From: Greg Kroah-Hartman Date: Tue, 22 Apr 2025 08:39:05 +0000 (+0200) Subject: 6.6-stable patches X-Git-Tag: v6.1.135~74 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=74839eaa88dac5da3c7f78cf55901545e392679b;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch loongarch-eliminate-superfluous-get_numa_distances_cnt.patch usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch --- diff --git a/queue-6.6/btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch b/queue-6.6/btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch new file mode 100644 index 0000000000..611f7efe57 --- /dev/null +++ b/queue-6.6/btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch @@ -0,0 +1,114 @@ +From 30479f31d44d47ed00ae0c7453d9b253537005b2 Mon Sep 17 00:00:00 2001 +From: Boris Burkov +Date: Fri, 19 Jul 2024 16:49:08 -0700 +Subject: btrfs: fix qgroup reserve leaks in cow_file_range + +From: Boris Burkov + +commit 30479f31d44d47ed00ae0c7453d9b253537005b2 upstream. + +In the buffered write path, the dirty page owns the qgroup reserve until +it creates an ordered_extent. + +Therefore, any errors that occur before the ordered_extent is created +must free that reservation, or else the space is leaked. The fstest +generic/475 exercises various IO error paths, and is able to trigger +errors in cow_file_range where we fail to get to allocating the ordered +extent. Note that because we *do* clear delalloc, we are likely to +remove the inode from the delalloc list, so the inodes/pages to not have +invalidate/launder called on them in the commit abort path. + +This results in failures at the unmount stage of the test that look like: + + BTRFS: error (device dm-8 state EA) in cleanup_transaction:2018: errno=-5 IO failure + BTRFS: error (device dm-8 state EA) in btrfs_replace_file_extents:2416: errno=-5 IO failure + BTRFS warning (device dm-8 state EA): qgroup 0/5 has unreleased space, type 0 rsv 28672 + ------------[ cut here ]------------ + WARNING: CPU: 3 PID: 22588 at fs/btrfs/disk-io.c:4333 close_ctree+0x222/0x4d0 [btrfs] + Modules linked in: btrfs blake2b_generic libcrc32c xor zstd_compress raid6_pq + CPU: 3 PID: 22588 Comm: umount Kdump: loaded Tainted: G W 6.10.0-rc7-gab56fde445b8 #21 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.16.3-1-1 04/01/2014 + RIP: 0010:close_ctree+0x222/0x4d0 [btrfs] + RSP: 0018:ffffb4465283be00 EFLAGS: 00010202 + RAX: 0000000000000001 RBX: ffffa1a1818e1000 RCX: 0000000000000001 + RDX: 0000000000000000 RSI: ffffb4465283bbe0 RDI: ffffa1a19374fcb8 + RBP: ffffa1a1818e13c0 R08: 0000000100028b16 R09: 0000000000000000 + R10: 0000000000000003 R11: 0000000000000003 R12: ffffa1a18ad7972c + R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + FS: 00007f9168312b80(0000) GS:ffffa1a4afcc0000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f91683c9140 CR3: 000000010acaa000 CR4: 00000000000006f0 + Call Trace: + + ? close_ctree+0x222/0x4d0 [btrfs] + ? __warn.cold+0x8e/0xea + ? close_ctree+0x222/0x4d0 [btrfs] + ? report_bug+0xff/0x140 + ? handle_bug+0x3b/0x70 + ? exc_invalid_op+0x17/0x70 + ? asm_exc_invalid_op+0x1a/0x20 + ? close_ctree+0x222/0x4d0 [btrfs] + generic_shutdown_super+0x70/0x160 + kill_anon_super+0x11/0x40 + btrfs_kill_super+0x11/0x20 [btrfs] + deactivate_locked_super+0x2e/0xa0 + cleanup_mnt+0xb5/0x150 + task_work_run+0x57/0x80 + syscall_exit_to_user_mode+0x121/0x130 + do_syscall_64+0xab/0x1a0 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + RIP: 0033:0x7f916847a887 + ---[ end trace 0000000000000000 ]--- + BTRFS error (device dm-8 state EA): qgroup reserved space leaked + +Cases 2 and 3 in the out_reserve path both pertain to this type of leak +and must free the reserved qgroup data. Because it is already an error +path, I opted not to handle the possible errors in +btrfs_free_qgroup_data. + +Reviewed-by: Qu Wenruo +Signed-off-by: Boris Burkov +Signed-off-by: David Sterba +[Minor conflict resolved due to code context change.] +Signed-off-by: Jianqi Ren +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/inode.