577c80aa97f16cb9 upstream. + +When executing a NAND command within the panic write path, wait for any +pending command instead of calling BUG_ON to avoid crashing while +already crashing. + +Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller") +Signed-off-by: William Zhang +Reviewed-by: Florian Fainelli +Reviewed-by: Kursad Oney +Reviewed-by: Kamal Dasu +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-4-william.zhang@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -1271,7 +1271,17 @@ static void brcmnand_send_cmd(struct brc + + dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr); + +- BUG_ON(ctrl->cmd_pending != 0); ++ /* ++ * If we came here through _panic_write and there is a pending ++ * command, try to wait for it. If it times out, rather than ++ * hitting BUG_ON, just return so we don't crash while crashing. ++ */ ++ if (oops_in_progress) { ++ if (ctrl->cmd_pending && ++ bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0)) ++ return; ++ } else ++ BUG_ON(ctrl->cmd_pending != 0); + ctrl->cmd_pending = cmd; + + ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0); diff --git a/queue-4.19/mtd-rawnand-brcmnand-fix-potential-false-time-out-warning.patch b/queue-4.19/mtd-rawnand-brcmnand-fix-potential-false-time-out-warning.patch new file mode 100644 index 00000000000..e6dedfc82d2 --- /dev/null +++ b/queue-4.19/mtd-rawnand-brcmnand-fix-potential-false-time-out-warning.patch @@ -0,0 +1,42 @@ +From 9cc0a598b944816f2968baf2631757f22721b996 Mon Sep 17 00:00:00 2001 +From: William Zhang +Date: Thu, 6 Jul 2023 11:29:06 -0700 +Subject: mtd: rawnand: brcmnand: Fix potential false time out warning + +From: William Zhang + +commit 9cc0a598b944816f2968baf2631757f22721b996 upstream. + +If system is busy during the command status polling function, the driver +may not get the chance to poll the status register till the end of time +out and return the premature status. Do a final check after time out +happens to ensure reading the correct status. + +Fixes: 9d2ee0a60b8b ("mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program") +Signed-off-by: William Zhang +Reviewed-by: Florian Fainelli +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-3-william.zhang@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -836,6 +836,14 @@ static int bcmnand_ctrl_poll_status(stru + cpu_relax(); + } while (time_after(limit, jiffies)); + ++ /* ++ * do a final check after time out in case the CPU was busy and the driver ++ * did not get enough time to perform the polling to avoid false alarms ++ */ ++ val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS); ++ if ((val & mask) == expected_val) ++ return 0; ++ + dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n", + expected_val, val & mask); + diff --git a/queue-4.19/mtd-rawnand-brcmnand-fix-potential-out-of-bounds-access-in-oob-write.patch b/queue-4.19/mtd-rawnand-brcmnand-fix-potential-out-of-bounds-access-in-oob-write.patch new file mode 100644 index 00000000000..cce8f67b851 --- /dev/null +++ b/queue-4.19/mtd-rawnand-brcmnand-fix-potential-out-of-bounds-access-in-oob-write.patch @@ -0,0 +1,64 @@ +From 5d53244186c9ac58cb88d76a0958ca55b83a15cd Mon Sep 17 00:00:00 2001 +From: William Zhang +Date: Thu, 6 Jul 2023 11:29:08 -0700 +Subject: mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write + +From: William Zhang + +commit 5d53244186c9ac58cb88d76a0958ca55b83a15cd upstream. + +When the oob buffer length is not in multiple of words, the oob write +function does out-of-bounds read on the oob source buffer at the last +iteration. Fix that by always checking length limit on the oob buffer +read and fill with 0xff when reaching the end of the buffer to the oob +registers. + +Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller") +Signed-off-by: William Zhang +Reviewed-by: Florian Fainelli +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-5-william.zhang@broadcom.