backport known fixes of regressions from the stable tree
found with using the `stablefixes` tool from //git.lwn.net/gitdm.git like: git log --decorate v5.4.100^..v5.4.211 | stablefixes The resulting stable-fixes.html was checked for entries with fixes that got added later than v5.4.203 of regressions introduced earlier than that version. Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
This commit is contained in:
Thomas Lamprecht
parent
60a431b5fd
commit
a5bdb43175
35
patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch
Normal file
35
patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch
Normal file
@ -0,0 +1,35 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Chuck Lever <chuck.lever@oracle.com>
|
||||
Date: Thu, 30 Jun 2022 16:48:18 -0400
|
||||
Subject: [PATCH] SUNRPC: Fix READ_PLUS crasher
|
||||
|
||||
commit a23dd544debcda4ee4a549ec7de59e85c3c8345c upstream.
|
||||
|
||||
Looks like there are still cases when "space_left - frag1bytes" can
|
||||
legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains
|
||||
within the current encode buffer.
|
||||
|
||||
Reported-by: Bruce Fields <bfields@fieldses.org>
|
||||
Reported-by: Zorro Lang <zlang@redhat.com>
|
||||
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151
|
||||
Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()")
|
||||
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
net/sunrpc/xdr.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c
|
||||
index cb8740d15633..daa4165f1179 100644
|
||||
--- a/net/sunrpc/xdr.c
|
||||
+++ b/net/sunrpc/xdr.c
|
||||
@@ -608,7 +608,7 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr,
|
||||
*/
|
||||
xdr->p = (void *)p + frag2bytes;
|
||||
space_left = xdr->buf->buflen - xdr->buf->len;
|
||||
- if (space_left - nbytes >= PAGE_SIZE)
|
||||
+ if (space_left - frag1bytes >= PAGE_SIZE)
|
||||
xdr->end = (void *)p + PAGE_SIZE;
|
||||
else
|
||||
xdr->end = (void *)p + space_left - frag1bytes;
|
||||
@ -0,0 +1,42 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Trond Myklebust <trond.myklebust@hammerspace.com>
|
||||
Date: Tue, 2 Aug 2022 15:48:50 -0400
|
||||
Subject: [PATCH] NFSv4/pnfs: Fix a use-after-free bug in open
|
||||
|
||||
commit 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac upstream.
|
||||
|
||||
If someone cancels the open RPC call, then we must not try to free
|
||||
either the open slot or the layoutget operation arguments, since they
|
||||
are likely still in use by the hung RPC call.
|
||||
|
||||
Fixes: 6949493884fe ("NFSv4: Don't hold the layoutget locks across multiple RPC calls")
|
||||
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
fs/nfs/nfs4proc.c | 11 ++++++-----
|
||||
1 file changed, 6 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
|
||||
index eee2d67d3ac9..831a16fec616 100644
|
||||
--- a/fs/nfs/nfs4proc.c
|
||||
+++ b/fs/nfs/nfs4proc.c
|
||||
@@ -3041,12 +3041,13 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata,
|
||||
}
|
||||
|
||||
out:
|
||||
- if (opendata->lgp) {
|
||||
- nfs4_lgopen_release(opendata->lgp);
|
||||
- opendata->lgp = NULL;
|
||||
- }
|
||||
- if (!opendata->cancelled)
|
||||
+ if (!opendata->cancelled) {
|
||||
+ if (opendata->lgp) {
|
||||
+ nfs4_lgopen_release(opendata->lgp);
|
||||
+ opendata->lgp = NULL;
|
||||
+ }
|
||||
nfs4_sequence_free_slot(&opendata->o_res.seq_res);
|
||||
+ }
|
||||
return ret;
|
||||
}
|
||||
|
||||
@ -0,0 +1,70 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Nilesh Javali <njavali@marvell.com>
|
||||
Date: Tue, 12 Jul 2022 22:20:36 -0700
|
||||
Subject: [PATCH] scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover"
|
||||
|
||||
commit 5bc7b01c513a4a9b4cfe306e8d1720cfcfd3b8a3 upstream.
|
||||
|
||||
This fixes the regression of NVMe discovery failure during driver load
|
||||
time.
|
||||
|
||||
This reverts commit 6a45c8e137d4e2c72eecf1ac7cf64f2fdfcead99.
