diff --git a/blacklist.conf b/blacklist.conf index db9e3fb..e90b70e 100644 --- a/blacklist.conf +++ b/blacklist.conf @@ -1865,3 +1865,12 @@ d5ab95da2a41567440097c277c5771ad13928dad # only on unsupported SoC b3656d8227f4c45812c6b40815d8f4e446ed372a # documentation only dfe1fe75e00e4c724ede7b9e593f6f680e446c5f # backport not worth the risk b90f3726ea3811421f56757e866f01f6e2bb37d6 # doc fix +17c7d35f141ef6158076adf3338f115f64fcf760 # requires context driver does not have (too many missing commits) +247f994459383a15486b6a78b669b6fc088c7543 # too many missing code changes: context way off +4b42d557a8add52b9a9924fb31e40a218aab7801 # requires prereq. that is too invasive and doesn't apply cleanly +3fe1e56d0e68b623dd62d8d38265d2a052e7e185 # breaks kabi +34e64705ad415ed7a816e60ef62b42fe6d1729d9 # breaks kabi +ebfac7b778fac8b0e8e92ec91d0b055f046b4604 # clang-specific +89f5f8fb5bf4305a5425f70abf3c0d93643c93dc # just a cleanup +1e886090cefe26113122a7d59a36a9aec492fef5 # documentation +39c0c8553bfb5a3d108aa47f1256076d507605e3 # reverts 0dcec41acb85 ("scsi: qla2xxx: Make sure that aborted commands are freed") diff --git a/patches.kabi/scsi-ufs-fix-ktime_t-kabi-change b/patches.kabi/scsi-ufs-fix-ktime_t-kabi-change new file mode 100644 index 0000000..0cc81d6 --- /dev/null +++ b/patches.kabi/scsi-ufs-fix-ktime_t-kabi-change @@ -0,0 +1,30 @@ +From: Lee Duncan +Date: Thu Jun 24 07:48:38 PDT 2021 +Subject: SCSI: ufs: fix ktime_t kabi change +Patch-mainline: never, kABI workaround +References: bsc#1187630 + +The patch scsi-ufs-fix-imprecise-load-calculation-in-devfreq-window +changed a kernel time value being an unsigned long to being +a ktime_t. These are the same size (64 bits), so just call +it an unsigned long for kABI checks. + +Signed-off-by: Lee Duncan +--- + drivers/scsi/ufs/ufshcd.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -391,7 +391,11 @@ struct ufs_saved_pwr_info { + struct ufs_clk_scaling { + int active_reqs; + unsigned long tot_busy_t; ++#ifdef __GENKSYMS__ ++ unsigned long window_start_t; ++#else + ktime_t window_start_t; ++#endif + ktime_t busy_start_t; + struct device_attribute enable_attr; + struct ufs_saved_pwr_info saved_pwr_info; diff --git a/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch b/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch index 171d0c4..62e3dfa 100644 --- a/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch +++ b/patches.rt/kthread-convert-worker-lock-to-raw-spinlock.patch @@ -144,19 +144,19 @@ Signed-off-by: Mike Galbraith if (!noop) wait_for_completion(&fwork.done); -@@ -985,9 +985,9 @@ static bool __kthread_cancel_work(struct - * any queuing is blocked by setting the canceling counter. - */ - work->canceling++; -- spin_unlock_irqrestore(&worker->lock, *flags); -+ raw_spin_unlock_irqrestore(&worker->lock, *flags); - del_timer_sync(&dwork->timer); -- spin_lock_irqsave(&worker->lock, *flags); -+ raw_spin_lock_irqsave(&worker->lock, *flags); - work->canceling--; - } +@@ -980,9 +980,9 @@ static void kthread_cancel_delayed_work_ + * any queuing is blocked by setting the canceling counter. + */ + work->canceling++; +- spin_unlock_irqrestore(&worker->lock, *flags); ++ raw_spin_unlock_irqrestore(&worker->lock, *flags); + del_timer_sync(&dwork->timer); +- spin_lock_irqsave(&worker->lock, *flags); ++ raw_spin_lock_irqsave(&worker->lock, *flags); + work->canceling--; + } -@@ -1034,7 +1034,7 @@ bool kthread_mod_delayed_work(struct kth +@@ -1044,7 +1044,7 @@ bool kthread_mod_delayed_work(struct kth unsigned long flags; int ret = false; @@ -165,7 +165,7 @@ Signed-off-by: Mike Galbraith /* Do not bother with canceling when never queued. */ if (!work->worker) -@@ -1051,7 +1051,7 @@ bool kthread_mod_delayed_work(struct kth +@@ -1073,7 +1073,7 @@ bool kthread_mod_delayed_work(struct kth fast_queue: __kthread_queue_delayed_work(worker, dwork, delay); out: @@ -174,7 +174,7 @@ Signed-off-by: Mike Galbraith return ret; } EXPORT_SYMBOL_GPL(kthread_mod_delayed_work); -@@ -1065,7 +1065,7 @@ static bool __kthread_cancel_work_sync(s +@@ -1087,7 +1087,7 @@ static bool __kthread_cancel_work_sync(s if (!worker) goto out; @@ -183,7 +183,7 @@ Signed-off-by: Mike Galbraith /* Work must not be used with >1 worker, see kthread_queue_work(). */ WARN_ON_ONCE(work->worker != worker); -@@ -1079,13 +1079,13 @@ static bool __kthread_cancel_work_sync(s +@@ -1104,13 +1104,13 @@ static bool __kthread_cancel_work_sync(s * In the meantime, block any queuing by setting the canceling counter. */ work->canceling++; diff --git a/patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch b/patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch new file mode 100644 index 0000000..2812867 --- /dev/null +++ b/patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch @@ -0,0 +1,120 @@ +From 0ec13aff058a82426c8d44b688c804cc4a5a0a3d Mon Sep 17 00:00:00 2001 +From: Sukadev Bhattiprolu +Date: Wed, 23 Jun 2021 21:13:10 -0700 +Subject: [PATCH] Revert "ibmvnic: simplify reset_long_term_buff function" + +References: bsc#1186206 ltc#191041 +Patch-mainline: v5.14-rc1 +Git-commit: 0ec13aff058a82426c8d44b688c804cc4a5a0a3d + +This reverts commit 1c7d45e7b2c29080bf6c8cd0e213cc3cbb62a054. + +We tried to optimize the number of hcalls we send and skipped sending +the REQUEST_MAP calls for some maps. However during resets, we need to +resend all the maps to the VIOS since the VIOS does not remember the +old values. In fact we may have failed over to a new VIOS which will +not have any of the mappings. + +When we send packets with map ids the VIOS does not know about, it +triggers a FATAL reset. While the client does recover from the FATAL +error reset, we are seeing a large number of such resets. Handling +FATAL resets is lot more unnecessary work than issuing a few more +hcalls so revert the commit and resend the maps to the VIOS. + +Fixes: 1c7d45e7b2c ("ibmvnic: simplify reset_long_term_buff function") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Acked-by: Michal Suchanek +--- + drivers/net/ethernet/ibm/ibmvnic.c | 46 ++++++++++++++++++++++++------ + 1 file changed, 38 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 5788bb956d73..4b4eccc496a8 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -257,12 +257,40 