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/brcmnand/brcmnand.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c +@@ -1213,19 +1213,33 @@ static int write_oob_to_regs(struct brcm + const u8 *oob, int sas, int sector_1k) + { + int tbytes = sas << sector_1k; +- int j; ++ int j, k = 0; ++ u32 last = 0xffffffff; ++ u8 *plast = (u8 *)&last; + + /* Adjust OOB values for 1K sector size */ + if (sector_1k && (i & 0x01)) + tbytes = max(0, tbytes - (int)ctrl->max_oob); + tbytes = min_t(int, tbytes, ctrl->max_oob); + +- for (j = 0; j < tbytes; j += 4) ++ /* ++ * tbytes may not be multiple of words. Make sure we don't read out of ++ * the boundary and stop at last word. ++ */ ++ for (j = 0; (j + 3) < tbytes; j += 4) + oob_reg_write(ctrl, j, + (oob[j + 0] << 24) | + (oob[j + 1] << 16) | + (oob[j + 2] << 8) | + (oob[j + 3] << 0)); ++ ++ /* handle the remaing bytes */ ++ while (j < tbytes) ++ plast[k++] = oob[j++]; ++ ++ if (tbytes & 0x3) ++ oob_reg_write(ctrl, (tbytes & ~0x3), (__force u32)cpu_to_be32(last)); ++ + return tbytes; + } + diff --git a/queue-4.19/perf-hists-browser-fix-hierarchy-mode-header.patch b/queue-4.19/perf-hists-browser-fix-hierarchy-mode-header.patch new file mode 100644 index 00000000000..884155c4761 --- /dev/null +++ b/queue-4.19/perf-hists-browser-fix-hierarchy-mode-header.patch @@ -0,0 +1,43 @@ +From e2cabf2a44791f01c21f8d5189b946926e34142e Mon Sep 17 00:00:00 2001 +From: Namhyung Kim +Date: Mon, 31 Jul 2023 02:49:32 -0700 +Subject: perf hists browser: Fix hierarchy mode header + +From: Namhyung Kim + +commit e2cabf2a44791f01c21f8d5189b946926e34142e upstream. + +The commit ef9ff6017e3c4593 ("perf ui browser: Move the extra title +lines from the hists browser") introduced ui_browser__gotorc_title() to +help moving non-title lines easily. But it missed to update the title +for the hierarchy mode so it won't print the header line on TUI at all. + + $ perf report --hierarchy + +Fixes: ef9ff6017e3c4593 ("perf ui browser: Move the extra title lines from the hists browser") +Signed-off-by: Namhyung Kim +Tested-by: Arnaldo Carvalho de Melo +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Peter Zijlstra +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230731094934.1616495-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/ui/browsers/hists.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/ui/browsers/hists.c ++++ b/tools/perf/ui/browsers/hists.c +@@ -1704,7 +1704,7 @@ static void hists_browser__hierarchy_hea + hists_browser__scnprintf_hierarchy_headers(browser, headers, + sizeof(headers)); + +- ui_browser__gotorc(&browser->b, 0, 0); ++ ui_browser__gotorc_title(&browser->b, 0, 0); + ui_browser__set_color(&browser->b, HE_COLORSET_ROOT); + ui_browser__write_nstring(&browser->b, headers, browser->b.width + 1); + } diff --git a/queue-4.19/series b/queue-4.19/series index a96c31c7aee..f996c7a8cff 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -221,3 +221,8 @@ idr-fix-param-name-in-idr_alloc_cyclic-doc.patch netfilter-nfnetlink_osf-avoid-oob-read.patch ata-sata_gemini-add-missing-module_description.patch ata-pata_ftide010-add-missing-module_description.patch +btrfs-don-t-start-transaction-when-joining-with-trans_join_nostart.patch +mtd-rawnand-brcmnand-fix-crash-during-the-panic_write.patch +mtd-rawnand-brcmnand-fix-potential-out-of-bounds-access-in-oob-write.patch +mtd-rawnand-brcmnand-fix-potential-false-time-out-warning.patch +perf-hists-browser-fix-hierarchy-mode-header.patch