From a5bdb43175342854f198a8241725f5f5b301c3da Mon Sep 17 00:00:00 2001 From: Thomas Lamprecht Date: Fri, 26 Aug 2022 16:34:01 +0200 Subject: [PATCH] backport known fixes of regressions from the stable tree found with using the `stablefixes` tool from //git.lwn.net/gitdm.git like: git log --decorate v5.4.100^..v5.4.211 | stablefixes The resulting stable-fixes.html was checked for entries with fixes that got added later than v5.4.203 of regressions introduced earlier than that version. Signed-off-by: Thomas Lamprecht --- .../0008-SUNRPC-Fix-READ_PLUS-crasher.patch | 35 +++++++++ ...nfs-Fix-a-use-after-free-bug-in-open.patch | 42 +++++++++++ ...-qla2xxx-Fix-disk-failure-to-redisco.patch | 70 ++++++++++++++++++ ...m-seed-of-tmp_inode-after-migrating-.patch | 73 +++++++++++++++++++ ...alize-TLB-invalidates-with-GT-resets.patch | 72 ++++++++++++++++++ 5 files changed, 292 insertions(+) create mode 100644 patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch create mode 100644 patches/kernel/0009-NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch create mode 100644 patches/kernel/0010-scsi-Revert-scsi-qla2xxx-Fix-disk-failure-to-redisco.patch create mode 100644 patches/kernel/0011-ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch create mode 100644 patches/kernel/0012-drm-i915-gt-Serialize-TLB-invalidates-with-GT-resets.patch diff --git a/patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch b/patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch new file mode 100644 index 0000000..dee3d73 --- /dev/null +++ b/patches/kernel/0008-SUNRPC-Fix-READ_PLUS-crasher.patch @@ -0,0 +1,35 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Thu, 30 Jun 2022 16:48:18 -0400 +Subject: [PATCH] SUNRPC: Fix READ_PLUS crasher + +commit a23dd544debcda4ee4a549ec7de59e85c3c8345c upstream. + +Looks like there are still cases when "space_left - frag1bytes" can +legitimately exceed PAGE_SIZE. Ensure that xdr->end always remains +within the current encode buffer. + +Reported-by: Bruce Fields +Reported-by: Zorro Lang +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216151 +Fixes: 6c254bf3b637 ("SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer()") +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Lamprecht +--- + net/sunrpc/xdr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index cb8740d15633..daa4165f1179 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -608,7 +608,7 @@ static __be32 *xdr_get_next_encode_buffer(struct xdr_stream *xdr, + */ + xdr->p = (void *)p + frag2bytes; + space_left = xdr->buf->buflen - xdr->buf->len; +- if (space_left - nbytes >= PAGE_SIZE) ++ if (space_left - frag1bytes >= PAGE_SIZE) + xdr->end = (void *)p + PAGE_SIZE; + else + xdr->end = (void *)p + space_left - frag1bytes; diff --git a/patches/kernel/0009-NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch b/patches/kernel/0009-NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch new file mode 100644 index 0000000..acb8394 --- /dev/null +++ b/patches/kernel/0009-NFSv4-pnfs-Fix-a-use-after-free-bug-in-open.patch @@ -0,0 +1,42 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Trond Myklebust +Date: Tue, 2 Aug 2022 15:48:50 -0400 +Subject: [PATCH] NFSv4/pnfs: Fix a use-after-free bug in open + +commit 2135e5d56278ffdb1c2e6d325dc6b87f669b9dac upstream. + +If someone cancels the open RPC call, then we must not try to free +either the open slot or the layoutget operation arguments, since they +are likely still in use by the hung RPC call. + +Fixes: 6949493884fe ("NFSv4: Don't hold the layoutget locks across multiple RPC calls") +Signed-off-by: Trond Myklebust +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Lamprecht +--- + fs/nfs/nfs4proc.