From: Greg Kroah-Hartman Date: Thu, 29 Aug 2024 16:26:31 +0000 (+0200) Subject: 6.1-stable patches X-Git-Tag: v4.19.321~80 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e9f75406670e564c973e70028fc64f7222308147;p=thirdparty%2Fkernel%2Fstable-queue.git 6.1-stable patches added patches: btrfs-run-delayed-iputs-when-flushing-delalloc.patch drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch loongarch-remove-the-unused-dma-direct.h.patch pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch series smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch --- diff --git a/queue-6.1/btrfs-run-delayed-iputs-when-flushing-delalloc.patch b/queue-6.1/btrfs-run-delayed-iputs-when-flushing-delalloc.patch new file mode 100644 index 00000000000..40d5292c84b --- /dev/null +++ b/queue-6.1/btrfs-run-delayed-iputs-when-flushing-delalloc.patch @@ -0,0 +1,45 @@ +From 2d3447261031503b181dacc549fe65ffe2d93d65 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Wed, 21 Aug 2024 15:53:18 -0400 +Subject: btrfs: run delayed iputs when flushing delalloc + +From: Josef Bacik + +commit 2d3447261031503b181dacc549fe65ffe2d93d65 upstream. + +We have transient failures with btrfs/301, specifically in the part +where we do + + for i in $(seq 0 10); do + write 50m to file + rm -f file + done + +Sometimes this will result in a transient quota error, and it's because +sometimes we start writeback on the file which results in a delayed +iput, and thus the rm doesn't actually clean the file up. When we're +flushing the quota space we need to run the delayed iputs to make sure +all the unlinks that we think have completed have actually completed. +This removes the small window where we could fail to find enough space +in our quota. + +CC: stable@vger.kernel.org # 5.15+ +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/qgroup.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -3745,6 +3745,8 @@ static int try_flush_qgroup(struct btrfs + return 0; + } + ++ btrfs_run_delayed_iputs(root->fs_info); ++ btrfs_wait_on_delayed_iputs(root->fs_info); + ret = btrfs_start_delalloc_snapshot(root, true); + if (ret < 0) + goto out; diff --git a/queue-6.1/drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch b/queue-6.1/drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch new file mode 100644 index 00000000000..be856654cff --- /dev/null +++ b/queue-6.1/drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch @@ -0,0 +1,39 @@ +From 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 Mon Sep 17 00:00:00 2001 +From: Jesse Zhang +Date: Wed, 24 Apr 2024 17:10:46 +0800 +Subject: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jesse Zhang + +commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 upstream. + +Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. +V2: To really improve the handling we would actually + need to have a separate value of 0xffffffff.(Christian) + +Signed-off-by: Jesse Zhang +Suggested-by: Christian König +Reviewed-by: Christian König +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +Signed-off-by: Vamsi Krishna Brahmajosyula +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +@@ -743,7 +743,8 @@ int amdgpu_vce_ring_parse_cs(struct amdg + uint32_t created = 0; + uint32_t allocated = 0; + uint32_t tmp, handle = 0; +- uint32_t *size = &tmp; ++ uint32_t dummy = 0xffffffff; ++ uint32_t *size = &dummy; + unsigned idx; + int i, r = 0; + diff --git a/queue-6.1/loongarch-remove-the-unused-dma-direct.h.patch b/queue-6.1/loongarch-remove-the-unused-dma-direct.h.patch new file mode 100644 index 00000000000..056c304f4fb --- /dev/null +++ b/queue-6.1/loongarch-remove-the-unused-dma-direct.h.patch @@ -0,0 +1,46 @@ +From 58aec91efb93338d1cc7acc0a93242613a2a4e5f