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1546,6 +1546,7 @@ out_unlock: + locked_page, + clear_bits, + page_ops); ++ btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); + start += cur_alloc_size; + } + +@@ -1559,6 +1560,7 @@ out_unlock: + clear_bits |= EXTENT_CLEAR_DATA_RESV; + extent_clear_unlock_delalloc(inode, start, end, locked_page, + clear_bits, page_ops); ++ btrfs_qgroup_free_data(inode, NULL, start, cur_alloc_size, NULL); + } + return ret; + } +@@ -2222,13 +2224,15 @@ error: + */ + if (cow_start != (u64)-1) + cur_offset = cow_start; +- if (cur_offset < end) ++ if (cur_offset < end) { + extent_clear_unlock_delalloc(inode, cur_offset, end, + locked_page, EXTENT_LOCKED | + EXTENT_DELALLOC | EXTENT_DEFRAG | + EXTENT_DO_ACCOUNTING, PAGE_UNLOCK | + PAGE_START_WRITEBACK | + PAGE_END_WRITEBACK); ++ btrfs_qgroup_free_data(inode, NULL, cur_offset, end - cur_offset + 1, NULL); ++ } + btrfs_free_path(path); + return ret; + } diff --git a/queue-6.6/loongarch-eliminate-superfluous-get_numa_distances_cnt.patch b/queue-6.6/loongarch-eliminate-superfluous-get_numa_distances_cnt.patch new file mode 100644 index 0000000000..9f07b950b5 --- /dev/null +++ b/queue-6.6/loongarch-eliminate-superfluous-get_numa_distances_cnt.patch @@ -0,0 +1,48 @@ +From a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb Mon Sep 17 00:00:00 2001 +From: Yuli Wang +Date: Sat, 8 Mar 2025 13:51:32 +0800 +Subject: LoongArch: Eliminate superfluous get_numa_distances_cnt() + +From: Yuli Wang + +commit a0d3c8bcb9206ac207c7ad3182027c6b0a1319bb upstream. + +In LoongArch, get_numa_distances_cnt() isn't in use, resulting in a +compiler warning. + +Fix follow errors with clang-18 when W=1e: + +arch/loongarch/kernel/acpi.c:259:28: error: unused function 'get_numa_distances_cnt' [-Werror,-Wunused-function] + 259 | static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit) + | ^~~~~~~~~~~~~~~~~~~~~~ +1 error generated. + +Link: https://lore.kernel.org/all/Z7bHPVUH4lAezk0E@kernel.org/ +Signed-off-by: Yuli Wang +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/kernel/acpi.c | 12 ------------ + 1 file changed, 12 deletions(-) + +--- a/arch/loongarch/kernel/acpi.c ++++ b/arch/loongarch/kernel/acpi.c +@@ -216,18 +216,6 @@ static __init int setup_node(int pxm) + return acpi_map_pxm_to_node(pxm); + } + +-/* +- * Callback for SLIT parsing. pxm_to_node() returns NUMA_NO_NODE for +- * I/O localities since SRAT does not list them. I/O localities are +- * not supported at this point. +- */ +-unsigned int numa_distance_cnt; +- +-static inline unsigned int get_numa_distances_cnt(struct acpi_table_slit *slit) +-{ +- return slit->locality_count; +-} +- + void __init numa_set_distance(int from, int to, int distance) + { + if ((u8)distance != distance || (from == to && distance != LOCAL_DISTANCE)) { diff --git a/queue-6.6/series b/queue-6.6/series index 30142da25d..fd52e41f30 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -373,3 +373,9 @@ x86-tdx-fix-arch_safe_halt-execution-for-tdx-vms.patch x86-split_lock-fix-the-delayed-detection-logic.patch nvme-rdma-unquiesce-admin_q-before-destroy-it.patch powerpc-rtas-prevent-spectre-v1-gadget-construction-in-sys_rtas.patch +loongarch-eliminate-superfluous-get_numa_distances_cnt.patch +usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch +usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch +btrfs-fix-qgroup-reserve-leaks-in-cow_file_range.patch +wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch +wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch diff --git a/queue-6.6/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch b/queue-6.6/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch new file mode 100644 index 0000000000..2431fa9411 --- /dev/null +++ b/queue-6.6/usb-typec-fix-pm-usage-counter-imbalance-in-ucsi_ccg_sync_control.patch @@ -0,0 +1,49 @@ +From b0e525d7a22ea350e75e2aec22e47fcfafa4cacd Mon Sep 17 00:00:00 2001 +From: GONG Ruiqi +Date: Tue, 7 Jan 2025 09:57:50 +0800 +Subject: usb: typec: fix pm usage counter imbalance in ucsi_ccg_sync_control() + +From: GONG Ruiqi + +commit b0e525d7a22ea350e75e2aec22e47fcfafa4cacd upstream. + +The error handling for the case `con_index == 0` should involve dropping +the pm usage counter, as ucsi_ccg_sync_control() gets it at the +beginning. Fix it. + +Cc: stable +Fixes: e56aac6e5a25 ("usb: typec: fix potential array underflow in ucsi_ccg_sync_control()") +Signed-off-by: GONG Ruiqi +Reviewed-by: Dan Carpenter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/20250107015750.2778646-1-gongruiqi1@huawei.com +Signed-off-by: Greg Kroah-Hartman +[Minor context change fixed] +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_ccg.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -587,7 +587,7 @@ static int ucsi_ccg_sync_write(struct uc + UCSI_CMD_CONNECTOR_MASK; + if (con_index == 0) { + ret = -EINVAL; +- goto unlock; ++ goto err_put; + } + con = &uc->ucsi->connector[con_index - 1]; + ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); +@@ -603,8 +603,8 @@ static int ucsi_ccg_sync_write(struct uc + + err_clear_bit: + clear_bit(DEV_CMD_PENDING, &uc->flags); ++err_put: + pm_runtime_put_sync(uc->dev); +-unlock: + mutex_unlock(&uc->lock); + + return ret; diff --git a/queue-6.6/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch b/queue-6.6/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch new file mode 100644 index 0000000000..679faf468e --- /dev/null +++ b/queue-6.6/usb-typec-fix-potential-array-underflow-in-ucsi_ccg_sync_control.patch @@ -0,0 +1,50 @@ +From e56aac6e5a25630645607b6856d4b2a17b2311a5 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Mon, 11 Nov 2024 14:08:06 +0300 +Subject: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() + +From: Dan Carpenter + +commit e56aac6e5a25630645607b6856d4b2a17b2311a5 upstream. + +The "command" variable can be controlled by the user via debugfs. The +worry is that if con_index is zero then "&uc->ucsi->connector[con_index +- 1]" would be an array underflow. + +Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices") +Signed-off-by: Dan Carpenter +Reviewed-by: Heikki Krogerus +Link: https://lore.kernel.org/r/c69ef0b3-61b0-4dde-98dd-97b97f81d912@stanley.mountain +Signed-off-by: Greg Kroah-Hartman +[Minor context change fixed. + 13f2ec3115c8 ("usb: typec: ucsi: simplify command sending API") rename + ucsi_ccg_sync_write to ucsi_ccg_sync_control in v6.11, so this patch is + applied in ucsi_ccg_sync_write in v6.6.] +Signed-off-by: Bin Lan +Signed-off-by: He Zhe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/usb/typec/ucsi/ucsi_ccg.c ++++ b/drivers/usb/typec/ucsi/ucsi_ccg.c +@@ -585,6 +585,10 @@ static int ucsi_ccg_sync_write(struct uc + uc->has_multiple_dp) { + con_index = (uc->last_cmd_sent >> 16) & + UCSI_CMD_CONNECTOR_MASK; ++ if (con_index == 0) { ++ ret = -EINVAL; ++ goto unlock; ++ } + con = &uc->ucsi->connector[con_index - 1]; + ucsi_ccg_update_set_new_cam_cmd(uc, con, (u64 *)val); + } +@@ -600,6 +604,7 @@ static int ucsi_ccg_sync_write(struct uc + err_clear_bit: + clear_bit(DEV_CMD_PENDING, &uc->flags); + pm_runtime_put_sync(uc->dev); ++unlock: + mutex_unlock(&uc->lock); + + return ret; diff --git a/queue-6.6/wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch b/queue-6.6/wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch new file mode 100644 index 0000000000..23dfd0c446 --- /dev/null +++ b/queue-6.6/wifi-rtw89-pci-add-pre_deinit-to-be-called-after-probe-complete.patch @@ -0,0 +1,85 @@ +From 9e1aff437a560cd72cb6a60ee33fe162b0afdaf1 Mon Sep 17 00:00:00 2001 +From: Ping-Ke Shih +Date: Fri, 10 Nov 2023 09:23:15 +0800 +Subject: wifi: rtw89: pci: add pre_deinit to be called after probe complete + +From: Ping-Ke Shih + +commit 9e1aff437a560cd72cb6a60ee33fe162b0afdaf1 upstream. + +At probe stage, we only do partial initialization to enable ability to +download firmware and read capabilities. After that, we