From: Greg Kroah-Hartman Date: Sun, 26 Oct 2025 14:36:36 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v5.4.301~41 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=29c954575dfaaff15c41523e380a6168cfcf00c9;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: mips-malta-fix-keyboard-resource-preventing-i8042-driver-from-registering.patch net-bonding-fix-possible-peer-notify-event-loss-or-dup-issue.patch net-ravb-ensure-memory-write-completes-before-ringing-tx-doorbell.patch net-usb-rtl8150-fix-frame-padding.patch ocfs2-clear-extent-cache-after-moving-defragmenting-extents.patch revert-cpuidle-menu-avoid-discarding-useful-information.patch --- diff --git a/queue-5.4/mips-malta-fix-keyboard-resource-preventing-i8042-driver-from-registering.patch b/queue-5.4/mips-malta-fix-keyboard-resource-preventing-i8042-driver-from-registering.patch new file mode 100644 index 0000000000..f4fbbb837c --- /dev/null +++ b/queue-5.4/mips-malta-fix-keyboard-resource-preventing-i8042-driver-from-registering.patch @@ -0,0 +1,65 @@ +From bf5570590a981d0659d0808d2d4bcda21b27a2a5 Mon Sep 17 00:00:00 2001 +From: "Maciej W. Rozycki" +Date: Tue, 21 Oct 2025 20:38:22 +0100 +Subject: MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej W. Rozycki + +commit bf5570590a981d0659d0808d2d4bcda21b27a2a5 upstream. + +MIPS Malta platform code registers the PCI southbridge legacy port I/O +PS/2 keyboard range as a standard resource marked as busy. It prevents +the i8042 driver from registering as it fails to claim the resource in +a call to i8042_platform_init(). Consequently PS/2 keyboard and mouse +devices cannot be used with this platform. + +Fix the issue by removing the busy marker from the standard reservation, +making the driver register successfully: + + serio: i8042 KBD port at 0x60,0x64 irq 1 + serio: i8042 AUX port at 0x60,0x64 irq 12 + +and the resource show up as expected among the legacy devices: + + 00000000-00ffffff : MSC PCI I/O + 00000000-0000001f : dma1 + 00000020-00000021 : pic1 + 00000040-0000005f : timer + 00000060-0000006f : keyboard + 00000060-0000006f : i8042 + 00000070-00000077 : rtc0 + 00000080-0000008f : dma page reg + 000000a0-000000a1 : pic2 + 000000c0-000000df : dma2 + [...] + +If the i8042 driver has not been configured, then the standard resource +will remain there preventing any conflicting dynamic assignment of this +PCI port I/O address range. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Maciej W. Rozycki +Signed-off-by: Bjorn Helgaas +Reviewed-by: Ilpo Järvinen +Acked-by: Thomas Bogendoerfer +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/alpine.DEB.2.21.2510211919240.8377@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/mti-malta/malta-setup.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/mips/mti-malta/malta-setup.c ++++ b/arch/mips/mti-malta/malta-setup.c +@@ -48,7 +48,7 @@ static struct resource standard_io_resou + .name = "keyboard", + .start = 0x60, + .end = 0x6f, +- .flags = IORESOURCE_IO | IORESOURCE_BUSY ++ .flags = IORESOURCE_IO + }, + { + .name = "dma page reg", diff --git a/queue-5.4/net-bonding-fix-possible-peer-notify-event-loss-or-dup-issue.patch b/queue-5.4/net-bonding-fix-possible-peer-notify-event-loss-or-dup-issue.patch new file mode 100644 index 0000000000..620f162afc --- /dev/null +++ b/queue-5.4/net-bonding-fix-possible-peer-notify-event-loss-or-dup-issue.patch @@ -0,0 +1,113 @@ +From 10843e1492e474c02b91314963161731fa92af91 Mon Sep 17 00:00:00 2001 +From: Tonghao Zhang +Date: Tue, 21 Oct 2025 13:09:33 +0800 +Subject: net: bonding: fix possible peer notify event loss or dup issue + +From: Tonghao Zhang + +commit 10843e1492e474c02b91314963161731fa92af91 upstream. + +If the send_peer_notif counter and the peer event notify are not synchronized. +It may cause problems such as the loss or dup of peer notify event. + +Before this patch: +- If should_notify_peers is true and the lock for send_peer_notif-- fails, peer + event may be sent again in next mii_monitor loop, because should_notify_peers + is still true. +- If should_notify_peers is true and the lock for send_peer_notif-- succeeded, + but the lock for peer event fails, the peer event will be lost. + +This patch locks the RTNL for send_peer_notif, events, and commit simultaneously. + +Fixes: 07a4ddec3ce9 ("bonding: add an option to specify a delay between peer notifications") +Cc: Jay Vosburgh +Cc: Andrew Lunn +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Cc: Hangbin Liu +Cc: Nikolay Aleksandrov +Cc: Vincent Bernat +Cc: +Signed-off-by: Tonghao Zhang +Acked-by: Jay Vosburgh +Link: https://patch.msgid.link/20251021050933.46412-1-tonghao@bamaicloud.