Commit Graph

9739 Commits

Author SHA1 Message Date
Greg Kroah-Hartman 3e7bedcc0e Merge 5.10.198 into android12-5.10-lts
Changes in 5.10.198
	NFS: Use the correct commit info in nfs_join_page_group()
	NFS/pNFS: Report EINVAL errors from connect() to the server
	SUNRPC: Mark the cred for revalidation if the server rejects it
	tracing: Increase trace array ref count on enable and filter files
	ata: ahci: Drop pointless VPRINTK() calls and convert the remaining ones
	ata: libahci: clear pending interrupt status
	ext4: remove the 'group' parameter of ext4_trim_extent
	ext4: add new helper interface ext4_try_to_trim_range()
	ext4: scope ret locally in ext4_try_to_trim_range()
	ext4: change s_last_trim_minblks type to unsigned long
	ext4: mark group as trimmed only if it was fully scanned
	ext4: replace the traditional ternary conditional operator with with max()/min()
	ext4: move setting of trimmed bit into ext4_try_to_trim_range()
	ext4: do not let fstrim block system suspend
	tracing: Have event inject files inc the trace array ref count
	netfilter: nf_tables: integrate pipapo into commit protocol
	netfilter: nf_tables: don't skip expired elements during walk
	netfilter: nf_tables: GC transaction API to avoid race with control plane
	netfilter: nf_tables: adapt set backend to use GC transaction API
	netfilter: nft_set_hash: mark set element as dead when deleting from packet path
	netfilter: nf_tables: remove busy mark and gc batch API
	netfilter: nf_tables: don't fail inserts if duplicate has expired
	netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path
	netfilter: nf_tables: GC transaction race with netns dismantle
	netfilter: nf_tables: GC transaction race with abort path
	netfilter: nf_tables: use correct lock to protect gc_list
	netfilter: nf_tables: defer gc run if previous batch is still pending
	netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
	netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention
	netfilter: nft_set_pipapo: stop GC iteration if GC transaction allocation fails
	netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration
	netfilter: nf_tables: fix memleak when more than 255 elements expired
	ASoC: meson: spdifin: start hw on dai probe
	netfilter: nf_tables: disallow element removal on anonymous sets
	bpf: Avoid deadlock when using queue and stack maps from NMI
	selftests/tls: Add {} to avoid static checker warning
	selftests: tls: swap the TX and RX sockets in some tests
	ASoC: imx-audmix: Fix return error with devm_clk_get()
	i40e: Fix VF VLAN offloading when port VLAN is configured
	ipv4: fix null-deref in ipv4_link_failure
	powerpc/perf/hv-24x7: Update domain value check
	dccp: fix dccp_v4_err()/dccp_v6_err() again
	platform/x86: intel_scu_ipc: Check status after timeout in busy_loop()
	platform/x86: intel_scu_ipc: Check status upon timeout in ipc_wait_for_interrupt()
	platform/x86: intel_scu_ipc: Don't override scu in intel_scu_ipc_dev_simple_command()
	platform/x86: intel_scu_ipc: Fail IPC send if still busy
	x86/srso: Fix srso_show_state() side effect
	x86/srso: Fix SBPB enablement for spec_rstack_overflow=off
	net: hns3: only enable unicast promisc when mac table full
	net: hns3: add 5ms delay before clear firmware reset irq source
	net: bridge: use DEV_STATS_INC()
	team: fix null-ptr-deref when team device type is changed
	netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
	seqlock: avoid -Wshadow warnings
	seqlock: Rename __seqprop() users
	seqlock: Prefix internal seqcount_t-only macros with a "do_"
	locking/seqlock: Do the lockdep annotation before locking in do_write_seqcount_begin_nested()
	bnxt_en: Flush XDP for bnxt_poll_nitroa0()'s NAPI
	net: rds: Fix possible NULL-pointer dereference
	gpio: tb10x: Fix an error handling path in tb10x_gpio_probe()
	i2c: mux: demux-pinctrl: check the return value of devm_kstrdup()
	netfilter: nf_tables: unregister flowtable hooks on netns exit
	netfilter: nf_tables: double hook unregistration in netns path
	Input: i8042 - rename i8042-x86ia64io.h to i8042-acpipnpio.h
	Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
	mmc: renesas_sdhi: probe into TMIO after SCC parameters have been setup
	mmc: renesas_sdhi: populate SCC pointer at the proper place
	mmc: tmio: support custom irq masks
	mmc: renesas_sdhi: register irqs before registering controller
	media: venus: core: Add io base variables for each block
	media: venus: hfi,pm,firmware: Convert to block relative addressing
	media: venus: hfi: Define additional 6xx registers
	media: venus: core: Add differentiator IS_V6(core)
	media: venus: hfi: Add a 6xx boot logic
	media: venus: hfi_venus: Write to VIDC_CTRL_INIT after unmasking interrupts
	netfilter: use actual socket sk for REJECT action
	netfilter: nft_exthdr: Support SCTP chunks
	netfilter: nf_tables: add and use nft_sk helper
	netfilter: nf_tables: add and use nft_thoff helper
	netfilter: nft_exthdr: break evaluation if setting TCP option fails
	netfilter: exthdr: add support for tcp option removal
	netfilter: nft_exthdr: Fix non-linear header modification
	ata: libata: Rename link flag ATA_LFLAG_NO_DB_DELAY
	ata: ahci: Add support for AMD A85 FCH (Hudson D4)
	ata: ahci: Rename board_ahci_mobile
	ata: ahci: Add Elkhart Lake AHCI controller
	btrfs: reset destination buffer when read_extent_buffer() gets invalid range
	MIPS: Alchemy: only build mmc support helpers if au1xmmc is enabled
	bus: ti-sysc: Use fsleep() instead of usleep_range() in sysc_reset()
	bus: ti-sysc: Fix missing AM35xx SoC matching
	clk: tegra: fix error return case for recalc_rate
	ARM: dts: omap: correct indentation
	ARM: dts: ti: omap: Fix bandgap thermal cells addressing for omap3/4
	ARM: dts: motorola-mapphone: Configure lower temperature passive cooling
	ARM: dts: motorola-mapphone: Add 1.2GHz OPP
	ARM: dts: motorola-mapphone: Drop second ti,wlcore compatible value
	ARM: dts: am335x: Guardian: Update beeper label
	ARM: dts: Unify pwm-omap-dmtimer node names
	ARM: dts: ti: omap: motorola-mapphone: Fix abe_clkctrl warning on boot
	bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
	power: supply: ucs1002: fix error code in ucs1002_get_property()
	xtensa: add default definition for XCHAL_HAVE_DIV32
	xtensa: iss/network: make functions static
	xtensa: boot: don't add include-dirs
	xtensa: boot/lib: fix function prototypes
	gpio: pmic-eic-sprd: Add can_sleep flag for PMIC EIC chip
	i2c: npcm7xx: Fix callback completion ordering
	dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock
	parisc: sba: Fix compile warning wrt list of SBA devices
	parisc: iosapic.c: Fix sparse warnings
	parisc: drivers: Fix sparse warning
	parisc: irq: Make irq_stack_union static to avoid sparse warning
	scsi: qedf: Add synchronization between I/O completions and abort
	selftests/ftrace: Correctly enable event in instance-event.tc
	ring-buffer: Avoid softlockup in ring_buffer_resize()
	selftests: fix dependency checker script
	ring-buffer: Do not attempt to read past "commit"
	platform/mellanox: mlxbf-bootctl: add NET dependency into Kconfig
	scsi: pm80xx: Use phy-specific SAS address when sending PHY_START command
	scsi: pm80xx: Avoid leaking tags when processing OPC_INB_SET_CONTROLLER_CONFIG command
	ata: libata-eh: do not clear ATA_PFLAG_EH_PENDING in ata_eh_reset()
	spi: nxp-fspi: reset the FLSHxCR1 registers
	bpf: Clarify error expectations from bpf_clone_redirect
	media: vb2: frame_vector.c: replace WARN_ONCE with a comment
	powerpc/watchpoints: Disable preemption in thread_change_pc()
	ncsi: Propagate carrier gain/loss events to the NCSI controller
	fbdev/sh7760fb: Depend on FB=y
	perf build: Define YYNOMEM as YYNOABORT for bison < 3.81
	sched/cpuacct: Fix user/system in shown cpuacct.usage*
	sched/cpuacct: Fix charge percpu cpuusage
	sched/cpuacct: Optimize away RCU read lock
	cgroup: Fix suspicious rcu_dereference_check() usage warning
	ACPI: Check StorageD3Enable _DSD property in ACPI code
	nvme-pci: factor the iod mempool creation into a helper
	nvme-pci: factor out a nvme_pci_alloc_dev helper
	nvme-pci: do not set the NUMA node of device if it has none
	watchdog: iTCO_wdt: No need to stop the timer in probe
	watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running
	netfilter: nft_exthdr: Search chunks in SCTP packets only
	netfilter: nft_exthdr: Fix for unsafe packet data read
	nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
	smack: Record transmuting in smk_transmuted
	smack: Retrieve transmuting information in smack_inode_getsecurity()
	Smack:- Use overlay inode label in smack_inode_copy_up()
	Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux"
	serial: 8250_port: Check IRQ data before use
	nilfs2: fix potential use after free in nilfs_gccache_submit_read_data()
	netfilter: nf_tables: disallow rule removal from chain binding
	ALSA: hda: Disable power save for solving pop issue on Lenovo ThinkCentre M70q
	ata: libata-scsi: ignore reserved bits for REPORT SUPPORTED OPERATION CODES
	i2c: i801: unregister tco_pdev in i801_probe() error path
	Revert "SUNRPC dont update timeout value on connection reset"
	proc: nommu: /proc/<pid>/maps: release mmap read lock
	ring-buffer: Update "shortest_full" in polling
	btrfs: properly report 0 avail for very full file systems
	bpf: Fix BTF_ID symbol generation collision
	bpf: Fix BTF_ID symbol generation collision in tools/
	net: thunderbolt: Fix TCPv6 GSO checksum calculation
	ata: libata-core: Fix ata_port_request_pm() locking
	ata: libata-core: Fix port and device removal
	ata: libata-core: Do not register PM operations for SAS ports
	ata: libata-sata: increase PMP SRST timeout to 10s
	fs: binfmt_elf_efpic: fix personality for ELF-FDPIC
	spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe
	spi: zynqmp-gqspi: fix clock imbalance on probe failure
	NFS: Cleanup unused rpc_clnt variable
	NFS: rename nfs_client_kset to nfs_kset
	NFSv4: Fix a state manager thread deadlock regression
	ring-buffer: remove obsolete comment for free_buffer_page()
	ring-buffer: Fix bytes info in per_cpu buffer stats
	drm/mediatek: Fix backport issue in mtk_drm_gem_prime_vmap()
	rbd: move rbd_dev_refresh() definition
	rbd: decouple header read-in from updating rbd_dev->header
	rbd: decouple parent info read-in from updating rbd_dev
	rbd: take header_rwsem in rbd_dev_refresh() only when updating
	block: fix use-after-free of q->q_usage_counter
	Revert "clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz"
	Revert "PCI: qcom: Disable write access to read only registers for IP v2.3.3"
	scsi: zfcp: Fix a double put in zfcp_port_enqueue()
	qed/red_ll2: Fix undefined behavior bug in struct qed_ll2_info
	wifi: mwifiex: Fix tlv_buf_left calculation
	net: replace calls to sock->ops->connect() with kernel_connect()
	net: prevent rewrite of msg_name in sock_sendmsg()
	arm64: Add Cortex-A520 CPU part definition
	ubi: Refuse attaching if mtd's erasesize is 0
	wifi: iwlwifi: dbg_ini: fix structure packing
	wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet
	bpf: Fix tr dereferencing
	drivers/net: process the result of hdlc_open() and add call of hdlc_close() in uhdlc_close()
	wifi: mt76: mt76x02: fix MT76x0 external LNA gain handling
	regmap: rbtree: Fix wrong register marked as in-cache when creating new node
	ima: Finish deprecation of IMA_TRUSTED_KEYRING Kconfig
	scsi: target: core: Fix deadlock due to recursive locking
	ima: rework CONFIG_IMA dependency block
	NFSv4: Fix a nfs4_state_manager() race
	modpost: add missing else to the "of" check
	net: fix possible store tearing in neigh_periodic_work()
	ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data()
	net: dsa: mv88e6xxx: Avoid EEPROM timeout when EEPROM is absent
	net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg
	net: nfc: llcp: Add lock when modifying device list
	net: ethernet: ti: am65-cpsw: Fix error code in am65_cpsw_nuss_init_tx_chns()
	netfilter: handle the connecting collision properly in nf_conntrack_proto_sctp
	netfilter: nf_tables: nft_set_rbtree: fix spurious insertion failure
	net: stmmac: dwmac-stm32: fix resume on STM32 MCU
	tipc: fix a potential deadlock on &tx->lock
	tcp: fix quick-ack counting to count actual ACKs of new data
	tcp: fix delayed ACKs for MSS boundary condition
	sctp: update transport state when processing a dupcook packet
	sctp: update hb timer immediately after users change hb_interval
	cpupower: add Makefile dependencies for install targets
	dm zoned: free dmz->ddev array in dmz_put_zoned_devices
	RDMA/core: Require admin capabilities to set system parameters
	of: dynamic: Fix potential memory leak in of_changeset_action()
	IB/mlx4: Fix the size of a buffer in add_port_entries()
	gpio: aspeed: fix the GPIO number passed to pinctrl_gpio_set_config()
	gpio: pxa: disable pinctrl calls for MMP_GPIO
	RDMA/cma: Initialize ib_sa_multicast structure to 0 when join
	RDMA/cma: Fix truncation compilation warning in make_cma_ports
	RDMA/uverbs: Fix typo of sizeof argument
	RDMA/siw: Fix connection failure handling
	RDMA/mlx5: Fix NULL string error
	parisc: Restore __ldcw_align for PA-RISC 2.0 processors
	netfilter: nf_tables: fix kdoc warnings after gc rework
	netfilter: nftables: exthdr: fix 4-byte stack OOB write
	mmc: renesas_sdhi: only reset SCC when its pointer is populated
	xen/events: replace evtchn_rwlock with RCU
	Linux 5.10.198

Change-Id: Iabfdf919ae63e41a565e523087d800ebc20e5448
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-10-26 17:54:46 +00:00
Greg Kroah-Hartman 3414e62421 Merge 5.10.197 into android12-5.10-lts
Changes in 5.10.197
	autofs: fix memory leak of waitqueues in autofs_catatonic_mode
	btrfs: output extra debug info if we failed to find an inline backref
	locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock
	ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
	kernel/fork: beware of __put_task_struct() calling context
	rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
	scftorture: Forgive memory-allocation failure if KASAN
	ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad Z470
	perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
	ACPI: video: Add backlight=native DMI quirk for Apple iMac12,1 and iMac12,2
	hw_breakpoint: fix single-stepping when using bpf_overflow_handler
	devlink: remove reload failed checks in params get/set callbacks
	crypto: lrw,xts - Replace strlcpy with strscpy
	wifi: ath9k: fix fortify warnings
	wifi: ath9k: fix printk specifier
	wifi: mwifiex: fix fortify warning
	wifi: wil6210: fix fortify warnings
	crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
	tpm_tis: Resend command to recover from data transfer errors
	mmc: sdhci-esdhc-imx: improve ESDHC_FLAG_ERR010450
	alx: fix OOB-read compiler warning
	netfilter: ebtables: fix fortify warnings in size_entry_mwt()
	wifi: mac80211_hwsim: drop short frames
	drm/bridge: tc358762: Instruct DSI host to generate HSE packets
	samples/hw_breakpoint: Fix kernel BUG 'invalid opcode: 0000'
	ALSA: hda: intel-dsp-cfg: add LunarLake support
	drm/exynos: fix a possible null-pointer dereference due to data race in exynos_drm_crtc_atomic_disable()
	bus: ti-sysc: Configure uart quirks for k3 SoC
	md: raid1: fix potential OOB in raid1_remove_disk()
	ext2: fix datatype of block number in ext2_xattr_set2()
	fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
	jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
	powerpc/pseries: fix possible memory leak in ibmebus_bus_init()
	media: dvb-usb-v2: af9035: Fix null-ptr-deref in af9035_i2c_master_xfer
	media: dw2102: Fix null-ptr-deref in dw2102_i2c_transfer()
	media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
	media: anysee: fix null-ptr-deref in anysee_master_xfer
	media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
	media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
	media: tuners: qt1010: replace BUG_ON with a regular error
	media: pci: cx23885: replace BUG with error return
	usb: gadget: fsl_qe_udc: validate endpoint index for ch9 udc
	scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
	serial: cpm_uart: Avoid suspicious locking
	media: pci: ipu3-cio2: Initialise timing struct to avoid a compiler warning
	kobject: Add sanity check for kset->kobj.ktype in kset_register()
	mtd: rawnand: brcmnand: Allow SoC to provide I/O operations
	mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
	perf jevents: Make build dependency on test JSONs
	perf tools: Add an option to build without libbfd
	btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
	btrfs: add a helper to read the superblock metadata_uuid
	btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
	drm: gm12u320: Fix the timeout usage for usb_bulk_msg()
	scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
	selftests: tracing: Fix to unmount tracefs for recovering environment
	scsi: lpfc: Fix the NULL vs IS_ERR() bug for debugfs_create_file()
	x86/boot/compressed: Reserve more memory for page tables
	samples/hw_breakpoint: fix building without module unloading
	md/raid1: fix error: ISO C90 forbids mixed declarations
	attr: block mode changes of symlinks
	ovl: fix incorrect fdput() on aio completion
	btrfs: fix lockdep splat and potential deadlock after failure running delayed items
	btrfs: release path before inode lookup during the ino lookup ioctl
	drm/amdgpu: fix amdgpu_cs_p1_user_fence
	net/sched: Retire rsvp classifier
	proc: fix a dentry lock race between release_task and lookup
	mm/filemap: fix infinite loop in generic_file_buffered_read()
	drm/amd/display: enable cursor degamma for DCN3+ DRM legacy gamma
	tracing: Have current_trace inc the trace array ref count
	tracing: Have option files inc the trace array ref count
	nfsd: fix change_info in NFSv4 RENAME replies
	tracefs: Add missing lockdown check to tracefs_create_dir()
	i2c: aspeed: Reset the i2c controller when timeout occurs
	ata: libata: disallow dev-initiated LPM transitions to unsupported states
	scsi: megaraid_sas: Fix deadlock on firmware crashdump
	scsi: pm8001: Setup IRQs on resume
	ext4: fix rec_len verify error
	Linux 5.10.197

Change-Id: Ic8626d7d13ec54d438c4d80efe1f8b6bddeb84a8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-10-26 17:52:15 +00:00
Josef Bacik cbbfdb4bab btrfs: properly report 0 avail for very full file systems
commit 58bfe2ccec upstream.

A user reported some issues with smaller file systems that get very
full.  While investigating this issue I noticed that df wasn't showing
100% full, despite having 0 chunk space and having < 1MiB of available
metadata space.

This turns out to be an overflow issue, we're doing:

  total_available_metadata_space - SZ_4M < global_block_rsv_size

to determine if there's not enough space to make metadata allocations,
which overflows if total_available_metadata_space is < 4M.  Fix this by
checking to see if our available space is greater than the 4M threshold.
This makes df properly report 100% usage on the file system.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-10-10 21:53:35 +02:00
Qu Wenruo d678c078f3 btrfs: reset destination buffer when read_extent_buffer() gets invalid range
[ Upstream commit 74ee79142c ]

Commit f98b6215d7 ("btrfs: extent_io: do extra check for extent buffer
read write functions") changed how we handle invalid extent buffer range
for read_extent_buffer().

Previously if the range is invalid we just set the destination to zero,
but after the patch we do nothing and error out.

This can lead to smatch static checker errors like:

  fs/btrfs/print-tree.c:186 print_uuid_item() error: uninitialized symbol 'subvol_id'.
  fs/btrfs/tests/extent-io-tests.c:338 check_eb_bitmap() error: uninitialized symbol 'has'.
  fs/btrfs/tests/extent-io-tests.c:353 check_eb_bitmap() error: uninitialized symbol 'has'.
  fs/btrfs/uuid-tree.c:203 btrfs_uuid_tree_remove() error: uninitialized symbol 'read_subid'.
  fs/btrfs/uuid-tree.c:353 btrfs_uuid_tree_iterate() error: uninitialized symbol 'subid_le'.
  fs/btrfs/uuid-tree.c:72 btrfs_uuid_tree_lookup() error: uninitialized symbol 'data'.
  fs/btrfs/volumes.c:7415 btrfs_dev_stats_value() error: uninitialized symbol 'val'.

Fix those warnings by reverting back to the old memset() behavior.
By this we keep the static checker happy and would still make a lot of
noise when such invalid ranges are passed in.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: f98b6215d7 ("btrfs: extent_io: do extra check for extent buffer read write functions")
Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-10-10 21:53:30 +02:00
Filipe Manana 7390bb377b btrfs: release path before inode lookup during the ino lookup ioctl
commit ee34a82e89 upstream.

During the ino lookup ioctl we can end up calling btrfs_iget() to get an
inode reference while we are holding on a root's btree. If btrfs_iget()
needs to lookup the inode from the root's btree, because it's not
currently loaded in memory, then it will need to lock another or the
same path in the same root btree. This may result in a deadlock and
trigger the following lockdep splat:

  WARNING: possible circular locking dependency detected
  6.5.0-rc7-syzkaller-00004-gf7757129e3de #0 Not tainted
  ------------------------------------------------------
  syz-executor277/5012 is trying to acquire lock:
  ffff88802df41710 (btrfs-tree-01){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136

  but task is already holding lock:
  ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (btrfs-tree-00){++++}-{3:3}:
         down_read_nested+0x49/0x2f0 kernel/locking/rwsem.c:1645
         __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
         btrfs_search_slot+0x13a4/0x2f80 fs/btrfs/ctree.c:2302
         btrfs_init_root_free_objectid+0x148/0x320 fs/btrfs/disk-io.c:4955
         btrfs_init_fs_root fs/btrfs/disk-io.c:1128 [inline]
         btrfs_get_root_ref+0x5ae/0xae0 fs/btrfs/disk-io.c:1338
         btrfs_get_fs_root fs/btrfs/disk-io.c:1390 [inline]
         open_ctree+0x29c8/0x3030 fs/btrfs/disk-io.c:3494
         btrfs_fill_super+0x1c7/0x2f0 fs/btrfs/super.c:1154
         btrfs_mount_root+0x7e0/0x910 fs/btrfs/super.c:1519
         legacy_get_tree+0xef/0x190 fs/fs_context.c:611
         vfs_get_tree+0x8c/0x270 fs/super.c:1519
         fc_mount fs/namespace.c:1112 [inline]
         vfs_kern_mount+0xbc/0x150 fs/namespace.c:1142
         btrfs_mount+0x39f/0xb50 fs/btrfs/super.c:1579
         legacy_get_tree+0xef/0x190 fs/fs_context.c:611
         vfs_get_tree+0x8c/0x270 fs/super.c:1519
         do_new_mount+0x28f/0xae0 fs/namespace.c:3335
         do_mount fs/namespace.c:3675 [inline]
         __do_sys_mount fs/namespace.c:3884 [inline]
         __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861
         do_syscall_x64 arch/x86/entry/common.c:50 [inline]
         do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
         entry_SYSCALL_64_after_hwframe+0x63/0xcd

  -> #0 (btrfs-tree-01){++++}-{3:3}:
         check_prev_add kernel/locking/lockdep.c:3142 [inline]
         check_prevs_add kernel/locking/lockdep.c:3261 [inline]
         validate_chain kernel/locking/lockdep.c:3876 [inline]
         __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144
         lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761
         down_read_nested+0x49/0x2f0 kernel/locking/rwsem.c:1645
         __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
         btrfs_tree_read_lock fs/btrfs/locking.c:142 [inline]
         btrfs_read_lock_root_node+0x292/0x3c0 fs/btrfs/locking.c:281
         btrfs_search_slot_get_root fs/btrfs/ctree.c:1832 [inline]
         btrfs_search_slot+0x4ff/0x2f80 fs/btrfs/ctree.c:2154
         btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:412
         btrfs_read_locked_inode fs/btrfs/inode.c:3892 [inline]
         btrfs_iget_path+0x2d9/0x1520 fs/btrfs/inode.c:5716
         btrfs_search_path_in_tree_user fs/btrfs/ioctl.c:1961 [inline]
         btrfs_ioctl_ino_lookup_user+0x77a/0xf50 fs/btrfs/ioctl.c:2105
         btrfs_ioctl+0xb0b/0xd40 fs/btrfs/ioctl.c:4683
         vfs_ioctl fs/ioctl.c:51 [inline]
         __do_sys_ioctl fs/ioctl.c:870 [inline]
         __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:856
         do_syscall_x64 arch/x86/entry/common.c:50 [inline]
         do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
         entry_SYSCALL_64_after_hwframe+0x63/0xcd

  other info that might help us debug this:

   Possible unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    rlock(btrfs-tree-00);
                                 lock(btrfs-tree-01);
                                 lock(btrfs-tree-00);
    rlock(btrfs-tree-01);

   *** DEADLOCK ***

  1 lock held by syz-executor277/5012:
   #0: ffff88802df418e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136

  stack backtrace:
  CPU: 1 PID: 5012 Comm: syz-executor277 Not tainted 6.5.0-rc7-syzkaller-00004-gf7757129e3de #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
  Call Trace:
   <TASK>
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
   check_noncircular+0x375/0x4a0 kernel/locking/lockdep.c:2195
   check_prev_add kernel/locking/lockdep.c:3142 [inline]
   check_prevs_add kernel/locking/lockdep.c:3261 [inline]
   validate_chain kernel/locking/lockdep.c:3876 [inline]
   __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144
   lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761
   down_read_nested+0x49/0x2f0 kernel/locking/rwsem.c:1645
   __btrfs_tree_read_lock+0x2f/0x220 fs/btrfs/locking.c:136
   btrfs_tree_read_lock fs/btrfs/locking.c:142 [inline]
   btrfs_read_lock_root_node+0x292/0x3c0 fs/btrfs/locking.c:281
   btrfs_search_slot_get_root fs/btrfs/ctree.c:1832 [inline]
   btrfs_search_slot+0x4ff/0x2f80 fs/btrfs/ctree.c:2154
   btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:412
   btrfs_read_locked_inode fs/btrfs/inode.c:3892 [inline]
   btrfs_iget_path+0x2d9/0x1520 fs/btrfs/inode.c:5716
   btrfs_search_path_in_tree_user fs/btrfs/ioctl.c:1961 [inline]
   btrfs_ioctl_ino_lookup_user+0x77a/0xf50 fs/btrfs/ioctl.c:2105
   btrfs_ioctl+0xb0b/0xd40 fs/btrfs/ioctl.c:4683
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:870 [inline]
   __se_sys_ioctl+0xf8/0x170 fs/ioctl.c:856
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7f0bec94ea39

Fix this simply by releasing the path before calling btrfs_iget() as at
point we don't need the path anymore.