Mon Sep 17 00:00:00 2001 +From: Miao Wang +Date: Sun, 25 Aug 2024 22:17:39 +0800 +Subject: LoongArch: Remove the unused dma-direct.h + +From: Miao Wang + +commit 58aec91efb93338d1cc7acc0a93242613a2a4e5f upstream. + +dma-direct.h is introduced in commit d4b6f1562a3c3284 ("LoongArch: Add +Non-Uniform Memory Access (NUMA) support"). In commit c78c43fe7d42524c +("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA"), +ARCH_HAS_PHYS_TO_DMA was deselected and the coresponding phys_to_dma()/ +dma_to_phys() functions were removed. However, the unused dma-direct.h +was left behind, which is removed by this patch. + +Cc: +Fixes: c78c43fe7d42 ("LoongArch: Use acpi_arch_dma_setup() and remove ARCH_HAS_PHYS_TO_DMA") +Signed-off-by: Miao Wang +Signed-off-by: Huacai Chen +Signed-off-by: Greg Kroah-Hartman +--- + arch/loongarch/include/asm/dma-direct.h | 11 ----------- + 1 file changed, 11 deletions(-) + delete mode 100644 arch/loongarch/include/asm/dma-direct.h + +diff --git a/arch/loongarch/include/asm/dma-direct.h b/arch/loongarch/include/asm/dma-direct.h +deleted file mode 100644 +index 75ccd808a2af..000000000000 +--- a/arch/loongarch/include/asm/dma-direct.h ++++ /dev/null +@@ -1,11 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-/* +- * Copyright (C) 2020-2022 Loongson Technology Corporation Limited +- */ +-#ifndef _LOONGARCH_DMA_DIRECT_H +-#define _LOONGARCH_DMA_DIRECT_H +- +-dma_addr_t phys_to_dma(struct device *dev, phys_addr_t paddr); +-phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr); +- +-#endif /* _LOONGARCH_DMA_DIRECT_H */ +-- +2.46.0 + diff --git a/queue-6.1/pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch b/queue-6.1/pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch new file mode 100644 index 00000000000..c13249ab499 --- /dev/null +++ b/queue-6.1/pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch @@ -0,0 +1,52 @@ +From 128f71fe014fc91efa1407ce549f94a9a9f1072c Mon Sep 17 00:00:00 2001 +From: Huang-Huang Bao +Date: Tue, 9 Jul 2024 18:54:28 +0800 +Subject: pinctrl: rockchip: correct RK3328 iomux width flag for GPIO2-B pins + +From: Huang-Huang Bao + +commit 128f71fe014fc91efa1407ce549f94a9a9f1072c upstream. + +The base iomux offsets for each GPIO pin line are accumulatively +calculated based off iomux width flag in rockchip_pinctrl_get_soc_data. +If the iomux width flag is one of IOMUX_WIDTH_4BIT, IOMUX_WIDTH_3BIT or +IOMUX_WIDTH_2BIT, the base offset for next pin line would increase by 8 +bytes, otherwise it would increase by 4 bytes. + +Despite most of GPIO2-B iomux have 2-bit data width, which can be fit +into 4 bytes space with write mask, it actually take 8 bytes width for +whole GPIO2-B line. + +Commit e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328 +GPIO2-B pins") wrongly set iomux width flag to 0, causing all base +iomux offset for line after GPIO2-B to be calculated wrong. Fix the +iomux width flag to IOMUX_WIDTH_2BIT so the offset after GPIO2-B is +correctly increased by 8, matching the actual width of GPIO2-B iomux. + +Fixes: e8448a6c817c ("pinctrl: rockchip: fix pinmux bits for RK3328 GPIO2-B pins") +Cc: stable@vger.kernel.org +Reported-by: Richard Kojedzinszky +Closes: https://lore.kernel.org/linux-rockchip/4f29b743202397d60edfb3c725537415@kojedz.in/ +Tested-by: Richard Kojedzinszky +Signed-off-by: Huang-Huang Bao +Reviewed-by: Heiko Stuebner +Tested-by: Daniel Golle +Tested-by: Trevor Woerner +Link: https://lore.kernel.org/20240709105428.1176375-1-i@eh5.me +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-rockchip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3803,7 +3803,7 @@ static struct rockchip_pin_bank rk3328_p + PIN_BANK_IOMUX_FLAGS(0, 32, "gpio0", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(1, 