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter, + dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); + } + +-static int reset_long_term_buff(struct ibmvnic_long_term_buff *ltb) ++static int reset_long_term_buff(struct ibmvnic_adapter *adapter, ++ struct ibmvnic_long_term_buff *ltb) + { +- if (!ltb->buff) +- return -EINVAL; ++ struct device *dev = &adapter->vdev->dev; ++ int rc; + + memset(ltb->buff, 0, ltb->size); ++ ++ mutex_lock(&adapter->fw_lock); ++ adapter->fw_done_rc = 0; ++ ++ reinit_completion(&adapter->fw_done); ++ rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id); ++ if (rc) { ++ mutex_unlock(&adapter->fw_lock); ++ return rc; ++ } ++ ++ rc = ibmvnic_wait_for_completion(adapter, &adapter->fw_done, 10000); ++ if (rc) { ++ dev_info(dev, ++ "Reset failed, long term map request timed out or aborted\n"); ++ mutex_unlock(&adapter->fw_lock); ++ return rc; ++ } ++ ++ if (adapter->fw_done_rc) { ++ dev_info(dev, ++ "Reset failed, attempting to free and reallocate buffer\n"); ++ free_long_term_buff(adapter, ltb); ++ mutex_unlock(&adapter->fw_lock); ++ return alloc_long_term_buff(adapter, ltb, ltb->size); ++ } ++ mutex_unlock(&adapter->fw_lock); + return 0; + } + +@@ -484,7 +512,8 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter) + rx_pool->size * + rx_pool->buff_size); + } else { +- rc = reset_long_term_buff(&rx_pool->long_term_buff); ++ rc = reset_long_term_buff(adapter, ++ &rx_pool->long_term_buff); + } + + if (rc) +@@ -607,11 +636,12 @@ static int init_rx_pools(struct net_device *netdev) + return 0; + } + +-static int reset_one_tx_pool(struct ibmvnic_tx_pool *tx_pool) ++static int reset_one_tx_pool(struct ibmvnic_adapter *adapter, ++ struct ibmvnic_tx_pool *tx_pool) + { + int rc, i; + +- rc = reset_long_term_buff(&tx_pool->long_term_buff); ++ rc = reset_long_term_buff(adapter, &tx_pool->long_term_buff); + if (rc) + return rc; + +@@ -638,10 +668,10 @@ static int reset_tx_pools(struct ibmvnic_adapter *adapter) + + tx_scrqs = adapter->num_active_tx_pools; + for (i = 0; i < tx_scrqs; i++) { +- rc = reset_one_tx_pool(&adapter->tso_pool[i]); ++ rc = reset_one_tx_pool(adapter, &adapter->tso_pool[i]); + if (rc) + return rc; +- rc = reset_one_tx_pool(&adapter->tx_pool[i]); ++ rc = reset_one_tx_pool(adapter, &adapter->tx_pool[i]); + if (rc) + return rc; + } +-- +2.26.2 + diff --git a/patches.suse/bpf-Fix-leakage-under-speculation-on-mispredicted-br.patch b/patches.suse/bpf-Fix-leakage-under-speculation-on-mispredicted-br.patch new file mode 100644 index 0000000..477e0c4 --- /dev/null +++ b/patches.suse/bpf-Fix-leakage-under-speculation-on-mispredicted-br.patch @@ -0,0 +1,224 @@ +From: Daniel Borkmann +Date: Fri, 28 May 2021 15:47:32 +0000 +Subject: bpf: Fix leakage under speculation on mispredicted branches +Patch-mainline: v5.13-rc7 +Git-commit: 9183671af6dbf60a1219371d4ed73e23f43b49db +References: bsc#1187554,CVE-2021-33624 + +The verifier only enumerates valid control-flow paths and skips paths that +are unreachable in the non-speculative domain. And so it can miss issues +under speculative execution on mispredicted branches. + +For example, a type confusion has been demonstrated with the following +crafted program: + + // r0 = pointer to a map array entry + // r6 = pointer to readable stack slot + // r9 = scalar controlled by attacker + 1: r0 = *(u64 *)(r0) // cache miss + 2: if r0 != 0x0 goto line 4 + 3: r6 = r9 + 4: if r0 != 0x1 goto line 6 + 5: r9 = *(u8 *)(r6) + 6: // leak r9 + +Since line 3 runs iff r0 == 0 and line 5 runs iff r0 == 1, the verifier +concludes that the pointer dereference on line 5 is safe. But: if the +attacker trains both the branches to fall-through, such that the following +is speculatively executed ... + + r6 = r9 + r9 = *(u8 *)(r6) + // leak r9 + +... then the program will dereference an attacker-controlled value and could +leak its content under speculative execution via side-channel. This requires +to mistrain the branch predictor, which can be rather tricky, because the +branches are mutually exclusive. However such training can be done at +congruent addresses in user space using different branches that are not +mutually exclusive. That is, by training branches in user space ... + + A: if r0 != 0x0 goto line C + B: ... + C: if r0 != 0x0 goto line D + D: ... + +... such that addresses A and C collide to the same CPU branch prediction +entries in the PHT (pattern history table) as those of the BPF program's +lines 2 and 4, respectively. A non-privileged attacker could simply brute +force such collisions in the PHT until observing the attack succeeding. + +Alternative methods to mistrain the branch predictor are also possible that +avoid brute forcing the collisions in the PHT. A reliable attack has been +demonstrated, for example, using the following crafted program: + + // r0 = pointer to a [control] map array entry + // r7 = *(u64 *)(r0 + 0), training/attack phase + // r8 = *(u64 *)(r0 + 8), oob address + // [...] + // r0 = pointer to a [data] map array entry + 1: if r7 == 0x3 goto line 3 + 2: r8 = r0 + // crafted sequence of conditional jumps to separate the conditional + // branch in line 193 from the current execution flow + 3: if r0 != 0x0 goto line 5 + 4: if r0 == 0x0 goto exit + 5: if r0 != 0x0 goto line 7 + 6: if r0 == 0x0 goto exit + [...] + 187: if r0 != 0x0 goto line 189 + 188: if r0 == 0x0 goto exit + // load any slowly-loaded value (due to cache miss in phase 3) ... + 189: r3 = *(u64 *)(r0 + 0x1200) + // ... and turn it into known zero for verifier, while preserving slowly- + // loaded dependency when executing: + 190: r3 &= 1 + 191: r3 &= 2 + // speculatively bypassed phase dependency + 192: r7 += r3 + 193: if r7 == 0x3 goto exit + 194: r4 = *(u8 *)(r8 + 0) + // leak r4 + +As can be seen, in training phase (phase != 0x3), the condition in line 1 +turns into false and therefore r8 with the oob address is overridden with +the valid map value address, which in line 194 we can read out without +issues. However, in attack phase, line 2 is skipped, and due to the cache +miss in line 189 where the map value is (zeroed and later) added to the +phase register, the condition in line 193 takes the fall-through path due +to prior branch predictor training, where under speculation, it'll load the +byte at oob address r8 (unknown scalar type at that