Reported-by: syzbot+bf66ad948981797d2f1d@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/00000000000045fa140603c4a969@google.com/
Fixes: 23d0b79dfa ("btrfs: Add unprivileged version of ino_lookup ioctl")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-23 11:01:10 +02:00
Filipe Manana 3d379dd109 btrfs: fix lockdep splat and potential deadlock after failure running delayed items
commit e110f8911d upstream.

When running delayed items we are holding a delayed node's mutex and then
we will attempt to modify a subvolume btree to insert/update/delete the
delayed items. However if have an error during the insertions for example,
btrfs_insert_delayed_items() may return with a path that has locked extent
buffers (a leaf at the very least), and then we attempt to release the
delayed node at __btrfs_run_delayed_items(), which requires taking the
delayed node's mutex, causing an ABBA type of deadlock. This was reported
by syzbot and the lockdep splat is the following:

  WARNING: possible circular locking dependency detected
  6.5.0-rc7-syzkaller-00024-g93f5de5f648d #0 Not tainted
  ------------------------------------------------------
  syz-executor.2/13257 is trying to acquire lock:
  ffff88801835c0c0 (&delayed_node->mutex){+.+.}-{3:3}, at: __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256

  but task is already holding lock:
  ffff88802a5ab8e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_lock+0x3c/0x2a0 fs/btrfs/locking.c:198

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (btrfs-tree-00){++++}-{3:3}:
         __lock_release kernel/locking/lockdep.c:5475 [inline]
         lock_release+0x36f/0x9d0 kernel/locking/lockdep.c:5781
         up_write+0x79/0x580 kernel/locking/rwsem.c:1625
         btrfs_tree_unlock_rw fs/btrfs/locking.h:189 [inline]
         btrfs_unlock_up_safe+0x179/0x3b0 fs/btrfs/locking.c:239
         search_leaf fs/btrfs/ctree.c:1986 [inline]
         btrfs_search_slot+0x2511/0x2f80 fs/btrfs/ctree.c:2230
         btrfs_insert_empty_items+0x9c/0x180 fs/btrfs/ctree.c:4376
         btrfs_insert_delayed_item fs/btrfs/delayed-inode.c:746 [inline]
         btrfs_insert_delayed_items fs/btrfs/delayed-inode.c:824 [inline]
         __btrfs_commit_inode_delayed_items+0xd24/0x2410 fs/btrfs/delayed-inode.c:1111
         __btrfs_run_delayed_items+0x1db/0x430 fs/btrfs/delayed-inode.c:1153
         flush_space+0x269/0xe70 fs/btrfs/space-info.c:723
         btrfs_async_reclaim_metadata_space+0x106/0x350 fs/btrfs/space-info.c:1078
         process_one_work+0x92c/0x12c0 kernel/workqueue.c:2600
         worker_thread+0xa63/0x1210 kernel/workqueue.c:2751
         kthread+0x2b8/0x350 kernel/kthread.c:389
         ret_from_fork+0x2e/0x60 arch/x86/kernel/process.c:145
         ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304

  -> #0 (&delayed_node->mutex){+.+.}-{3:3}:
         check_prev_add kernel/locking/lockdep.c:3142 [inline]
         check_prevs_add kernel/locking/lockdep.c:3261 [inline]
         validate_chain kernel/locking/lockdep.c:3876 [inline]
         __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144
         lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761
         __mutex_lock_common+0x1d8/0x2530 kernel/locking/mutex.c:603
         __mutex_lock kernel/locking/mutex.c:747 [inline]
         mutex_lock_nested+0x1b/0x20 kernel/locking/mutex.c:799
         __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256
         btrfs_release_delayed_node fs/btrfs/delayed-inode.c:281 [inline]
         __btrfs_run_delayed_items+0x2b5/0x430 fs/btrfs/delayed-inode.c:1156
         btrfs_commit_transaction+0x859/0x2ff0 fs/btrfs/transaction.c:2276
         btrfs_sync_file+0xf56/0x1330 fs/btrfs/file.c:1988
         vfs_fsync_range fs/sync.c:188 [inline]
         vfs_fsync fs/sync.c:202 [inline]
         do_fsync fs/sync.c:212 [inline]
         __do_sys_fsync fs/sync.c:220 [inline]
         __se_sys_fsync fs/sync.c:218 [inline]
         __x64_sys_fsync+0x196/0x1e0 fs/sync.c:218
         do_syscall_x64 arch/x86/entry/common.c:50 [inline]
         do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
         entry_SYSCALL_64_after_hwframe+0x63/0xcd

  other info that might help us debug this:

   Possible unsafe locking scenario:

         CPU0                    CPU1
         ----                    ----
    lock(btrfs-tree-00);
                                 lock(&delayed_node->mutex);
                                 lock(btrfs-tree-00);
    lock(&delayed_node->mutex);

   *** DEADLOCK ***

  3 locks held by syz-executor.2/13257:
   #0: ffff88802c1ee370 (btrfs_trans_num_writers){++++}-{0:0}, at: spin_unlock include/linux/spinlock.h:391 [inline]
   #0: ffff88802c1ee370 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0xb87/0xe00 fs/btrfs/transaction.c:287
   #1: ffff88802c1ee398 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0xbb2/0xe00 fs/btrfs/transaction.c:288
   #2: ffff88802a5ab8e8 (btrfs-tree-00){++++}-{3:3}, at: __btrfs_tree_lock+0x3c/0x2a0 fs/btrfs/locking.c:198

  stack backtrace:
  CPU: 0 PID: 13257 Comm: syz-executor.2 Not tainted 6.5.0-rc7-syzkaller-00024-g93f5de5f648d #0
  Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
  Call Trace:
   <TASK>
   __dump_stack lib/dump_stack.c:88 [inline]
   dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
   check_noncircular+0x375/0x4a0 kernel/locking/lockdep.c:2195
   check_prev_add kernel/locking/lockdep.c:3142 [inline]
   check_prevs_add kernel/locking/lockdep.c:3261 [inline]
   validate_chain kernel/locking/lockdep.c:3876 [inline]
   __lock_acquire+0x39ff/0x7f70 kernel/locking/lockdep.c:5144
   lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5761
   __mutex_lock_common+0x1d8/0x2530 kernel/locking/mutex.c:603
   __mutex_lock kernel/locking/mutex.c:747 [inline]
   mutex_lock_nested+0x1b/0x20 kernel/locking/mutex.c:799
   __btrfs_release_delayed_node+0x9a/0xaa0 fs/btrfs/delayed-inode.c:256
   btrfs_release_delayed_node fs/btrfs/delayed-inode.c:281 [inline]
   __btrfs_run_delayed_items+0x2b5/0x430 fs/btrfs/delayed-inode.c:1156
   btrfs_commit_transaction+0x859/0x2ff0 fs/btrfs/transaction.c:2276
   btrfs_sync_file+0xf56/0x1330 fs/btrfs/file.c:1988
   vfs_fsync_range fs/sync.c:188 [inline]
   vfs_fsync fs/sync.c:202 [inline]
   do_fsync fs/sync.c:212 [inline]
   __do_sys_fsync fs/sync.c:220 [inline]
   __se_sys_fsync fs/sync.c:218 [inline]
   __x64_sys_fsync+0x196/0x1e0 fs/sync.c:218
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x7f3ad047cae9
  Code: 28 00 00 00 75 (...)
  RSP: 002b:00007f3ad12510c8 EFLAGS: 00000246 ORIG_RAX: 000000000000004a
  RAX: ffffffffffffffda RBX: 00007f3ad059bf80 RCX: 00007f3ad047cae9
  RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
  RBP: 00007f3ad04c847a R08: 0000000000000000 R09: 0000000000000000
  R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
  R13: 000000000000000b R14: 00007f3ad059bf80 R15: 00007ffe56af92f8
   </TASK>
  ------------[ cut here ]------------

Fix this by releasing the path before releasing the delayed node in the
error path at __btrfs_run_delayed_items().

Reported-by: syzbot+a379155f07c134ea9879@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/000000000000abba27060403b5bd@google.com/
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-23 11:01:10 +02:00
Anand Jain df380d6f5c btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super
[ Upstream commit 6bfe3959b0 ]

The function btrfs_validate_super() should verify the metadata_uuid in
the provided superblock argument. Because, all its callers expect it to
do that.

Such as in the following stacks:

  write_all_supers()
   sb = fs_info->super_for_commit;
   btrfs_validate_write_super(.., sb)
     btrfs_validate_super(.., sb, ..)

  scrub_one_super()
	btrfs_validate_super(.., sb, ..)

And
   check_dev_super()
	btrfs_validate_super(.., sb, ..)

However, it currently verifies the fs_info::super_copy::metadata_uuid
instead.  Fix this using the correct metadata_uuid in the superblock
argument.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-23 11:01:09 +02:00
Anand Jain ab90a3930d btrfs: add a helper to read the superblock metadata_uuid
[ Upstream commit 4844c3664a ]

In some cases, we need to read the FSID from the superblock when the
metadata_uuid is not set, and otherwise, read the metadata_uuid. So,
add a helper.

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 6bfe3959b0 ("btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-23 11:01:09 +02:00
Josef Bacik cc87d2bb39 btrfs: move btrfs_pinned_by_swapfile prototype into volumes.h
[ Upstream commit c2e79e865b ]

This is defined in volumes.c, move the prototype into volumes.h.

Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 6bfe3959b0 ("btrfs: compare the correct fsid/metadata_uuid in btrfs_validate_super")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-23 11:01:09 +02:00
Qu Wenruo b7c3cf2f6c btrfs: output extra debug info if we failed to find an inline backref
[ Upstream commit 7f72f50547 ]

[BUG]
Syzbot reported several warning triggered inside
lookup_inline_extent_backref().

[CAUSE]
As usual, the reproducer doesn't reliably trigger locally here, but at
least we know the WARN_ON() is triggered when an inline backref can not
be found, and it can only be triggered when @insert is true. (I.e.
inserting a new inline backref, which means the backref should already
exist)

[ENHANCEMENT]
After the WARN_ON(), dump all the parameters and the extent tree
leaf to help debug.

Link: https://syzkaller.appspot.com/bug?extid=d6f9ff86c1d804ba2bc6
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-09-23 11:01:04 +02:00
Greg Kroah-Hartman 8026d5839b Merge 5.10.195 into android12-5.10-lts
Changes in 5.10.195
	erofs: ensure that the post-EOF tails are all zeroed
	ARM: pxa: remove use of symbol_get()
	mmc: au1xmmc: force non-modular build and remove symbol_get usage
	net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
	rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
	modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
	USB: serial: option: add Quectel EM05G variant (0x030e)
	USB: serial: option: add FOXCONN T99W368/T99W373 product
	usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
	usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
	HID: wacom: remove the battery when the EKR is off
	staging: rtl8712: fix race condition
	Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
	configfs: fix a race in configfs_lookup()
	serial: qcom-geni: fix opp vote on shutdown
	serial: sc16is7xx: fix broken port 0 uart init
	serial: sc16is7xx: fix bug when first setting GPIO direction
	firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
	fsi: master-ast-cf: Add MODULE_FIRMWARE macro
	nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
	nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
	pinctrl: amd: Don't show `Invalid config param` errors
	ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
	ARM: dts: imx: update sdma node name format
	ARM: dts: imx7s: Drop dma-apb interrupt-names
	ARM: dts: imx: Adjust dma-apbh node name
	ARM: dts: imx: Set default tuning step for imx7d usdhc
	phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
	media: pulse8-cec: handle possible ping error
	media: pci: cx23885: fix error handling for cx23885 ATSC boards
	9p: virtio: make sure 'offs' is initialized in zc_request
	ASoC: da7219: Flush pending AAD IRQ when suspending
	ASoC: da7219: Check for failure reading AAD IRQ events
	ethernet: atheros: fix return value check in atl1c_tso_csum()
	vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
	m68k: Fix invalid .section syntax
	s390/dasd: use correct number of retries for ERP requests
	s390/dasd: fix hanging device after request requeue
	fs/nls: make load_nls() take a const parameter
	ASoc: codecs: ES8316: Fix DMIC config
	ASoC: atmel: Fix the 8K sample parameter in I2SC master
	platform/x86: intel: hid: Always call BTNL ACPI method
	platform/x86: huawei-wmi: Silence ambient light sensor
	drm/amd/display: Exit idle optimizations before attempt to access PHY
	ovl: Always reevaluate the file signature for IMA
	ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
	security: keys: perform capable check only on privileged operations
	kprobes: Prohibit probing on CFI preamble symbol
	clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
	vmbus_testing: fix wrong python syntax for integer value comparison
	net: usb: qmi_wwan: add Quectel EM05GV2
	idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
	scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
	netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
	bnx2x: fix page fault following EEH recovery
	sctp: handle invalid error codes without calling BUG()
	scsi: storvsc: Always set no_report_opcodes
	ALSA: seq: oss: Fix racy open/close of MIDI devices
	tracing: Introduce pipe_cpumask to avoid race on trace_pipes
	platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
	net: Avoid address overwrite in kernel_connect
	udf: Check consistency of Space Bitmap Descriptor
	udf: Handle error when adding extent to a file
	Revert "net: macsec: preserve ingress frame ordering"
	reiserfs: Check the return value from __getblk()
	eventfd: Export eventfd_ctx_do_read()
	eventfd: prevent underflow for eventfd semaphores
	fs: Fix error checking for d_hash_and_lookup()
	tmpfs: verify {g,u}id mount options correctly
	selftests/harness: Actually report SKIP for signal tests
	refscale: Fix uninitalized use of wait_queue_head_t
	OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
	selftests/resctrl: Don't leak buffer in fill_cache()
	selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
	selftests/resctrl: Close perf value read fd on errors
	x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
	perf/imx_ddr: don't enable counter0 if none of 4 counters are used
	s390/pkey: fix/harmonize internal keyblob headers
	s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
	x86/efistub: Fix PCI ROM preservation in mixed mode
	cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
	bpftool: Use a local bpf_perf_event_value to fix accessing its fields
	bpf: Clear the probe_addr for uprobe
	tcp: tcp_enter_quickack_mode() should be static
	hwrng: nomadik - keep clock enabled while hwrng is registered
	regmap: rbtree: Use alloc_flags for memory allocations
	udp: re-score reuseport groups when connected sockets are present
	bpf: reject unhashed sockets in bpf_sk_assign
	wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
	spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
	can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
	wifi: mwifiex: Fix OOB and integer underflow when rx packets
	wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
	selftests/bpf: fix static assert compilation issue for test_cls_*.c
	crypto: stm32 - Properly handle pm_runtime_get failing
	crypto: api - Use work queue in crypto_destroy_instance
	Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
	Bluetooth: Fix potential use-after-free when clear keys
	net: tcp: fix unexcepted socket die when snd_wnd is 0
	selftests/bpf: Clean up fmod_ret in bench_rename test script
	ice: ice_aq_check_events: fix off-by-one check when filling buffer
	crypto: caam - fix unchecked return value error
	hwrng: iproc-rng200 - Implement suspend and resume calls
	lwt: Fix return values of BPF xmit ops
	lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
	fs: ocfs2: namei: check return value of ocfs2_add_entry()
	wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
	wifi: mwifiex: Fix missed return in oob checks failed path
	samples/bpf: fix broken map lookup probe
	wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
	wifi: ath9k: protect WMI command response buffer replacement with a lock
	wifi: mwifiex: avoid possible NULL skb pointer dereference
	Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
	wifi: ath9k: use IS_ERR() with debugfs_create_dir()
	net: arcnet: Do not call kfree_skb() under local_irq_disable()
	mlxsw: i2c: Fix chunk size setting in output mailbox buffer
	mlxsw: i2c: Limit single transaction buffer size
	hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
	net/sched: sch_hfsc: Ensure inner classes have fsc curve
	netrom: Deny concurrent connect().
	drm/bridge: tc358764: Fix debug print parameter order
	quota: factor out dquot_write_dquot()
	quota: rename dquot_active() to inode_quota_active()
	quota: add new helper dquot_active()
	quota: fix dqput() to follow the guarantees dquot_srcu should provide
	ASoC: stac9766: fix build errors with REGMAP_AC97
	soc: qcom: ocmem: Add OCMEM hardware version print
	soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
	arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
	drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
	ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
	ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
	ARM: dts: BCM53573: Drop nonexistent #usb-cells
	ARM: dts: BCM53573: Add cells sizes to PCIe node
	ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
	drm/etnaviv: fix dumping of active MMU context
	x86/mm: Fix PAT bit missing from page protection modify mask
	ARM: dts: s3c64xx: align pinctrl with dtschema
	ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
	ARM: dts: s5pv210: adjust node names to DT spec
	ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
	ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
	drm: adv7511: Fix low refresh rate register for ADV7533/5
	ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
	arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
	arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
	drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
	md/bitmap: don't set max_write_behind if there is no write mostly device
	md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
	drm/tegra: Remove superfluous error messages around platform_get_irq()
	drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
	of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
	drm/armada: Fix off-by-one error in armada_overlay_get_property()
	drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
	ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
	drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
	drm/msm/mdp5: Don't leak some plane state
	firmware: meson_sm: fix to avoid potential NULL pointer dereference
	smackfs: Prevent underflow in smk_set_cipso()
	drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
	drm/msm/a2xx: Call adreno_gpu_init() earlier
	audit: fix possible soft lockup in __audit_inode_child()
	bus: ti-sysc: Fix build warning for 64-bit build
	drm/mediatek: Fix potential memory leak if vmap() fail
	bus: ti-sysc: Fix cast to enum warning
	of: unittest: Fix overlay type in apply/revert check
	ALSA: ac97: Fix possible error value of *rac97
	ipmi:ssif: Add check for kstrdup
	ipmi:ssif: Fix a memory leak when scanning for an adapter
	drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
	clk: sunxi-ng: Modify mismatched function name
	clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
	clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
	ext4: correct grp validation in ext4_mb_good_group
	clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
	clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
	clk: qcom: reset: Use the correct type of sleep/delay based on length
	PCI: Mark NVIDIA T4 GPUs to avoid bus reset
	pinctrl: mcp23s08: check return value of devm_kasprintf()
	PCI: pciehp: Use RMW accessors for changing LNKCTL
	PCI/ASPM: Use RMW accessors for changing LNKCTL
	clk: imx8mp: fix sai4 clock
	clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
	vfio/type1: fix cap_migration information leak
	powerpc/fadump: reset dump area size if fadump memory reserve fails
	powerpc/perf: Convert fsl_emb notifier to state machine callbacks
	drm/amdgpu: Use RMW accessors for changing LNKCTL
	drm/radeon: Use RMW accessors for changing LNKCTL
	net/mlx5: Use RMW accessors for changing LNKCTL
	wifi: ath10k: Use RMW accessors for changing LNKCTL
	powerpc: Don't include lppaca.h in paca.h
	powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
	nfs/blocklayout: Use the passed in gfp flags
	powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
	jfs: validate max amount of blocks before allocation.
	fs: lockd: avoid possible wrong NULL parameter
	NFSD: da_addr_body field missing in some GETDEVICEINFO replies
	NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
	NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
	media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
	media: i2c: tvp5150: check return value of devm_kasprintf()
	media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
	drivers: usb: smsusb: fix error handling code in smsusb_init_device
	media: dib7000p: Fix potential division by zero
	media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
	media: cx24120: Add retval check for cx24120_message_send()
	scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
	scsi: libsas: Introduce more SAM status code aliases in enum exec_status
	scsi: hisi_sas: Modify v3 HW SSP underflow error processing
	scsi: hisi_sas: Modify v3 HW SATA completion error processing
	scsi: hisi_sas: Fix warnings detected by sparse
	scsi: hisi_sas: Fix normally completed I/O analysed as failed
	media: rkvdec: increase max supported height for H.264
	media: mediatek: vcodec: Return NULL if no vdec_fb is found
	usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
	scsi: RDMA/srp: Fix residual handling
	scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
	scsi: iscsi: Add length check for nlattr payload
	scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
	scsi: be2iscsi: Add length check when parsing nlattrs
	scsi: qla4xxx: Add length check when parsing nlattrs
	serial: sprd: Assign sprd_port after initialized to avoid wrong access
	serial: sprd: Fix DMA buffer leak issue
	x86/APM: drop the duplicate APM_MINOR_DEV macro
	scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
	scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
	scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
	coresight: tmc: Explicit type conversions to prevent integer overflow
	dma-buf/sync_file: Fix docs syntax
	driver core: test_async: fix an error code
	IB/uverbs: Fix an potential error pointer dereference
	fsi: aspeed: Reset master errors after CFAM reset
	iommu/qcom: Disable and reset context bank before programming
	iommu/vt-d: Fix to flush cache of PASID directory table
	media: go7007: Remove redundant if statement
	USB: gadget: f_mass_storage: Fix unused variable warning
	media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
	media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
	media: ov2680: Remove auto-gain and auto-exposure controls
	media: ov2680: Fix ov2680_bayer_order()
	media: ov2680: Fix vflip / hflip set functions
	media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
	cgroup:namespace: Remove unused cgroup_namespaces_init()
	scsi: core: Use 32-bit hostnum in scsi_host_lookup()
	scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
	serial: tegra: handle clk prepare error in tegra_uart_hw_init()
	amba: bus: fix refcount leak
	Revert "IB/isert: Fix incorrect release of isert connection"
	RDMA/siw: Balance the reference of cep->kref in the error path
	RDMA/siw: Correct wrong debug message
	HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
	HID: multitouch: Correct devm device reference for hidinput input_dev name
	x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
	tracing: Fix race issue between cpu buffer write and swap
	mtd: rawnand: brcmnand: Fix mtd oobsize
	phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
	phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
	phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
	rpmsg: glink: Add check for kstrdup
	mtd: spi-nor: Check bus width while setting QE bit
	mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
	um: Fix hostaudio build errors
	dmaengine: ste_dma40: Add missing IRQ check in d40_probe
	cpufreq: Fix the race condition while updating the transition_task of policy
	virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
	igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
	netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
	netfilter: xt_u32: validate user space input
	netfilter: xt_sctp: validate the flag_info count
	skbuff: skb_segment, Call zero copy functions before using skbuff frags
	igb: set max size RX buffer when store bad packet is enabled
	PM / devfreq: Fix leak in devfreq_dev_release()
	ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
	printk: ringbuffer: Fix truncating buffer size min_t cast
	scsi: core: Fix the scsi_set_resid() documentation
	ipmi_si: fix a memleak in try_smi_init()
	ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
	backlight/gpio_backlight: Compare against struct fb_info.device
	backlight/bd6107: Compare against struct fb_info.device
	backlight/lv5207lp: Compare against struct fb_info.device
	xtensa: PMU: fix base address for the newer hardware
	arm64: csum: Fix OoB access in IP checksum code for negative lengths
	media: dvb: symbol fixup for dvb_attach()
	Revert "scsi: qla2xxx: Fix buffer overrun"
	scsi: mpt3sas: Perform additional retries if doorbell read returns 0
	ntb: Drop packets when qp link is down
	ntb: Clean up tx tail index on link down
	ntb: Fix calculation ntb_transport_tx_free_entry()
	Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
	procfs: block chmod on /proc/thread-self/comm
	parisc: Fix /proc/cpuinfo output for lscpu
	dlm: fix plock lookup when using multiple lockspaces
	dccp: Fix out of bounds access in DCCP error handler
	X.509: if signature is unsupported skip validation
	net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
	fsverity: skip PKCS#7 parser when keyring is empty
	pstore/ram: Check start of empty przs during init
	s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
	crypto: stm32 - fix loop iterating through scatterlist for DMA
	cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
	usb: typec: bus: verify partner exists in typec_altmode_attention
	USB: core: Unite old scheme and new scheme descriptor reads
	USB: core: Change usb_get_device_descriptor() API
	USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
	USB: core: Fix oversight in SuperSpeed initialization
	usb: typec: tcpci: clear the fault status bit
	tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
	md/md-bitmap: remove unnecessary local variable in backlog_store()
	udf: initialize newblock to 0
	net/ipv6: SKB symmetric hash should incorporate transport ports
	io_uring: always lock in io_apoll_task_func
	io_uring: break out of iowq iopoll on teardown
	io_uring: break iopolling on signal
	scsi: qla2xxx: Fix deletion race condition
	scsi: qla2xxx: fix inconsistent TMF timeout
	scsi: qla2xxx: Fix erroneous link up failure
	scsi: qla2xxx: Turn off noisy message log
	scsi: qla2xxx: Remove unsupported ql2xenabledif option
	fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
	drm/ast: Fix DRAM init on AST2200
	lib/test_meminit: allocate pages up to order MAX_ORDER
	parisc: led: Fix LAN receive and transmit LEDs
	parisc: led: Reduce CPU overhead for disk & lan LED computation
	pinctrl: cherryview: fix address_space_handler() argument
	dt-bindings: clock: xlnx,versal-clk: drop select:false
	clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
	clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
	soc: qcom: qmi_encdec: Restrict string length in decode
	NFS: Fix a potential data corruption
	NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
	kconfig: fix possible buffer overflow
	backlight: gpio_backlight: Drop output GPIO direction check for initial power state
	perf annotate bpf: Don't enclose non-debug code with an assert()
	x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
	perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
	watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
	pwm: lpc32xx: Remove handling of PWM channels
	net/sched: fq_pie: avoid stalls in fq_pie_timer()
	sctp: annotate data-races around sk->sk_wmem_queued
	ipv4: annotate data-races around fi->fib_dead
	net: read sk->sk_family once in sk_mc_loop()
	drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
	drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
	ipv4: ignore dst hint for multipath routes
	igb: disable virtualization features on 82580
	veth: Fixing transmit return status for dropped packets
	net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
	af_unix: Fix data-races around user->unix_inflight.
	af_unix: Fix data-race around unix_tot_inflight.
	af_unix: Fix data-races around sk->sk_shutdown.
	af_unix: Fix data race around sk->sk_err.
	net: sched: sch_qfq: Fix UAF in qfq_dequeue()
	kcm: Destroy mutex in kcm_exit_net()
	igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
	igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
	igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
	s390/zcrypt: don't leak memory if dev_set_name() fails
	idr: fix param name in idr_alloc_cyclic() doc
	ip_tunnels: use DEV_STATS_INC()
	net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
	net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
	netfilter: nfnetlink_osf: avoid OOB read
	net: hns3: fix the port information display when sfp is absent
	sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
	ext4: add correct group descriptors and reserved GDT blocks to system zone
	ata: sata_gemini: Add missing MODULE_DESCRIPTION
	ata: pata_ftide010: Add missing MODULE_DESCRIPTION
	fuse: nlookup missing decrement in fuse_direntplus_link
	btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
	btrfs: use the correct superblock to compare fsid in btrfs_validate_super
	mtd: rawnand: brcmnand: Fix crash during the panic_write
	mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
	mtd: rawnand: brcmnand: Fix potential false time out warning
	drm/amd/display: prevent potential division by zero errors
	perf hists browser: Fix hierarchy mode header
	perf tools: Handle old data in PERF_RECORD_ATTR
	perf hists browser: Fix the number of entries for 'e' key
	ACPI: APEI: explicit init of HEST and GHES in apci_init()
	arm64: sdei: abort running SDEI handlers during crash
	scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
	scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
	scsi: qla2xxx: Fix crash in PCIe error handling
	scsi: qla2xxx: Flush mailbox commands on chip reset
	ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
	ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
	bus: mhi: host: Skip MHI reset if device is in RDDM
	net: ipv4: fix one memleak in __inet_del_ifa()
	selftests/kselftest/runner/run_one(): allow running non-executable files
	kselftest/runner.sh: Propagate SIGTERM to runner child
	net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
	net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
	net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
	hsr: Fix uninit-value access in fill_frame_info()
	r8152: check budget for r8152_poll()
	kcm: Fix memory leak in error path of kcm_sendmsg()
	platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
	platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
	net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
	ipv6: fix ip6_sock_set_addr_preferences() typo
	ixgbe: fix timestamp configuration code
	kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
	drm/amd/display: Fix a bug when searching for insert_above_mpcc
	parisc: Drop loops_per_jiffy from per_cpu struct
	Linux 5.10.195

Change-Id: I4eef618f573b6d4201e05c9cf56088d77d712d97
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-09-19 11:32:32 +00:00
Anand Jain e76cef3dcd btrfs: use the correct superblock to compare fsid in btrfs_validate_super
commit d167aa76dc upstream.