use this pre_deinit +to disable HCI to save power. + +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20231110012319.12727-4-pkshih@realtek.com +[ Zenm: The rtw89 driver in recent kernel versions supports both Wi-Fi 6/6E + and Wi-Fi 7, however the rtw89 driver in kernel 6.6 supports + Wi-Fi 6/6E only, so remove the unnecessary code for Wi-Fi 7 from + the upstream patch to make it apply on 6.6.y. ] +Signed-off-by: Zenm Chen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtw89/core.c | 2 ++ + drivers/net/wireless/realtek/rtw89/core.h | 6 ++++++ + drivers/net/wireless/realtek/rtw89/pci.c | 8 ++++++++ + 3 files changed, 16 insertions(+) + +--- a/drivers/net/wireless/realtek/rtw89/core.c ++++ b/drivers/net/wireless/realtek/rtw89/core.c +@@ -3807,6 +3807,8 @@ static int rtw89_chip_efuse_info_setup(s + rtw89_core_setup_phycap(rtwdev); + rtw89_core_setup_rfe_parms(rtwdev); + ++ rtw89_hci_mac_pre_deinit(rtwdev); ++ + rtw89_mac_pwr_off(rtwdev); + + return 0; +--- a/drivers/net/wireless/realtek/rtw89/core.h ++++ b/drivers/net/wireless/realtek/rtw89/core.h +@@ -2989,6 +2989,7 @@ struct rtw89_hci_ops { + void (*write32)(struct rtw89_dev *rtwdev, u32 addr, u32 data); + + int (*mac_pre_init)(struct rtw89_dev *rtwdev); ++ int (*mac_pre_deinit)(struct rtw89_dev *rtwdev); + int (*mac_post_init)(struct rtw89_dev *rtwdev); + int (*deinit)(struct rtw89_dev *rtwdev); + +@@ -4515,6 +4516,11 @@ static inline void rtw89_hci_tx_kick_off + return rtwdev->hci.ops->tx_kick_off(rtwdev, txch); + } + ++static inline int rtw89_hci_mac_pre_deinit(struct rtw89_dev *rtwdev) ++{ ++ return rtwdev->hci.ops->mac_pre_deinit(rtwdev); ++} ++ + static inline void rtw89_hci_flush_queues(struct rtw89_dev *rtwdev, u32 queues, + bool drop) + { +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -2568,6 +2568,13 @@ static int rtw89_pci_ops_mac_pre_init(st + return 0; + } + ++static int rtw89_pci_ops_mac_pre_deinit(struct rtw89_dev *rtwdev) ++{ ++ rtw89_pci_power_wake(rtwdev, false); ++ ++ return 0; ++} ++ + int rtw89_pci_ltr_set(struct rtw89_dev *rtwdev, bool en) + { + u32 val; +@@ -3812,6 +3819,7 @@ static const struct rtw89_hci_ops rtw89_ + .write32 = rtw89_pci_ops_write32, + + .mac_pre_init = rtw89_pci_ops_mac_pre_init, ++ .mac_pre_deinit = rtw89_pci_ops_mac_pre_deinit, + .mac_post_init = rtw89_pci_ops_mac_post_init, + .deinit = rtw89_pci_ops_deinit, + diff --git a/queue-6.6/wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch b/queue-6.6/wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch new file mode 100644 index 0000000000..cf27b55fa4 --- /dev/null +++ b/queue-6.6/wifi-rtw89-pci-disable-pcie-wake-bit-when-pcie-deinit.patch @@ -0,0 +1,35 @@ +From 9c1df813e08832c3836c254bc8a2f83ff22dbc06 Mon Sep 17 00:00:00 2001 +From: Ping-Ke Shih +Date: Mon, 11 Nov 2024 14:38:35 +0800 +Subject: wifi: rtw89: pci: disable PCIE wake bit when PCIE deinit + +From: Ping-Ke Shih + +commit 9c1df813e08832c3836c254bc8a2f83ff22dbc06 upstream. + +The PCIE wake bit is to control PCIE wake signal to host. When PCIE is +going down, clear this bit to prevent waking up host unexpectedly. + +Signed-off-by: Ping-Ke Shih +Link: https://patch.msgid.link/20241111063835.15454-1-pkshih@realtek.com +[ Zenm: The rtw89 driver in recent kernel versions supports both Wi-Fi 6/6E + and Wi-Fi 7, however the rtw89 driver in kernel 6.6 supports + Wi-Fi 6/6E only, so remove the unnecessary code for Wi-Fi 7 from + the upstream patch to make it apply on 6.6.y. ] +Signed-off-by: Zenm Chen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/realtek/rtw89/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/net/wireless/realtek/rtw89/pci.c ++++ b/drivers/net/wireless/realtek/rtw89/pci.c +@@ -2482,6 +2482,8 @@ static int rtw89_pci_ops_deinit(struct r + { + const struct rtw89_pci_info *info = rtwdev->pci_info; + ++ rtw89_pci_power_wake(rtwdev, false); ++ + if (rtwdev->chip->chip_id == RTL8852A) { + /* ltr sw trigger */ + rtw89_write32_set(rtwdev, R_AX_LTR_CTRL_0, B_AX_APP_LTR_IDLE);