|
||||
|
||||
Link: https://lore.kernel.org/r/20220713052045.10683-2-njavali@marvell.com
|
||||
Cc: stable@vger.kernel.org
|
||||
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
|
||||
Signed-off-by: Nilesh Javali <njavali@marvell.com>
|
||||
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
drivers/scsi/qla2xxx/qla_init.c | 5 ++---
|
||||
drivers/scsi/qla2xxx/qla_nvme.c | 5 -----
|
||||
2 files changed, 2 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
|
||||
index 1800eb0aad1c..c662c8af6cc1 100644
|
||||
--- a/drivers/scsi/qla2xxx/qla_init.c
|
||||
+++ b/drivers/scsi/qla2xxx/qla_init.c
|
||||
@@ -5422,8 +5422,6 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport)
|
||||
if (atomic_read(&fcport->state) == FCS_ONLINE)
|
||||
return;
|
||||
|
||||
- qla2x00_set_fcport_state(fcport, FCS_ONLINE);
|
||||
-
|
||||
rport_ids.node_name = wwn_to_u64(fcport->node_name);
|
||||
rport_ids.port_name = wwn_to_u64(fcport->port_name);
|
||||
rport_ids.port_id = fcport->d_id.b.domain << 16 |
|
||||
@@ -5519,7 +5517,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
|
||||
qla2x00_reg_remote_port(vha, fcport);
|
||||
break;
|
||||
case MODE_TARGET:
|
||||
- qla2x00_set_fcport_state(fcport, FCS_ONLINE);
|
||||
if (!vha->vha_tgt.qla_tgt->tgt_stop &&
|
||||
!vha->vha_tgt.qla_tgt->tgt_stopped)
|
||||
qlt_fc_port_added(vha, fcport);
|
||||
@@ -5534,6 +5531,8 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
|
||||
break;
|
||||
}
|
||||
|
||||
+ qla2x00_set_fcport_state(fcport, FCS_ONLINE);
|
||||
+
|
||||
if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) {
|
||||
if (fcport->id_changed) {
|
||||
fcport->id_changed = 0;
|
||||
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
|
||||
index a15af048cd82..f0de7089e9ae 100644
|
||||
--- a/drivers/scsi/qla2xxx/qla_nvme.c
|
||||
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
|
||||
@@ -36,11 +36,6 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport)
|
||||
(fcport->nvme_flag & NVME_FLAG_REGISTERED))
|
||||
return 0;
|
||||
|
||||
- if (atomic_read(&fcport->state) == FCS_ONLINE)
|
||||
- return 0;
|
||||
-
|
||||
- qla2x00_set_fcport_state(fcport, FCS_ONLINE);
|
||||
-
|
||||
fcport->nvme_flag &= ~NVME_FLAG_RESETTING;
|
||||
|
||||
memset(&req, 0, sizeof(struct nvme_fc_port_info));
|
||||
@ -0,0 +1,73 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Li Lingfeng <lilingfeng3@huawei.com>
|
||||
Date: Fri, 17 Jun 2022 14:25:15 +0800
|
||||
Subject: [PATCH] ext4: recover csum seed of tmp_inode after migrating to
|
||||
extents
|
||||
|
||||
[ Upstream commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c ]
|
||||
|
||||
When migrating to extents, the checksum seed of temporary inode
|
||||
need to be replaced by inode's, otherwise the inode checksums
|
||||
will be incorrect when swapping the inodes data.
|
||||
|
||||
However, the temporary inode can not match it's checksum to
|
||||
itself since it has lost it's own checksum seed.
|
||||
|
||||
mkfs.ext4 -F /dev/sdc
|
||||
mount /dev/sdc /mnt/sdc
|
||||
xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile
|
||||
chattr -e /mnt/sdc/testfile
|
||||
chattr +e /mnt/sdc/testfile
|
||||
umount /dev/sdc
|
||||
fsck -fn /dev/sdc
|
||||
|
||||
========
|
||||
...
|
||||
Pass 1: Checking inodes, blocks, and sizes
|
||||
Inode 13 passes checks, but checksum does not match inode. Fix? no
|
||||
...
|
||||
========
|
||||
|
||||
The fix is simple, save the checksum seed of temporary inode, and
|
||||
recover it after migrating to extents.
|
||||
|
||||
Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents")
|
||||
Signed-off-by: Li Lingfeng <lilingfeng3@huawei.com>
|
||||
Reviewed-by: Jan Kara <jack@suse.cz>
|
||||
Link: https://lore.kernel.org/r/20220617062515.2113438-1-lilingfeng3@huawei.com
|
||||
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
|
||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
fs/ext4/migrate.c | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c
|
||||
index c5b2ea1a9372..1faa8e4ffb9d 100644
|
||||
--- a/fs/ext4/migrate.c
|
||||
+++ b/fs/ext4/migrate.c
|
||||
@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode)
|
||||
struct inode *tmp_inode = NULL;
|
||||
struct migrate_struct lb;
|
||||
unsigned long max_entries;
|
||||
- __u32 goal;
|
||||
+ __u32 goal, tmp_csum_seed;
|
||||
uid_t owner[2];
|
||||
|
||||
/*
|
||||
@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode)
|
||||
* the migration.