The function btrfs_validate_super() should verify the fsid in the provided
superblock argument. Because, all its callers expect it to do that.

Such as in the following stack:

   write_all_supers()
       sb = fs_info->super_for_commit;
       btrfs_validate_write_super(.., sb)
         btrfs_validate_super(.., sb, ..)

   scrub_one_super()
	btrfs_validate_super(.., sb, ..)

And
   check_dev_super()
	btrfs_validate_super(.., sb, ..)

However, it currently verifies the fs_info::super_copy::fsid instead,
which is not correct.  Fix this using the correct fsid in the superblock
argument.

CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-19 12:20:28 +02:00
Filipe Manana f2873a18c2 btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
commit 4490e803e1 upstream.

When joining a transaction with TRANS_JOIN_NOSTART, if we don't find a
running transaction we end up creating one. This goes against the purpose
of TRANS_JOIN_NOSTART which is to join a running transaction if its state
is at or below the state TRANS_STATE_COMMIT_START, otherwise return an
-ENOENT error and don't start a new transaction. So fix this to not create
a new transaction if there's no running transaction at or below that
state.

CC: stable@vger.kernel.org # 4.14+
Fixes: a6d155d2e3 ("Btrfs: fix deadlock between fiemap and transaction commits")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-09-19 12:20:28 +02:00
Greg Kroah-Hartman b23fd871be Merge 5.10.192 into android12-5.10-lts
Changes in 5.10.192
	mmc: sdhci-f-sdh30: Replace with sdhci_pltfm
	macsec: Fix traffic counters/statistics
	macsec: use DEV_STATS_INC()
	net/mlx5: Refactor init clock function
	net/mlx5: Move all internal timer metadata into a dedicated struct
	net/mlx5: Skip clock update work when device is in error state
	drm/radeon: Fix integer overflow in radeon_cs_parser_init
	ALSA: emu10k1: roll up loops in DSP setup code for Audigy
	ASoC: Intel: sof_sdw: add quirk for MTL RVP
	ASoC: Intel: sof_sdw: add quirk for LNL RVP
	PCI: tegra194: Fix possible array out of bounds access
	ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings
	ASoC: Intel: sof_sdw: Add support for Rex soundwire
	iopoll: Call cpu_relax() in busy loops
	quota: Properly disable quotas when add_dquot_ref() fails
	quota: fix warning in dqgrab()
	dma-remap: use kvmalloc_array/kvfree for larger dma memory remap
	drm/amdgpu: install stub fence into potential unused fence pointers
	HID: add quirk for 03f0:464a HP Elite Presenter Mouse
	RDMA/mlx5: Return the firmware result upon destroying QP/RQ
	ovl: check type and offset of struct vfsmount in ovl_entry
	udf: Fix uninitialized array access for some pathnames
	fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
	MIPS: dec: prom: Address -Warray-bounds warning
	FS: JFS: Fix null-ptr-deref Read in txBegin
	FS: JFS: Check for read-only mounted filesystem in txBegin
	media: v4l2-mem2mem: add lock to protect parameter num_rdy
	usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push
	media: platform: mediatek: vpu: fix NULL ptr dereference
	usb: chipidea: imx: don't request QoS for imx8ulp
	usb: chipidea: imx: add missing USB PHY DPDM wakeup setting
	gfs2: Fix possible data races in gfs2_show_options()
	pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
	Bluetooth: L2CAP: Fix use-after-free
	Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally
	drm/amdgpu: Fix potential fence use-after-free v2
	ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760
	ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()
	powerpc/kasan: Disable KCOV in KASAN code
	ring-buffer: Do not swap cpu_buffer during resize process
	IMA: allow/fix UML builds
	iio: add addac subdirectory
	dt-bindings: iio: add AD74413R
	iio: adc: stx104: Utilize iomap interface
	iio: adc: stx104: Implement and utilize register structures
	iio: addac: stx104: Fix race condition for stx104_write_raw()
	iio: addac: stx104: Fix race condition when converting analog-to-digital
	bus: mhi: Add MHI PCI support for WWAN modems
	bus: mhi: Add MMIO region length to controller structure
	bus: mhi: Move host MHI code to "host" directory
	bus: mhi: host: Range check CHDBOFF and ERDBOFF
	irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
	irqchip/mips-gic: Use raw spinlock for gic_lock
	usb: gadget: udc: core: Introduce check_config to verify USB configuration
	usb: cdns3: allocate TX FIFO size according to composite EP number
	usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
	USB: dwc3: qcom: fix NULL-deref on suspend
	mmc: bcm2835: fix deferred probing
	mmc: sunxi: fix deferred probing
	mmc: core: add devm_mmc_alloc_host
	mmc: meson-gx: use devm_mmc_alloc_host
	mmc: meson-gx: fix deferred probing
	tracing/probes: Have process_fetch_insn() take a void * instead of pt_regs
	tracing/probes: Fix to update dynamic data counter if fetcharg uses it
	virtio-mmio: Use to_virtio_mmio_device() to simply code
	virtio-mmio: don't break lifecycle of vm_dev
	i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue
	fbdev: mmp: fix value check in mmphw_probe()
	powerpc/rtas_flash: allow user copy to flash block cache objects
	tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux
	tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms
	btrfs: fix BUG_ON condition in btrfs_cancel_balance
	i2c: designware: Handle invalid SMBus block data response length value
	net: xfrm: Fix xfrm_address_filter OOB read
	net: af_key: fix sadb_x_filter validation
	net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
	xfrm: fix slab-use-after-free in decode_session6
	ip6_vti: fix slab-use-after-free in decode_session6
	ip_vti: fix potential slab-use-after-free in decode_session6
	xfrm: add NULL check in xfrm_update_ae_params
	xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH
	selftests: mirror_gre_changes: Tighten up the TTL test match
	drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs
	ipvs: fix racy memcpy in proc_do_sync_threshold
	netfilter: nft_dynset: disallow object maps
	net: phy: broadcom: stub c45 read/write for 54810
	team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	i40e: fix misleading debug logs
	net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset
	sock: Fix misuse of sk_under_memory_pressure()
	net: do not allow gso_size to be set to GSO_BY_FRAGS
	bus: ti-sysc: Flush posted write on enable before reset
	arm64: dts: rockchip: fix supplies on rk3399-rock-pi-4
	arm64: dts: rockchip: use USB host by default on rk3399-rock-pi-4
	arm64: dts: rockchip: add ES8316 codec for ROCK Pi 4
	arm64: dts: rockchip: add SPDIF node for ROCK Pi 4
	arm64: dts: rockchip: fix regulator name on rk3399-rock-4
	arm64: dts: rockchip: sort nodes/properties on rk3399-rock-4
	arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4
	ASoC: rt5665: add missed regulator_bulk_disable
	ASoC: meson: axg-tdm-formatter: fix channel slot allocation
	ALSA: hda/realtek - Remodified 3k pull low procedure
	serial: 8250: Fix oops for port->pm on uart_change_pm()
	ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
	cifs: Release folio lock on fscache read hit.
	mmc: wbsd: fix double mmc_free_host() in wbsd_init()
	mmc: block: Fix in_flight[issue_type] value error
	netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
	af_unix: Fix null-ptr-deref in unix_stream_sendpage().
	virtio-net: set queues after driver_ok
	net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
	mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove
	x86/cpu: Fix __x86_return_thunk symbol type
	x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk()
	x86/alternative: Make custom return thunk unconditional
	objtool: Add frame-pointer-specific function ignore
	x86/ibt: Add ANNOTATE_NOENDBR
	x86/cpu: Clean up SRSO return thunk mess
	x86/cpu: Rename original retbleed methods
	x86/cpu: Rename srso_(.*)_alias to srso_alias_\1
	x86/cpu: Cleanup the untrain mess
	x86/srso: Explain the untraining sequences a bit more
	x86/static_call: Fix __static_call_fixup()
	x86/retpoline: Don't clobber RFLAGS during srso_safe_ret()
	x86/CPU/AMD: Fix the DIV(0) initial fix attempt
	x86/srso: Disable the mitigation on unaffected configurations
	x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG
	objtool/x86: Fixup frame-pointer vs rethunk
	x86/srso: Correct the mitigation status when SMT is disabled
	Linux 5.10.192

Change-Id: Id6dcc6748bce39baa640b8f0c3764d1d95643016
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-28 17:10:38 +00:00
Greg Kroah-Hartman 412095349f Merge 5.10.191 into android12-5.10-lts
Changes in 5.10.191
	wireguard: allowedips: expand maximum node depth
	mmc: moxart: read scr register without changing byte order
	ipv6: adjust ndisc_is_useropt() to also return true for PIO
	bpf: allow precision tracking for programs with subprogs
	bpf: stop setting precise in current state
	bpf: aggressively forget precise markings during state checkpointing
	selftests/bpf: make test_align selftest more robust
	selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
	selftests/bpf: Fix sk_assign on s390x
	dmaengine: pl330: Return DMA_PAUSED when transaction is paused
	riscv,mmio: Fix readX()-to-delay() ordering
	drm/nouveau/gr: enable memory loads on helper invocation on all channels
	drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap()
	drm/amd/display: check attr flag before set cursor degamma on DCN3+
	hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100
	radix tree test suite: fix incorrect allocation size for pthreads
	x86/pkeys: Revert a5eff72597 ("x86/pkeys: Add PKRU value to init_fpstate")
	nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput
	io_uring: correct check for O_TMPFILE
	iio: cros_ec: Fix the allocation size for cros_ec_command
	binder: fix memory leak in binder_init()
	usb-storage: alauda: Fix uninit-value in alauda_check_media()
	usb: dwc3: Properly handle processing of pending events
	usb: common: usb-conn-gpio: Prevent bailing out if initial role is none
	x86/srso: Fix build breakage with the LLVM linker
	x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405
	x86/mm: Fix VDSO and VVAR placement on 5-level paging machines
	x86/speculation: Add cpu_show_gds() prototype
	x86: Move gds_ucode_mitigated() declaration to header
	drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes
	selftests/rseq: Fix build with undefined __weak
	selftests: forwarding: Add a helper to skip test when using veth pairs
	selftests: forwarding: ethtool: Skip when using veth pairs
	selftests: forwarding: ethtool_extended_state: Skip when using veth pairs
	selftests: forwarding: Skip test when no interfaces are specified
	selftests: forwarding: Switch off timeout
	selftests: forwarding: tc_flower: Relax success criterion
	mISDN: Update parameter type of dsp_cmx_send()
	net/packet: annotate data-races around tp->status
	tunnels: fix kasan splat when generating ipv4 pmtu error
	bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
	dccp: fix data-race around dp->dccps_mss_cache
	drivers: net: prevent tun_build_skb() to exceed the packet size limit
	IB/hfi1: Fix possible panic during hotplug remove
	wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
	net: phy: at803x: remove set/get wol callbacks for AR8032
	net: hns3: refactor hclge_mac_link_status_wait for interface reuse
	net: hns3: add wait until mac link down
	dmaengine: mcf-edma: Fix a potential un-allocated memory access
	net/mlx5: Allow 0 for total host VFs
	ibmvnic: Enforce stronger sanity checks on login response
	ibmvnic: Unmap DMA login rsp buffer on send login fail
	ibmvnic: Handle DMA unmapping of login buffs in release functions
	btrfs: don't stop integrity writeback too early
	btrfs: set cache_block_group_error if we find an error
	nvme-tcp: fix potential unbalanced freeze & unfreeze
	nvme-rdma: fix potential unbalanced freeze & unfreeze
	netfilter: nf_tables: report use refcount overflow
	scsi: core: Fix legacy /proc parsing buffer overflow
	scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
	scsi: 53c700: Check that command slot is not NULL
	scsi: snic: Fix possible memory leak if device_add() fails
	scsi: core: Fix possible memory leak if device_add() fails
	scsi: qedi: Fix firmware halt over suspend and resume
	scsi: qedf: Fix firmware halt over suspend and resume
	alpha: remove __init annotation from exported page_is_ram()
	sch_netem: fix issues in netem_change() vs get_dist_table()
	Linux 5.10.191

Change-Id: Ice1868f0a7b328bb0e56985ac0bb5af9434fd073
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-28 16:37:52 +00:00
xiaoshoukui bd7bef82ce btrfs: fix BUG_ON condition in btrfs_cancel_balance
commit 29eefa6d0d upstream.

Pausing and canceling balance can race to interrupt balance lead to BUG_ON
panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance
does not take this race scenario into account.

However, the race condition has no other side effects. We can fix that.

Reproducing it with panic trace like this:

  kernel BUG at fs/btrfs/volumes.c:4618!
  RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0
  Call Trace:
   <TASK>
   ? do_nanosleep+0x60/0x120
   ? hrtimer_nanosleep+0xb7/0x1a0
   ? sched_core_clone_cookie+0x70/0x70
   btrfs_ioctl_balance_ctl+0x55/0x70
   btrfs_ioctl+0xa46/0xd20
   __x64_sys_ioctl+0x7d/0xa0
   do_syscall_64+0x38/0x80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

  Race scenario as follows:
  > mutex_unlock(&fs_info->balance_mutex);
  > --------------------
  > .......issue pause and cancel req in another thread
  > --------------------
  > ret = __btrfs_balance(fs_info);
  >
  > mutex_lock(&fs_info->balance_mutex);
  > if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {
  >         btrfs_info(fs_info, "balance: paused");
  >         btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);
  > }

CC: stable@vger.kernel.org # 4.19+
Signed-off-by: xiaoshoukui <xiaoshoukui@ruijie.com.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-26 15:26:51 +02:00
Greg Kroah-Hartman df0f5bd7a8 Merge 5.10.190 into android12-5.10-lts
Changes in 5.10.190
	KVM: s390: pv: fix index value of replaced ASCE
	io_uring: don't audit the capability check in io_uring_create()
	gpio: tps68470: Make tps68470_gpio_output() always set the initial value
	btrfs: fix race between quota disable and relocation
	btrfs: fix extent buffer leak after tree mod log failure at split_node()
	i2c: Delete error messages for failed memory allocations
	i2c: Improve size determinations
	i2c: nomadik: Remove unnecessary goto label
	i2c: nomadik: Use devm_clk_get_enabled()
	i2c: nomadik: Remove a useless call in the remove function
	PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link()
	PCI/ASPM: Factor out pcie_wait_for_retrain()
	PCI/ASPM: Avoid link retraining race
	dlm: cleanup plock_op vs plock_xop
	dlm: rearrange async condition return
	fs: dlm: interrupt posix locks only when process is killed
	drm/ttm: add ttm_bo_pin()/ttm_bo_unpin() v2
	drm/ttm: never consider pinned BOs for eviction&swap
	tracing: Show real address for trace event arguments
	pwm: meson: Simplify duplicated per-channel tracking
	pwm: meson: fix handling of period/duty if greater than UINT_MAX
	ext4: fix to check return value of freeze_bdev() in ext4_shutdown()
	phy: qcom-snps: Use dev_err_probe() to simplify code
	phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc
	phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend
	phy: qcom-snps-femto-v2: properly enable ref clock
	media: staging: atomisp: select V4L2_FWNODE
	i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir()
	net: phy: marvell10g: fix 88x3310 power up
	net: hns3: reconstruct function hclge_ets_validate()
	net: hns3: fix wrong bw weight of disabled tc issue
	vxlan: move to its own directory
	vxlan: calculate correct header length for GPE
	phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe()
	ethernet: atheros: fix return value check in atl1e_tso_csum()
	ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address
	tcp: Reduce chance of collisions in inet6_hashfn().
	ice: Fix memory management in ice_ethtool_fdir.c
	bonding: reset bond's flags when down link is P2P device
	team: reset team's flags when down link is P2P device
	platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100
	netfilter: nft_set_rbtree: fix overlap expiration walk
	netfilter: nftables: add helper function to validate set element data
	netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR
	netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID
	net/sched: mqprio: refactor nlattr parsing to a separate function
	net/sched: mqprio: add extack to mqprio_parse_nlattr()
	net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64
	benet: fix return value check in be_lancer_xmit_workarounds()
	tipc: check return value of pskb_trim()
	tipc: stop tipc crypto on failure in tipc_node_create
	RDMA/mlx4: Make check for invalid flags stricter
	drm/msm/dpu: drop enum dpu_core_perf_data_bus_id
	drm/msm/adreno: Fix snapshot BINDLESS_DATA size
	RDMA/mthca: Fix crash when polling CQ for shared QPs
	drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb()
	ASoC: fsl_spdif: Silence output on stop
	block: Fix a source code comment in include/uapi/linux/blkzoned.h
	dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths
	dm raid: clean up four equivalent goto tags in raid_ctr()
	dm raid: protect md_stop() with 'reconfig_mutex'
	ata: pata_ns87415: mark ns87560_tf_read static
	ring-buffer: Fix wrong stat of cpu_buffer->read
	tracing: Fix warning in trace_buffered_event_disable()
	Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()"
	USB: gadget: Fix the memory leak in raw_gadget driver
	serial: qcom-geni: drop bogus runtime pm state update
	serial: 8250_dw: Preserve original value of DLF register
	serial: sifive: Fix sifive_serial_console_setup() section
	USB: serial: option: support Quectel EM060K_128
	USB: serial: option: add Quectel EC200A module support
	USB: serial: simple: add Kaufmann RKS+CAN VCP
	USB: serial: simple: sort driver entries
	can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED
	Revert "usb: dwc3: core: Enable AutoRetry feature in the controller"
	usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy
	usb: dwc3: don't reset device side if dwc3 was configured as host-only
	usb: ohci-at91: Fix the unhandle interrupt when resume
	USB: quirks: add quirk for Focusrite Scarlett
	usb: xhci-mtk: set the dma max_seg_size
	Revert "usb: xhci: tegra: Fix error check"
	Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group
	Documentation: security-bugs.rst: clarify CVE handling
	staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
	tty: n_gsm: fix UAF in gsm_cleanup_mux
	ALSA: hda/relatek: Enable Mute LED on HP 250 G8
	hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled
	btrfs: check for commit error at btrfs_attach_transaction_barrier()
	file: always lock position for FMODE_ATOMIC_POS
	nfsd: Remove incorrect check in nfsd4_validate_stateid
	tpm_tis: Explicitly check for error code
	irq-bcm6345-l1: Do not assume a fixed block to cpu mapping
	irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation
	KVM: VMX: Invert handling of CR0.WP for EPT without unrestricted guest
	KVM: VMX: Fold ept_update_paging_mode_cr0() back into vmx_set_cr0()
	KVM: nVMX: Do not clear CR3 load/store exiting bits if L1 wants 'em
	KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest
	staging: rtl8712: Use constants from <linux/ieee80211.h>
	staging: r8712: Fix memory leak in _r8712_init_xmit_priv()
	btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
	virtio-net: fix race between set queues and probe
	s390/dasd: fix hanging device after quiesce/resume
	ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register
	ceph: never send metrics if disable_send_metrics is set
	dm cache policy smq: ensure IO doesn't prevent cleaner policy progress
	drm/ttm: make ttm_bo_unpin more defensive
	ACPI: processor: perflib: Use the "no limit" frequency QoS
	ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily
	cpufreq: intel_pstate: Drop ACPI _PSS states table patching
	selftests: mptcp: depend on SYN_COOKIES
	io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq
	ASoC: cs42l51: fix driver to properly autoload with automatic module loading
	kprobes/x86: Fix fall-through warnings for Clang
	x86/kprobes: Do not decode opcode in resume_execution()
	x86/kprobes: Retrieve correct opcode for group instruction
	x86/kprobes: Identify far indirect JMP correctly
	x86/kprobes: Use int3 instead of debug trap for single-step
	x86/kprobes: Fix to identify indirect jmp and others using range case
	x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration
	x86/kprobes: Update kcb status flag after singlestepping
	x86/kprobes: Fix JNG/JNLE emulation
	io_uring: gate iowait schedule on having pending requests
	perf: Fix function pointer case
	loop: Select I/O scheduler 'none' from inside add_disk()
	arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux
	word-at-a-time: use the same return type for has_zero regardless of endianness
	KVM: s390: fix sthyi error handling
	wifi: cfg80211: Fix return value in scan logic
	net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
	net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer()
	bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing
	rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length
	net: dsa: fix value check in bcm_sf2_sw_probe()
	perf test uprobe_from_different_cu: Skip if there is no gcc
	net: sched: cls_u32: Fix match key mis-addressing
	mISDN: hfcpci: Fix potential deadlock on &hc->lock
	net: annotate data-races around sk->sk_max_pacing_rate
	net: add missing READ_ONCE(sk->sk_rcvlowat) annotation
	net: add missing READ_ONCE(sk->sk_sndbuf) annotation
	net: add missing READ_ONCE(sk->sk_rcvbuf) annotation
	net: add missing data-race annotations around sk->sk_peek_off
	net: add missing data-race annotation for sk_ll_usec
	net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
	net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
	net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
	bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire
	net: ll_temac: Switch to use dev_err_probe() helper
	net: ll_temac: fix error checking of irq_of_parse_and_map()
	net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode
	net: dcb: choose correct policy to parse DCB_ATTR_BCN
	s390/qeth: Don't call dev_close/dev_open (DOWN/UP)
	ip6mr: Fix skb_under_panic in ip6mr_cache_report()
	vxlan: Fix nexthop hash size
	net/mlx5: fs_core: Make find_closest_ft more generic
	net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio
	tcp_metrics: fix addr_same() helper
	tcp_metrics: annotate data-races around tm->tcpm_stamp
	tcp_metrics: annotate data-races around tm->tcpm_lock
	tcp_metrics: annotate data-races around tm->tcpm_vals[]
	tcp_metrics: annotate data-races around tm->tcpm_net
	tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen
	scsi: zfcp: Defer fc_rport blocking until after ADISC response
	libceph: fix potential hang in ceph_osdc_notify()
	USB: zaurus: Add ID for A-300/B-500/C-700
	ceph: defer stopping mdsc delayed_work
	exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
	exfat: release s_lock before calling dir_emit()
	mtd: spinand: toshiba: Fix ecc_get_status
	mtd: rawnand: meson: fix OOB available bytes for ECC
	arm64: dts: stratix10: fix incorrect I2C property for SCL signal
	net: tun_chr_open(): set sk_uid from current_fsuid()
	net: tap_open(): set sk_uid from current_fsuid()
	bpf: Disable preemption in bpf_event_output
	open: make RESOLVE_CACHED correctly test for O_TMPFILE
	drm/ttm: check null pointer before accessing when swapping
	file: reinstate f_pos locking optimization for regular files
	tracing: Fix sleeping while atomic in kdb ftdump
	fs/sysv: Null check to prevent null-ptr-deref bug
	Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
	net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
	fs: Protect reconfiguration of sb read-write from racing writes
	ext2: Drop fragment support
	mtd: rawnand: omap_elm: Fix incorrect type in assignment
	mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
	powerpc/mm/altmap: Fix altmap boundary check
	selftests/rseq: check if libc rseq support is registered
	selftests/rseq: Play nice with binaries statically linked against glibc 2.35+
	soundwire: bus: add better dev_dbg to track complete() calls
	soundwire: bus: pm_runtime_request_resume on peripheral attachment
	soundwire: fix enumeration completion
	PM / wakeirq: support enabling wake-up irq after runtime_suspend called
	PM: sleep: wakeirq: fix wake irq arming
	exfat: speed up iterate/lookup by fixing start point of traversing cluster chain
	exfat: support dynamic allocate bh for exfat_entry_set_cache
	exfat: check if filename entries exceeds max filename length
	mt76: move band capabilities in mt76_phy
	mt76: mt7615: Fix fall-through warnings for Clang
	wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC)
	ARM: dts: imx: add usb alias
	ARM: dts: imx6sll: fixup of operating points
	ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node
	x86/CPU/AMD: Do not leak quotient data after a division by 0
	Linux 5.10.190

Fix up build problem in ext4 due to merge of ed3d841f2f ("ext4: fix to
check return value of freeze_bdev() in ext4_shutdown()") conflicting
with a previous block layer core change coming in through the f2fs tree
in the past, that is not upstream, but ANDROID specific.