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_main.c | 40 ++++++++++++++++++---------------------- + 1 file changed, 18 insertions(+), 22 deletions(-) + +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -2331,7 +2331,7 @@ static void bond_mii_monitor(struct work + { + struct bonding *bond = container_of(work, struct bonding, + mii_work.work); +- bool should_notify_peers = false; ++ bool should_notify_peers; + bool commit; + unsigned long delay; + struct slave *slave; +@@ -2343,30 +2343,33 @@ static void bond_mii_monitor(struct work + goto re_arm; + + rcu_read_lock(); ++ + should_notify_peers = bond_should_notify_peers(bond); + commit = !!bond_miimon_inspect(bond); +- if (bond->send_peer_notif) { +- rcu_read_unlock(); +- if (rtnl_trylock()) { +- bond->send_peer_notif--; +- rtnl_unlock(); +- } +- } else { +- rcu_read_unlock(); +- } + +- if (commit) { ++ rcu_read_unlock(); ++ ++ if (commit || bond->send_peer_notif) { + /* Race avoidance with bond_close cancel of workqueue */ + if (!rtnl_trylock()) { + delay = 1; +- should_notify_peers = false; + goto re_arm; + } + +- bond_for_each_slave(bond, slave, iter) { +- bond_commit_link_state(slave, BOND_SLAVE_NOTIFY_LATER); ++ if (commit) { ++ bond_for_each_slave(bond, slave, iter) { ++ bond_commit_link_state(slave, ++ BOND_SLAVE_NOTIFY_LATER); ++ } ++ bond_miimon_commit(bond); ++ } ++ ++ if (bond->send_peer_notif) { ++ bond->send_peer_notif--; ++ if (should_notify_peers) ++ call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, ++ bond->dev); + } +- bond_miimon_commit(bond); + + rtnl_unlock(); /* might sleep, hold no other locks */ + } +@@ -2374,13 +2377,6 @@ static void bond_mii_monitor(struct work + re_arm: + if (bond->params.miimon) + queue_delayed_work(bond->wq, &bond->mii_work, delay); +- +- if (should_notify_peers) { +- if (!rtnl_trylock()) +- return; +- call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, bond->dev); +- rtnl_unlock(); +- } + } + + static int bond_upper_dev_walk(struct net_device *upper, void *data) diff --git a/queue-5.4/net-ravb-ensure-memory-write-completes-before-ringing-tx-doorbell.patch b/queue-5.4/net-ravb-ensure-memory-write-completes-before-ringing-tx-doorbell.patch new file mode 100644 index 0000000000..2811c4cb9c --- /dev/null +++ b/queue-5.4/net-ravb-ensure-memory-write-completes-before-ringing-tx-doorbell.patch @@ -0,0 +1,52 @@ +From 706136c5723626fcde8dd8f598a4dcd251e24927 Mon Sep 17 00:00:00 2001 +From: Lad Prabhakar +Date: Fri, 17 Oct 2025 16:18:30 +0100 +Subject: net: ravb: Ensure memory write completes before ringing TX doorbell +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lad Prabhakar + +commit 706136c5723626fcde8dd8f598a4dcd251e24927 upstream. + +Add a final dma_wmb() barrier before triggering the transmit request +(TCCR_TSRQ) to ensure all descriptor and buffer writes are visible to +the DMA engine. + +According to the hardware manual, a read-back operation is required +before writing to the doorbell register to guarantee completion of +previous writes. Instead of performing a dummy read, a dma_wmb() is +used to both enforce the same ordering semantics on the CPU side and +also to ensure completion of writes. + +Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper") +Cc: stable@vger.kernel.org +Co-developed-by: Fabrizio Castro +Signed-off-by: Fabrizio Castro +Signed-off-by: Lad Prabhakar +Reviewed-by: Niklas Söderlund +Link: https://patch.msgid.link/20251017151830.171062-5-prabhakar.mahadev-lad.rj@bp.renesas.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/renesas/ravb_main.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -1602,6 +1602,14 @@ static netdev_tx_t ravb_start_xmit(struc + } else { + desc->die_dt = DT_FSINGLE; + } ++ ++ /* Before ringing the doorbell we need to make sure that the latest ++ * writes have been committed to memory, otherwise it could delay ++ * things until the doorbell is rang again. ++ * This is in replacement of the read operation mentioned in the HW ++ * manuals. ++ */ ++ dma_wmb(); + ravb_modify(ndev, TCCR, TCCR_TSRQ0 << q, TCCR_TSRQ0 << q); + + priv->cur_tx[q] += num_tx_desc; diff --git a/queue-5.4/net-usb-rtl8150-fix-frame-padding.patch b/queue-5.4/net-usb-rtl8150-fix-frame-padding.patch new file mode 100644 index 0000000000..be54d53772 --- /dev/null +++ b/queue-5.4/net-usb-rtl8150-fix-frame-padding.patch @@ -0,0 +1,54 @@ +From 75cea9860aa6b2350d90a8d78fed114d27c7eca2 Mon Sep 17 00:00:00 2001 +From: Michal Pecio +Date: Tue, 14 Oct 2025 20:35:28 +0200 +Subject: net: usb: rtl8150: Fix frame padding + +From: Michal Pecio + +commit 75cea9860aa6b2350d90a8d78fed114d27c7eca2 upstream. + +TX frames aren't padded and unknown memory is sent into the ether. + +Theoretically, it isn't even guaranteed that the extra memory exists +and can be sent out, which could cause further problems. In practice, +I found that plenty of tailroom exists in the skb itself (in my test +with ping at least) and skb_padto() easily succeeds, so use it here. + +In the event of -ENOMEM drop the frame like other drivers do. + +The use of one more padding byte instead of a USB zero-length packet +is retained to avoid regression. I have a dodgy Etron xHCI controller +which doesn't seem to support sending ZLPs at all. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Cc: stable@vger.kernel.org +Signed-off-by: Michal Pecio +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/20251014203528.3f9783c4.michal.pecio@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/rtl8150.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/rtl8150.c ++++ b/drivers/net/usb/rtl8150.c +@@ -705,9 +705,16 @@ static netdev_tx_t rtl8150_start_xmit(st + rtl8150_t *dev = netdev_priv(netdev); + int count, res; + ++ /* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */ ++ count = max(skb->len, ETH_ZLEN); ++ if (count % 64 == 0) ++ count++; ++ if (skb_padto(skb, count)) { ++ netdev->stats.tx_dropped++; ++ return NETDEV_TX_OK; ++ } ++ + netif_stop_queue(netdev); +- count = (skb->len < 60) ? 60 : skb->len; +- count = (count & 0x3f) ? count : count + 1; + dev->tx_skb = skb; + usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2), + skb->data, count, write_bulk_callback, dev); diff --git a/queue-5.4/ocfs2-clear-extent-cache-after-moving-defragmenting-extents.patch b/queue-5.4/ocfs2-clear-extent-cache-after-moving-defragmenting-extents.patch new file mode 100644 index 0000000000..d66984e4f3 --- /dev/null +++ b/queue-5.4/ocfs2-clear-extent-cache-after-moving-defragmenting-extents.patch @@ -0,0 +1,62 @@ +From 78a63493f8e352296dbc7cb7b3f4973105e8679e Mon Sep 17 00:00:00 2001 +From: Deepanshu Kartikey +Date: Thu, 9 Oct 2025 21:19:03 +0530 +Subject: ocfs2: clear extent cache after moving/defragmenting extents + +From: Deepanshu Kartikey + +commit 78a63493f8e352296dbc7cb7b3f4973105e8679e upstream. + +The extent map cache can become stale when extents are moved or +defragmented, causing subsequent operations to see outdated extent flags. +This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters(). + +The problem occurs when: +1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED +2. ioctl(FITRIM) triggers ocfs2_move_extents() +3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2) +4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() + which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0) +5. The extent map cache is not invalidated after the move +6. Later write() operations read stale cached flags (0x2) but disk has + updated flags (0x0), causing a mismatch +7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers + +Fix by clearing the extent map cache after each extent move/defrag +operation in __ocfs2_move_extents_range(). This ensures subsequent +operations read fresh extent data from disk. + +Link: https://lore.kernel.org/all/20251009142917.517229-1-kartikey406@gmail.com/T/ +Link: https://lkml.kernel.org/r/20251009154903.522339-1-kartikey406@gmail.com +Fixes: 53069d4e7695 ("Ocfs2/move_extents: move/defrag extents within a certain range.") +Signed-off-by: Deepanshu Kartikey +Reported-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com +Tested-by: syzbot+6fdd8fa3380730a4b22c@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?id=2959889e1f6e216585ce522f7e8bc002b46ad9e7 +Reviewed-by: Mark Fasheh +Reviewed-by: Joseph Qi +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Jun Piao +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Greg Kroah-Hartman +--- + fs/ocfs2/move_extents.