From: Greg Kroah-Hartman Date: Sat, 9 Oct 2021 14:17:24 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.14.12~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b26d2434f59ee3fb50c8d214cf11c37b98c3cdde;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: arm-dts-omap3430-sdp-fix-nand-device-node.patch arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch xen-balloon-fix-cancelled-balloon-action.patch --- diff --git a/queue-4.19/arm-dts-omap3430-sdp-fix-nand-device-node.patch b/queue-4.19/arm-dts-omap3430-sdp-fix-nand-device-node.patch new file mode 100644 index 00000000000..a48964fe9fc --- /dev/null +++ b/queue-4.19/arm-dts-omap3430-sdp-fix-nand-device-node.patch @@ -0,0 +1,31 @@ +From 80d680fdccba214e8106dc1aa33de5207ad75394 Mon Sep 17 00:00:00 2001 +From: Roger Quadros +Date: Thu, 2 Sep 2021 12:58:28 +0300 +Subject: ARM: dts: omap3430-sdp: Fix NAND device node + +From: Roger Quadros + +commit 80d680fdccba214e8106dc1aa33de5207ad75394 upstream. + +Nand is on CS1 so reg properties first field should be 1 not 0. + +Fixes: 44e4716499b8 ("ARM: dts: omap3: Fix NAND device nodes") +Cc: stable@vger.kernel.org # v4.6+ +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/omap3430-sdp.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm/boot/dts/omap3430-sdp.dts ++++ b/arch/arm/boot/dts/omap3430-sdp.dts +@@ -104,7 +104,7 @@ + + nand@1,0 { + compatible = "ti,omap2-nand"; +- reg = <0 0 4>; /* CS0, offset 0, IO size 4 */ ++ reg = <1 0 4>; /* CS1, offset 0, IO size 4 */ + interrupt-parent = <&gpmc>; + interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */ + <1 IRQ_TYPE_NONE>; /* termcount */ diff --git a/queue-4.19/arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch b/queue-4.19/arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch new file mode 100644 index 00000000000..5e43e87c9f4 --- /dev/null +++ b/queue-4.19/arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch @@ -0,0 +1,43 @@ +From f5c03f131dae3f06d08464e6157dd461200f78d9 Mon Sep 17 00:00:00 2001 +From: David Heidelberg +Date: Wed, 18 Aug 2021 08:53:17 +0200 +Subject: ARM: dts: qcom: apq8064: use compatible which contains chipid + +From: David Heidelberg + +commit f5c03f131dae3f06d08464e6157dd461200f78d9 upstream. + +Also resolves these kernel warnings for APQ8064: +adreno 4300000.adreno-3xx: Using legacy qcom,chipid binding! +adreno 4300000.adreno-3xx: Use compatible qcom,adreno-320.2 instead. + +Tested on Nexus 7 2013, no functional changes. + +Cc: +Signed-off-by: David Heidelberg +Link: https://lore.kernel.org/r/20210818065317.19822-1-david@ixit.cz +Signed-off-by: Bjorn Andersson +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -1182,7 +1182,7 @@ + }; + + gpu: adreno-3xx@4300000 { +- compatible = "qcom,adreno-3xx"; ++ compatible = "qcom,adreno-320.2", "qcom,adreno"; + reg = <0x04300000 0x20000>; + reg-names = "kgsl_3d0_reg_memory"; + interrupts = ; +@@ -1197,7 +1197,6 @@ + <&mmcc GFX3D_AHB_CLK>, + <&mmcc GFX3D_AXI_CLK>, + <&mmcc MMSS_IMEM_AHB_CLK>; +- qcom,chipid = <0x03020002>; + + iommus = <&gfx3d 0 + &gfx3d 1 diff --git a/queue-4.19/nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch b/queue-4.19/nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch new file mode 100644 index 00000000000..7b622118167 --- /dev/null +++ b/queue-4.19/nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch @@ -0,0 +1,52 @@ +From f2e717d655040d632c9015f19aa4275f8b16e7f2 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Thu, 30 Sep 2021 15:44:41 -0400 +Subject: nfsd4: Handle the NFSv4 READDIR 'dircount' hint being zero + +From: Trond Myklebust + +commit f2e717d655040d632c9015f19aa4275f8b16e7f2 upstream. + +RFC3530 notes that the 'dircount' field may be zero, in which case the +recommendation is to ignore it, and only enforce the 'maxcount' field. +In RFC5661, this recommendation to ignore a zero valued field becomes a +requirement. + +Fixes: aee377644146 ("nfsd4: fix rd_dircount enforcement") +Cc: +Signed-off-by: Trond Myklebust +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/nfs4xdr.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -3124,15 +3124,18 @@ nfsd4_encode_dirent(void *ccdv, const ch + goto fail; + cd->rd_maxcount -= entry_bytes; + /* +- * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so +- * let's always let through the first entry, at least: ++ * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and ++ * notes that it could be zero. If it is zero, then the server ++ * should enforce only the rd_maxcount value. + */ +- if (!cd->rd_dircount) +- goto fail; +- name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8; +- if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) +- goto fail; +- cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie); ++ if (cd->rd_dircount) { ++ name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8; ++ if (name_and_cookie > cd->rd_dircount && cd->cookie_offset) ++ goto fail; ++ cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie); ++ if (!cd->rd_dircount) ++ cd->rd_maxcount = 0; ++ } + + cd->cookie_offset = cookie_offset; + skip_entry: diff --git a/queue-4.19/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch b/queue-4.19/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch new file mode 100644 index 00000000000..bae5bef5e05 --- /dev/null +++ b/queue-4.19/ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch @@ -0,0 +1,62 @@ +From a295aef603e109a47af355477326bd41151765b6 Mon Sep 17 00:00:00 2001 +From: Zheng Liang +Date: Fri, 24 Sep 2021 09:16:27 +0800 +Subject: ovl: fix missing negative dentry check in ovl_rename() + +From: Zheng Liang + +commit a295aef603e109a47af355477326bd41151765b6 upstream. + +The following reproducer + + mkdir lower upper work merge + touch lower/old + touch lower/new + mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merge + rm merge/new + mv merge/old merge/new & unlink upper/new + +may result in this race: + +PROCESS A: + rename("merge/old", "merge/new"); + overwrite=true,ovl_lower_positive(old)=true, + ovl_dentry_is_whiteout(new)=true -> flags |= RENAME_EXCHANGE + +PROCESS B: + unlink("upper/new"); + +PROCESS A: + lookup newdentry in new_upperdir + call vfs_rename() with negative newdentry and RENAME_EXCHANGE + +Fix by adding the missing check for negative newdentry. + +Signed-off-by: Zheng Liang +Fixes: e9be9d5e76e3 ("overlay filesystem") +Cc: # v3.18 +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/dir.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -1166,9 +1166,13 @@ static int ovl_rename(struct inode *oldd + goto out_dput; + } + } else { +- if (!d_is_negative(newdentry) && +- (!new_opaque || !ovl_is_whiteout(newdentry))) +- goto out_dput; ++ if (!d_is_negative(newdentry)) { ++ if (!new_opaque || !ovl_is_whiteout(newdentry)) ++ goto out_dput; ++ } else { ++ if (flags & RENAME_EXCHANGE) ++ goto out_dput; ++ } + } + + if (olddentry == trap) diff --git a/queue-4.19/series b/queue-4.19/series index 48053361c83..9c856bc4dac 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -2,3 +2,8 @@ partially-revert-usb-kconfig-using-select-for-usb_common-dependency.patch usb-cdc-acm-fix-racy-tty-buffer-accesses.patch usb-cdc-acm-fix-break-reporting.patch xen-privcmd-fix-error-handling-in-mmap-resource-processing.patch +ovl-fix-missing-negative-dentry-check-in-ovl_rename.patch +nfsd4-handle-the-nfsv4-readdir-dircount-hint-being-zero.patch +xen-balloon-fix-cancelled-balloon-action.patch +arm-dts-omap3430-sdp-fix-nand-device-node.patch +arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch diff --git a/queue-4.19/xen-balloon-fix-cancelled-balloon-action.patch b/queue-4.19/xen-balloon-fix-cancelled-balloon-action.patch new file mode 100644 index 00000000000..c85a4ef6146 --- /dev/null +++ b/queue-4.19/xen-balloon-fix-cancelled-balloon-action.patch @@ -0,0 +1,73 @@ +From 319933a80fd4f07122466a77f93e5019d71be74c Mon Sep 17 00:00:00 2001 +From: Juergen Gross +Date: Tue, 5 Oct 2021 15:34:33 +0200 +Subject: xen/balloon: fix cancelled balloon action +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Juergen Gross + +commit 319933a80fd4f07122466a77f93e5019d71be74c upstream. + +In case a ballooning action is cancelled the new kernel thread handling +the ballooning might end up in a busy loop. + +Fix that by handling the cancelled action gracefully. + +While at it introduce a short wait for the BP_WAIT case. + +Cc: stable@vger.kernel.org +Fixes: 8480ed9c2bbd56 ("xen/balloon: use a kernel thread instead a workqueue") +Reported-by: Marek Marczykowski-Górecki +Signed-off-by: Juergen Gross +Tested-by: Jason Andryuk +Reviewed-by: Boris Ostrovsky +Link: https://lore.kernel.org/r/20211005133433.32008-1-jgross@suse.com +Signed-off-by: Juergen Gross +Signed-off-by: Greg Kroah-Hartman +--- + drivers/xen/balloon.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -508,12 +508,12 @@ static enum bp_state decrease_reservatio + } + + /* +- * Stop waiting if either state is not BP_EAGAIN and ballooning action is +- * needed, or if the credit has changed while state is BP_EAGAIN. ++ * Stop waiting if either state is BP_DONE and ballooning action is ++ * needed, or if the credit has changed while state is not BP_DONE. + */ + static bool balloon_thread_cond(enum bp_state state, long credit) + { +- if (state != BP_EAGAIN) ++ if (state == BP_DONE) + credit = 0; + + return current_credit() != credit || kthread_should_stop(); +@@ -533,10 +533,19 @@ static int balloon_thread(void *unused) + + set_freezable(); + for (;;) { +- if (state == BP_EAGAIN) +- timeout = balloon_stats.schedule_delay * HZ; +- else ++ switch (state) { ++ case BP_DONE: ++ case BP_ECANCELED: + timeout = 3600 * HZ; ++ break; ++ case BP_EAGAIN: ++ timeout = balloon_stats.schedule_delay * HZ; ++ break; ++ case BP_WAIT: ++ timeout = HZ; ++ break; ++ } ++ + credit = current_credit(); + + wait_event_freezable_timeout(balloon_thread_wq,