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index eee2d67d3ac9..831a16fec616 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3041,12 +3041,13 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + } + + out: +- if (opendata->lgp) { +- nfs4_lgopen_release(opendata->lgp); +- opendata->lgp = NULL; +- } +- if (!opendata->cancelled) ++ if (!opendata->cancelled) { ++ if (opendata->lgp) { ++ nfs4_lgopen_release(opendata->lgp); ++ opendata->lgp = NULL; ++ } + nfs4_sequence_free_slot(&opendata->o_res.seq_res); ++ } + return ret; + } + diff --git a/patches/kernel/0010-scsi-Revert-scsi-qla2xxx-Fix-disk-failure-to-redisco.patch b/patches/kernel/0010-scsi-Revert-scsi-qla2xxx-Fix-disk-failure-to-redisco.patch new file mode 100644 index 0000000..046924c --- /dev/null +++ b/patches/kernel/0010-scsi-Revert-scsi-qla2xxx-Fix-disk-failure-to-redisco.patch @@ -0,0 +1,70 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Nilesh Javali +Date: Tue, 12 Jul 2022 22:20:36 -0700 +Subject: [PATCH] scsi: Revert "scsi: qla2xxx: Fix disk failure to rediscover" + +commit 5bc7b01c513a4a9b4cfe306e8d1720cfcfd3b8a3 upstream. + +This fixes the regression of NVMe discovery failure during driver load +time. + +This reverts commit 6a45c8e137d4e2c72eecf1ac7cf64f2fdfcead99. + +Link: https://lore.kernel.org/r/20220713052045.10683-2-njavali@marvell.com +Cc: stable@vger.kernel.org +Reviewed-by: Himanshu Madhani +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Thomas Lamprecht +--- + drivers/scsi/qla2xxx/qla_init.c | 5 ++--- + drivers/scsi/qla2xxx/qla_nvme.c | 5 ----- + 2 files changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 1800eb0aad1c..c662c8af6cc1 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -5422,8 +5422,6 @@ qla2x00_reg_remote_port(scsi_qla_host_t *vha, fc_port_t *fcport) + if (atomic_read(&fcport->state) == FCS_ONLINE) + return; + +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + rport_ids.node_name = wwn_to_u64(fcport->node_name); + rport_ids.port_name = wwn_to_u64(fcport->port_name); + rport_ids.port_id = fcport->d_id.b.domain << 16 | +@@ -5519,7 +5517,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + qla2x00_reg_remote_port(vha, fcport); + break; + case MODE_TARGET: +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); + if (!vha->vha_tgt.qla_tgt->tgt_stop && + !vha->vha_tgt.qla_tgt->tgt_stopped) + qlt_fc_port_added(vha, fcport); +@@ -5534,6 +5531,8 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + break; + } + ++ qla2x00_set_fcport_state(fcport, FCS_ONLINE); ++ + if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { + if (fcport->id_changed) { + fcport->id_changed = 0; +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index a15af048cd82..f0de7089e9ae 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -36,11 +36,6 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + (fcport->nvme_flag & NVME_FLAG_REGISTERED)) + return 0; + +- if (atomic_read(&fcport->state) == FCS_ONLINE) +- return 0; +- +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- + fcport->nvme_flag &= ~NVME_FLAG_RESETTING; + + memset(&req, 0, sizeof(struct nvme_fc_port_info)); diff --git a/patches/kernel/0011-ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch b/patches/kernel/0011-ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch new file mode 100644 index 0000000..9c2eefa --- /dev/null +++ b/patches/kernel/0011-ext4-recover-csum-seed-of-tmp_inode-after-migrating-.patch @@ -0,0 +1,73 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Li Lingfeng +Date: Fri, 17 Jun 2022 14:25:15 +0800 +Subject: [PATCH] ext4: recover csum seed of tmp_inode after migrating to + extents + +[ Upstream commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c ] + +When migrating to extents, the checksum seed of temporary inode +need to be replaced by inode's, otherwise the inode checksums +will be incorrect when swapping the inodes data. + +However, the temporary inode can not match it's checksum to +itself since it has lost it's own checksum seed. + +mkfs.ext4 -F /dev/sdc +mount /dev/sdc /mnt/sdc +xfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile +chattr -e /mnt/sdc/testfile +chattr +e /mnt/sdc/testfile +umount /dev/sdc +fsck -fn /dev/sdc + +======== +... +Pass 1: Checking inodes, blocks, and sizes +Inode 13 passes checks, but checksum does not match inode. Fix? no +... +======== + +The fix is simple, save the checksum seed of temporary inode, and +recover it after migrating to extents. + +Fixes: e81c9302a6c3 ("ext4: set csum seed in tmp inode while migrating to extents") +Signed-off-by: Li Lingfeng +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20220617062515.2113438-1-lilingfeng3@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +Signed-off-by: Thomas Lamprecht +--- + fs/ext4/migrate.