From: Greg Kroah-Hartman Date: Sun, 16 Jul 2023 10:25:06 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v6.1.39~78 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=306e4f3011b33f25735ffcdde7fdd8ad2e49b440;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: arm-orion5x-fix-d2net-gpio-initialization.patch btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch --- diff --git a/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch b/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch new file mode 100644 index 00000000000..f0266df5c4e --- /dev/null +++ b/queue-4.14/arm-orion5x-fix-d2net-gpio-initialization.patch @@ -0,0 +1,55 @@ +From f8ef1233939495c405a9faa4bd1ae7d3f581bae4 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Tue, 16 May 2023 17:31:05 +0200 +Subject: ARM: orion5x: fix d2net gpio initialization + +From: Arnd Bergmann + +commit f8ef1233939495c405a9faa4bd1ae7d3f581bae4 upstream. + +The DT version of this board has a custom file with the gpio +device. However, it does nothing because the d2net_init() +has no caller or prototype: + +arch/arm/mach-orion5x/board-d2net.c:101:13: error: no previous prototype for 'd2net_init' + +Call it from the board-dt file as intended. + +Fixes: 94b0bd366e36 ("ARM: orion5x: convert d2net to Device Tree") +Reviewed-by: Andrew Lunn +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20230516153109.514251-10-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/mach-orion5x/board-dt.c | 3 +++ + arch/arm/mach-orion5x/common.h | 6 ++++++ + 2 files changed, 9 insertions(+) + +--- a/arch/arm/mach-orion5x/board-dt.c ++++ b/arch/arm/mach-orion5x/board-dt.c +@@ -63,6 +63,9 @@ static void __init orion5x_dt_init(void) + if (of_machine_is_compatible("maxtor,shared-storage-2")) + mss2_init(); + ++ if (of_machine_is_compatible("lacie,d2-network")) ++ d2net_init(); ++ + of_platform_default_populate(NULL, orion5x_auxdata_lookup, NULL); + } + +--- a/arch/arm/mach-orion5x/common.h ++++ b/arch/arm/mach-orion5x/common.h +@@ -75,6 +75,12 @@ extern void mss2_init(void); + static inline void mss2_init(void) {} + #endif + ++#ifdef CONFIG_MACH_D2NET_DT ++void d2net_init(void); ++#else ++static inline void d2net_init(void) {} ++#endif ++ + /***************************************************************************** + * Helpers to access Orion registers + ****************************************************************************/ diff --git a/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch b/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch new file mode 100644 index 00000000000..db5fe1e1dd7 --- /dev/null +++ b/queue-4.14/btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch @@ -0,0 +1,84 @@ +From b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Mon, 19 Jun 2023 17:21:47 +0100 +Subject: btrfs: fix race when deleting quota root from the dirty cow roots list + +From: Filipe Manana + +commit b31cb5a6eb7a48b0a7bfdf06832b1fd5088d8c79 upstream. + +When disabling quotas we are deleting the quota root from the list +fs_info->dirty_cowonly_roots without taking the lock that protects it, +which is struct btrfs_fs_info::trans_lock. This unsynchronized list +manipulation may cause chaos if there's another concurrent manipulation +of this list, such as when adding a root to it with +ctree.c:add_root_to_dirty_list(). + +This can result in all sorts of weird failures caused by a race, such as +the following crash: + + [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI + [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G W 6.4.0-rc6-btrfs-next-134+ #1 + [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 + [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs] + [337571.279928] Code: 85 38 06 00 (...) + [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206 + [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000 + [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070 + [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b + [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600 + [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48 + [337571.281723] FS: 00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000 + [337571.281950] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0 + [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + [337571.282874] Call Trace: + [337571.283101] + [337571.283327] ? __die_body+0x1b/0x60 + [337571.283570] ? die_addr+0x39/0x60 + [337571.283796] ? exc_general_protection+0x22e/0x430 + [337571.284022] ? asm_exc_general_protection+0x22/0x30 + [337571.284251] ? commit_cowonly_roots+0x11f/0x250 [btrfs] + [337571.284531] btrfs_commit_transaction+0x42e/0xf90 [btrfs] + [337571.284803] ? _raw_spin_unlock+0x15/0x30 + [337571.285031] ? release_extent_buffer+0x103/0x130 [btrfs] + [337571.285305] reset_balance_state+0x152/0x1b0 [btrfs] + [337571.285578] btrfs_balance+0xa50/0x11e0 [btrfs] + [337571.285864] ? __kmem_cache_alloc_node+0x14a/0x410 + [337571.286086] btrfs_ioctl+0x249a/0x3320 [btrfs] + [337571.286358] ? mod_objcg_state+0xd2/0x360 + [337571.286577] ? refill_obj_stock+0xb0/0x160 + [337571.286798] ? seq_release+0x25/0x30 + [337571.287016] ? __rseq_handle_notify_resume+0x3ba/0x4b0 + [337571.287235] ? percpu_counter_add_batch+0x2e/0xa0 + [337571.287455] ? __x64_sys_ioctl+0x88/0xc0 + [337571.287675] __x64_sys_ioctl+0x88/0xc0 + [337571.287901] do_syscall_64+0x38/0x90 + [337571.288126] entry_SYSCALL_64_after_hwframe+0x72/0xdc + [337571.288352] RIP: 0033:0x7f478aaffe9b + +So fix this by locking struct btrfs_fs_info::trans_lock before deleting +the quota root from that list. + +Fixes: bed92eae26cc ("Btrfs: qgroup implementation and prototypes") +CC: stable@vger.kernel.org # 4.14+ +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/qgroup.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -969,7 +969,9 @@ int btrfs_quota_disable(struct btrfs_tra + if (ret) + goto out; + ++ spin_lock(&fs_info->trans_lock); + list_del("a_root->dirty_list); ++ spin_unlock(&fs_info->trans_lock); + + btrfs_tree_lock(quota_root->node); + clean_tree_block(fs_info, quota_root->node); diff --git a/queue-4.14/series b/queue-4.14/series index f5a1eeeef5d..bf7f4324b9c 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -80,3 +80,5 @@ mmc-core-disable-trim-on-kingston-emmc04g-m627.patch mmc-core-disable-trim-on-micron-mtfc4gacajcn-1m.patch integrity-fix-possible-multiple-allocation-in-integrity_inode_get.patch jffs2-reduce-stack-usage-in-jffs2_build_xattr_subsystem.patch +btrfs-fix-race-when-deleting-quota-root-from-the-dirty-cow-roots-list.patch +arm-orion5x-fix-d2net-gpio-initialization.patch