Change-Id: Ib95e59ce8ba653bcc791802735afafcd26bd996f
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-25 12:26:58 +00:00
Josef Bacik 200ae5fa0b btrfs: set cache_block_group_error if we find an error
commit 92fb94b69c upstream.

We set cache_block_group_error if btrfs_cache_block_group() returns an
error, this is because we could end up not finding space to allocate and
mistakenly return -ENOSPC, and which could then abort the transaction
with the incorrect errno, and in the case of ENOSPC result in a
WARN_ON() that will trip up tests like generic/475.

However there's the case where multiple threads can be racing, one
thread gets the proper error, and the other thread doesn't actually call
btrfs_cache_block_group(), it instead sees ->cached ==
BTRFS_CACHE_ERROR.  Again the result is the same, we fail to allocate
our space and return -ENOSPC.  Instead we need to set
cache_block_group_error to -EIO in this case to make sure that if we do
not make our allocation we get the appropriate error returned back to
the caller.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-16 18:21:02 +02:00
Christoph Hellwig bd3175f9d5 btrfs: don't stop integrity writeback too early
commit effa24f689 upstream.

extent_write_cache_pages stops writing pages as soon as nr_to_write hits
zero.  That is the right thing for opportunistic writeback, but incorrect
for data integrity writeback, which needs to ensure that no dirty pages
are left in the range.  Thus only stop the writeback for WB_SYNC_NONE
if nr_to_write hits 0.

This is a port of write_cache_pages changes in commit 05fe478dd0
("mm: write_cache_pages integrity fix").

Note that I've only trigger the problem with other changes to the btrfs
writeback code, but this condition seems worthwhile fixing anyway.

CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: David Sterba <dsterba@suse.com>
[ updated comment ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-16 18:21:02 +02:00
Filipe Manana 3d10481a90 btrfs: check if the transaction was aborted at btrfs_wait_for_commit()
[ Upstream commit bf7ecbe987 ]

At btrfs_wait_for_commit() we wait for a transaction to finish and then
always return 0 (success) without checking if it was aborted, in which
case the transaction didn't happen due to some critical error. Fix this
by checking if the transaction was aborted.

Fixes: 462045928b ("Btrfs: add START_SYNC, WAIT_SYNC ioctls")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-11 11:57:43 +02:00
Filipe Manana c5c797ccc3 btrfs: check for commit error at btrfs_attach_transaction_barrier()
commit b28ff3a7d7 upstream.

btrfs_attach_transaction_barrier() is used to get a handle pointing to the
current running transaction if the transaction has not started its commit
yet (its state is < TRANS_STATE_COMMIT_START). If the transaction commit
has started, then we wait for the transaction to commit and finish before
returning - however we completely ignore if the transaction was aborted
due to some error during its commit, we simply return ERR_PT(-ENOENT),
which makes the caller assume everything is fine and no errors happened.

This could make an fsync return success (0) to user space when in fact we
had a transaction abort and the target inode changes were therefore not
persisted.

Fix this by checking for the return value from btrfs_wait_for_commit(),
and if it returned an error, return it back to the caller.

Fixes: d4edf39bd5 ("Btrfs: fix uncompleted transaction")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-08-11 11:57:42 +02:00
Filipe Manana 52df40a5c7 btrfs: fix extent buffer leak after tree mod log failure at split_node()
[ Upstream commit ede600e497 ]

At split_node(), if we fail to log the tree mod log copy operation, we
return without unlocking the split extent buffer we just allocated and
without decrementing the reference we own on it. Fix this by unlocking
it and decrementing the ref count before returning.

Fixes: 5de865eebb ("Btrfs: fix tree mod logging")
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-11 11:57:31 +02:00
Filipe Manana 52403c3dad btrfs: fix race between quota disable and relocation
[ Upstream commit 8a4a0b2a3e ]

If we disable quotas while we have a relocation of a metadata block group
that has extents belonging to the quota root, we can cause the relocation
to fail with -ENOENT. This is because relocation builds backref nodes for
extents of the quota root and later needs to walk the backrefs and access
the quota root - however if in between a task disables quotas, it results
in deleting the quota root from the root tree (with btrfs_del_root(),
called from btrfs_quota_disable().

This can be sporadically triggered by test case btrfs/255 from fstests:

  $ ./check btrfs/255
  FSTYP         -- btrfs
  PLATFORM      -- Linux/x86_64 debian0 6.4.0-rc6-btrfs-next-134+ #1 SMP PREEMPT_DYNAMIC Thu Jun 15 11:59:28 WEST 2023
  MKFS_OPTIONS  -- /dev/sdc
  MOUNT_OPTIONS -- /dev/sdc /home/fdmanana/btrfs-tests/scratch_1

  btrfs/255 6s ... _check_dmesg: something found in dmesg (see /home/fdmanana/git/hub/xfstests/results//btrfs/255.dmesg)
  - output mismatch (see /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad)
#      --- tests/btrfs/255.out	2023-03-02 21:47:53.876609426 +0000
#      +++ /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad	2023-06-16 10:20:39.267563212 +0100
#      @@ -1,2 +1,4 @@
#       QA output created by 255
#      +ERROR: error during balancing '/home/fdmanana/btrfs-tests/scratch_1': No such file or directory
#      +There may be more info in syslog - try dmesg | tail
#       Silence is golden
#      ...
      (Run 'diff -u /home/fdmanana/git/hub/xfstests/tests/btrfs/255.out /home/fdmanana/git/hub/xfstests/results//btrfs/255.out.bad'  to see the entire diff)
  Ran: btrfs/255
  Failures: btrfs/255
  Failed 1 of 1 tests

To fix this make the quota disable operation take the cleaner mutex, as
relocation of a block group also takes this mutex. This is also what we
do when deleting a subvolume/snapshot, we take the cleaner mutex in the
cleaner kthread (at cleaner_kthread()) and then we call btrfs_del_root()
at btrfs_drop_snapshot() while under the protection of the cleaner mutex.

Fixes: bed92eae26 ("Btrfs: qgroup implementation and prototypes")
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-08-11 11:57:31 +02:00
Greg Kroah-Hartman 477f5e6b9e Merge 5.10.188 into android12-5.10-lts
Changes in 5.10.188
	media: atomisp: fix "variable dereferenced before check 'asd'"
	x86/smp: Use dedicated cache-line for mwait_play_dead()
	can: isotp: isotp_sendmsg(): fix return error fix on TX path
	video: imsttfb: check for ioremap() failures
	fbdev: imsttfb: Fix use after free bug in imsttfb_probe
	HID: wacom: Use ktime_t rather than int when dealing with timestamps
	HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651.
	Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe"
	scripts/tags.sh: Resolve gtags empty index generation
	drm/amdgpu: Validate VM ioctl flags.
	nubus: Partially revert proc_create_single_data() conversion
	fs: pipe: reveal missing function protoypes
	x86/resctrl: Only show tasks' pid in current pid namespace
	blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost
	md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
	md/raid10: fix overflow of md/safe_mode_delay
	md/raid10: fix wrong setting of max_corr_read_errors
	md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
	md/raid10: fix io loss while replacement replace rdev
	irqchip/jcore-aic: Kill use of irq_create_strict_mappings()
	irqchip/jcore-aic: Fix missing allocation of IRQ descriptors
	posix-timers: Prevent RT livelock in itimer_delete()
	tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode().
	clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe
	PM: domains: fix integer overflow issues in genpd_parse_state()
	perf/arm-cmn: Fix DTC reset
	powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
	ARM: 9303/1: kprobes: avoid missing-declaration warnings
	cpufreq: intel_pstate: Fix energy_performance_preference for passive
	thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe()
	rcuscale: Console output claims too few grace periods
	rcuscale: Always log error message
	rcuscale: Move shutdown from wait_event() to wait_event_idle()
	rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup()
	rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale
	perf/ibs: Fix interface via core pmu events
	x86/mm: Fix __swp_entry_to_pte() for Xen PV guests
	evm: Complete description of evm_inode_setattr()
	ima: Fix build warnings
	pstore/ram: Add check for kstrdup
	igc: Enable and fix RX hash usage by netstack
	wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation
	wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
	samples/bpf: Fix buffer overflow in tcp_basertt
	spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG
	wifi: wilc1000: fix for absent RSN capabilities WFA testcase
	wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan()
	bpf: Remove extra lock_sock for TCP_ZEROCOPY_RECEIVE
	sctp: add bpf_bypass_getsockopt proto callback
	libbpf: fix offsetof() and container_of() to work with CO-RE
	nfc: constify several pointers to u8, char and sk_buff
	nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect()
	bpftool: JIT limited misreported as negative value on aarch64
	regulator: core: Fix more error checking for debugfs_create_dir()
	regulator: core: Streamline debugfs operations
	wifi: orinoco: Fix an error handling path in spectrum_cs_probe()
	wifi: orinoco: Fix an error handling path in orinoco_cs_probe()
	wifi: atmel: Fix an error handling path in atmel_probe()
	wl3501_cs: Fix misspelling and provide missing documentation
	net: create netdev->dev_addr assignment helpers
	wl3501_cs: use eth_hw_addr_set()
	wifi: wl3501_cs: Fix an error handling path in wl3501_probe()
	wifi: ray_cs: Utilize strnlen() in parse_addr()
	wifi: ray_cs: Drop useless status variable in parse_addr()
	wifi: ray_cs: Fix an error handling path in ray_probe()
	wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
	wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled
	wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown
	watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config
	watchdog/perf: more properly prevent false positives with turbo modes
	kexec: fix a memory leak in crash_shrink_memory()
	memstick r592: make memstick_debug_get_tpc_name() static
	wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key()
	rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO
	wifi: iwlwifi: pull from TXQs with softirqs disabled
	wifi: cfg80211: rewrite merging of inherited elements
	wifi: ath9k: convert msecs to jiffies where needed
	igc: Fix race condition in PTP tx code
	net: stmmac: fix double serdes powerdown
	netlink: fix potential deadlock in netlink_set_err()
	netlink: do not hard code device address lenth in fdb dumps
	selftests: rtnetlink: remove netdevsim device after ipsec offload test
	gtp: Fix use-after-free in __gtp_encap_destroy().
	net: axienet: Move reset before 64-bit DMA detection
	sfc: fix crash when reading stats while NIC is resetting
	nfc: llcp: simplify llcp_sock_connect() error paths
	net: nfc: Fix use-after-free caused by nfc_llcp_find_local
	lib/ts_bm: reset initial match offset for every block of text
	netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
	netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value.
	ipvlan: Fix return value of ipvlan_queue_xmit()
	netlink: Add __sock_i_ino() for __netlink_diag_dump().
	radeon: avoid double free in ci_dpm_init()
	drm/amd/display: Explicitly specify update type per plane info change
	Input: drv260x - sleep between polling GO bit
	drm/bridge: tc358768: always enable HS video mode
	drm/bridge: tc358768: fix PLL parameters computation
	drm/bridge: tc358768: fix PLL target frequency
	drm/bridge: tc358768: fix TCLK_ZEROCNT computation
	drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation
	drm/bridge: tc358768: fix TCLK_TRAILCNT computation
	drm/bridge: tc358768: fix THS_ZEROCNT computation
	drm/bridge: tc358768: fix TXTAGOCNT computation
	drm/bridge: tc358768: fix THS_TRAILCNT computation
	drm/vram-helper: fix function names in vram helper doc
	ARM: dts: BCM5301X: Drop "clock-names" from the SPI node
	ARM: dts: meson8b: correct uart_B and uart_C clock references
	Input: adxl34x - do not hardcode interrupt trigger type
	drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks`
	drm/panel: sharp-ls043t1le01: adjust mode settings
	ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards
	bus: ti-sysc: Fix dispc quirk masking bool variables
	arm64: dts: microchip: sparx5: do not use PSCI on reference boards
	RDMA/bnxt_re: Disable/kill tasklet only if it is enabled
	RDMA/bnxt_re: Fix to remove unnecessary return labels
	RDMA/bnxt_re: Use unique names while registering interrupts
	RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid
	RDMA/bnxt_re: Fix to remove an unnecessary log
	ARM: dts: gta04: Move model property out of pinctrl node
	arm64: dts: qcom: msm8916: correct camss unit address
	arm64: dts: qcom: msm8994: correct SPMI unit address
	arm64: dts: qcom: msm8996: correct camss unit address
	drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H
	ARM: ep93xx: fix missing-prototype warnings
	ARM: omap2: fix missing tick_broadcast() prototype
	arm64: dts: qcom: apq8096: fix fixed regulator name property
	ARM: dts: stm32: Shorten the AV96 HDMI sound card name
	memory: brcmstb_dpfe: fix testing array offset after use
	ASoC: es8316: Increment max value for ALC Capture Target Volume control
	ASoC: es8316: Do not set rate constraints for unsupported MCLKs
	ARM: dts: meson8: correct uart_B and uart_C clock references
	soc/fsl/qe: fix usb.c build errors
	IB/hfi1: Use bitmap_zalloc() when applicable
	IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors
	IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate
	RDMA: Remove uverbs_ex_cmd_mask values that are linked to functions
	RDMA/hns: Fix coding style issues
	RDMA/hns: Use refcount_t APIs for HEM
	RDMA/hns: Clean the hardware related code for HEM
	RDMA/hns: Fix hns_roce_table_get return value
	ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier
	arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1
	fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe()
	arm64: dts: ti: k3-j7200: Fix physical address of pin
	ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2
	ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx
	hwmon: (gsc-hwmon) fix fan pwm temperature scaling
	hwmon: (adm1275) enable adm1272 temperature reporting
	hwmon: (adm1275) Allow setting sample averaging
	hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272
	ARM: dts: BCM5301X: fix duplex-full => full-duplex
	drm/amdkfd: Fix potential deallocation of previously deallocated memory.
	drm/radeon: fix possible division-by-zero errors
	amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
	RDMA/bnxt_re: wraparound mbox producer index
	RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context
	clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
	clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()
	clk: tegra: tegra124-emc: Fix potential memory leak
	ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
	drm/msm/dpu: do not enable color-management if DSPPs are not available
	drm/msm/dp: Free resources after unregistering them
	clk: vc5: check memory returned by kasprintf()
	clk: cdce925: check return value of kasprintf()
	clk: si5341: Allow different output VDD_SEL values
	clk: si5341: Add sysfs properties to allow checking/resetting device faults
	clk: si5341: return error if one synth clock registration fails
	clk: si5341: check return value of {devm_}kasprintf()
	clk: si5341: free unused memory on probe failure
	clk: keystone: sci-clk: check return value of kasprintf()
	clk: ti: clkctrl: check return value of kasprintf()
	drivers: meson: secure-pwrc: always enable DMA domain
	ovl: update of dentry revalidate flags after copy up
	ASoC: imx-audmix: check return value of devm_kasprintf()
	PCI: cadence: Fix Gen2 Link Retraining process
	scsi: qedf: Fix NULL dereference in error handling
	pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors
	PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free
	scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe()
	PCI: pciehp: Cancel bringup sequence if card is not present
	PCI: ftpci100: Release the clock resources
	PCI: Add pci_clear_master() stub for non-CONFIG_PCI
	perf bench: Use unbuffered output when pipe/tee'ing to a file
	perf bench: Add missing setlocale() call to allow usage of %'d style formatting
	pinctrl: cherryview: Return correct value if pin in push-pull mode
	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures
	perf script: Fixup 'struct evsel_script' method prefix
	perf script: Fix allocation of evsel->priv related to per-event dump files
	perf dwarf-aux: Fix off-by-one in die_get_varname()
	pinctrl: at91-pio4: check return value of devm_kasprintf()
	powerpc/powernv/sriov: perform null check on iov before dereferencing iov
	mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t *
	mm: rename p4d_page_vaddr to p4d_pgtable and make it return pud_t *
	powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo
	powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary
	hwrng: virtio - add an internal buffer
	hwrng: virtio - don't wait on cleanup
	hwrng: virtio - don't waste entropy
	hwrng: virtio - always add a pending request
	hwrng: virtio - Fix race on data_avail and actual data
	crypto: nx - fix build warnings when DEBUG_FS is not enabled
	modpost: fix section mismatch message for R_ARM_ABS32
	modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24}
	crypto: marvell/cesa - Fix type mismatch warning
	modpost: fix off by one in is_executable_section()
	ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard
	NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION
	dax: Fix dax_mapping_release() use after free
	dax: Introduce alloc_dev_dax_id()
	hwrng: st - keep clock enabled while hwrng is registered
	io_uring: ensure IOPOLL locks around deferred work
	USB: serial: option: add LARA-R6 01B PIDs
	usb: dwc3: gadget: Propagate core init errors to UDC during pullup
	phy: tegra: xusb: Clear the driver reference in usb-phy dev
	block: fix signed int overflow in Amiga partition support
	block: change all __u32 annotations to __be32 in affs_hardblocks.h
	SUNRPC: Fix UAF in svc_tcp_listen_data_ready()
	w1: w1_therm: fix locking behavior in convert_t
	w1: fix loop in w1_fini()
	sh: j2: Use ioremap() to translate device tree address into kernel memory
	serial: 8250: omap: Fix freeing of resources on failed register
	clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks
	media: usb: Check az6007_read() return value
	media: videodev2.h: Fix struct v4l2_input tuner index comment
	media: usb: siano: Fix warning due to null work_func_t function pointer
	clk: qcom: reset: Allow specifying custom reset delay
	clk: qcom: reset: support resetting multiple bits
	clk: qcom: ipq6018: fix networking resets
	usb: dwc3: qcom: Fix potential memory leak
	usb: gadget: u_serial: Add null pointer check in gserial_suspend
	extcon: Fix kernel doc of property fields to avoid warnings
	extcon: Fix kernel doc of property capability fields to avoid warnings
	usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()
	usb: hide unused usbfs_notify_suspend/resume functions
	serial: 8250: lock port for stop_rx() in omap8250_irq()
	serial: 8250: lock port for UART_IER access in omap8250_irq()
	kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR
	coresight: Fix loss of connection info when a module is unloaded
	mfd: rt5033: Drop rt5033-battery sub-device
	media: venus: helpers: Fix ALIGN() of non power of two
	media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var()
	KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes
	usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove()
	usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe()
	usb: common: usb-conn-gpio: Set last role to unknown before initial detection
	usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe()
	mfd: intel-lpss: Add missing check for platform_get_resource
	Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection"
	serial: 8250_omap: Use force_suspend and resume for system suspend
	test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation
	mfd: stmfx: Fix error path in stmfx_chip_init
	mfd: stmfx: Nullify stmfx->vdd in case of error
	KVM: s390: vsie: fix the length of APCB bitmap
	mfd: stmpe: Only disable the regulators if they are enabled
	phy: tegra: xusb: check return value of devm_kzalloc()
	pwm: imx-tpm: force 'real_period' to be zero in suspend
	pwm: sysfs: Do not apply state to already disabled PWMs
	rtc: st-lpc: Release some resources in st_rtc_probe() in case of error
	media: cec: i2c: ch7322: also select REGMAP
	sctp: fix potential deadlock on &net->sctp.addr_wq_lock
	Add MODULE_FIRMWARE() for FIRMWARE_TG357766.
	net: dsa: vsc73xx: fix MTU configuration
	spi: bcm-qspi: return error if neither hif_mspi nor mspi is available
	mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
	f2fs: fix error path handling in truncate_dnode()
	octeontx2-af: Fix mapping for NIX block from CGX connection
	powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y
	net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode
	tcp: annotate data races in __tcp_oow_rate_limited()
	xsk: Honor SO_BINDTODEVICE on bind
	net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX
	pptp: Fix fib lookup calls.
	net: dsa: tag_sja1105: fix MAC DA patching from meta frames
	s390/qeth: Fix vipa deletion
	sh: dma: Fix DMA channel offset calculation
	apparmor: fix missing error check for rhashtable_insert_fast
	i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process()
	i2c: xiic: Don't try to handle more interrupt events after error
	ALSA: jack: Fix mutex call in snd_jack_report()
	i2c: qup: Add missing unwind goto in qup_i2c_probe()
	NFSD: add encoding of op_recall flag for write delegation
	io_uring: wait interruptibly for request completions on exit
	mmc: core: disable TRIM on Kingston EMMC04G-M627
	mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M
	mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS
	mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used.
	bcache: fixup btree_cache_wait list damage
	bcache: Remove unnecessary NULL point check in node allocations
	bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent
	um: Use HOST_DIR for mrproper
	integrity: Fix possible multiple allocation in integrity_inode_get()
	autofs: use flexible array in ioctl structure
	shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs
	jffs2: reduce stack usage in jffs2_build_xattr_subsystem()
	fs: avoid empty option when generating legacy mount string
	ext4: Remove ext4 locking of moved directory
	Revert "f2fs: fix potential corruption when moving a directory"
	fs: Establish locking order for unrelated directories
	fs: Lock moved directories
	btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
	btrfs: fix race when deleting quota root from the dirty cow roots list
	ASoC: mediatek: mt8173: Fix irq error path
	ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path
	ARM: orion5x: fix d2net gpio initialization
	leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename
	fs: no need to check source
	fanotify: disallow mount/sb marks on kernel internal pseudo fs
	tpm, tpm_tis: Claim locality in interrupt handler
	selftests/bpf: Add verifier test for PTR_TO_MEM spill
	block: add overflow checks for Amiga partition support
	sh: pgtable-3level: Fix cast to pointer from integer of different size
	netfilter: nf_tables: use net_generic infra for transaction data
	netfilter: nf_tables: add rescheduling points during loop detection walks
	netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE
	netfilter: nf_tables: fix chain binding transaction logic
	netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain
	netfilter: nf_tables: reject unbound anonymous set before commit phase
	netfilter: nf_tables: reject unbound chain set before commit phase
	netfilter: nftables: rename set element data activation/deactivation functions
	netfilter: nf_tables: drop map element references from preparation phase
	netfilter: nf_tables: unbind non-anonymous set if rule construction fails
	netfilter: nf_tables: fix scheduling-while-atomic splat
	netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
	netfilter: nf_tables: do not ignore genmask when looking up chain by id
	netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
	wireguard: queueing: use saner cpu selection wrapping
	wireguard: netlink: send staged packets when setting initial private key
	tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
	rcu-tasks: Mark ->trc_reader_nesting data races
	rcu-tasks: Mark ->trc_reader_special.b.need_qs data races
	rcu-tasks: Simplify trc_read_check_handler() atomic operations
	block/partition: fix signedness issue for Amiga partitions
	io_uring: Use io_schedule* in cqring wait
	io_uring: add reschedule point to handle_tw_list()
	net: lan743x: Don't sleep in atomic context
	workqueue: clean up WORK_* constant types, clarify masking
	drm/panel: simple: Add connector_type for innolux_at043tn24
	drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags
	igc: Remove delay during TX ring configuration
	net/mlx5e: fix double free in mlx5e_destroy_flow_table
	net/mlx5e: Check for NOT_READY flag state after locking
	igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings
	scsi: qla2xxx: Fix error code in qla2x00_start_sp()
	net: mvneta: fix txq_map in case of txq_number==1
	net/sched: cls_fw: Fix improper refcount update leads to use-after-free
	gve: Set default duplex configuration to full
	ionic: remove WARN_ON to prevent panic_on_warn
	net: bgmac: postpone turning IRQs off to avoid SoC hangs
	net: prevent skb corruption on frag list segmentation
	icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().
	udp6: fix udp6_ehashfn() typo
	ntb: idt: Fix error handling in idt_pci_driver_init()
	NTB: amd: Fix error handling in amd_ntb_pci_driver_init()
	ntb: intel: Fix error handling in intel_ntb_pci_driver_init()
	NTB: ntb_transport: fix possible memory leak while device_register() fails
	NTB: ntb_tool: Add check for devm_kcalloc
	ipv6/addrconf: fix a potential refcount underflow for idev
	platform/x86: wmi: remove unnecessary argument
	platform/x86: wmi: use guid_t and guid_equal()
	platform/x86: wmi: move variables
	platform/x86: wmi: Break possible infinite loop when parsing GUID
	igc: Fix launchtime before start of cycle
	igc: Fix inserting of empty frame for launchtime
	riscv: bpf: Move bpf_jit_alloc_exec() and bpf_jit_free_exec() to core
	riscv: bpf: Avoid breaking W^X
	bpf, riscv: Support riscv jit to provide bpf_line_info
	riscv, bpf: Fix inconsistent JIT image generation
	erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF
	wifi: airo: avoid uninitialized warning in airo_get_rate()
	net/sched: flower: Ensure both minimum and maximum ports are specified
	netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write()
	net/sched: make psched_mtu() RTNL-less safe
	net/sched: sch_qfq: refactor parsing of netlink parameters
	net/sched: sch_qfq: account for stab overhead in qfq_enqueue
	nvme-pci: fix DMA direction of unmapping integrity data
	f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
	pinctrl: amd: Fix mistake in handling clearing pins at startup
	pinctrl: amd: Detect internal GPIO0 debounce handling
	pinctrl: amd: Only use special debounce behavior for GPIO 0
	tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
	mtd: rawnand: meson: fix unaligned DMA buffers handling
	net: bcmgenet: Ensure MDIO unregistration has clocks enabled
	powerpc: Fail build if using recordmcount with binutils v2.37
	misc: fastrpc: Create fastrpc scalar with correct buffer count
	erofs: fix compact 4B support for 16k block size
	MIPS: Loongson: Fix cpu_probe_loongson() again
	ext4: Fix reusing stale buffer heads from last failed mounting
	ext4: fix wrong unit use in ext4_mb_clear_bb
	ext4: get block from bh in ext4_free_blocks for fast commit replay
	ext4: fix wrong unit use in ext4_mb_new_blocks
	ext4: only update i_reserved_data_blocks on successful block allocation
	jfs: jfs_dmap: Validate db_l2nbperpage while mounting
	hwrng: imx-rngc - fix the timeout for init and self check
	PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold
	PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
	PCI: qcom: Disable write access to read only registers for IP v2.3.3
	PCI: rockchip: Assert PCI Configuration Enable bit after probe
	PCI: rockchip: Write PCI Device ID to correct register
	PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked
	PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core
	PCI: rockchip: Use u32 variable to access 32-bit registers
	PCI: rockchip: Set address alignment for endpoint mode
	misc: pci_endpoint_test: Free IRQs before removing the device
	misc: pci_endpoint_test: Re-init completion for every test
	md/raid0: add discard support for the 'original' layout
	fs: dlm: return positive pid value for F_GETLK
	drm/atomic: Allow vblank-enabled + self-refresh "disable"
	drm/rockchip: vop: Leave vblank enabled in self-refresh
	drm/amd/display: Correct `DMUB_FW_VERSION` macro
	serial: atmel: don't enable IRQs prematurely
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
	tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk
	firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool()
	ceph: don't let check_caps skip sending responses for revoke msgs
	xhci: Fix resume issue of some ZHAOXIN hosts
	xhci: Fix TRB prefetch issue of ZHAOXIN hosts
	xhci: Show ZHAOXIN xHCI root hub speed correctly
	meson saradc: fix clock divider mask length
	Revert "8250: add support for ASIX devices with a FIFO bug"
	s390/decompressor: fix misaligned symbol build error
	tracing/histograms: Add histograms to hist_vars if they have referenced variables
	samples: ftrace: Save required argument registers in sample trampolines
	net: ena: fix shift-out-of-bounds in exponential backoff
	ring-buffer: Fix deadloop issue on reading trace_pipe
	xtensa: ISS: fix call to split_if_spec
	tracing: Fix null pointer dereference in tracing_err_log_open()
	tracing/probes: Fix not to count error code to total length
	scsi: qla2xxx: Wait for io return on terminate rport
	scsi: qla2xxx: Array index may go out of bound
	scsi: qla2xxx: Fix buffer overrun
	scsi: qla2xxx: Fix potential NULL pointer dereference
	scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
	scsi: qla2xxx: Correct the index of array
	scsi: qla2xxx: Pointer may be dereferenced
	scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
	net/sched: sch_qfq: reintroduce lmax bound check for MTU
	RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests
	drm/atomic: Fix potential use-after-free in nonblocking commits
	ALSA: hda/realtek - remove 3k pull low procedure
	ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx
	keys: Fix linking a duplicate key to a keyring's assoc_array
	perf probe: Add test for regression introduced by switch to die_get_decl_file()
	btrfs: fix warning when putting transaction with qgroups enabled after abort
	fuse: revalidate: don't invalidate if interrupted
	selftests: tc: set timeout to 15 minutes
	selftests: tc: add 'ct' action kconfig dep
	regmap: Drop initial version of maximum transfer length fixes
	regmap: Account for register length in SMBus I/O limits
	can: bcm: Fix UAF in bcm_proc_show()
	drm/client: Fix memory leak in drm_client_target_cloned
	drm/client: Fix memory leak in drm_client_modeset_probe
	ASoC: fsl_sai: Disable bit clock with transmitter
	ext4: correct inline offset when handling xattrs in inode body
	debugobjects: Recheck debug_objects_enabled before reporting
	nbd: Add the maximum limit of allocated index in nbd_dev_add
	md: fix data corruption for raid456 when reshape restart while grow up
	md/raid10: prevent soft lockup while flush writes
	posix-timers: Ensure timer ID search-loop limit is valid
	btrfs: add xxhash to fast checksum implementations
	ACPI: button: Add lid disable DMI quirk for Nextbook Ares 8A
	ACPI: video: Add backlight=native DMI quirk for Apple iMac11,3
	ACPI: video: Add backlight=native DMI quirk for Lenovo ThinkPad X131e (3371 AMD version)
	arm64: set __exception_irq_entry with __irq_entry as a default
	arm64: mm: fix VA-range sanity check
	sched/fair: Don't balance task to its current running CPU
	wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range
	bpf: Address KCSAN report on bpf_lru_list
	devlink: report devlink_port_type_warn source device
	wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point()
	wifi: iwlwifi: mvm: avoid baid size integer overflow
	igb: Fix igb_down hung on surprise removal
	spi: bcm63xx: fix max prepend length
	fbdev: imxfb: warn about invalid left/right margin
	pinctrl: amd: Use amd_pinconf_set() for all config options
	net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field()
	bridge: Add extack warning when enabling STP in netns.
	iavf: Fix use-after-free in free_netdev
	iavf: Fix out-of-bounds when setting channels on remove
	security: keys: Modify mismatched function name
	octeontx2-pf: Dont allocate BPIDs for LBK interfaces
	tcp: annotate data-races around tcp_rsk(req)->ts_recent
	net: ipv4: Use kfree_sensitive instead of kfree
	net:ipv6: check return value of pskb_trim()
	Revert "tcp: avoid the lookup process failing to get sk in ehash table"
	fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe
	llc: Don't drop packet from non-root netns.
	netfilter: nf_tables: fix spurious set element insertion failure
	netfilter: nf_tables: can't schedule in nft_chain_validate
	netfilter: nft_set_pipapo: fix improper element removal
	netfilter: nf_tables: skip bound chain in netns release path
	netfilter: nf_tables: skip bound chain on rule flush
	tcp: annotate data-races around tp->tcp_tx_delay
	tcp: annotate data-races around tp->keepalive_time
	tcp: annotate data-races around tp->keepalive_intvl
	tcp: annotate data-races around tp->keepalive_probes
	net: Introduce net.ipv4.tcp_migrate_req.
	tcp: Fix data-races around sysctl_tcp_syn(ack)?_retries.
	tcp: annotate data-races around icsk->icsk_syn_retries
	tcp: annotate data-races around tp->linger2
	tcp: annotate data-races around rskq_defer_accept
	tcp: annotate data-races around tp->notsent_lowat
	tcp: annotate data-races around icsk->icsk_user_timeout
	tcp: annotate data-races around fastopenq.max_qlen
	net: phy: prevent stale pointer dereference in phy_init()
	tracing/histograms: Return an error if we fail to add histogram to hist_vars list
	tracing: Fix memory leak of iter->temp when reading trace_pipe
	ftrace: Store the order of pages allocated in ftrace_page
	ftrace: Fix possible warning on checking all pages used in ftrace_process_locs()
	Linux 5.10.188