point) which could then +be leaked via side-channel. + +One way to mitigate these is to 'branch off' an unreachable path, meaning, +the current verification path keeps following the is_branch_taken() path +and we push the other branch to the verification stack. Given this is +unreachable from the non-speculative domain, this branch's vstate is +explicitly marked as speculative. This is needed for two reasons: i) if +this path is solely seen from speculative execution, then we later on still +want the dead code elimination to kick in in order to sanitize these +instructions with jmp-1s, and ii) to ensure that paths walked in the +non-speculative domain are not pruned from earlier walks of paths walked in +the speculative domain. Additionally, for robustness, we mark the registers +which have been part of the conditional as unknown in the speculative path +given there should be no assumptions made on their content. + +The fix in here mitigates type confusion attacks described earlier due to +i) all code paths in the BPF program being explored and ii) existing +verifier logic already ensuring that given memory access instruction +references one specific data structure. + +An alternative to this fix that has also been looked at in this scope was to +mark aux->alu_state at the jump instruction with a BPF_JMP_TAKEN state as +well as direction encoding (always-goto, always-fallthrough, unknown), such +that mixing of different always-* directions themselves as well as mixing of +always-* with unknown directions would cause a program rejection by the +verifier, e.g. programs with constructs like 'if ([...]) { x = 0; } else +{ x = 1; }' with subsequent 'if (x == 1) { [...] }'. For unprivileged, this +would result in only single direction always-* taken paths, and unknown taken +paths being allowed, such that the former could be patched from a conditional +jump to an unconditional jump (ja). Compared to this approach here, it would +have two downsides: i) valid programs that otherwise are not performing any +pointer arithmetic, etc, would potentially be rejected/broken, and ii) we are +required to turn off path pruning for unprivileged, where both can be avoided +in this work through pushing the invalid branch to the verification stack. + +The issue was originally discovered by Adam and Ofek, and later independently +discovered and reported as a result of Benedict and Piotr's research work. + +Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation") +Reported-by: Adam Morrison +Reported-by: Ofek Kirzner +Reported-by: Benedict Schlueter +Reported-by: Piotr Krysiuk +Signed-off-by: Daniel Borkmann +Reviewed-by: John Fastabend +Reviewed-by: Benedict Schlueter +Reviewed-by: Piotr Krysiuk +Acked-by: Alexei Starovoitov +Acked-by: Gary Lin + +NOTE from Gary: + * Replace 'branch->frame[branch->curframe]->regs' with 'branch->regs' + in sanitize_speculative_path() since calling bpf functions from + bpf(*) wasn't backported + * Replace "env->bypass_spec_v1" with "env->allow_ptr_leaks" for the + privileged user check. + * Modify the diff for check_cond_jmp_op() to fit the code + +(*) f4d7e40a5b71 ("bpf: introduce function calls (verification)") + +--- + kernel/bpf/verifier.c | 42 ++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 38 insertions(+), 4 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -2802,6 +2802,27 @@ struct bpf_sanitize_info { + bool mask_to_left; + }; + ++static struct bpf_verifier_state * ++sanitize_speculative_path(struct bpf_verifier_env *env, ++ const struct bpf_insn *insn, ++ u32 next_idx, u32 curr_idx) ++{ ++ struct bpf_verifier_state *branch; ++ struct bpf_reg_state *regs; ++ ++ branch = push_stack(env, next_idx, curr_idx, true); ++ if (branch && insn) { ++ regs = branch->frame[branch->curframe]->regs; ++ if (BPF_SRC(insn->code) == BPF_K) { ++ mark_reg_unknown(env, regs, insn->dst_reg); ++ } else if (BPF_SRC(insn->code) == BPF_X) { ++ mark_reg_unknown(env, regs, insn->dst_reg); ++ mark_reg_unknown(env, regs, insn->src_reg); ++ } ++ } ++ return branch; ++} ++ + static int sanitize_ptr_alu(struct bpf_verifier_env *env, + struct bpf_insn *insn, + const struct bpf_reg_state *ptr_reg, +@@ -2885,7 +2906,8 @@ do_sim: + tmp = *dst_reg; + *dst_reg = *ptr_reg; + } +- ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true); ++ ret = sanitize_speculative_path(env, NULL, env->insn_idx + 1, ++ env->insn_idx); + if (!ptr_is_dst_reg && ret) + *dst_reg = tmp; + return !ret ? REASON_STACK : 0; +@@ -4270,13 +4292,26 @@ static int check_cond_jmp_op(struct bpf_ + int pred = is_branch_taken(dst_reg, insn->imm, opcode); + + if (pred == 1) { +- /* only follow the goto, ignore fall-through */ ++ /* Only follow the goto, ignore fall-through. If needed, push ++ * the fall-through branch for simulation under speculative ++ * execution. ++ */ ++ if (!env->allow_ptr_leaks && ++ !sanitize_speculative_path(env, insn, *insn_idx + 1, ++ *insn_idx)) ++ return -EFAULT; + *insn_idx += insn->off; + return 0; + } else if (pred == 0) { +- /* only follow fall-through branch, since +- * that's where the program will go ++ /* Only follow the fall-through branch, since that's where the ++ * program will go. If needed, push the goto branch for ++ * simulation under speculative execution. + */ ++ if (!env->allow_ptr_leaks && ++ !sanitize_speculative_path(env, insn, ++ *insn_idx + insn->off + 1, ++ *insn_idx)) ++ return -EFAULT; + return 0; + } + } diff --git a/patches.suse/btrfs-add-missing-error-handling-after-doing-leaf-node-binary-search.patch b/patches.suse/btrfs-add-missing-error-handling-after-doing-leaf-node-binary-search.patch new file mode 100644 index 0000000..94dddd1 --- /dev/null +++ b/patches.suse/btrfs-add-missing-error-handling-after-doing-leaf-node-binary-search.patch @@ -0,0 +1,99 @@ +From: Filipe Manana +Date: Mon, 18 Feb 2019 16:57:26 +0000 +Subject: Btrfs: add missing error handling after doing leaf/node binary search +Git-commit: cbca7d59fea4e81ee3bf724cf20018f96d53ccea +Patch-mainline: v5.1-rc1 +References: bsc#1187833 + +The function map_private_extent_buffer() can return an -EINVAL error, and +it is called by generic_bin_search() which will return back the error. The +btrfs_bin_search() function in turn calls generic_bin_search() and the +key_search() function calls