|
||||
*/
|
||||
ei = EXT4_I(inode);
|
||||
+ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed;
|
||||
EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed;
|
||||
i_size_write(tmp_inode, i_size_read(inode));
|
||||
/*
|
||||
@@ -593,6 +594,7 @@ int ext4_ext_migrate(struct inode *inode)
|
||||
* the inode is not visible to user space.
|
||||
*/
|
||||
tmp_inode->i_blocks = 0;
|
||||
+ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed;
|
||||
|
||||
/* Reset the extent details */
|
||||
ext4_ext_tree_init(handle, tmp_inode);
|
||||
@ -0,0 +1,72 @@
|
||||
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||||
From: Chris Wilson <chris.p.wilson@intel.com>
|
||||
Date: Tue, 12 Jul 2022 16:21:33 +0100
|
||||
Subject: [PATCH] drm/i915/gt: Serialize TLB invalidates with GT resets
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
[ Upstream commit a1c5a7bf79c1faa5633b918b5c0666545e84c4d1 ]
|
||||
|
||||
Avoid trying to invalidate the TLB in the middle of performing an
|
||||
engine reset, as this may result in the reset timing out. Currently,
|
||||
the TLB invalidate is only serialised by its own mutex, forgoing the
|
||||
uncore lock, but we can take the uncore->lock as well to serialise
|
||||
the mmio access, thereby serialising with the GDRST.
|
||||
|
||||
Tested on a NUC5i7RYB, BIOS RYBDWi35.86A.0380.2019.0517.1530 with
|
||||
i915 selftest/hangcheck.
|
||||
|
||||
Cc: stable@vger.kernel.org # v4.4 and upper
|
||||
Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store")
|
||||
Reported-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
||||
Tested-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
||||
Reviewed-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
||||
Signed-off-by: Chris Wilson <chris.p.wilson@intel.com>
|
||||
Cc: Tvrtko Ursulin <tvrtko.ursulin@linux.intel.com>
|
||||
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
|
||||
Acked-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
|
||||
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
|
||||
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
|
||||
Link: https://patchwork.freedesktop.org/patch/msgid/1e59a7c45dd919a530256b9ac721ac6ea86c0677.1657639152.git.mchehab@kernel.org
|
||||
(cherry picked from commit 33da97894758737895e90c909f16786052680ef4)
|
||||
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
|
||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||||
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>
|
||||
---
|
||||
drivers/gpu/drm/i915/gt/intel_gt.c | 15 ++++++++++++++-
|
||||
1 file changed, 14 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c
|
||||
index c8c070375d29..f6d7f5d307d7 100644
|
||||
--- a/drivers/gpu/drm/i915/gt/intel_gt.c
|
||||
+++ b/drivers/gpu/drm/i915/gt/intel_gt.c
|
||||
@@ -339,6 +339,20 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt)
|
||||
mutex_lock(>->tlb_invalidate_lock);
|
||||
intel_uncore_forcewake_get(uncore, FORCEWAKE_ALL);
|
||||
|
||||
+ spin_lock_irq(&uncore->lock); /* serialise invalidate with GT reset */
|
||||
+
|
||||
+ for_each_engine(engine, gt, id) {
|
||||
+ struct reg_and_bit rb;
|
||||
+
|
||||
+ rb = get_reg_and_bit(engine, regs == gen8_regs, regs, num);
|
||||
+ if (!i915_mmio_reg_offset(rb.reg))
|
||||
+ continue;
|
||||
+
|
||||
+ intel_uncore_write_fw(uncore, rb.reg, rb.bit);
|
||||
+ }
|
||||
+
|
||||
+ spin_unlock_irq(&uncore->lock);
|
||||
+
|
||||
for_each_engine(engine, gt, id) {
|
||||
/*
|
||||
* HW architecture suggest typical invalidation time at 40us,
|
||||
@@ -353,7 +367,6 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt)
|
||||
if (!i915_mmio_reg_offset(rb.reg))
|
||||
continue;
|
||||
|
||||
- intel_uncore_write_fw(uncore, rb.reg, rb.bit);
|
||||
if (__intel_wait_for_register_fw(uncore,
|
||||
rb.reg, rb.bit, 0,
|
||||
timeout_us, timeout_ms,
|
||||
Loading…
Reference in New Issue
Block a user