Change-Id: Ibcc1adc43df5b8f649b12078eedd5d4f57de4578
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-08-03 11:23:27 +00:00
David Sterba ae51eb90bc btrfs: add xxhash to fast checksum implementations
[ Upstream commit efcfcbc6a3 ]

The implementation of XXHASH is now CPU only but still fast enough to be
considered for the synchronous checksumming, like non-generic crc32c.

A userspace benchmark comparing it to various implementations (patched
hash-speedtest from btrfs-progs):

  Block size:     4096
  Iterations:     1000000
  Implementation: builtin
  Units:          CPU cycles

	NULL-NOP: cycles:     73384294, cycles/i       73
     NULL-MEMCPY: cycles:    228033868, cycles/i      228,    61664.320 MiB/s
      CRC32C-ref: cycles:  24758559416, cycles/i    24758,      567.950 MiB/s
       CRC32C-NI: cycles:   1194350470, cycles/i     1194,    11773.433 MiB/s
  CRC32C-ADLERSW: cycles:   6150186216, cycles/i     6150,     2286.372 MiB/s
  CRC32C-ADLERHW: cycles:    626979180, cycles/i      626,    22427.453 MiB/s
      CRC32C-PCL: cycles:    466746732, cycles/i      466,    30126.699 MiB/s
	  XXHASH: cycles:    860656400, cycles/i      860,    16338.188 MiB/s

Comparing purely software implementation (ref), current outdated
accelerated using crc32q instruction (NI), optimized implementations by
M. Adler (https://stackoverflow.com/questions/17645167/implementing-sse-4-2s-crc32c-in-software/17646775#17646775)
and the best one that was taken from kernel using the PCLMULQDQ
instruction (PCL).

Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-07-27 08:44:37 +02:00
Filipe Manana d2c667cc18 btrfs: fix warning when putting transaction with qgroups enabled after abort
commit aa84ce8a78 upstream.

If we have a transaction abort with qgroups enabled we get a warning
triggered when doing the final put on the transaction, like this:

  [552.6789] ------------[ cut here ]------------
  [552.6815] WARNING: CPU: 4 PID: 81745 at fs/btrfs/transaction.c:144 btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6817] Modules linked in: btrfs blake2b_generic xor (...)
  [552.6819] CPU: 4 PID: 81745 Comm: btrfs-transacti Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [552.6819] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-0-gea1b7a073390-prebuilt.qemu.org 04/01/2014
  [552.6819] RIP: 0010:btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6821] Code: bd a0 01 00 (...)
  [552.6821] RSP: 0018:ffffa168c0527e28 EFLAGS: 00010286
  [552.6821] RAX: ffff936042caed00 RBX: ffff93604a3eb448 RCX: 0000000000000000
  [552.6821] RDX: ffff93606421b028 RSI: ffffffff92ff0878 RDI: ffff93606421b010
  [552.6821] RBP: ffff93606421b000 R08: 0000000000000000 R09: ffffa168c0d07c20
  [552.6821] R10: 0000000000000000 R11: ffff93608dc52950 R12: ffffa168c0527e70
  [552.6821] R13: ffff93606421b000 R14: ffff93604a3eb420 R15: ffff93606421b028
  [552.6821] FS:  0000000000000000(0000) GS:ffff93675fb00000(0000) knlGS:0000000000000000
  [552.6821] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [552.6821] CR2: 0000558ad262b000 CR3: 000000014feda005 CR4: 0000000000370ee0
  [552.6822] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [552.6822] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [552.6822] Call Trace:
  [552.6822]  <TASK>
  [552.6822]  ? __warn+0x80/0x130
  [552.6822]  ? btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6824]  ? report_bug+0x1f4/0x200
  [552.6824]  ? handle_bug+0x42/0x70
  [552.6824]  ? exc_invalid_op+0x14/0x70
  [552.6824]  ? asm_exc_invalid_op+0x16/0x20
  [552.6824]  ? btrfs_put_transaction+0x123/0x130 [btrfs]
  [552.6826]  btrfs_cleanup_transaction+0xe7/0x5e0 [btrfs]
  [552.6828]  ? _raw_spin_unlock_irqrestore+0x23/0x40
  [552.6828]  ? try_to_wake_up+0x94/0x5e0
  [552.6828]  ? __pfx_process_timeout+0x10/0x10
  [552.6828]  transaction_kthread+0x103/0x1d0 [btrfs]
  [552.6830]  ? __pfx_transaction_kthread+0x10/0x10 [btrfs]
  [552.6832]  kthread+0xee/0x120
  [552.6832]  ? __pfx_kthread+0x10/0x10
  [552.6832]  ret_from_fork+0x29/0x50
  [552.6832]  </TASK>
  [552.6832] ---[ end trace 0000000000000000 ]---

This corresponds to this line of code:

  void btrfs_put_transaction(struct btrfs_transaction *transaction)
  {
      (...)
          WARN_ON(!RB_EMPTY_ROOT(
                          &transaction->delayed_refs.dirty_extent_root));
      (...)
  }

The warning happens because btrfs_qgroup_destroy_extent_records(), called
in the transaction abort path, we free all entries from the rbtree
"dirty_extent_root" with rbtree_postorder_for_each_entry_safe(), but we
don't actually empty the rbtree - it's still pointing to nodes that were
freed.

So set the rbtree's root node to NULL to avoid this warning (assign
RB_ROOT).

Fixes: 81f7eb00ff ("btrfs: destroy qgroup extent records on transaction abort")
CC: stable@vger.kernel.org # 5.10+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-27 08:44:34 +02:00
Filipe Manana 6819bb0b85 btrfs: fix race when deleting quota root from the dirty cow roots list
commit b31cb5a6eb upstream.

When disabling quotas we are deleting the quota root from the list
fs_info->dirty_cowonly_roots without taking the lock that protects it,
which is struct btrfs_fs_info::trans_lock. This unsynchronized list
manipulation may cause chaos if there's another concurrent manipulation
of this list, such as when adding a root to it with
ctree.c:add_root_to_dirty_list().

This can result in all sorts of weird failures caused by a race, such as
the following crash:

  [337571.278245] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] PREEMPT SMP PTI
  [337571.278933] CPU: 1 PID: 115447 Comm: btrfs Tainted: G        W          6.4.0-rc6-btrfs-next-134+ #1
  [337571.279153] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
  [337571.279572] RIP: 0010:commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.279928] Code: 85 38 06 00 (...)
  [337571.280363] RSP: 0018:ffff9f63446efba0 EFLAGS: 00010206
  [337571.280582] RAX: ffff942d98ec2638 RBX: ffff9430b82b4c30 RCX: 0000000449e1c000
  [337571.280798] RDX: dead000000000100 RSI: ffff9430021e4900 RDI: 0000000000036070
  [337571.281015] RBP: ffff942d98ec2000 R08: ffff942d98ec2000 R09: 000000000000015b
  [337571.281254] R10: 0000000000000009 R11: 0000000000000001 R12: ffff942fe8fbf600
  [337571.281476] R13: ffff942dabe23040 R14: ffff942dabe20800 R15: ffff942d92cf3b48
  [337571.281723] FS:  00007f478adb7340(0000) GS:ffff94349fa40000(0000) knlGS:0000000000000000
  [337571.281950] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [337571.282184] CR2: 00007f478ab9a3d5 CR3: 000000001e02c001 CR4: 0000000000370ee0
  [337571.282416] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  [337571.282647] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
  [337571.282874] Call Trace:
  [337571.283101]  <TASK>
  [337571.283327]  ? __die_body+0x1b/0x60
  [337571.283570]  ? die_addr+0x39/0x60
  [337571.283796]  ? exc_general_protection+0x22e/0x430
  [337571.284022]  ? asm_exc_general_protection+0x22/0x30
  [337571.284251]  ? commit_cowonly_roots+0x11f/0x250 [btrfs]
  [337571.284531]  btrfs_commit_transaction+0x42e/0xf90 [btrfs]
  [337571.284803]  ? _raw_spin_unlock+0x15/0x30
  [337571.285031]  ? release_extent_buffer+0x103/0x130 [btrfs]
  [337571.285305]  reset_balance_state+0x152/0x1b0 [btrfs]
  [337571.285578]  btrfs_balance+0xa50/0x11e0 [btrfs]
  [337571.285864]  ? __kmem_cache_alloc_node+0x14a/0x410
  [337571.286086]  btrfs_ioctl+0x249a/0x3320 [btrfs]
  [337571.286358]  ? mod_objcg_state+0xd2/0x360
  [337571.286577]  ? refill_obj_stock+0xb0/0x160
  [337571.286798]  ? seq_release+0x25/0x30
  [337571.287016]  ? __rseq_handle_notify_resume+0x3ba/0x4b0
  [337571.287235]  ? percpu_counter_add_batch+0x2e/0xa0
  [337571.287455]  ? __x64_sys_ioctl+0x88/0xc0
  [337571.287675]  __x64_sys_ioctl+0x88/0xc0
  [337571.287901]  do_syscall_64+0x38/0x90
  [337571.288126]  entry_SYSCALL_64_after_hwframe+0x72/0xdc
  [337571.288352] RIP: 0033:0x7f478aaffe9b

So fix this by locking struct btrfs_fs_info::trans_lock before deleting
the quota root from that list.

Fixes: bed92eae26 ("Btrfs: qgroup implementation and prototypes")
CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-27 08:44:14 +02:00
Matt Corallo a3fbd156bd btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile
commit 160fe8f6fd upstream.

Callers of `btrfs_reduce_alloc_profile` expect it to return exactly
one allocation profile flag, and failing to do so may ultimately
result in a WARN_ON and remount-ro when allocating new blocks, like
the below transaction abort on 6.1.

`btrfs_reduce_alloc_profile` has two ways of determining the profile,
first it checks if a conversion balance is currently running and
uses the profile we're converting to. If no balance is currently
running, it returns the max-redundancy profile which at least one
block in the selected block group has.

This works by simply checking each known allocation profile bit in
redundancy order. However, `btrfs_reduce_alloc_profile` has not been
updated as new flags have been added - first with the `DUP` profile
and later with the RAID1C34 profiles.

Because of the way it checks, if we have blocks with different
profiles and at least one is known, that profile will be selected.
However, if none are known we may return a flag set with multiple
allocation profiles set.

This is currently only possible when a balance from one of the three
unhandled profiles to another of the unhandled profiles is canceled
after allocating at least one block using the new profile.

In that case, a transaction abort like the below will occur and the
filesystem will need to be mounted with -o skip_balance to get it
mounted rw again (but the balance cannot be resumed without a
similar abort).

  [770.648] ------------[ cut here ]------------
  [770.648] BTRFS: Transaction aborted (error -22)
  [770.648] WARNING: CPU: 43 PID: 1159593 at fs/btrfs/extent-tree.c:4122 find_free_extent+0x1d94/0x1e00 [btrfs]
  [770.648] CPU: 43 PID: 1159593 Comm: btrfs Tainted: G        W 6.1.0-0.deb11.7-powerpc64le #1  Debian 6.1.20-2~bpo11+1a~test
  [770.648] Hardware name: T2P9D01 REV 1.00 POWER9 0x4e1202 opal:skiboot-bc106a0 PowerNV
  [770.648] NIP:  c00800000f6784fc LR: c00800000f6784f8 CTR: c000000000d746c0
  [770.648] REGS: c000200089afe9a0 TRAP: 0700   Tainted: G        W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
  [770.648] MSR:  9000000002029033 <SF,HV,VEC,EE,ME,IR,DR,RI,LE>  CR: 28848282  XER: 20040000
  [770.648] CFAR: c000000000135110 IRQMASK: 0
	    GPR00: c00800000f6784f8 c000200089afec40 c00800000f7ea800 0000000000000026
	    GPR04: 00000001004820c2 c000200089afea00 c000200089afe9f8 0000000000000027
	    GPR08: c000200ffbfe7f98 c000000002127f90 ffffffffffffffd8 0000000026d6a6e8
	    GPR12: 0000000028848282 c000200fff7f3800 5deadbeef0000122 c00000002269d000
	    GPR16: c0002008c7797c40 c000200089afef17 0000000000000000 0000000000000000
	    GPR20: 0000000000000000 0000000000000001 c000200008bc5a98 0000000000000001
	    GPR24: 0000000000000000 c0000003c73088d0 c000200089afef17 c000000016d3a800
	    GPR28: c0000003c7308800 c00000002269d000 ffffffffffffffea 0000000000000001
  [770.648] NIP [c00800000f6784fc] find_free_extent+0x1d94/0x1e00 [btrfs]
  [770.648] LR [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs]
  [770.648] Call Trace:
  [770.648] [c000200089afec40] [c00800000f6784f8] find_free_extent+0x1d90/0x1e00 [btrfs] (unreliable)
  [770.648] [c000200089afed30] [c00800000f681398] btrfs_reserve_extent+0x1a0/0x2f0 [btrfs]
  [770.648] [c000200089afeea0] [c00800000f681bf0] btrfs_alloc_tree_block+0x108/0x670 [btrfs]
  [770.648] [c000200089afeff0] [c00800000f66bd68] __btrfs_cow_block+0x170/0x850 [btrfs]
  [770.648] [c000200089aff100] [c00800000f66c58c] btrfs_cow_block+0x144/0x288 [btrfs]
  [770.648] [c000200089aff1b0] [c00800000f67113c] btrfs_search_slot+0x6b4/0xcb0 [btrfs]
  [770.648] [c000200089aff2a0] [c00800000f679f60] lookup_inline_extent_backref+0x128/0x7c0 [btrfs]
  [770.648] [c000200089aff3b0] [c00800000f67b338] lookup_extent_backref+0x70/0x190 [btrfs]
  [770.648] [c000200089aff470] [c00800000f67b54c] __btrfs_free_extent+0xf4/0x1490 [btrfs]
  [770.648] [c000200089aff5a0] [c00800000f67d770] __btrfs_run_delayed_refs+0x328/0x1530 [btrfs]
  [770.648] [c000200089aff740] [c00800000f67ea2c] btrfs_run_delayed_refs+0xb4/0x3e0 [btrfs]
  [770.648] [c000200089aff800] [c00800000f699aa4] btrfs_commit_transaction+0x8c/0x12b0 [btrfs]
  [770.648] [c000200089aff8f0] [c00800000f6dc628] reset_balance_state+0x1c0/0x290 [btrfs]
  [770.648] [c000200089aff9a0] [c00800000f6e2f7c] btrfs_balance+0x1164/0x1500 [btrfs]
  [770.648] [c000200089affb40] [c00800000f6f8e4c] btrfs_ioctl+0x2b54/0x3100 [btrfs]
  [770.648] [c000200089affc80] [c00000000053be14] sys_ioctl+0x794/0x1310
  [770.648] [c000200089affd70] [c00000000002af98] system_call_exception+0x138/0x250
  [770.648] [c000200089affe10] [c00000000000c654] system_call_common+0xf4/0x258
  [770.648] --- interrupt: c00 at 0x7fff94126800
  [770.648] NIP:  00007fff94126800 LR: 0000000107e0b594 CTR: 0000000000000000
  [770.648] REGS: c000200089affe80 TRAP: 0c00   Tainted: G        W (6.1.0-0.deb11.7-powerpc64le Debian 6.1.20-2~bpo11+1a~test)
  [770.648] MSR:  900000000000d033 <SF,HV,EE,PR,ME,IR,DR,RI,LE>  CR: 24002848  XER: 00000000
  [770.648] IRQMASK: 0
	    GPR00: 0000000000000036 00007fffc9439da0 00007fff94217100 0000000000000003
	    GPR04: 00000000c4009420 00007fffc9439ee8 0000000000000000 0000000000000000
	    GPR08: 00000000803c7416 0000000000000000 0000000000000000 0000000000000000
	    GPR12: 0000000000000000 00007fff9467d120 0000000107e64c9c 0000000107e64d0a
	    GPR16: 0000000107e64d06 0000000107e64cf1 0000000107e64cc4 0000000107e64c73
	    GPR20: 0000000107e64c31 0000000107e64bf1 0000000107e64be7 0000000000000000
	    GPR24: 0000000000000000 00007fffc9439ee0 0000000000000003 0000000000000001
	    GPR28: 00007fffc943f713 0000000000000000 00007fffc9439ee8 0000000000000000
  [770.648] NIP [00007fff94126800] 0x7fff94126800
  [770.648] LR [0000000107e0b594] 0x107e0b594
  [770.648] --- interrupt: c00
  [770.648] Instruction dump:
  [770.648] 3b00ffe4 e8898828 481175f5 60000000 4bfff4fc 3be00000 4bfff570 3d220000
  [770.648] 7fc4f378 e8698830 4811cd95 e8410018 <0fe00000> f9c10060 f9e10068 fa010070
  [770.648] ---[ end trace 0000000000000000 ]---
  [770.648] BTRFS: error (device dm-2: state A) in find_free_extent_update_loop:4122: errno=-22 unknown
  [770.648] BTRFS info (device dm-2: state EA): forced readonly
  [770.648] BTRFS: error (device dm-2: state EA) in __btrfs_free_extent:3070: errno=-22 unknown
  [770.648] BTRFS error (device dm-2: state EA): failed to run delayed ref for logical 17838685708288 num_bytes 24576 type 184 action 2 ref_mod 1: -22
  [770.648] BTRFS: error (device dm-2: state EA) in btrfs_run_delayed_refs:2144: errno=-22 unknown
  [770.648] BTRFS: error (device dm-2: state EA) in reset_balance_state:3599: errno=-22 unknown