32, "gpio1", 0, 0, 0, 0), + PIN_BANK_IOMUX_FLAGS(2, 32, "gpio2", 0, +- 0, ++ IOMUX_WIDTH_2BIT, + IOMUX_WIDTH_3BIT, + 0), + PIN_BANK_IOMUX_FLAGS(3, 32, "gpio3", diff --git a/queue-6.1/pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch b/queue-6.1/pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch new file mode 100644 index 00000000000..b98c753edf1 --- /dev/null +++ b/queue-6.1/pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch @@ -0,0 +1,36 @@ +From 1c38a62f15e595346a1106025722869e87ffe044 Mon Sep 17 00:00:00 2001 +From: Ma Ke +Date: Thu, 8 Aug 2024 12:13:55 +0800 +Subject: pinctrl: single: fix potential NULL dereference in pcs_get_function() + +From: Ma Ke + +commit 1c38a62f15e595346a1106025722869e87ffe044 upstream. + +pinmux_generic_get_function() can return NULL and the pointer 'function' +was dereferenced without checking against NULL. Add checking of pointer +'function' in pcs_get_function(). + +Found by code review. + +Cc: stable@vger.kernel.org +Fixes: 571aec4df5b7 ("pinctrl: single: Use generic pinmux helpers for managing functions") +Signed-off-by: Ma Ke +Link: https://lore.kernel.org/20240808041355.2766009-1-make24@iscas.ac.cn +Signed-off-by: Linus Walleij +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pinctrl/pinctrl-single.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/pinctrl/pinctrl-single.c ++++ b/drivers/pinctrl/pinctrl-single.c +@@ -350,6 +350,8 @@ static int pcs_get_function(struct pinct + return -ENOTSUPP; + fselector = setting->func; + function = pinmux_generic_get_function(pctldev, fselector); ++ if (!function) ++ return -EINVAL; + *func = function->data; + if (!(*func)) { + dev_err(pcs->dev, "%s could not find function%i\n", diff --git a/queue-6.1/series b/queue-6.1/series new file mode 100644 index 00000000000..48799a651a4 --- /dev/null +++ b/queue-6.1/series @@ -0,0 +1,6 @@ +drm-amdgpu-using-uninitialized-value-size-when-calling-amdgpu_vce_cs_reloc.patch +loongarch-remove-the-unused-dma-direct.h.patch +btrfs-run-delayed-iputs-when-flushing-delalloc.patch +smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch +pinctrl-rockchip-correct-rk3328-iomux-width-flag-for-gpio2-b-pins.patch +pinctrl-single-fix-potential-null-dereference-in-pcs_get_function.patch diff --git a/queue-6.1/smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch b/queue-6.1/smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch new file mode 100644 index 00000000000..ab0a435c279 --- /dev/null +++ b/queue-6.1/smb-client-avoid-dereferencing-rdata-null-in-smb2_new_read_req.patch @@ -0,0 +1,33 @@ +From c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf Mon Sep 17 00:00:00 2001 +From: Stefan Metzmacher +Date: Wed, 21 Aug 2024 17:18:23 +0200 +Subject: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() + +From: Stefan Metzmacher + +commit c724b2ab6a46435b4e7d58ad2fbbdb7a318823cf upstream. + +This happens when called from SMB2_read() while using rdma +and reaching the rdma_readwrite_threshold. + +Cc: stable@vger.kernel.org +Fixes: a6559cc1d35d ("cifs: split out smb3_use_rdma_offload() helper") +Reviewed-by: David Howells +Signed-off-by: Stefan Metzmacher +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/smb/client/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/smb/client/smb2pdu.c ++++ b/fs/smb/client/smb2pdu.c +@@ -4184,7 +4184,7 @@ smb2_new_read_req(void **buf, unsigned i + * If we want to do a RDMA write, fill in and append + * smbd_buffer_descriptor_v1 to the end of read request + */ +- if (smb3_use_rdma_offload(io_parms)) { ++ if (rdata && smb3_use_rdma_offload(io_parms)) { + struct smbd_buffer_descriptor_v1 *v1; + bool need_invalidate = server->dialect == SMB30_PROT_ID; +