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/fs/ocfs2/move_extents.c ++++ b/fs/ocfs2/move_extents.c +@@ -870,6 +870,11 @@ static int __ocfs2_move_extents_range(st + mlog_errno(ret); + goto out; + } ++ /* ++ * Invalidate extent cache after moving/defragging to prevent ++ * stale cached data with outdated extent flags. ++ */ ++ ocfs2_extent_map_trunc(inode, cpos); + + context->clusters_moved += alloc_size; + next: diff --git a/queue-5.4/revert-cpuidle-menu-avoid-discarding-useful-information.patch b/queue-5.4/revert-cpuidle-menu-avoid-discarding-useful-information.patch new file mode 100644 index 0000000000..0097a1c0d8 --- /dev/null +++ b/queue-5.4/revert-cpuidle-menu-avoid-discarding-useful-information.patch @@ -0,0 +1,78 @@ +From 10fad4012234a7dea621ae17c0c9486824f645a0 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Sat, 18 Oct 2025 14:27:15 +0200 +Subject: Revert "cpuidle: menu: Avoid discarding useful information" + +From: Rafael J. Wysocki + +commit 10fad4012234a7dea621ae17c0c9486824f645a0 upstream. + +It is reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding +useful information") led to a performance regression on Intel Jasper Lake +systems because it reduced the time spent by CPUs in idle state C7 which +is correlated to the maximum frequency the CPUs can get to because of an +average running power limit [1]. + +Before that commit, get_typical_interval() would have returned UINT_MAX +whenever it had been unable to make a high-confidence prediction which +had led to selecting the deepest available idle state too often and +both power and performance had been inadequate as a result of that on +some systems. However, this had not been a problem on systems with +relatively aggressive average running power limits, like the Jasper Lake +systems in question, because on those systems it was compensated by the +ability to run CPUs faster. + +It was addressed by causing get_typical_interval() to return a number +based on the recent idle duration information available to it even if it +could not make a high-confidence prediction, but that clearly did not +take the possible correlation between idle power and available CPU +capacity into account. + +For this reason, revert most of the changes made by commit 85975daeaa4d, +except for one cosmetic cleanup, and add a comment explaining the +rationale for returning UINT_MAX from get_typical_interval() when it +is unable to make a high-confidence prediction. + +Fixes: 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") +Closes: https://lore.kernel.org/linux-pm/36iykr223vmcfsoysexug6s274nq2oimcu55ybn6ww4il3g3cv@cohflgdbpnq7/ [1] +Reported-by: Sergey Senozhatsky +Cc: All applicable +Signed-off-by: Rafael J. Wysocki +Link: https://patch.msgid.link/3663603.iIbC2pHGDl@rafael.j.wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpuidle/governors/menu.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +--- a/drivers/cpuidle/governors/menu.c ++++ b/drivers/cpuidle/governors/menu.c +@@ -258,20 +258,17 @@ again: + * + * This can deal with workloads that have long pauses interspersed + * with sporadic activity with a bunch of short pauses. ++ * ++ * However, if the number of remaining samples is too small to exclude ++ * any more outliers, allow the deepest available idle state to be ++ * selected because there are systems where the time spent by CPUs in ++ * deep idle states is correlated to the maximum frequency the CPUs ++ * can get to. On those systems, shallow idle states should be avoided ++ * unless there is a clear indication that the given CPU is most likley ++ * going to be woken up shortly. + */ +- if (divisor * 4 <= INTERVALS * 3) { +- /* +- * If there are sufficiently many data points still under +- * consideration after the outliers have been eliminated, +- * returning without a prediction would be a mistake because it +- * is likely that the next interval will not exceed the current +- * maximum, so return the latter in that case. +- */ +- if (divisor >= INTERVALS / 2) +- return max; +- ++ if (divisor * 4 <= INTERVALS * 3) + return UINT_MAX; +- } + + thresh = max - 1; + goto again; diff --git a/queue-5.4/series b/queue-5.4/series index 1c38eb5262..0011e305c4 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -191,3 +191,9 @@ rtnetlink-allow-deleting-fdb-entries-in-user-namespa.patch net-enetc-correct-the-value-of-enetc_rxb_truesize.patch arm64-mm-avoid-always-making-pte-dirty-in-pte_mkwrit.patch sctp-avoid-null-dereference-when-chunk-data-buffer-i.patch +net-bonding-fix-possible-peer-notify-event-loss-or-dup-issue.patch +revert-cpuidle-menu-avoid-discarding-useful-information.patch +mips-malta-fix-keyboard-resource-preventing-i8042-driver-from-registering.patch +ocfs2-clear-extent-cache-after-moving-defragmenting-extents.patch +net-usb-rtl8150-fix-frame-padding.patch +net-ravb-ensure-memory-write-completes-before-ringing-tx-doorbell.patch