Fixes: 47e6f7423b ("btrfs: add support for 3-copy replication (raid1c3)")
Fixes: 8d6fac0087 ("btrfs: add support for 4-copy replication (raid1c4)")
CC: stable@vger.kernel.org # 5.10+
Signed-off-by: Matt Corallo <blnxfsl@bluematt.me>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-07-27 08:44:14 +02:00
Greg Kroah-Hartman c6ac900e26 Merge 5.10.185 into android12-5.10-lts
Changes in 5.10.185
	lib: cleanup kstrto*() usage
	kernel.h: split out kstrtox() and simple_strtox() to a separate header
	test_firmware: Use kstrtobool() instead of strtobool()
	test_firmware: prevent race conditions by a correct implementation of locking
	test_firmware: fix a memory leak with reqs buffer
	power: supply: ab8500: Fix external_power_changed race
	power: supply: sc27xx: Fix external_power_changed race
	power: supply: bq27xxx: Use mod_delayed_work() instead of cancel() + schedule()
	ARM: dts: vexpress: add missing cache properties
	tools: gpio: fix debounce_period_us output of lsgpio
	power: supply: Ratelimit no data debug output
	platform/x86: asus-wmi: Ignore WMI events with codes 0x7B, 0xC0
	regulator: Fix error checking for debugfs_create_dir
	irqchip/gic-v3: Disable pseudo NMIs on Mediatek devices w/ firmware issues
	power: supply: Fix logic checking if system is running from battery
	btrfs: scrub: try harder to mark RAID56 block groups read-only
	btrfs: handle memory allocation failure in btrfs_csum_one_bio
	ASoC: soc-pcm: test if a BE can be prepared
	parisc: Improve cache flushing for PCXL in arch_sync_dma_for_cpu()
	parisc: Flush gatt writes and adjust gatt mask in parisc_agp_mask_memory()
	MIPS: Alchemy: fix dbdma2
	mips: Move initrd_start check after initrd address sanitisation.
	ASoC: dwc: move DMA init to snd_soc_dai_driver probe()
	xen/blkfront: Only check REQ_FUA for writes
	drm:amd:amdgpu: Fix missing buffer object unlock in failure path
	irqchip/gic: Correctly validate OF quirk descriptors
	io_uring: hold uring mutex around poll removal
	epoll: ep_autoremove_wake_function should use list_del_init_careful
	ocfs2: fix use-after-free when unmounting read-only filesystem
	ocfs2: check new file size on fallocate call
	nios2: dts: Fix tse_mac "max-frame-size" property
	nilfs2: fix incomplete buffer cleanup in nilfs_btnode_abort_change_key()
	nilfs2: fix possible out-of-bounds segment allocation in resize ioctl
	kexec: support purgatories with .text.hot sections
	x86/purgatory: remove PGO flags
	powerpc/purgatory: remove PGO flags
	nouveau: fix client work fence deletion race
	RDMA/uverbs: Restrict usage of privileged QKEYs
	net: usb: qmi_wwan: add support for Compal RXM-G1
	ALSA: hda/realtek: Add a quirk for Compaq N14JP6
	Remove DECnet support from kernel
	USB: serial: option: add Quectel EM061KGL series
	serial: lantiq: add missing interrupt ack
	usb: dwc3: gadget: Reset num TRBs before giving back the request
	RDMA/rtrs: Fix the last iu->buf leak in err path
	spi: fsl-dspi: avoid SCK glitches with continuous transfers
	netfilter: nfnetlink: skip error delivery on batch in case of ENOMEM
	net: enetc: correct the indexes of highest and 2nd highest TCs
	ping6: Fix send to link-local addresses with VRF.
	net/sched: cls_u32: Fix reference counter leak leading to overflow
	RDMA/rxe: Remove the unused variable obj
	RDMA/rxe: Removed unused name from rxe_task struct
	RDMA/rxe: Fix the use-before-initialization error of resp_pkts
	iavf: remove mask from iavf_irq_enable_queues()
	octeontx2-af: fixed resource availability check
	RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions
	RDMA/cma: Always set static rate to 0 for RoCE
	IB/uverbs: Fix to consider event queue closing also upon non-blocking mode
	IB/isert: Fix dead lock in ib_isert
	IB/isert: Fix possible list corruption in CMA handler
	IB/isert: Fix incorrect release of isert connection
	ipvlan: fix bound dev checking for IPv6 l3s mode
	sctp: fix an error code in sctp_sf_eat_auth()
	igb: fix nvm.ops.read() error handling
	drm/nouveau: don't detect DSM for non-NVIDIA device
	drm/nouveau/dp: check for NULL nv_connector->native_mode
	drm/nouveau: add nv_encoder pointer check for NULL
	ext4: drop the call to ext4_error() from ext4_get_group_info()
	net/sched: cls_api: Fix lockup on flushing explicitly created chain
	net: lapbether: only support ethernet devices
	net: tipc: resize nlattr array to correct size
	selftests/ptp: Fix timestamp printf format for PTP_SYS_OFFSET
	afs: Fix vlserver probe RTT handling
	cgroup: always put cset in cgroup_css_set_put_fork
	rcu/kvfree: Avoid freeing new kfree_rcu() memory after old grace period
	neighbour: Remove unused inline function neigh_key_eq16()
	net: Remove unused inline function dst_hold_and_use()
	net: Remove DECnet leftovers from flow.h.
	neighbour: delete neigh_lookup_nodev as not used
	batman-adv: Switch to kstrtox.h for kstrtou64
	mmc: block: ensure error propagation for non-blk
	mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block
	nilfs2: reject devices with insufficient block count
	media: dvbdev: Fix memleak in dvb_register_device
	media: dvbdev: fix error logic at dvb_register_device()
	media: dvb-core: Fix use-after-free due to race at dvb_register_device()
	drm/i915/dg1: Wait for pcode/uncore handshake at startup
	drm/i915/gen11+: Only load DRAM information from pcode
	um: Fix build w/o CONFIG_PM_SLEEP
	Linux 5.10.185

Change-Id: I05ba9c2e38c013c553c9f89e2a6b71ec9bdb0bd3
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-28 10:31:14 +00:00
Greg Kroah-Hartman b7321283a9 Merge 5.10.184 into android12-5.10-lts
Changes in 5.10.184
	ata: ahci: fix enum constants for gcc-13
	gcc-plugins: Reorganize gimple includes for GCC 13
	sfc (gcc13): synchronize ef100_enqueue_skb()'s return type
	remove the sx8 block driver
	bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
	f2fs: fix iostat lock protection
	blk-iocost: avoid 64-bit division in ioc_timer_fn
	block/blk-iocost (gcc13): keep large values in a new enum
	i40iw: fix build warning in i40iw_manage_apbvt()
	i40e: fix build warnings in i40e_alloc.h
	i40e: fix build warning in ice_fltr_add_mac_to_list()
	staging: vchiq_core: drop vchiq_status from vchiq_initialise
	spi: qup: Request DMA before enabling clocks
	afs: Fix setting of mtime when creating a file/dir/symlink
	wifi: mt76: mt7615: fix possible race in mt7615_mac_sta_poll
	neighbour: fix unaligned access to pneigh_entry
	net: dsa: lan9303: allow vid != 0 in port_fdb_{add|del} methods
	net/smc: Avoid to access invalid RMBs' MRs in SMCRv1 ADD LINK CONT
	net/sched: fq_pie: ensure reasonable TCA_FQ_PIE_QUANTUM values
	Bluetooth: Fix l2cap_disconnect_req deadlock
	Bluetooth: L2CAP: Add missing checks for invalid DCID
	qed/qede: Fix scheduling while atomic
	netfilter: conntrack: fix NULL pointer dereference in nf_confirm_cthelper
	netfilter: ipset: Add schedule point in call_ad().
	ipv6: rpl: Fix Route of Death.
	rfs: annotate lockless accesses to sk->sk_rxhash
	rfs: annotate lockless accesses to RFS sock flow table
	net: sched: move rtm_tca_policy declaration to include file
	net: sched: fix possible refcount leak in tc_chain_tmplt_add()
	bpf: Add extra path pointer check to d_path helper
	lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release()
	bnxt_en: Don't issue AP reset during ethtool's reset operation
	bnxt_en: Query default VLAN before VNIC setup on a VF
	bnxt_en: Implement .set_port / .unset_port UDP tunnel callbacks
	batman-adv: Broken sync while rescheduling delayed work
	Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
	Input: psmouse - fix OOB access in Elantech protocol
	ALSA: hda/realtek: Add a quirk for HP Slim Desktop S01
	ALSA: hda/realtek: Add Lenovo P3 Tower platform
	drm/amdgpu: fix xclk freq on CHIP_STONEY
	can: j1939: j1939_sk_send_loop_abort(): improved error queue handling in J1939 Socket
	can: j1939: change j1939_netdev_lock type to mutex
	can: j1939: avoid possible use-after-free when j1939_can_rx_register fails
	ceph: fix use-after-free bug for inodes when flushing capsnaps
	s390/dasd: Use correct lock while counting channel queue length
	Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk
	Bluetooth: hci_qca: fix debugfs registration
	tee: amdtee: Add return_origin to 'struct tee_cmd_load_ta'
	rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting
	rbd: get snapshot context after exclusive lock is ensured to be held
	pinctrl: meson-axg: add missing GPIOA_18 gpio group
	usb: usbfs: Enforce page requirements for mmap
	usb: usbfs: Use consistent mmap functions
	staging: vc04_services: fix gcc-13 build warning
	ASoC: codecs: wsa881x: do not set can_multi_write flag
	i2c: sprd: Delete i2c adapter in .remove's error path
	eeprom: at24: also select REGMAP
	riscv: fix kprobe __user string arg print fault issue
	vhost: support PACKED when setting-getting vring_base
	Revert "ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled"
	ext4: only check dquot_initialize_needed() when debugging
	tcp: fix tcp_min_tso_segs sysctl
	xfs: verify buffer contents when we skip log replay
	MIPS: locking/atomic: Fix atomic{_64,}_sub_if_positive
	drm/atomic: Don't pollute crtc_state->mode_blob with error pointers
	btrfs: check return value of btrfs_commit_transaction in relocation
	btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
	Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"
	Linux 5.10.184

Change-Id: If2d013f1bba8d713f8935810a5887f80eabae81c
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-28 07:16:23 +00:00
Greg Kroah-Hartman 848ca335c1 Merge 5.10.183 into android12-5.10-lts
Changes in 5.10.183
	RDMA/bnxt_re: Code refactor while populating user MRs
	RDMA/bnxt_re: Fix the page_size used during the MR creation
	RDMA/efa: Fix unsupported page sizes in device
	dmaengine: at_xdmac: Fix concurrency over chan's completed_cookie
	dmaengine: at_xdmac: Fix race for the tx desc callback
	dmaengine: at_xdmac: Move the free desc to the tail of the desc list
	dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
	RDMA/bnxt_re: Fix a possible memory leak
	RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
	iommu/rockchip: Fix unwind goto issue
	iommu/amd: Don't block updates to GATag if guest mode is on
	dmaengine: pl330: rename _start to prevent build error
	net/mlx5: fw_tracer, Fix event handling
	netrom: fix info-leak in nr_write_internal()
	af_packet: Fix data-races of pkt_sk(sk)->num.
	amd-xgbe: fix the false linkup in xgbe_phy_status
	mtd: rawnand: ingenic: fix empty stub helper definitions
	af_packet: do not use READ_ONCE() in packet_bind()
	tcp: deny tcp_disconnect() when threads are waiting
	tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
	net/sched: sch_ingress: Only create under TC_H_INGRESS
	net/sched: sch_clsact: Only create under TC_H_CLSACT
	net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
	net/sched: Prohibit regrafting ingress or clsact Qdiscs
	net: sched: fix NULL pointer dereference in mq_attach
	net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
	udp6: Fix race condition in udp6_sendmsg & connect
	net/mlx5: Read embedded cpu after init bit cleared
	net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
	net: dsa: mv88e6xxx: Increase wait after reset deactivation
	mtd: rawnand: marvell: ensure timing values are written
	mtd: rawnand: marvell: don't set the NAND frequency select
	watchdog: menz069_wdt: fix watchdog initialisation
	ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
	mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
	btrfs: abort transaction when sibling keys check fails for leaves
	ARM: 9295/1: unwind:fix unwind abort for uleb128 case
	media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
	gfs2: Don't deref jdesc in evict
	fbdev: modedb: Add 1920x1080 at 60 Hz video mode
	fbdev: stifb: Fix info entry in sti_struct on error path
	nbd: Fix debugfs_create_dir error checking
	block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
	ASoC: dwc: limit the number of overrun messages
	xfrm: Check if_id in inbound policy/secpath match
	ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
	ASoC: ssm2602: Add workaround for playback distortions
	media: dvb_demux: fix a bug for the continuity counter
	media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
	media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
	media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
	media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
	media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
	media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
	media: netup_unidvb: fix irq init by register it at the end of probe
	media: dvb_ca_en50221: fix a size write bug
	media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
	media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
	media: dvb-core: Fix use-after-free due on race condition at dvb_net
	media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
	media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
	s390/pkey: zeroize key blobs
	wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
	ARM: dts: stm32: add pin map for CAN controller on stm32f7
	arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
	scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
	wifi: b43: fix incorrect __packed annotation
	netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
	ALSA: oss: avoid missing-prototype warnings
	drm/msm: Be more shouty if per-process pgtables aren't working
	atm: hide unused procfs functions
	mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
	iio: adc: mxs-lradc: fix the order of two cleanup operations
	HID: google: add jewel USB id
	HID: wacom: avoid integer overflow in wacom_intuos_inout()
	iio: imu: inv_icm42600: fix timestamp reset
	iio: light: vcnl4035: fixed chip ID check
	iio: dac: mcp4725: Fix i2c_master_send() return value handling
	iio: adc: ad7192: Change "shorted" channels to differential
	iio: dac: build ad5758 driver when AD5758 is selected
	net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
	usb: gadget: f_fs: Add unbind event before functionfs_unbind
	misc: fastrpc: return -EPIPE to invocations on device removal
	misc: fastrpc: reject new invocations during device removal
	scsi: stex: Fix gcc 13 warnings
	ata: libata-scsi: Use correct device no in ata_find_dev()
	x86/boot: Wrap literal addresses in absolute_pointer()
	ACPI: thermal: drop an always true check
	ath6kl: Use struct_group() to avoid size-mismatched casting
	gcc-12: disable '-Wdangling-pointer' warning for now
	eth: sun: cassini: remove dead code
	mmc: vub300: fix invalid response handling
	tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
	btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
	selinux: don't use make's grouped targets feature yet
	tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
	selftests: mptcp: connect: skip if MPTCP is not supported
	selftests: mptcp: pm nl: skip if MPTCP is not supported
	ext4: add EA_INODE checking to ext4_iget()
	ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
	ext4: disallow ea_inodes with extended attributes
	ext4: add lockdep annotations for i_data_sem for ea_inode's
	fbcon: Fix null-ptr-deref in soft_cursor
	serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
	test_firmware: fix the memory leak of the allocated firmware buffer
	KVM: x86: Account fastpath-only VM-Exits in vCPU stats
	KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
	regmap: Account for register length when chunking
	tpm, tpm_tis: Request threaded interrupt handler
	media: ti-vpe: cal: avoid FIELD_GET assertion
	drm/rcar: stop using 'imply' for dependencies
	scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
	scsi: dpt_i2o: Do not process completions with invalid addresses
	crypto: ccp: Reject SEV commands with mismatching command buffer
	crypto: ccp: Play nice with vmalloc'd memory for SEV command structs
	selftests: mptcp: diag: skip if MPTCP is not supported
	selftests: mptcp: simult flows: skip if MPTCP is not supported
	selftests: mptcp: join: skip if MPTCP is not supported
	ext4: enable the lazy init thread when remounting read/write
	ARM: defconfig: drop CONFIG_DRM_RCAR_LVDS
	Linux 5.10.183

Change-Id: Iaaaaa9d53fea0e6f58a5ba1ad86f9150c2cdf8af
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-27 16:18:22 +00:00
Greg Kroah-Hartman 6d62ca19a7 Merge 5.10.181 into android12-5.10-lts
Changes in 5.10.181
	driver core: add a helper to setup both the of_node and fwnode of a device
	drm/mipi-dsi: Set the fwnode for mipi_dsi_device
	ARM: 9296/1: HP Jornada 7XX: fix kernel-doc warnings
	net: mdio: mvusb: Fix an error handling path in mvusb_mdio_probe()
	linux/dim: Do nothing if no time delta between samples
	net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().
	netfilter: conntrack: fix possible bug_on with enable_hooks=1
	netlink: annotate accesses to nlk->cb_running
	net: annotate sk->sk_err write from do_recvmmsg()
	net: deal with most data-races in sk_wait_event()
	net: tap: check vlan with eth_type_vlan() method
	net: add vlan_get_protocol_and_depth() helper
	tcp: factor out __tcp_close() helper
	tcp: add annotations around sk->sk_shutdown accesses
	ipvlan:Fix out-of-bounds caused by unclear skb->cb
	net: datagram: fix data-races in datagram_poll()
	af_unix: Fix a data race of sk->sk_receive_queue->qlen.
	af_unix: Fix data races around sk->sk_shutdown.
	drm/i915/dp: prevent potential div-by-zero
	fbdev: arcfb: Fix error handling in arcfb_probe()
	ext4: remove an unused variable warning with CONFIG_QUOTA=n
	ext4: reflect error codes from ext4_multi_mount_protect() to its callers
	ext4: don't clear SB_RDONLY when remounting r/w until quota is re-enabled
	ext4: fix lockdep warning when enabling MMP
	ext4: remove redundant mb_regenerate_buddy()
	ext4: drop s_mb_bal_lock and convert protected fields to atomic
	ext4: add mballoc stats proc file
	ext4: allow to find by goal if EXT4_MB_HINT_GOAL_ONLY is set
	ext4: allow ext4_get_group_info() to fail
	refscale: Move shutdown from wait_event() to wait_event_idle()
	rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access
	fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode()
	drm/amd/display: Use DC_LOG_DC in the trasform pixel function
	regmap: cache: Return error in cache sync operations for REGCACHE_NONE
	arm64: dts: qcom: msm8996: Add missing DWC3 quirks
	memstick: r592: Fix UAF bug in r592_remove due to race condition
	firmware: arm_sdei: Fix sleep from invalid context BUG
	ACPI: EC: Fix oops when removing custom query handlers
	remoteproc: stm32_rproc: Add mutex protection for workqueue
	drm/tegra: Avoid potential 32-bit integer overflow
	ACPICA: Avoid undefined behavior: applying zero offset to null pointer
	ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects
	drm/amd: Fix an out of bounds error in BIOS parser
	wifi: ath: Silence memcpy run-time false positive warning
	bpf: Annotate data races in bpf_local_storage
	wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex
	ext2: Check block size validity during mount
	scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
	net: pasemi: Fix return type of pasemi_mac_start_tx()
	net: Catch invalid index in XPS mapping
	scsi: target: iscsit: Free cmds before session free
	lib: cpu_rmap: Avoid use after free on rmap->obj array entries
	scsi: message: mptlan: Fix use after free bug in mptlan_remove() due to race condition
	gfs2: Fix inode height consistency check
	ext4: set goal start correctly in ext4_mb_normalize_request
	ext4: Fix best extent lstart adjustment logic in ext4_mb_new_inode_pa()
	f2fs: fix to drop all dirty pages during umount() if cp_error is set
	samples/bpf: Fix fout leak in hbm's run_bpf_prog
	wifi: iwlwifi: pcie: fix possible NULL pointer dereference
	wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
	null_blk: Always check queue mode setting from configfs
	wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
	wifi: ath11k: Fix SKB corruption in REO destination ring
	ipvs: Update width of source for ip_vs_sync_conn_options
	Bluetooth: hci_bcm: Fall back to getting bdaddr from EFI if not set
	Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp
	staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE
	HID: logitech-hidpp: Don't use the USB serial for USB devices
	HID: logitech-hidpp: Reconcile USB and Unifying serials
	spi: spi-imx: fix MX51_ECSPI_* macros when cs > 3
	HID: wacom: generic: Set battery quirk only when we see battery data
	usb: typec: tcpm: fix multiple times discover svids error
	serial: 8250: Reinit port->pm on port specific driver unbind
	mcb-pci: Reallocate memory region to avoid memory overlapping
	sched: Fix KCSAN noinstr violation
	recordmcount: Fix memory leaks in the uwrite function
	RDMA/core: Fix multiple -Warray-bounds warnings
	iommu/arm-smmu-qcom: Limit the SMR groups to 128
	clk: tegra20: fix gcc-7 constant overflow warning
	iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any
	Input: xpad - add constants for GIP interface numbers
	phy: st: miphy28lp: use _poll_timeout functions for waits
	mfd: dln2: Fix memory leak in dln2_probe()
	btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c
	btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
	btrfs: fix space cache inconsistency after error loading it from disk
	xfrm: don't check the default policy if the policy allows the packet
	Revert "Fix XFRM-I support for nested ESP tunnels"
	drm/msm/dp: unregister audio driver during unbind
	drm/msm/dpu: Remove duplicate register defines from INTF
	cpupower: Make TSC read per CPU for Mperf monitor
	af_key: Reject optional tunnel/BEET mode templates in outbound policies
	net: fec: Better handle pm_runtime_get() failing in .remove()
	net: phy: dp83867: add w/a for packet errors seen with short cables
	ALSA: firewire-digi00x: prevent potential use after free
	ALSA: hda/realtek: Apply HP B&O top speaker profile to Pavilion 15
	vsock: avoid to close connected socket after the timeout
	ipv4/tcp: do not use per netns ctl sockets
	net: Find dst with sk's xfrm policy not ctl_sk
	tcp: fix possible sk_priority leak in tcp_v4_send_reset()
	serial: arc_uart: fix of_iomap leak in `arc_serial_probe`
	erspan: get the proto with the md version for collect_md
	net: hns3: fix sending pfc frames after reset issue
	net: hns3: fix reset delay time to avoid configuration timeout
	media: netup_unidvb: fix use-after-free at del_timer()
	SUNRPC: Fix trace_svc_register() call site
	drm/exynos: fix g2d_open/close helper function definitions
	net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
	net/tipc: fix tipc header files for kernel-doc
	tipc: add tipc_bearer_min_mtu to calculate min mtu
	tipc: do not update mtu if msg_max is too small in mtu negotiation
	tipc: check the bearer min mtu properly when setting it by netlink
	net: bcmgenet: Remove phy_stop() from bcmgenet_netif_stop()
	net: bcmgenet: Restore phy_stop() depending upon suspend/close
	wifi: mac80211: fix min center freq offset tracing
	wifi: iwlwifi: mvm: don't trust firmware n_channels
	scsi: storvsc: Don't pass unused PFNs to Hyper-V host
	cassini: Fix a memory leak in the error handling path of cas_init_one()
	igb: fix bit_shift to be in [1..8] range
	vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit()
	netfilter: nft_set_rbtree: fix null deref on element insertion
	bridge: always declare tunnel functions
	ALSA: usb-audio: Add a sample rate workaround for Line6 Pod Go
	USB: usbtmc: Fix direction for 0-length ioctl control messages
	usb-storage: fix deadlock when a scsi command timeouts more than once
	USB: UHCI: adjust zhaoxin UHCI controllers OverCurrent bit value
	usb: dwc3: debugfs: Resume dwc3 before accessing registers
	usb: gadget: u_ether: Fix host MAC address case
	usb: typec: altmodes/displayport: fix pin_assignment_show
	ALSA: hda: Fix Oops by 9.1 surround channel names
	ALSA: hda: Add NVIDIA codec IDs a3 through a7 to patch table
	ALSA: hda/realtek: Add quirk for Clevo L140AU
	ALSA: hda/realtek: Add a quirk for HP EliteDesk 805
	ALSA: hda/realtek: Add quirk for 2nd ASUS GU603
	can: j1939: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: isotp: recvmsg(): allow MSG_CMSG_COMPAT flag
	can: kvaser_pciefd: Set CAN_STATE_STOPPED in kvaser_pciefd_stop()
	can: kvaser_pciefd: Call request_irq() before enabling interrupts
	can: kvaser_pciefd: Empty SRB buffer in probe
	can: kvaser_pciefd: Clear listen-only bit if not explicitly requested
	can: kvaser_pciefd: Do not send EFLUSH command on TFD interrupt
	can: kvaser_pciefd: Disable interrupts in probe error path
	statfs: enforce statfs[64] structure initialization
	serial: Add support for Advantech PCI-1611U card
	vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF
	ceph: force updating the msg pointer in non-split case
	tpm/tpm_tis: Disable interrupts for more Lenovo devices
	powerpc/64s/radix: Fix soft dirty tracking
	nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
	HID: wacom: Force pen out of prox if no events have been received in a while
	HID: wacom: Add new Intuos Pro Small (PTH-460) device IDs
	HID: wacom: add three styli to wacom_intuos_get_tool_type
	KVM: arm64: Link position-independent string routines into .hyp.text
	serial: 8250_exar: derive nr_ports from PCI ID for Acces I/O cards
	serial: exar: Add support for Sealevel 7xxxC serial cards
	serial: 8250_exar: Add support for USR298x PCI Modems
	s390/qdio: get rid of register asm
	s390/qdio: fix do_sqbs() inline assembly constraint
	watchdog: sp5100_tco: Immediately trigger upon starting.
	ARM: dts: stm32: fix AV96 board SAI2 pin muxing on stm32mp15
	writeback, cgroup: remove extra percpu_ref_exit()
	net/sched: act_mirred: refactor the handle of xmit
	net/sched: act_mirred: better wording on protection against excessive stack growth
	act_mirred: use the backlog for nested calls to mirred ingress
	spi: fsl-spi: Re-organise transfer bits_per_word adaptation
	spi: fsl-cpm: Use 16 bit mode for large transfers with even size
	ocfs2: Switch to security_inode_init_security()
	ALSA: hda/ca0132: add quirk for EVGA X299 DARK
	ALSA: hda: Fix unhandled register update during auto-suspend period
	ALSA: hda/realtek: Enable headset onLenovo M70/M90
	net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
	m68k: Move signal frame following exception on 68020/030
	parisc: Handle kgdb breakpoints only in kernel context
	parisc: Allow to reboot machine after system halt
	gpio: mockup: Fix mode of debugfs files
	btrfs: use nofs when cleaning up aborted transactions
	dt-binding: cdns,usb3: Fix cdns,on-chip-buff-size type
	x86/mm: Avoid incomplete Global INVLPG flushes
	selftests/memfd: Fix unknown type name build failure
	parisc: Fix flush_dcache_page() for usage from irq context
	x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
	debugobjects: Don't wake up kswapd from fill_pool()
	fbdev: udlfb: Fix endpoint check
	net: fix stack overflow when LRO is disabled for virtual interfaces
	udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
	USB: core: Add routines for endpoint checks in old drivers
	USB: sisusbvga: Add endpoint checks
	media: radio-shark: Add endpoint checks
	net: fix skb leak in __skb_tstamp_tx()
	selftests: fib_tests: mute cleanup error message
	octeontx2-pf: Fix TSOv6 offload
	bpf: Fix mask generation for 32-bit narrow loads of 64-bit fields
	ipv6: Fix out-of-bounds access in ipv6_find_tlv()
	power: supply: leds: Fix blink to LED on transition
	power: supply: bq27xxx: Fix bq27xxx_battery_update() race condition
	power: supply: bq27xxx: Fix I2C IRQ race on remove
	power: supply: bq27xxx: Fix poll_interval handling and races on remove
	power: supply: sbs-charger: Fix INHIBITED bit for Status reg
	fs: fix undefined behavior in bit shift for SB_NOUSER
	coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet()
	xen/pvcalls-back: fix double frees with pvcalls_new_active_socket()
	x86/show_trace_log_lvl: Ensure stack pointer is aligned, again
	ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
	forcedeth: Fix an error handling path in nv_probe()
	net/mlx5e: do as little as possible in napi poll when budget is 0
	net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs
	net/mlx5: Fix error message when failing to allocate device memory
	net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
	arm64: dts: imx8mn-var-som: fix PHY detection bug by adding deassert delay
	3c589_cs: Fix an error handling path in tc589_probe()
	net: phy: mscc: add VSC8502 to MODULE_DEVICE_TABLE
	Linux 5.10.181