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/migrate.c b/fs/ext4/migrate.c +index c5b2ea1a9372..1faa8e4ffb9d 100644 +--- a/fs/ext4/migrate.c ++++ b/fs/ext4/migrate.c +@@ -435,7 +435,7 @@ int ext4_ext_migrate(struct inode *inode) + struct inode *tmp_inode = NULL; + struct migrate_struct lb; + unsigned long max_entries; +- __u32 goal; ++ __u32 goal, tmp_csum_seed; + uid_t owner[2]; + + /* +@@ -483,6 +483,7 @@ int ext4_ext_migrate(struct inode *inode) + * the migration. + */ + ei = EXT4_I(inode); ++ tmp_csum_seed = EXT4_I(tmp_inode)->i_csum_seed; + EXT4_I(tmp_inode)->i_csum_seed = ei->i_csum_seed; + i_size_write(tmp_inode, i_size_read(inode)); + /* +@@ -593,6 +594,7 @@ int ext4_ext_migrate(struct inode *inode) + * the inode is not visible to user space. + */ + tmp_inode->i_blocks = 0; ++ EXT4_I(tmp_inode)->i_csum_seed = tmp_csum_seed; + + /* Reset the extent details */ + ext4_ext_tree_init(handle, tmp_inode); diff --git a/patches/kernel/0012-drm-i915-gt-Serialize-TLB-invalidates-with-GT-resets.patch b/patches/kernel/0012-drm-i915-gt-Serialize-TLB-invalidates-with-GT-resets.patch new file mode 100644 index 0000000..a8b431e --- /dev/null +++ b/patches/kernel/0012-drm-i915-gt-Serialize-TLB-invalidates-with-GT-resets.patch @@ -0,0 +1,72 @@ +From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Tue, 12 Jul 2022 16:21:33 +0100 +Subject: [PATCH] drm/i915/gt: Serialize TLB invalidates with GT resets +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit a1c5a7bf79c1faa5633b918b5c0666545e84c4d1 ] + +Avoid trying to invalidate the TLB in the middle of performing an +engine reset, as this may result in the reset timing out. Currently, +the TLB invalidate is only serialised by its own mutex, forgoing the +uncore lock, but we can take the uncore->lock as well to serialise +the mmio access, thereby serialising with the GDRST. + +Tested on a NUC5i7RYB, BIOS RYBDWi35.86A.0380.2019.0517.1530 with +i915 selftest/hangcheck. + +Cc: stable@vger.kernel.org # v4.4 and upper +Fixes: 7938d61591d3 ("drm/i915: Flush TLBs before releasing backing store") +Reported-by: Mauro Carvalho Chehab +Tested-by: Mauro Carvalho Chehab +Reviewed-by: Mauro Carvalho Chehab +Signed-off-by: Chris Wilson +Cc: Tvrtko Ursulin +Reviewed-by: Andi Shyti +Acked-by: Thomas Hellström +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/1e59a7c45dd919a530256b9ac721ac6ea86c0677.1657639152.git.mchehab@kernel.org +(cherry picked from commit 33da97894758737895e90c909f16786052680ef4) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +Signed-off-by: Thomas Lamprecht +--- + drivers/gpu/drm/i915/gt/intel_gt.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/i915/gt/intel_gt.c b/drivers/gpu/drm/i915/gt/intel_gt.c +index c8c070375d29..f6d7f5d307d7 100644 +--- a/drivers/gpu/drm/i915/gt/intel_gt.c ++++ b/drivers/gpu/drm/i915/gt/intel_gt.c +@@ -339,6 +339,20 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + mutex_lock(>->tlb_invalidate_lock); + intel_uncore_forcewake_get(uncore, FORCEWAKE_ALL); + ++ spin_lock_irq(&uncore->lock); /* serialise invalidate with GT reset */ ++ ++ for_each_engine(engine, gt, id) { ++ struct reg_and_bit rb; ++ ++ rb = get_reg_and_bit(engine, regs == gen8_regs, regs, num); ++ if (!i915_mmio_reg_offset(rb.reg)) ++ continue; ++ ++ intel_uncore_write_fw(uncore, rb.reg, rb.bit); ++ } ++ ++ spin_unlock_irq(&uncore->lock); ++ + for_each_engine(engine, gt, id) { + /* + * HW architecture suggest typical invalidation time at 40us, +@@ -353,7 +367,6 @@ void intel_gt_invalidate_tlbs(struct intel_gt *gt) + if (!i915_mmio_reg_offset(rb.reg)) + continue; + +- intel_uncore_write_fw(uncore, rb.reg, rb.bit); + if (__intel_wait_for_register_fw(uncore, + rb.reg, rb.bit, 0, + timeout_us, timeout_ms,