Change-Id: Iaad0b0bb7c1ad061b28ad4ee16e03db935241177
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-27 08:23:11 +00:00
Greg Kroah-Hartman d70c95bd81 Merge 5.10.180 into android12-5.10-lts
Changes in 5.10.180
	seccomp: Move copy_seccomp() to no failure path.
	counter: 104-quad-8: Fix race condition between FLAG and CNTR reads
	KVM: arm64: Fix buffer overflow in kvm_arm_set_fw_reg()
	wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
	drm/fb-helper: set x/yres_virtual in drm_fb_helper_check_var
	bluetooth: Perform careful capability checks in hci_sock_ioctl()
	x86/fpu: Prevent FPU state corruption
	USB: serial: option: add UNISOC vendor and TOZED LT70C product
	driver core: Don't require dynamic_debug for initcall_debug probe timing
	iio: adc: palmas_gpadc: fix NULL dereference on rmmod
	ASoC: Intel: bytcr_rt5640: Add quirk for the Acer Iconia One 7 B1-750
	asm-generic/io.h: suppress endianness warnings for readq() and writeq()
	wireguard: timers: cast enum limits members to int in prints
	PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock
	PCI: qcom: Fix the incorrect register usage in v2.7.0 config
	USB: dwc3: fix runtime pm imbalance on probe errors
	USB: dwc3: fix runtime pm imbalance on unbind
	hwmon: (k10temp) Check range scale when CUR_TEMP register is read-write
	hwmon: (adt7475) Use device_property APIs when configuring polarity
	posix-cpu-timers: Implement the missing timer_wait_running callback
	perf sched: Cast PTHREAD_STACK_MIN to int as it may turn into sysconf(__SC_THREAD_STACK_MIN_VALUE)
	blk-mq: release crypto keyslot before reporting I/O complete
	blk-crypto: make blk_crypto_evict_key() return void
	blk-crypto: make blk_crypto_evict_key() more robust
	ext4: use ext4_journal_start/stop for fast commit transactions
	staging: iio: resolver: ads1210: fix config mode
	xhci: fix debugfs register accesses while suspended
	tick/nohz: Fix cpu_is_hotpluggable() by checking with nohz subsystem
	MIPS: fw: Allow firmware to pass a empty env
	ipmi:ssif: Add send_retries increment
	ipmi: fix SSIF not responding under certain cond.
	kheaders: Use array declaration instead of char
	pwm: meson: Fix axg ao mux parents
	pwm: meson: Fix g12a ao clk81 name
	ring-buffer: Sync IRQ works before buffer destruction
	crypto: api - Demote BUG_ON() in crypto_unregister_alg() to a WARN_ON()
	crypto: safexcel - Cleanup ring IRQ workqueues on load failure
	rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed
	reiserfs: Add security prefix to xattr name in reiserfs_security_write()
	KVM: nVMX: Emulate NOPs in L2, and PAUSE if it's not intercepted
	relayfs: fix out-of-bounds access in relay_file_read
	writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
	i2c: omap: Fix standard mode false ACK readings
	iommu/amd: Fix "Guest Virtual APIC Table Root Pointer" configuration in IRTE
	Revert "ubifs: dirty_cow_znode: Fix memleak in error handling path"
	ubifs: Fix memleak when insert_old_idx() failed
	ubi: Fix return value overwrite issue in try_write_vid_and_data()
	ubifs: Free memory for tmpfile name
	sound/oss/dmasound: fix build when drivers are mixed =y/=m
	parisc: Fix argument pointer in real64_call_asm()
	nilfs2: do not write dirty data after degenerating to read-only
	nilfs2: fix infinite loop in nilfs_mdt_get_block()
	md/raid10: fix null-ptr-deref in raid10_sync_request
	mailbox: zynqmp: Fix IPI isr handling
	mailbox: zynqmp: Fix typo in IPI documentation
	wifi: rtl8xxxu: RTL8192EU always needs full init
	clk: rockchip: rk3399: allow clk_cifout to force clk_cifout_src to reparent
	rcu: Fix missing TICK_DEP_MASK_RCU_EXP dependency check
	selftests/resctrl: Return NULL if malloc_and_init_memory() did not alloc mem
	selftests/resctrl: Check for return value after write_schemata()
	selinux: fix Makefile dependencies of flask.h
	selinux: ensure av_permissions.h is built when needed
	tpm, tpm_tis: Do not skip reset of original interrupt vector
	tpm, tpm_tis: Claim locality before writing TPM_INT_ENABLE register
	tpm, tpm_tis: Disable interrupts if tpm_tis_probe_irq() failed
	tpm, tpm_tis: Claim locality before writing interrupt registers
	tpm, tpm: Implement usage counter for locality
	tpm, tpm_tis: Claim locality when interrupts are reenabled on resume
	erofs: stop parsing non-compact HEAD index if clusterofs is invalid
	erofs: fix potential overflow calculating xattr_isize
	drm/rockchip: Drop unbalanced obj unref
	drm/vgem: add missing mutex_destroy
	drm/probe-helper: Cancel previous job before starting new one
	soc: ti: pm33xx: Enable basic PM runtime support for genpd
	soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
	arm64: dts: renesas: r8a77990: Remove bogus voltages from OPP table
	arm64: dts: renesas: r8a774c0: Remove bogus voltages from OPP table
	drm/msm/disp/dpu: check for crtc enable rather than crtc active to release shared resources
	EDAC/skx: Fix overflows on the DRAM row address mapping arrays
	arm64: dts: qcom: msm8998: Fix stm-stimulus-base reg name
	arm64: dts: qcom: sdm845: correct dynamic power coefficients
	arm64: dts: qcom: sdm845: Fix the PCI I/O port range
	arm64: dts: qcom: msm8998: Fix the PCI I/O port range
	arm64: dts: qcom: ipq8074: Fix the PCI I/O port range
	arm64: dts: qcom: msm8996: Fix the PCI I/O port range
	ARM: dts: qcom: ipq4019: Fix the PCI I/O port range
	ARM: dts: qcom: ipq8064: reduce pci IO size to 64K
	ARM: dts: qcom: ipq8064: Fix the PCI I/O port range
	x86/MCE/AMD: Use an u64 for bank_map
	media: bdisp: Add missing check for create_workqueue
	firmware: qcom_scm: Clear download bit during reboot
	drm/bridge: adv7533: Fix adv7533_mode_valid for adv7533 and adv7535
	media: max9286: Free control handler
	drm/msm/adreno: Defer enabling runpm until hw_init()
	drm/msm/adreno: drop bogus pm_runtime_set_active()
	drm: msm: adreno: Disable preemption on Adreno 510
	ACPI: processor: Fix evaluating _PDC method when running as Xen dom0
	mmc: sdhci-of-esdhc: fix quirk to ignore command inhibit for data
	ARM: dts: gta04: fix excess dma channel usage
	drm/lima/lima_drv: Add missing unwind goto in lima_pdev_probe()
	regulator: core: Consistently set mutex_owner when using ww_mutex_lock_slow()
	regulator: core: Avoid lockdep reports when resolving supplies
	x86/apic: Fix atomic update of offset in reserve_eilvt_offset()
	media: rkvdec: fix use after free bug in rkvdec_remove
	media: dm1105: Fix use after free bug in dm1105_remove due to race condition
	media: saa7134: fix use after free bug in saa7134_finidev due to race condition
	media: rcar_fdp1: simplify error check logic at fdp_open()
	media: rcar_fdp1: fix pm_runtime_get_sync() usage count
	media: rcar_fdp1: Make use of the helper function devm_platform_ioremap_resource()
	media: rcar_fdp1: Fix the correct variable assignments
	media: rcar_fdp1: Fix refcount leak in probe and remove function
	media: rc: gpio-ir-recv: Fix support for wake-up
	media: venus: vdec: Fix non reliable setting of LAST flag
	media: venus: vdec: Make decoder return LAST flag for sufficient event
	media: venus: preserve DRC state across seeks
	media: venus: vdec: Handle DRC after drain
	media: venus: dec: Fix handling of the start cmd
	regulator: stm32-pwr: fix of_iomap leak
	x86/ioapic: Don't return 0 from arch_dynirq_lower_bound()
	arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step
	debugobject: Prevent init race with static objects
	drm/i915: Make intel_get_crtc_new_encoder() less oopsy
	tick/sched: Use tick_next_period for lockless quick check
	tick/sched: Reduce seqcount held scope in tick_do_update_jiffies64()
	tick/sched: Optimize tick_do_update_jiffies64() further
	tick: Get rid of tick_period
	tick/common: Align tick period with the HZ tick.
	wifi: ath6kl: minor fix for allocation size
	wifi: ath9k: hif_usb: fix memory leak of remain_skbs
	wifi: ath5k: fix an off by one check in ath5k_eeprom_read_freq_list()
	wifi: ath6kl: reduce WARN to dev_dbg() in callback
	tools: bpftool: Remove invalid \' json escape
	wifi: rtw88: mac: Return the original error from rtw_pwr_seq_parser()
	wifi: rtw88: mac: Return the original error from rtw_mac_power_switch()
	bpf: take into account liveness when propagating precision
	bpf: fix precision propagation verbose logging
	scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
	bpf: Remove misleading spec_v1 check on var-offset stack read
	vlan: partially enable SIOCSHWTSTAMP in container
	net/packet: annotate accesses to po->xmit
	net/packet: convert po->origdev to an atomic flag
	net/packet: convert po->auxdata to an atomic flag
	scsi: target: Rename struct sense_info to sense_detail
	scsi: target: Rename cmd.bad_sector to cmd.sense_info
	scsi: target: Make state_list per CPU
	scsi: target: Fix multiple LUN_RESET handling
	scsi: target: iscsit: Fix TAS handling during conn cleanup
	scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS
	f2fs: handle dqget error in f2fs_transfer_project_quota()
	f2fs: enforce single zone capacity
	f2fs: apply zone capacity to all zone type
	f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
	crypto: caam - Clear some memory in instantiate_rng
	crypto: sa2ul - Select CRYPTO_DES
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_rfreg()
	wifi: rtlwifi: fix incorrect error codes in rtl_debugfs_set_write_reg()
	net: qrtr: correct types of trace event parameters
	selftests/bpf: Wait for receive in cg_storage_multi test
	bpftool: Fix bug for long instructions in program CFG dumps
	crypto: drbg - make drbg_prepare_hrng() handle jent instantiation errors
	crypto: drbg - Only fail when jent is unavailable in FIPS mode
	xsk: Fix unaligned descriptor validation
	f2fs: fix to avoid use-after-free for cached IPU bio
	scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
	net: ethernet: stmmac: dwmac-rk: fix optional phy regulator handling
	bpf, sockmap: fix deadlocks in the sockhash and sockmap
	nvme: handle the persistent internal error AER
	nvme: fix async event trace event
	nvme-fcloop: fix "inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage"
	bpf, sockmap: Revert buggy deadlock fix in the sockhash and sockmap
	md/raid10: fix leak of 'r10bio->remaining' for recovery
	md/raid10: fix memleak for 'conf->bio_split'
	md/raid10: fix memleak of md thread
	wifi: iwlwifi: yoyo: Fix possible division by zero
	wifi: iwlwifi: fw: move memset before early return
	jdb2: Don't refuse invalidation of already invalidated buffers
	wifi: iwlwifi: make the loop for card preparation effective
	wifi: iwlwifi: mvm: check firmware response size
	wifi: iwlwifi: fw: fix memory leak in debugfs
	ixgbe: Allow flow hash to be set via ethtool
	ixgbe: Enable setting RSS table to default values
	bpf: Don't EFAULT for getsockopt with optval=NULL
	netfilter: nf_tables: don't write table validation state without mutex
	net/sched: sch_fq: fix integer overflow of "credit"
	ipv4: Fix potential uninit variable access bug in __ip_make_skb()
	Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
	netlink: Use copy_to_user() for optval in netlink_getsockopt().
	net: amd: Fix link leak when verifying config failed
	tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
	ipmi: ASPEED_BT_IPMI_BMC: select REGMAP_MMIO instead of depending on it
	pstore: Revert pmsg_lock back to a normal mutex
	usb: host: xhci-rcar: remove leftover quirk handling
	usb: dwc3: gadget: Change condition for processing suspend event
	fpga: bridge: fix kernel-doc parameter description
	iio: light: max44009: add missing OF device matching
	spi: spi-imx: using pm_runtime_resume_and_get instead of pm_runtime_get_sync
	spi: imx: Don't skip cleanup in remove's error path
	usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition
	PCI: imx6: Install the fault handler only on compatible match
	ASoC: es8316: Use IRQF_NO_AUTOEN when requesting the IRQ
	ASoC: es8316: Handle optional IRQ assignment
	linux/vt_buffer.h: allow either builtin or modular for macros
	spi: qup: Don't skip cleanup in remove's error path
	spi: fsl-spi: Fix CPM/QE mode Litte Endian
	vmci_host: fix a race condition in vmci_host_poll() causing GPF
	of: Fix modalias string generation
	PCI/EDR: Clear Device Status after EDR error recovery
	ia64: mm/contig: fix section mismatch warning/error
	ia64: salinfo: placate defined-but-not-used warning
	scripts/gdb: bail early if there are no clocks
	scripts/gdb: bail early if there are no generic PD
	coresight: etm_pmu: Set the module field
	ASoC: fsl_mqs: move of_node_put() to the correct location
	spi: cadence-quadspi: fix suspend-resume implementations
	i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path
	uapi/linux/const.h: prefer ISO-friendly __typeof__
	sh: sq: Fix incorrect element size for allocating bitmap buffer
	usb: gadget: tegra-xudc: Fix crash in vbus_draw
	usb: chipidea: fix missing goto in `ci_hdrc_probe`
	usb: mtu3: fix kernel panic at qmu transfer done irq handler
	firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
	tty: serial: fsl_lpuart: adjust buffer length to the intended size
	serial: 8250: Add missing wakeup event reporting
	staging: rtl8192e: Fix W_DISABLE# does not work after stop/start
	spmi: Add a check for remove callback when removing a SPMI driver
	macintosh/windfarm_smu_sat: Add missing of_node_put()
	powerpc/mpc512x: fix resource printk format warning
	powerpc/wii: fix resource printk format warnings
	powerpc/sysdev/tsi108: fix resource printk format warnings
	macintosh: via-pmu-led: requires ATA to be set
	powerpc/rtas: use memmove for potentially overlapping buffer copy
	perf/core: Fix hardlockup failure caused by perf throttle
	clk: at91: clk-sam9x60-pll: fix return value check
	RDMA/siw: Fix potential page_array out of range access
	RDMA/rdmavt: Delete unnecessary NULL check
	workqueue: Rename "delayed" (delayed by active management) to "inactive"
	workqueue: Fix hung time report of worker pools
	rtc: omap: include header for omap_rtc_power_off_program prototype
	RDMA/mlx4: Prevent shift wrapping in set_user_sq_size()
	rtc: meson-vrtc: Use ktime_get_real_ts64() to get the current time
	power: supply: generic-adc-battery: fix unit scaling
	clk: add missing of_node_put() in "assigned-clocks" property parsing
	RDMA/siw: Remove namespace check from siw_netdev_event()
	RDMA/cm: Trace icm_send_rej event before the cm state is reset
	RDMA/srpt: Add a check for valid 'mad_agent' pointer
	IB/hfi1: Fix SDMA mmu_rb_node not being evicted in LRU order
	IB/hfi1: Add AIP tx traces
	IB/hfi1: Add additional usdma traces
	IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests
	NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
	firmware: raspberrypi: Introduce devm_rpi_firmware_get()
	input: raspberrypi-ts: Release firmware handle when not needed
	Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
	RDMA/mlx5: Fix flow counter query via DEVX
	SUNRPC: remove the maximum number of retries in call_bind_status
	RDMA/mlx5: Use correct device num_ports when modify DC
	clocksource/drivers/davinci: Fix memory leak in davinci_timer_register when init fails
	openrisc: Properly store r31 to pt_regs on unhandled exceptions
	ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
	leds: TI_LMU_COMMON: select REGMAP instead of depending on it
	dmaengine: mv_xor_v2: Fix an error code.
	leds: tca6507: Fix error handling of using fwnode_property_read_string
	pwm: mtk-disp: Don't check the return code of pwmchip_remove()
	pwm: mtk-disp: Adjust the clocks to avoid them mismatch
	pwm: mtk-disp: Disable shadow registers before setting backlight values
	phy: tegra: xusb: Add missing tegra_xusb_port_unregister for usb2_port and ulpi_port
	dmaengine: dw-edma: Fix to change for continuous transfer
	dmaengine: dw-edma: Fix to enable to issue dma request on DMA processing
	dmaengine: at_xdmac: do not enable all cyclic channels
	thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe
	mfd: tqmx86: Do not access I2C_DETECT register through io_base
	mfd: tqmx86: Remove incorrect TQMx90UC board ID
	mfd: tqmx86: Add support for TQMx110EB and TQMxE40x
	mfd: tqmx86: Specify IO port register range more precisely
	mfd: tqmx86: Correct board names for TQMxE39x
	afs: Fix updating of i_size with dv jump from server
	scripts/gdb: fix lx-timerlist for Python3
	btrfs: scrub: reject unsupported scrub flags
	s390/dasd: fix hanging blockdevice after request requeue
	ia64: fix an addr to taddr in huge_pte_offset()
	dm clone: call kmem_cache_destroy() in dm_clone_init() error path
	dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
	dm flakey: fix a crash with invalid table line
	dm ioctl: fix nested locking in table_clear() to remove deadlock concern
	perf auxtrace: Fix address filter entire kernel size
	perf intel-pt: Fix CYC timestamps after standalone CBR
	arm64: Always load shadow stack pointer directly from the task struct
	arm64: Stash shadow stack pointer in the task struct on interrupt
	debugobject: Ensure pool refill (again)
	sound/oss/dmasound: fix 'dmasound_setup' defined but not used
	arm64: dts: qcom: sdm845: correct dynamic power coefficients
	scsi: target: core: Avoid smp_processor_id() in preemptible code
	netfilter: nf_tables: deactivate anonymous set from preparation phase
	tty: create internal tty.h file
	tty: audit: move some local functions out of tty.h
	tty: move some internal tty lock enums and functions out of tty.h
	tty: move some tty-only functions to drivers/tty/tty.h
	tty: clean include/linux/tty.h up
	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH
	ring-buffer: Ensure proper resetting of atomic variables in ring_buffer_reset_online_cpus
	crypto: ccp - Clear PSP interrupt status register before calling handler
	mailbox: zynq: Switch to flexible array to simplify code
	mailbox: zynqmp: Fix counts of child nodes
	dm verity: skip redundant verity_handle_err() on I/O errors
	dm verity: fix error handling for check_at_most_once on FEC
	scsi: qedi: Fix use after free bug in qedi_remove()
	net/ncsi: clear Tx enable mode when handling a Config required AEN
	net/sched: cls_api: remove block_cb from driver_list before freeing
	sit: update dev->needed_headroom in ipip6_tunnel_bind_dev()
	net: dsa: mv88e6xxx: add mv88e6321 rsvd2cpu
	writeback: fix call of incorrect macro
	watchdog: dw_wdt: Fix the error handling path of dw_wdt_drv_probe()
	net/sched: act_mirred: Add carrier check
	sfc: Fix module EEPROM reporting for QSFP modules
	rxrpc: Fix hard call timeout units
	octeontx2-pf: Disable packet I/O for graceful exit
	octeontx2-vf: Detach LF resources on probe cleanup
	ionic: remove noise from ethtool rxnfc error msg
	af_packet: Don't send zero-byte data in packet_sendmsg_spkt().
	drm/amdgpu: add a missing lock for AMDGPU_SCHED
	ALSA: caiaq: input: Add error handling for unsupported input methods in `snd_usb_caiaq_input_init`
	net: dsa: mt7530: fix corrupt frames using trgmii on 40 MHz XTAL MT7621
	virtio_net: split free_unused_bufs()
	virtio_net: suppress cpu stall when free_unused_bufs
	net: enetc: check the index of the SFI rather than the handle
	perf vendor events power9: Remove UTF-8 characters from JSON files
	perf pmu: zfree() expects a pointer to a pointer to zero it after freeing its contents
	perf map: Delete two variable initialisations before null pointer checks in sort__sym_from_cmp()
	crypto: sun8i-ss - Fix a test in sun8i_ss_setup_ivs()
	perf symbols: Fix return incorrect build_id size in elf_read_build_id()
	btrfs: fix btrfs_prev_leaf() to not return the same key twice
	btrfs: don't free qgroup space unless specified
	btrfs: print-tree: parent bytenr must be aligned to sector size
	cifs: fix pcchunk length type in smb2_copychunk_range
	platform/x86: touchscreen_dmi: Add upside-down quirk for GDIX1002 ts on the Juno Tablet
	platform/x86: touchscreen_dmi: Add info for the Dexp Ursus KX210i
	inotify: Avoid reporting event with invalid wd
	sh: math-emu: fix macro redefined warning
	sh: mcount.S: fix build error when PRINTK is not enabled
	sh: init: use OF_EARLY_FLATTREE for early init
	sh: nmi_debug: fix return value of __setup handler
	remoteproc: stm32: Call of_node_put() on iteration error
	remoteproc: st: Call of_node_put() on iteration error
	ARM: dts: exynos: fix WM8960 clock name in Itop Elite
	ARM: dts: s5pv210: correct MIPI CSIS clock name
	f2fs: fix potential corruption when moving a directory
	drm/panel: otm8009a: Set backlight parent to panel device
	drm/amdgpu: fix an amdgpu_irq_put() issue in gmc_v9_0_hw_fini()
	drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras
	drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend
	HID: wacom: Set a default resolution for older tablets
	HID: wacom: insert timestamp to packed Bluetooth (BT) events
	KVM: x86: hyper-v: Avoid calling kvm_make_vcpus_request_mask() with vcpu_mask==NULL
	KVM: x86: do not report a vCPU as preempted outside instruction boundaries
	ext4: fix WARNING in mb_find_extent
	ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum
	ext4: fix data races when using cached status extents
	ext4: check iomap type only if ext4_iomap_begin() does not fail
	ext4: improve error recovery code paths in __ext4_remount()
	ext4: fix deadlock when converting an inline directory in nojournal mode
	ext4: add bounds checking in get_max_inline_xattr_value_size()
	ext4: bail out of ext4_xattr_ibody_get() fails for any reason
	ext4: remove a BUG_ON in ext4_mb_release_group_pa()
	ext4: fix invalid free tracking in ext4_xattr_move_to_block()
	serial: 8250: Fix serial8250_tx_empty() race with DMA Tx
	drbd: correctly submit flush bio on barrier
	KVM: x86: Ensure PV TLB flush tracepoint reflects KVM behavior
	KVM: x86: Fix recording of guest steal time / preempted status
	KVM: Fix steal time asm constraints
	KVM: x86: Remove obsolete disabling of page faults in kvm_arch_vcpu_put()
	KVM: x86: do not set st->preempted when going back to user space
	KVM: x86: revalidate steal time cache if MSR value changes
	KVM: x86: do not report preemption if the steal time cache is stale
	KVM: x86: move guest_pv_has out of user_access section
	printk: declare printk_deferred_{enter,safe}() in include/linux/printk.h
	drm/exynos: move to use request_irq by IRQF_NO_AUTOEN flag
	mm/page_alloc: fix potential deadlock on zonelist_update_seq seqlock
	drm/amd/display: Fix hang when skipping modeset
	Linux 5.10.180

Change-Id: Ie0c8ae79d56d844ec23ec277d91d4c70c3e1e9a8
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-26 17:31:57 +00:00
Greg Kroah-Hartman c7f1b9f365 Merge eded3ad80a ("ia64: fix an addr to taddr in huge_pte_offset()") into android12-5.10-lts
Steps on the way to 5.10.180

Change-Id: Ied555d8ab53844823d31e3221bd0fb155f0baeae
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-06-26 07:10:00 +00:00
Johannes Thumshirn 3bc883132d btrfs: handle memory allocation failure in btrfs_csum_one_bio
[ Upstream commit 806570c0bb ]

Since f8a53bb58e ("btrfs: handle checksum generation in the storage
layer") the failures of btrfs_csum_one_bio() are handled via
bio_end_io().

This means, we can return BLK_STS_RESOURCE from btrfs_csum_one_bio() in
case the allocation of the ordered sums fails.

This also fixes a syzkaller report, where injecting a failure into the
kvzalloc() call results in a BUG_ON().

Reported-by: syzbot+d8941552e21eac774778@syzkaller.appspotmail.com
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-21 15:45:36 +02:00
Qu Wenruo 142fbad314 btrfs: scrub: try harder to mark RAID56 block groups read-only
[ Upstream commit 7561551e7b ]

Currently we allow a block group not to be marked read-only for scrub.

But for RAID56 block groups if we require the block group to be
read-only, then we're allowed to use cached content from scrub stripe to
reduce unnecessary RAID56 reads.

So this patch would:

- Make btrfs_inc_block_group_ro() try harder
  During my tests, for cases like btrfs/061 and btrfs/064, we can hit
  ENOSPC from btrfs_inc_block_group_ro() calls during scrub.

  The reason is if we only have one single data chunk, and trying to
  scrub it, we won't have any space left for any newer data writes.

  But this check should be done by the caller, especially for scrub
  cases we only temporarily mark the chunk read-only.
  And newer data writes would always try to allocate a new data chunk
  when needed.

- Return error for scrub if we failed to mark a RAID56 chunk read-only

Signed-off-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-21 15:45:36 +02:00
Zixuan Fu b60e862e13 btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
commit 85f02d6c85 upstream.

In btrfs_relocate_block_group(), the rc is allocated.  Then
btrfs_relocate_block_group() calls

relocate_block_group()
  prepare_to_relocate()
    set_reloc_control()

that assigns rc to the variable fs_info->reloc_ctl. When
prepare_to_relocate() returns, it calls

btrfs_commit_transaction()
  btrfs_start_dirty_block_groups()
    btrfs_alloc_path()
      kmem_cache_zalloc()

which may fail for example (or other errors could happen). When the
failure occurs, btrfs_relocate_block_group() detects the error and frees
rc and doesn't set fs_info->reloc_ctl to NULL. After that, in
btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and
then used, which may cause a use-after-free bug.

This possible bug can be triggered by calling btrfs_ioctl_balance()
before calling btrfs_ioctl_defrag().

To fix this possible bug, in prepare_to_relocate(), check if
btrfs_commit_transaction() fails. If the failure occurs,
unset_reloc_control() is called to set fs_info->reloc_ctl to NULL.

The error log in our fault-injection testing is shown as follows:

  [   58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
  ...
  [   58.753577] Call Trace:
  ...
  [   58.755800]  kasan_report+0x45/0x60
  [   58.756066]  btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
  [   58.757304]  record_root_in_trans+0x792/0xa10 [btrfs]
  [   58.757748]  btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]
  [   58.758231]  start_transaction+0x896/0x2950 [btrfs]
  [   58.758661]  btrfs_defrag_root+0x250/0xc00 [btrfs]
  [   58.759083]  btrfs_ioctl_defrag+0x467/0xa00 [btrfs]
  [   58.759513]  btrfs_ioctl+0x3c95/0x114e0 [btrfs]
  ...
  [   58.768510] Allocated by task 23683:
  [   58.768777]  ____kasan_kmalloc+0xb5/0xf0
  [   58.769069]  __kmalloc+0x227/0x3d0
  [   58.769325]  alloc_reloc_control+0x10a/0x3d0 [btrfs]
  [   58.769755]  btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]
  [   58.770228]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]
  [   58.770655]  __btrfs_balance+0x1326/0x1f10 [btrfs]
  [   58.771071]  btrfs_balance+0x3150/0x3d30 [btrfs]
  [   58.771472]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
  [   58.771902]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]
  ...
  [   58.773337] Freed by task 23683:
  ...
  [   58.774815]  kfree+0xda/0x2b0
  [   58.775038]  free_reloc_control+0x1d6/0x220 [btrfs]
  [   58.775465]  btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]
  [   58.775944]  btrfs_relocate_chunk+0xf1/0x760 [btrfs]
  [   58.776369]  __btrfs_balance+0x1326/0x1f10 [btrfs]
  [   58.776784]  btrfs_balance+0x3150/0x3d30 [btrfs]
  [   58.777185]  btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
  [   58.777621]  btrfs_ioctl+0x4caa/0x114e0 [btrfs]
  ...

Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:10:01 +02:00
Josef Bacik 6f371623f3 btrfs: check return value of btrfs_commit_transaction in relocation
commit fb686c6824 upstream.

There are a few places where we don't check the return value of
btrfs_commit_transaction in relocation.c.  Thankfully all these places
have straightforward error handling, so simply change all of the sites
at once.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-14 11:10:01 +02:00
pengfuyuan e0b8664c2f btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
commit 5ad9b4719f upstream.

When compiling on a MIPS 64-bit machine we get these warnings:

    In file included from ./arch/mips/include/asm/cacheflush.h:13,
	             from ./include/linux/cacheflush.h:5,
	             from ./include/linux/highmem.h:8,
		     from ./include/linux/bvec.h:10,
		     from ./include/linux/blk_types.h:10,
                     from ./include/linux/blkdev.h:9,
	             from fs/btrfs/disk-io.c:7:
    fs/btrfs/disk-io.c: In function ‘csum_tree_block’:
    fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds]
      100 |   kaddr = page_address(buf->pages[i]);
          |                        ~~~~~~~~~~^~~
    ./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’
     2135 | #define page_address(page) lowmem_page_address(page)
          |                                                ^~~~
    cc1: all warnings being treated as errors

We can check if i overflows to solve the problem. However, this doesn't make
much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop.
In addition, i < num_pages can also ensure that buf->pages[i] will not cross
the boundary. Unfortunately, this doesn't help with the problem observed here:
gcc still complains.

To fix this add a compile-time condition for the extent buffer page
array size limit, which would eventually lead to eliminating the whole
for loop.

CC: stable@vger.kernel.org # 5.10+
Signed-off-by: pengfuyuan <pengfuyuan@kylinos.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-06-09 10:30:16 +02:00
Filipe Manana a3393eb6fb btrfs: abort transaction when sibling keys check fails for leaves
[ Upstream commit 9ae5afd02a ]

If the sibling keys check fails before we move keys from one sibling
leaf to another, we are not aborting the transaction - we leave that to
some higher level caller of btrfs_search_slot() (or anything else that
uses it to insert items into a b+tree).

This means that the transaction abort will provide a stack trace that
omits the b+tree modification call chain. So change this to immediately
abort the transaction and therefore get a more useful stack trace that
shows us the call chain in the bt+tree modification code.

It's also important to immediately abort the transaction just in case
some higher level caller is not doing it, as this indicates a very
serious corruption and we should stop the possibility of doing further
damage.

Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-06-09 10:30:08 +02:00
Josef Bacik 139f84c80d btrfs: use nofs when cleaning up aborted transactions
commit 597441b343 upstream.

Our CI system caught a lockdep splat:

  ======================================================
  WARNING: possible circular locking dependency detected
  6.3.0-rc7+ #1167 Not tainted
  ------------------------------------------------------
  kswapd0/46 is trying to acquire lock:
  ffff8c6543abd650 (sb_internal#2){++++}-{0:0}, at: btrfs_commit_inode_delayed_inode+0x5f/0x120

  but task is already holding lock:
  ffffffffabe61b40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x4aa/0x7a0

  which lock already depends on the new lock.

  the existing dependency chain (in reverse order) is:

  -> #1 (fs_reclaim){+.+.}-{0:0}:
	 fs_reclaim_acquire+0xa5/0xe0
	 kmem_cache_alloc+0x31/0x2c0
	 alloc_extent_state+0x1d/0xd0
	 __clear_extent_bit+0x2e0/0x4f0
	 try_release_extent_mapping+0x216/0x280
	 btrfs_release_folio+0x2e/0x90
	 invalidate_inode_pages2_range+0x397/0x470
	 btrfs_cleanup_dirty_bgs+0x9e/0x210
	 btrfs_cleanup_one_transaction+0x22/0x760
	 btrfs_commit_transaction+0x3b7/0x13a0
	 create_subvol+0x59b/0x970
	 btrfs_mksubvol+0x435/0x4f0
	 __btrfs_ioctl_snap_create+0x11e/0x1b0
	 btrfs_ioctl_snap_create_v2+0xbf/0x140
	 btrfs_ioctl+0xa45/0x28f0
	 __x64_sys_ioctl+0x88/0xc0
	 do_syscall_64+0x38/0x90
	 entry_SYSCALL_64_after_hwframe+0x72/0xdc

  -> #0 (sb_internal#2){++++}-{0:0}:
	 __lock_acquire+0x1435/0x21a0
	 lock_acquire+0xc2/0x2b0
	 start_transaction+0x401/0x730
	 btrfs_commit_inode_delayed_inode+0x5f/0x120
	 btrfs_evict_inode+0x292/0x3d0
	 evict+0xcc/0x1d0
	 inode_lru_isolate+0x14d/0x1e0
	 __list_lru_walk_one+0xbe/0x1c0
	 list_lru_walk_one+0x58/0x80
	 prune_icache_sb+0x39/0x60
	 super_cache_scan+0x161/0x1f0
	 do_shrink_slab+0x163/0x340
	 shrink_slab+0x1d3/0x290
	 shrink_node+0x300/0x720
	 balance_pgdat+0x35c/0x7a0
	 kswapd+0x205/0x410
	 kthread+0xf0/0x120
	 ret_from_fork+0x29/0x50

  other info that might help us debug this:

   Possible unsafe locking scenario:

	 CPU0                    CPU1
	 ----                    ----
    lock(fs_reclaim);
				 lock(sb_internal#2);
				 lock(fs_reclaim);
    lock(sb_internal#2);

   *** DEADLOCK ***

  3 locks held by kswapd0/46:
   #0: ffffffffabe61b40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0x4aa/0x7a0
   #1: ffffffffabe50270 (shrinker_rwsem){++++}-{3:3}, at: shrink_slab+0x113/0x290
   #2: ffff8c6543abd0e0 (&type->s_umount_key#44){++++}-{3:3}, at: super_cache_scan+0x38/0x1f0

  stack backtrace:
  CPU: 0 PID: 46 Comm: kswapd0 Not tainted 6.3.0-rc7+ #1167
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x58/0x90
   check_noncircular+0xd6/0x100
   ? save_trace+0x3f/0x310
   ? add_lock_to_list+0x97/0x120
   __lock_acquire+0x1435/0x21a0
   lock_acquire+0xc2/0x2b0
   ? btrfs_commit_inode_delayed_inode+0x5f/0x120
   start_transaction+0x401/0x730
   ? btrfs_commit_inode_delayed_inode+0x5f/0x120
   btrfs_commit_inode_delayed_inode+0x5f/0x120
   btrfs_evict_inode+0x292/0x3d0
   ? lock_release+0x134/0x270
   ? __pfx_wake_bit_function+0x10/0x10
   evict+0xcc/0x1d0
   inode_lru_isolate+0x14d/0x1e0
   __list_lru_walk_one+0xbe/0x1c0
   ? __pfx_inode_lru_isolate+0x10/0x10
   ? __pfx_inode_lru_isolate+0x10/0x10
   list_lru_walk_one+0x58/0x80
   prune_icache_sb+0x39/0x60
   super_cache_scan+0x161/0x1f0
   do_shrink_slab+0x163/0x340
   shrink_slab+0x1d3/0x290
   shrink_node+0x300/0x720
   balance_pgdat+0x35c/0x7a0
   kswapd+0x205/0x410
   ? __pfx_autoremove_wake_function+0x10/0x10
   ? __pfx_kswapd+0x10/0x10
   kthread+0xf0/0x120
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x29/0x50
   </TASK>

This happens because when we abort the transaction in the transaction
commit path we call invalidate_inode_pages2_range on our block group
cache inodes (if we have space cache v1) and any delalloc inodes we may
have.  The plain invalidate_inode_pages2_range() call passes through
GFP_KERNEL, which makes sense in most cases, but not here.  Wrap these
two invalidate callees with memalloc_nofs_save/memalloc_nofs_restore to
make sure we don't end up with the fs reclaim dependency under the
transaction dependency.

CC: stable@vger.kernel.org # 4.14+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-30 12:57:57 +01:00
Filipe Manana 84fdaaf0d7 btrfs: fix space cache inconsistency after error loading it from disk
[ Upstream commit 0004ff15ea ]

When loading a free space cache from disk, at __load_free_space_cache(),
if we fail to insert a bitmap entry, we still increment the number of
total bitmaps in the btrfs_free_space_ctl structure, which is incorrect
since we failed to add the bitmap entry. On error we then empty the
cache by calling __btrfs_remove_free_space_cache(), which will result
in getting the total bitmaps counter set to 1.

A failure to load a free space cache is not critical, so if a failure
happens we just rebuild the cache by scanning the extent tree, which
happens at block-group.c:caching_thread(). Yet the failure will result
in having the total bitmaps of the btrfs_free_space_ctl always bigger
by 1 then the number of bitmap entries we have. So fix this by having
the total bitmaps counter be incremented only if we successfully added
the bitmap entry.

Fixes: a67509c300 ("Btrfs: add a io_ctl struct and helpers for dealing with the space cache")
Reviewed-by: Anand Jain <anand.jain@oracle.com>
CC: stable@vger.kernel.org # 4.4+
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-30 12:57:51 +01:00
Nikolay Borisov a842fb6038 btrfs: replace calls to btrfs_find_free_ino with btrfs_find_free_objectid
[ Upstream commit abadc1fcd7 ]

The former is going away as part of the inode map removal so switch
callers to btrfs_find_free_objectid. No functional changes since with
INODE_MAP disabled (default) find_free_objectid was called anyway.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 0004ff15ea ("btrfs: fix space cache inconsistency after error loading it from disk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-30 12:57:51 +01:00
Nikolay Borisov 9c69a9d058 btrfs: move btrfs_find_highest_objectid/btrfs_find_free_objectid to disk-io.c
[ Upstream commit ec7d6dfd73 ]

Those functions are going to be used even after inode cache is removed
so moved them to a more appropriate place.

Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 0004ff15ea ("btrfs: fix space cache inconsistency after error loading it from disk")
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-05-30 12:57:51 +01:00
Anastasia Belova 829c20fd7a btrfs: print-tree: parent bytenr must be aligned to sector size
commit c87f318e6f upstream.

Check nodesize to sectorsize in alignment check in print_extent_item.
The comment states that and this is correct, similar check is done
elsewhere in the functions.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: ea57788eb7 ("btrfs: require only sector size alignment for parent eb bytenr")
CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Anastasia Belova <abelova@astralinux.ru>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:48:13 +02:00
Josef Bacik 148b16cd30 btrfs: don't free qgroup space unless specified
commit d246331b78 upstream.

Boris noticed in his simple quotas testing that he was getting a leak
with Sweet Tea's change to subvol create that stopped doing a
transaction commit.  This was just a side effect of that change.

In the delayed inode code we have an optimization that will free extra
reservations if we think we can pack a dir item into an already modified
leaf.  Previously this wouldn't be triggered in the subvolume create
case because we'd commit the transaction, it was still possible but
much harder to trigger.  It could actually be triggered if we did a
mkdir && subvol create with qgroups enabled.

This occurs because in btrfs_insert_delayed_dir_index(), which gets
called when we're adding the dir item, we do the following:

  btrfs_block_rsv_release(fs_info, trans->block_rsv, bytes, NULL);

if we're able to skip reserving space.

The problem here is that trans->block_rsv points at the temporary block
rsv for the subvolume create, which has qgroup reservations in the block
rsv.

This is a problem because btrfs_block_rsv_release() will do the
following:

  if (block_rsv->qgroup_rsv_reserved >= block_rsv->qgroup_rsv_size) {
	  qgroup_to_release = block_rsv->qgroup_rsv_reserved -
		  block_rsv->qgroup_rsv_size;
	  block_rsv->qgroup_rsv_reserved = block_rsv->qgroup_rsv_size;
  }

The temporary block rsv just has ->qgroup_rsv_reserved set,
->qgroup_rsv_size == 0.  The optimization in
btrfs_insert_delayed_dir_index() sets ->qgroup_rsv_reserved = 0.  Then
later on when we call btrfs_subvolume_release_metadata() which has

  btrfs_block_rsv_release(fs_info, rsv, (u64)-1, &qgroup_to_release);
  btrfs_qgroup_convert_reserved_meta(root, qgroup_to_release);

qgroup_to_release is set to 0, and we do not convert the reserved
metadata space.

The problem here is that the block rsv code has been unconditionally
messing with ->qgroup_rsv_reserved, because the main place this is used
is delalloc, and any time we call btrfs_block_rsv_release() we do it
with qgroup_to_release set, and thus do the proper accounting.

The subvolume code is the only other code that uses the qgroup
reservation stuff, but it's intermingled with the above optimization,
and thus was getting its reservation freed out from underneath it and
thus leaking the reserved space.

The solution is to simply not mess with the qgroup reservations if we
don't have qgroup_to_release set.  This works with the existing code as
anything that messes with the delalloc reservations always have
qgroup_to_release set.  This fixes the leak that Boris was observing.

Reviewed-by: Qu Wenruo <wqu@suse.com>
CC: stable@vger.kernel.org # 5.4+
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:48:13 +02:00
Filipe Manana 08fa23adbd btrfs: fix btrfs_prev_leaf() to not return the same key twice
commit 6f932d4ef0 upstream.

A call to btrfs_prev_leaf() may end up returning a path that points to the
same item (key) again. This happens if while btrfs_prev_leaf(), after we
release the path, a concurrent insertion happens, which moves items off
from a sibling into the front of the previous leaf, and an item with the
computed previous key does not exists.

For example, suppose we have the two following leaves:

  Leaf A

  -------------------------------------------------------------
  | ...   key (300 96 10)   key (300 96 15)   key (300 96 16) |
  -------------------------------------------------------------
              slot 20             slot 21             slot 22

  Leaf B

  -------------------------------------------------------------
  | key (300 96 20)   key (300 96 21)   key (300 96 22)   ... |
  -------------------------------------------------------------
      slot 0             slot 1             slot 2

If we call btrfs_prev_leaf(), from btrfs_previous_item() for example, with
a path pointing to leaf B and slot 0 and the following happens:

1) At btrfs_prev_leaf() we compute the previous key to search as:
   (300 96 19), which is a key that does not exists in the tree;

2) Then we call btrfs_release_path() at btrfs_prev_leaf();

3) Some other task inserts a key at leaf A, that sorts before the key at
   slot 20, for example it has an objectid of 299. In order to make room
   for the new key, the key at slot 22 is moved to the front of leaf B.
   This happens at push_leaf_right(), called from split_leaf().

   After this leaf B now looks like:

  --------------------------------------------------------------------------------
  | key (300 96 16)    key (300 96 20)   key (300 96 21)   key (300 96 22)   ... |
  --------------------------------------------------------------------------------
       slot 0              slot 1             slot 2             slot 3

4) At btrfs_prev_leaf() we call btrfs_search_slot() for the computed
   previous key: (300 96 19). Since the key does not exists,
   btrfs_search_slot() returns 1 and with a path pointing to leaf B
   and slot 1, the item with key (300 96 20);

5) This makes btrfs_prev_leaf() return a path that points to slot 1 of
   leaf B, the same key as before it was called, since the key at slot 0
   of leaf B (300 96 16) is less than the computed previous key, which is
   (300 96 19);

6) As a consequence btrfs_previous_item() returns a path that points again
   to the item with key (300 96 20).

For some users of btrfs_prev_leaf() or btrfs_previous_item() this may not
be functional a problem, despite not making sense to return a new path
pointing again to the same item/key. However for a caller such as
tree-log.c:log_dir_items(), this has a bad consequence, as it can result
in not logging some dir index deletions in case the directory is being
logged without holding the inode's VFS lock (logging triggered while
logging a child inode for example) - for the example scenario above, in
case the dir index keys 17, 18 and 19 were deleted in the current
transaction.

CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:48:13 +02:00
Qu Wenruo c96807a4ad btrfs: scrub: reject unsupported scrub flags
commit 604e6681e1 upstream.

Since the introduction of scrub interface, the only flag that we support
is BTRFS_SCRUB_READONLY.  Thus there is no sanity checks, if there are
some undefined flags passed in, we just ignore them.

This is problematic if we want to introduce new scrub flags, as we have
no way to determine if such flags are supported.

Address the problem by introducing a check for the flags, and if
unsupported flags are set, return -EOPNOTSUPP to inform the user space.

This check should be backported for all supported kernels before any new
scrub flags are introduced.

CC: stable@vger.kernel.org # 4.14+
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-05-17 11:48:06 +02:00
Greg Kroah-Hartman 2d6a4ad08c Merge 5.10.178 into android12-5.10-lts
Changes in 5.10.178
	gpio: GPIO_REGMAP: select REGMAP instead of depending on it
	Drivers: vmbus: Check for channel allocation before looking up relids
	pwm: cros-ec: Explicitly set .polarity in .get_state()
	pwm: sprd: Explicitly set .polarity in .get_state()
	KVM: s390: pv: fix external interruption loop not always detected
	wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
	net: qrtr: combine nameservice into main module
	net: qrtr: Fix a refcount bug in qrtr_recvmsg()
	icmp: guard against too small mtu
	net: don't let netpoll invoke NAPI if in xmit context
	sctp: check send stream number after wait_for_sndbuf
	net: qrtr: Do not do DEL_SERVER broadcast after DEL_CLIENT
	ipv6: Fix an uninit variable access bug in __ip6_make_skb()
	gpio: davinci: Add irq chip flag to skip set wake
	net: ethernet: ti: am65-cpsw: Fix mdio cleanup in probe
	net: stmmac: fix up RX flow hash indirection table when setting channels
	sunrpc: only free unix grouplist after RCU settles
	NFSD: callback request does not use correct credential for AUTH_SYS
	usb: xhci: tegra: fix sleep in atomic call
	xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough iommu
	USB: serial: cp210x: add Silicon Labs IFS-USB-DATACABLE IDs
	usb: typec: altmodes/displayport: Fix configure initial pin assignment
	USB: serial: option: add Telit FE990 compositions
	USB: serial: option: add Quectel RM500U-CN modem
	iio: adc: ti-ads7950: Set `can_sleep` flag for GPIO chip
	iio: dac: cio-dac: Fix max DAC write value check for 12-bit
	iio: light: cm32181: Unregister second I2C client if present
	tty: serial: sh-sci: Fix transmit end interrupt handler
	tty: serial: sh-sci: Fix Rx on RZ/G2L SCI
	tty: serial: fsl_lpuart: avoid checking for transfer complete when UARTCTRL_SBK is asserted in lpuart32_tx_empty
	nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
	nilfs2: fix sysfs interface lifetime
	dt-bindings: serial: renesas,scif: Fix 4th IRQ for 4-IRQ SCIFs
	ALSA: hda/realtek: Add quirk for Clevo X370SNW
	iio: adc: ad7791: fix IRQ flags
	scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
	perf/core: Fix the same task check in perf_event_set_output
	ftrace: Mark get_lock_parent_ip() __always_inline
	ftrace: Fix issue that 'direct->addr' not restored in modify_ftrace_direct()
	can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access
	can: isotp: isotp_ops: fix poll() to not report false EPOLLOUT events
	tracing: Free error logs of tracing instances
	ASoC: hdac_hdmi: use set_stream() instead of set_tdm_slots()
	drm/panfrost: Fix the panfrost_mmu_map_fault_addr() error path
	drm/nouveau/disp: Support more modes by checking with lower bpc
	ring-buffer: Fix race while reader and writer are on the same page
	mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
	selftests: intel_pstate: ftime() is deprecated
	drm/bridge: lt9611: Fix PLL being unable to lock
	Revert "media: ti: cal: fix possible memory leak in cal_ctx_create()"
	ocfs2: fix freeing uninitialized resource on ocfs2_dlm_shutdown
	bpftool: Print newline before '}' for struct with padding only fields
	Revert "pinctrl: amd: Disable and mask interrupts on resume"
	ALSA: emu10k1: fix capture interrupt handler unlinking
	ALSA: hda/sigmatel: add pin overrides for Intel DP45SG motherboard
	ALSA: i2c/cs8427: fix iec958 mixer control deactivation
	ALSA: firewire-tascam: add missing unwind goto in snd_tscm_stream_start_duplex()
	ALSA: hda/sigmatel: fix S/PDIF out on Intel D*45* motherboards
	Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
	Bluetooth: Fix race condition in hidp_session_thread
	btrfs: print checksum type and implementation at mount time
	btrfs: fix fast csum implementation detection
	fbmem: Reject FB_ACTIVATE_KD_TEXT from userspace
	mtdblock: tolerate corrected bit-flips
	mtd: rawnand: meson: fix bitmask for length in command word
	mtd: rawnand: stm32_fmc2: remove unsupported EDO mode
	mtd: rawnand: stm32_fmc2: use timings.mode instead of checking tRC_min
	clk: sprd: set max_register according to mapping range
	IB/mlx5: Add support for NDR link speed
	IB/mlx5: Add support for 400G_8X lane speed
	RDMA/cma: Allow UD qp_type to join multicast only
	9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
	niu: Fix missing unwind goto in niu_alloc_channels()
	sysctl: add proc_dou8vec_minmax()
	ipv4: shrink netns_ipv4 with sysctl conversions
	tcp: convert elligible sysctls to u8
	tcp: restrict net.ipv4.tcp_app_win
	drm/armada: Fix a potential double free in an error handling path
	qlcnic: check pci_reset_function result
	net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
	sctp: fix a potential overflow in sctp_ifwdtsn_skip
	RDMA/core: Fix GID entry ref leak when create_ah fails
	udp6: fix potential access to stale information
	net: macb: fix a memory corruption in extended buffer descriptor mode
	libbpf: Fix single-line struct definition output in btf_dump
	power: supply: cros_usbpd: reclassify "default case!" as debug
	wifi: mwifiex: mark OF related data as maybe unused
	i2c: imx-lpi2c: clean rx/tx buffers upon new message
	efi: sysfb_efi: Add quirk for Lenovo Yoga Book X91F/L
	drm: panel-orientation-quirks: Add quirk for Lenovo Yoga Book X90F
	verify_pefile: relax wrapper length check
	asymmetric_keys: log on fatal failures in PE/pkcs7
	riscv: add icache flush for nommu sigreturn trampoline
	net: sfp: initialize sfp->i2c_block_size at sfp allocation
	scsi: ses: Handle enclosure with just a primary component gracefully
	x86/PCI: Add quirk for AMD XHCI controller that loses MSI-X state in D3hot
	cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
	ubi: Fix failure attaching when vid_hdr offset equals to (sub)page size
	mtd: ubi: wl: Fix a couple of kernel-doc issues
	ubi: Fix deadlock caused by recursively holding work_sem
	powerpc/pseries: rename min_common_depth to primary_domain_index
	powerpc/pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY
	powerpc/pseries: Consolidate different NUMA distance update code paths
	powerpc/pseries: Add a helper for form1 cpu distance
	powerpc/pseries: Add support for FORM2 associativity
	powerpc/papr_scm: Update the NUMA distance table for the target node
	sched/fair: Move calculate of avg_load to a better location
	sched/fair: Fix imbalance overflow
	x86/rtc: Remove __init for runtime functions
	i2c: ocores: generate stop condition after timeout in polling mode
	watchdog: sbsa_wdog: Make sure the timeout programming is within the limits
	coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug
	kbuild: check the minimum assembler version in Kconfig
	kbuild: Switch to 'f' variants of integrated assembler flag
	kbuild: check CONFIG_AS_IS_LLVM instead of LLVM_IAS
	riscv: Handle zicsr/zifencei issues between clang and binutils
	kexec: move locking into do_kexec_load
	kexec: turn all kexec_mutex acquisitions into trylocks
	panic, kexec: make __crash_kexec() NMI safe
	sysctl: Fix data-races in proc_dou8vec_minmax().
	Linux 5.10.178

Change-Id: I34107ee680c7b081bb0c2782483cbb7ec62252ca
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2023-04-25 16:47:24 +00:00
Christoph Hellwig 5635e69406 btrfs: fix fast csum implementation detection
commit 68d99ab0e9 upstream.

The BTRFS_FS_CSUM_IMPL_FAST flag is currently set whenever a non-generic
crc32c is detected, which is the incorrect check if the file system uses
a different checksumming algorithm.  Refactor the code to only check
this if crc32c is actually used.  Note that in an ideal world the
information if an algorithm is hardware accelerated or not should be
provided by the crypto API instead, but that's left for another day.

CC: stable@vger.kernel.org # 5.4.x: c8a5f8ca9a: btrfs: print checksum type and implementation at mount time
CC: stable@vger.kernel.org # 5.4.x
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:10:25 +02:00