btrfs_bin_search(), so both can return the +-EINVAL error coming from the map_private_extent_buffer() function. Some +callers of these functions were ignoring that these functions can return +an error, so fix them to deal with error return values. + +Reviewed-by: Nikolay Borisov +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/ctree.c | 6 ++++++ + fs/btrfs/relocation.c | 10 ++++++++++ + fs/btrfs/tree-log.c | 2 ++ + 3 files changed, 18 insertions(+) + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 4fac5cc2e648..399b9c5182d5 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -3020,6 +3020,8 @@ int btrfs_search_old_slot(struct btrfs_root *root, const struct btrfs_key *key, + */ + prev_cmp = -1; + ret = key_search(b, key, level, &prev_cmp, &slot); ++ if (ret < 0) ++ goto done; + + if (level != 0) { + int dec = 0; +@@ -5171,6 +5173,10 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, + nritems = btrfs_header_nritems(cur); + level = btrfs_header_level(cur); + sret = btrfs_bin_search(cur, min_key, level, &slot); ++ if (sret < 0) { ++ ret = sret; ++ goto out; ++ } + + /* at the lowest level, we're done, setup the path and exit */ + if (level == path->lowest_level) { +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 70b85a593b7b..ddf028509931 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1806,6 +1806,8 @@ int replace_path(struct btrfs_trans_handle *trans, struct reloc_control *rc, + BUG_ON(level < lowest_level); + + ret = btrfs_bin_search(parent, &key, level, &slot); ++ if (ret < 0) ++ break; + if (ret && slot > 0) + slot--; + +@@ -2730,6 +2732,10 @@ static int do_relocation(struct btrfs_trans_handle *trans, + if (!lowest) { + ret = btrfs_bin_search(upper->eb, key, + upper->level, &slot); ++ if (ret < 0) { ++ err = ret; ++ goto next; ++ } + BUG_ON(ret); + bytenr = btrfs_node_blockptr(upper->eb, slot); + if (node->eb->start == bytenr) +@@ -2765,6 +2771,10 @@ static int do_relocation(struct btrfs_trans_handle *trans, + } else { + ret = btrfs_bin_search(upper->eb, key, upper->level, + &slot); ++ if (ret < 0) { ++ err = ret; ++ goto next; ++ } + BUG_ON(ret); + } + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index e76345f52beb..f06454a55e00 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3767,6 +3767,8 @@ static int drop_objectid_items(struct btrfs_trans_handle *trans, + found_key.type = 0; + ret = btrfs_bin_search(path->nodes[0], &found_key, 0, + &start_slot); ++ if (ret < 0) ++ break; + + ret = btrfs_del_items(trans, log, path, start_slot, + path->slots[0] - start_slot + 1); + diff --git a/patches.suse/btrfs-change-insert_dirty_subvol-to-return-errors.patch b/patches.suse/btrfs-change-insert_dirty_subvol-to-return-errors.patch new file mode 100644 index 0000000..7601a2f --- /dev/null +++ b/patches.suse/btrfs-change-insert_dirty_subvol-to-return-errors.patch @@ -0,0 +1,56 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:17 -0500 +Subject: btrfs: change insert_dirty_subvol to return errors +Git-commit: ac54da6c37f1eb45218e107f9c924e4d7f054e5b +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +This will be able to return errors in the future, so change it to return +an error and handle the errors appropriately. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2262,9 +2262,9 @@ static int find_next_key(struct btrfs_pa + /* + * Insert current subvolume into reloc_control::dirty_subvol_roots + */ +-static void insert_dirty_subvol(struct btrfs_trans_handle *trans, +- struct reloc_control *rc, +- struct btrfs_root *root) ++static int insert_dirty_subvol(struct btrfs_trans_handle *trans, ++ struct reloc_control *rc, ++ struct btrfs_root *root) + { + struct btrfs_root *reloc_root = root->reloc_root; + struct btrfs_root_item *reloc_root_item; +@@ -2284,6 +2284,8 @@ static void insert_dirty_subvol(struct b + btrfs_grab_fs_root(root); + list_add_tail(&root->reloc_dirty_list, &rc->dirty_subvol_roots); + } ++ ++ return 0; + } + + static int clean_dirty_subvols(struct reloc_control *rc) +@@ -2471,8 +2473,11 @@ static noinline_for_stack int merge_relo + out: + btrfs_free_path(path); + +- if (err == 0) +- insert_dirty_subvol(trans, rc, root); ++ if (err == 0) { ++ err = insert_dirty_subvol(trans, rc, root); ++ if (err) ++ btrfs_abort_transaction(trans, err); ++ } + + if (trans) + btrfs_end_transaction_throttle(trans); diff --git a/patches.suse/btrfs-check-record_root_in_trans-related-failures-in-select_reloc_root.patch b/patches.suse/btrfs-check-record_root_in_trans-related-failures-in-select_reloc_root.patch new file mode 100644 index 0000000..1247d75 --- /dev/null +++ b/patches.suse/btrfs-check-record_root_in_trans-related-failures-in-select_reloc_root.patch @@ -0,0 +1,49 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:00 -0500 +Subject: btrfs: check record_root_in_trans related failures in + select_reloc_root +Git-commit: 92de551b837650568486b94b67f4168e4c6cc68a +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We will record the fs root or the reloc root in the trans in +select_reloc_root. These will actually return errors in the following +patches, so check their return value here and return it up the stack. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2675,6 +2675,7 @@ struct btrfs_root *select_reloc_root(str + struct backref_node *next; + struct btrfs_root *root; + int index = 0; ++ int ret; + + next = node; + while (1) { +@@ -2710,11 +2711,15 @@ struct btrfs_root *select_reloc_root(str + } + + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) { +- record_reloc_root_in_trans(trans, root); ++ ret = record_reloc_root_in_trans(trans, root); ++ if (ret) ++ return ERR_PTR(ret); + break; + } + +- btrfs_record_root_in_trans(trans, root); ++ ret = btrfs_record_root_in_trans(trans, root); ++ if (ret) ++ return ERR_PTR(ret); + root = root->reloc_root; + + if (next->new_bytenr != root->node->start) { diff --git a/patches.suse/btrfs-check-return-value-of-btrfs_commit_transaction-in-relocation.patch b/patches.suse/btrfs-check-return-value-of-btrfs_commit_transaction-in-relocation.patch new file mode 100644 index 0000000..b42f798 --- /dev/null +++ b/patches.suse/btrfs-check-return-value-of-btrfs_commit_transaction-in-relocation.patch @@ -0,0 +1,53 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:34 -0500 +Subject: btrfs: check return value of btrfs_commit_transaction in relocation +Git-commit: fb686c6824dd6294ca772b92424b8fba666e7d00 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +There are a few places where we don't check the return value of +btrfs_commit_transaction in relocation.c. Thankfully all these places +have straightforward error handling, so simply change all of the sites +at once. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2603,7 +2603,7 @@ again: + list_splice(&reloc_roots, &rc->reloc_roots); + + if (!err) +- btrfs_commit_transaction(trans); ++ err = btrfs_commit_transaction(trans); + else + btrfs_end_transaction(trans); + return err; +@@ -4398,8 +4398,7 @@ int prepare_to_relocate(struct reloc_con + */ + return PTR_ERR(trans); + } +- btrfs_commit_transaction(trans); +- return 0; ++ return btrfs_commit_transaction(trans); + } + + static noinline_for_stack int relocate_block_group(struct reloc_control *rc) +@@ -4564,7 +4563,9 @@ restart: + err = PTR_ERR(trans); + goto out_free; + } +- btrfs_commit_transaction(trans); ++ ret = btrfs_commit_transaction(trans); ++ if (ret && !err) ++ err = ret; + out_free: + ret = clean_dirty_subvols(rc); + if (ret < 0 && !err) diff --git a/patches.suse/btrfs-cleanup-error-handling-in-prepare_to_merge.patch b/patches.suse/btrfs-cleanup-error-handling-in-prepare_to_merge.patch new file mode 100644 index 0000000..e97d9eb --- /dev/null +++ b/patches.suse/btrfs-cleanup-error-handling-in-prepare_to_merge.patch @@ -0,0 +1,45 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:31 -0500 +Subject: btrfs: cleanup error handling in prepare_to_merge +Git-commit: e0b085b0b03fa5c435b7240668f144199ed989c4 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +This probably can't happen even with a corrupt file system, because we +would have failed much earlier on than here. However there's no reason +we can't just check and bail out as appropriate, so do that and convert +the correctness BUG_ON() to an ASSERT(). + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 14 ++++++++++++-- + 1 file changed, 12 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2565,8 +2565,18 @@ again: + list_del_init(&reloc_root->root_list); + + root = read_fs_root(fs_info, reloc_root->root_key.offset); +- BUG_ON(IS_ERR(root)); +- BUG_ON(root->reloc_root != reloc_root); ++ if (IS_ERR(root)) { ++ /* ++ * Even if we have an error we need this reloc root ++ * back on our list so we can clean up properly. ++ */ ++ list_add(&reloc_root->root_list, &reloc_roots); ++ btrfs_abort_transaction(trans, (int)PTR_ERR(root)); ++ if (!err) ++ err = PTR_ERR(root); ++ break; ++ } ++ ASSERT(root->reloc_root == reloc_root); + + /* + * set reference count to 1, so btrfs_recover_relocation diff --git a/patches.suse/btrfs-convert-bug_on-s-in-relocate_tree_block.patch b/patches.suse/btrfs-convert-bug_on-s-in-relocate_tree_block.patch new file mode 100644 index 0000000..31b0dd9 --- /dev/null +++ b/patches.suse/btrfs-convert-bug_on-s-in-relocate_tree_block.patch @@ -0,0 +1,54 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:24:57 -0500 +Subject: btrfs: convert BUG_ON()'s in relocate_tree_block +Git-commit: 1c7bfa159fe796f0f6d310b02215d765f066b9c2 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We have a couple of BUG_ON()'s in relocate_tree_block() that can be +tripped if we have file system corruption. Convert these to ASSERT()'s +so developers still get yelled at when they break the backref code, but +error out nicely for users so the whole box doesn't go down. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 24 ++++++++++++++++++++++-- + 1 file changed, 22 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -3167,8 +3167,28 @@ static int relocate_tree_block(struct bt + + if (root) { + if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) { +- BUG_ON(node->new_bytenr); +- BUG_ON(!list_empty(&node->list)); ++ /* ++ * This block was the root block of a root, and this is ++ * the first time we're processing the block and thus it ++ * should not have had the ->new_bytenr modified and ++ * should have not been included on the changed list. ++ * ++ * However in the case of corruption we could have ++ * multiple refs pointing to the same block improperly, ++ * and thus we would trip over these checks. ASSERT() ++ * for the developer case, because it could indicate a ++ * bug in the backref code, however error out for a ++ * normal user in the case of corruption. ++ */ ++ ASSERT(node->new_bytenr == 0); ++ ASSERT(list_empty(&node->list)); ++ if (node->new_bytenr || !list_empty(&node->list)) { ++ btrfs_err(root->fs_info, ++ "bytenr %llu has improper references to it", ++ node->bytenr); ++ ret = -EUCLEAN; ++ goto out; ++ } + btrfs_record_root_in_trans(trans, root); + root = root->reloc_root; + node->new_bytenr = root->node->start; diff --git a/patches.suse/btrfs-convert-bug_on-s-in-select_reloc_root-to-proper-errors.patch b/patches.suse/btrfs-convert-bug_on-s-in-select_reloc_root-to-proper-errors.patch new file mode 100644 index 0000000..70faadc --- /dev/null +++ b/patches.suse/btrfs-convert-bug_on-s-in-select_reloc_root-to-proper-errors.patch @@ -0,0 +1,88 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:24:59 -0500 +Subject: btrfs: convert BUG_ON()'s in select_reloc_root() to proper errors +Git-commit: 8ee66afe99584e14250db2250397d110af6f4885 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We have several BUG_ON()'s in select_reloc_root() that can be tripped if +there is an extent tree corruption. Convert these to ASSERT()'s, because +if we hit it during testing it really is bad, or could indicate a +problem with the backref walking code. + +However if users hit these problems it generally indicates corruption, +I've hit a few machines in the fleet that trip over these with clearly +corrupted extent trees, so be nice and print out an error message and +return an error instead of bringing the whole box down. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 47 +++++++++++++++++++++++++++++++++++++++++++---- + 1 file changed, 43 insertions(+), 4 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2681,8 +2681,33 @@ struct btrfs_root *select_reloc_root(str + cond_resched(); + next = walk_up_backref(next, edges, &index); + root = next->root; +- BUG_ON(!root); +- BUG_ON(!test_bit(BTRFS_ROOT_REF_COWS, &root->state)); ++ ++ /* ++ * If there is no root, then our references for this block are ++ * incomplete, as we should be able to walk all the way up to a ++ * block that is owned by a root. ++ * ++ * This path is only for SHAREABLE roots, so if we come upon a ++ * non-SHAREABLE root then we have backrefs that resolve ++ * improperly. ++ * ++ * Both of these cases indicate file system corruption, or a bug ++ * in the backref walking code. ++ */ ++ if (!root) { ++ ASSERT(0); ++ btrfs_err(trans->fs_info, ++ "bytenr %llu doesn't have a backref path ending in a root", ++ node->bytenr); ++ return ERR_PTR(-EUCLEAN); ++ } ++ if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) { ++ ASSERT(0); ++ btrfs_err(trans->fs_info, ++ "bytenr %llu has multiple refs with one ending in a non-shareable root", ++ node->bytenr); ++ return ERR_PTR(-EUCLEAN); ++ } + + if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) { + record_reloc_root_in_trans(trans, root); +@@ -2693,8 +2718,22 @@ struct btrfs_root *select_reloc_root(str + root = root->reloc_root; + + if (next->new_bytenr != root->node->start) { +- BUG_ON(next->new_bytenr); +- BUG_ON(!list_empty(&next->list)); ++ /* ++ * We just created the reloc root, so we shouldn't have ++ * ->new_bytenr set and this shouldn't be in the changed ++ * list. If it is then we have multiple roots pointing ++ * at the same bytenr which indicates corruption, or ++ * we've made a mistake in the backref walking code. ++ */ ++ ASSERT(next->new_bytenr == 0); ++ ASSERT(list_empty(&next->list)); ++ if (next->new_bytenr || !list_empty(&next->list)) { ++ btrfs_err(trans->fs_info, ++ "bytenr %llu possibly has multiple roots pointing at the same bytenr %llu", ++ node->bytenr, next->bytenr); ++ return ERR_PTR(-EUCLEAN); ++ } ++ + next->new_bytenr = root->node->start; + next->root = root; + list_add_tail(&next->list, diff --git a/patches.suse/btrfs-convert-logic-bug_on-s-in-replace_path-to-assert-s.patch b/patches.suse/btrfs-convert-logic-bug_on-s-in-replace_path-to-assert-s.patch new file mode 100644 index 0000000..f6341af --- /dev/null +++ b/patches.suse/btrfs-convert-logic-bug_on-s-in-replace_path-to-assert-s.patch @@ -0,0 +1,41 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:21 -0500 +Subject: btrfs: convert logic BUG_ON()'s in replace_path to ASSERT()'s +Git-commit: 7a9213a93546e7eaef90e6e153af6b8fc7553f10 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +A few BUG_ON()'s in replace_path are purely to keep us from making +logical mistakes, so replace them with ASSERT()'s. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1887,8 +1887,8 @@ int replace_path(struct btrfs_trans_hand + int ret; + int slot; + +- BUG_ON(src->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(dest->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(src->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID); ++ ASSERT(dest->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); + + last_snapshot = btrfs_root_last_snapshot(&src->root_item); + again: +@@ -1922,7 +1922,7 @@ again: + struct btrfs_key first_key; + + level = btrfs_header_level(parent); +- BUG_ON(level < lowest_level); ++ ASSERT(level >= lowest_level); + + ret = btrfs_bin_search(parent, &key, level, &slot); + if (ret < 0) diff --git a/patches.suse/btrfs-convert-some-bug_on-s-to-assert-s-in-do_relocation.patch b/patches.suse/btrfs-convert-some-bug_on-s-to-assert-s-in-do_relocation.patch new file mode 100644 index 0000000..cd7bd23 --- /dev/null +++ b/patches.suse/btrfs-convert-some-bug_on-s-to-assert-s-in-do_relocation.patch @@ -0,0 +1,61 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:24:56 -0500 +Subject: btrfs: convert some BUG_ON()'s to ASSERT()'s in do_relocation +Git-commit: ffe30dd892ad37f1193ae639ce7e2ad142a62721 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +A few of these are checking for correctness, and won't be triggered by +corrupted file systems, so convert them to ASSERT() instead of BUG_ON() +and add a comment explaining their existence. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2865,7 +2865,11 @@ static int do_relocation(struct btrfs_tr + int slot; + int ret = 0; + +- BUG_ON(lowest && node->eb); ++ /* ++ * If we are lowest then this is the first time we're processing this ++ * block, and thus shouldn't have an eb associated with it yet. ++ */ ++ ASSERT(!lowest || !node->eb); + + path->lowest_level = node->level + 1; + rc->backref_cache.path[node->level] = node; +@@ -2961,7 +2965,11 @@ static int do_relocation(struct btrfs_tr + free_extent_buffer(eb); + if (ret < 0) + goto next; +- BUG_ON(node->eb != eb); ++ /* ++ * We've just COWed this block, it should have updated ++ * the correct backref node entry. ++ */ ++ ASSERT(node->eb == eb); + } else { + btrfs_set_node_blockptr(upper->eb, slot, + node->eb->start); +@@ -2997,7 +3005,11 @@ next: + } + + path->lowest_level = 0; +- BUG_ON(ret == -ENOSPC); ++ /* ++ * We should have allocated all of our space in the block rsv and thus ++ * shouldn't ENOSPC. ++ */ ++ ASSERT(ret != -ENOSPC); + return ret; + } + diff --git a/patches.suse/btrfs-do-not-leak-reloc-root-if-we-fail-to-read-the-fs-root.patch b/patches.suse/btrfs-do-not-leak-reloc-root-if-we-fail-to-read-the-fs-root.patch new file mode 100644 index 0000000..0941659 --- /dev/null +++ b/patches.suse/btrfs-do-not-leak-reloc-root-if-we-fail-to-read-the-fs-root.patch @@ -0,0 +1,37 @@ +From: Josef Bacik +Date: Fri, 6 Dec 2019 09:37:18 -0500 +Subject: btrfs: do not leak reloc root if we fail to read the fs root +Git-commit: ca1aa2818a53875cfdd175fb5e9a2984e997cce9 +Patch-mainline: v5.5-rc3 +References: bsc#1187833 + +If we fail to read the fs root corresponding with a reloc root we'll +just break out and free the reloc roots. But we remove our current +reloc_root from this list higher up, which means we'll leak this +reloc_root. Fix this by adding ourselves back to the reloc_roots list +so we are properly cleaned up. + +CC: stable@vger.kernel.org # 4.4+ +Reviewed-by: Filipe Manana +Reviewed-by: Johannes Thumshirn +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index d897a8e5e430..c58245797f30 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4552,6 +4552,7 @@ int btrfs_recover_relocation(struct btrfs_root *root) + fs_root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); ++ list_add_tail(&reloc_root->root_list, &reloc_roots); + goto out_free; + } + + diff --git a/patches.suse/btrfs-do-not-panic-in-_add_reloc_root.patch b/patches.suse/btrfs-do-not-panic-in-_add_reloc_root.patch new file mode 100644 index 0000000..133a217 --- /dev/null +++ b/patches.suse/btrfs-do-not-panic-in-_add_reloc_root.patch @@ -0,0 +1,57 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:30 -0500 +Subject: btrfs: do not panic in __add_reloc_root +Git-commit: 57a304cfd43b2b4a5b44b8f5dc026abb34183068 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +If we have a duplicate entry for a reloc root then we could have fs +corruption that resulted in a double allocation. Since this shouldn't +happen unless there is corruption, add an ASSERT(ret != -EEXIST) to all +of the callers of __add_reloc_root() to catch any logic mistakes for +developers, otherwise normal error handling will happen for normal +users. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1350,7 +1350,7 @@ static int __must_check __add_reloc_root + node->bytenr, &node->rb_node); + spin_unlock(&rc->reloc_root_tree.lock); + if (rb_node) { +- btrfs_panic(fs_info, -EEXIST, ++ btrfs_err(fs_info, + "Duplicate root found for start=%llu while inserting into relocation tree", + node->bytenr); + kfree(node); +@@ -1562,6 +1562,7 @@ int btrfs_init_reloc_root(struct btrfs_t + return PTR_ERR(reloc_root); + + ret = __add_reloc_root(reloc_root); ++ ASSERT(ret != -EEXIST); + if (ret) + return ret; + root->reloc_root = reloc_root; +@@ -4955,6 +4956,7 @@ int btrfs_recover_relocation(struct btrf + } + + err = __add_reloc_root(reloc_root); ++ ASSERT(err != -EEXIST); + if (err) { + list_add_tail(&reloc_root->root_list, &reloc_roots); + btrfs_end_transaction(trans); +@@ -5176,6 +5178,7 @@ int btrfs_reloc_post_snapshot(struct btr + return PTR_ERR(reloc_root); + + ret = __add_reloc_root(reloc_root); ++ ASSERT(ret != -EEXIST); + if (ret) + return ret; + new_root->reloc_root = reloc_root; diff --git a/patches.suse/btrfs-do-proper-error-handling-in-btrfs_update_reloc_root.patch b/patches.suse/btrfs-do-proper-error-handling-in-btrfs_update_reloc_root.patch new file mode 100644 index 0000000..57d3d51 --- /dev/null +++ b/patches.suse/btrfs-do-proper-error-handling-in-btrfs_update_reloc_root.patch @@ -0,0 +1,44 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:20 -0500 +Subject: btrfs: do proper error handling in btrfs_update_reloc_root +Git-commit: 592fbcd50c99b8adf999a2a54f9245caff333139 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We call btrfs_update_root in btrfs_update_reloc_root, which can fail for +all sorts of reasons, including IO errors. Instead of panicing the box +lets return the error, now that all callers properly handle those +errors. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1580,7 +1580,7 @@ int btrfs_update_reloc_root(struct btrfs + int ret; + + if (!have_reloc_root(root)) +- goto out; ++ return 0; + + reloc_root = root->reloc_root; + root_item = &reloc_root->root_item; +@@ -1605,10 +1605,7 @@ int btrfs_update_reloc_root(struct btrfs + + ret = btrfs_update_root(trans, fs_info->tree_root, + &reloc_root->root_key, root_item); +- BUG_ON(ret); +- +-out: +- return 0; ++ return ret; + } + + /* diff --git a/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_inode.patch b/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_inode.patch new file mode 100644 index 0000000..e1302e6 --- /dev/null +++ b/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_inode.patch @@ -0,0 +1,89 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:28 -0500 +Subject: btrfs: do proper error handling in create_reloc_inode +Git-commit: 790c1b8cd477af069a93375fa268d637ef799794 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We already handle some errors in this function, and the callers do the +correct error handling, so clean up the rest of the function to do the +appropriate error handling. + +There's a little extra work that needs to be done here, as we create the +inode item before we create the orphan item. We could potentially add +the orphan item, but if we failed to create the inode item we would have +to abort the transaction. + +Instead add a helper to delete the inode item we created in the case +that we're unable to look up the inode (this would likely be caused by +an ENOMEM), which if it succeeds means we can avoid a transaction abort +in this particular error case. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 39 +++++++++++++++++++++++++++++++++++++-- + 1 file changed, 37 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4559,6 +4559,35 @@ out: + return ret; + } + ++static void delete_orphan_inode(struct btrfs_trans_handle *trans, ++ struct btrfs_root *root, u64 objectid) ++{ ++ struct btrfs_path *path; ++ struct btrfs_key key; ++ int ret = 0; ++ ++ path = btrfs_alloc_path(); ++ if (!path) { ++ ret = -ENOMEM; ++ goto out; ++ } ++ ++ key.objectid = objectid; ++ key.type = BTRFS_INODE_ITEM_KEY; ++ key.offset = 0; ++ ret = btrfs_search_slot(trans, root, &key, path, -1, 1); ++ if (ret) { ++ if (ret > 0) ++ ret = -ENOENT; ++ goto out; ++ } ++ ret = btrfs_del_item(trans, root, path); ++out: ++ if (ret) ++ btrfs_abort_transaction(trans, ret); ++ btrfs_free_path(path); ++} ++ + /* + * helper to create inode for data relocation. + * the inode is in data relocation tree and its link count is 0 +@@ -4587,13 +4616,19 @@ struct inode *create_reloc_inode(struct + goto out; + + err = __insert_orphan_inode(trans, root, objectid); +- BUG_ON(err); ++ if (err) ++ goto out; + + key.objectid = objectid; + key.type = BTRFS_INODE_ITEM_KEY; + key.offset = 0; + inode = btrfs_iget(fs_info->sb, &key, root, NULL); +- BUG_ON(IS_ERR(inode) || is_bad_inode(inode)); ++ if (IS_ERR(inode)) { ++ delete_orphan_inode(trans, root, objectid); ++ err = PTR_ERR(inode); ++ inode = NULL; ++ goto out; ++ } + BTRFS_I(inode)->index_cnt = group->key.objectid; + + err = btrfs_orphan_add(trans, BTRFS_I(inode)); diff --git a/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_root.patch b/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_root.patch new file mode 100644 index 0000000..960ba63 --- /dev/null +++ b/patches.suse/btrfs-do-proper-error-handling-in-create_reloc_root.patch @@ -0,0 +1,92 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:14 -0500 +Subject: btrfs: do proper error handling in create_reloc_root +Git-commit: 84c50ba5214c2f3c1be4a931d521ec19f55dfdc8 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We do memory allocations here, read blocks from disk, all sorts of +operations that could easily fail at any given point. Instead of +panicing the box, simply return the error back up the chain, all callers +at this point have proper error handling. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 33 +++++++++++++++++++++++++++------ + 1 file changed, 27 insertions(+), 6 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1433,10 +1433,12 @@ static struct btrfs_root *create_reloc_r + struct extent_buffer *eb; + struct btrfs_root_item *root_item; + struct btrfs_key root_key; +- int ret; ++ int ret = 0; ++ bool must_abort = false; + + root_item = kmalloc(sizeof(*root_item), GFP_NOFS); +- BUG_ON(!root_item); ++ if (!root_item) ++ return ERR_PTR(-ENOMEM); + + root_key.objectid = BTRFS_TREE_RELOC_OBJECTID; + root_key.type = BTRFS_ROOT_ITEM_KEY; +@@ -1448,7 +1450,9 @@ static struct btrfs_root *create_reloc_r + /* called by btrfs_init_reloc_root */ + ret = btrfs_copy_root(trans, root, root->commit_root, &eb, + BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(ret); ++ if (ret) ++ goto fail; ++ + /* + * Set the last_snapshot field to the generation of the commit + * root - like this ctree.c:btrfs_block_can_be_shared() behaves +@@ -1469,9 +1473,16 @@ static struct btrfs_root *create_reloc_r + */ + ret = btrfs_copy_root(trans, root, root->node, &eb, + BTRFS_TREE_RELOC_OBJECTID); +- BUG_ON(ret); ++ if (ret) ++ goto fail; + } + ++ /* ++ * We have changed references at this point, we must abort the ++ * transaction if anything fails. ++ */ ++ must_abort = true; ++ + memcpy(root_item, &root->root_item, sizeof(*root_item)); + btrfs_set_root_bytenr(root_item, eb->start); + btrfs_set_root_level(root_item, btrfs_header_level(eb)); +@@ -1489,13 +1500,23 @@ static struct btrfs_root *create_reloc_r + + ret = btrfs_insert_root(trans, fs_info->tree_root, + &root_key, root_item); +- BUG_ON(ret); ++ if (ret) ++ goto fail; + kfree(root_item); + + reloc_root = btrfs_read_fs_root(fs_info->tree_root, &root_key); +- BUG_ON(IS_ERR(reloc_root)); ++ if (IS_ERR(reloc_root)) { ++ ret = PTR_ERR(reloc_root); ++ goto abort; ++ } + reloc_root->last_trans = trans->transid; + return reloc_root; ++fail: ++ kfree(root_item); ++abort: ++ if (must_abort) ++ btrfs_abort_transaction(trans, ret); ++ return ERR_PTR(ret); + } + + /* diff --git a/patches.suse/btrfs-do-proper-error-handling-in-merge_reloc_roots.patch b/patches.suse/btrfs-do-proper-error-handling-in-merge_reloc_roots.patch new file mode 100644 index 0000000..c7b57a7 --- /dev/null +++ b/patches.suse/btrfs-do-proper-error-handling-in-merge_reloc_roots.patch @@ -0,0 +1,55 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:33 -0500 +Subject: btrfs: do proper error handling in merge_reloc_roots +Git-commit: 24213fa46c7080c31d79aa2e3e2f0d9480cab700 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We have a BUG_ON() if we get an error back from btrfs_get_fs_root(). +This honestly should never fail, as at this point we have a solid +coordination of fs root to reloc root, and these roots will all be in +memory. But in the name of killing BUG_ON()'s remove these and handle +the error condition properly, ASSERT()'ing for developers. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 25 +++++++++++++++++++++++-- + 1 file changed, 23 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2654,8 +2654,29 @@ again: + + root = read_fs_root(fs_info, reloc_root->root_key.offset); + if (btrfs_root_refs(&reloc_root->root_item) > 0) { +- BUG_ON(IS_ERR(root)); +- BUG_ON(root->reloc_root != reloc_root); ++ if (IS_ERR(root)) { ++ /* ++ * For recovery we read the fs roots on mount, ++ * and if we didn't find the root then we marked ++ * the reloc root as a garbage root. For normal ++ * relocation obviously the root should exist in ++ * memory. However there's no reason we can't ++ * handle the error properly here just in case. ++ */ ++ ASSERT(0); ++ ret = PTR_ERR(root); ++ goto out; ++ } ++ if (root->reloc_root != reloc_root) { ++ /* ++ * This is actually impossible without something ++ * going really wrong (like weird race condition ++ * or cosmic rays). ++ */ ++ ASSERT(0); ++ ret = -EINVAL; ++ goto out; ++ } + ret = merge_reloc_root(rc, root); + if (ret) { + if (list_empty(&reloc_root->root_list)) diff --git a/patches.suse/btrfs-do-proper-error-handling-in-record_reloc_root_in_trans.patch b/patches.suse/btrfs-do-proper-error-handling-in-record_reloc_root_in_trans.patch new file mode 100644 index 0000000..98f3aec --- /dev/null +++ b/patches.suse/btrfs-do-proper-error-handling-in-record_reloc_root_in_trans.patch @@ -0,0 +1,57 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:01 -0500 +Subject: btrfs: do proper error handling in record_reloc_root_in_trans +Git-commit: 404bccbcaa7ecb073b4d7c1126efda47b346be4a +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +Generally speaking this shouldn't ever fail, the corresponding fs root +for the reloc root will already be in memory, so we won't get ENOMEM +here. + +However if there is no corresponding root for the reloc root then we +could get ENOMEM when we try to allocate it or we could get ENOENT +when we look it up and see that it doesn't exist. + +Convert these BUG_ON()'s into ASSERT()'s and add proper error handling +for the case of corruption. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2660,8 +2660,26 @@ static int record_reloc_root_in_trans(st + return 0; + + root = read_fs_root(fs_info, reloc_root->root_key.offset); +- BUG_ON(IS_ERR(root)); +- BUG_ON(root->reloc_root != reloc_root); ++ ++ /* ++ * This should succeed, since we can't have a reloc root without having ++ * already looked up the actual root and created the reloc root for this ++ * root. ++ * ++ * However if there's some sort of corruption where we have a ref to a ++ * reloc root without a corresponding root this could return ENOENT. ++ */ ++ if (IS_ERR(root)) { ++ ASSERT(0); ++ return PTR_ERR(root); ++ } ++ if (root->reloc_root != reloc_root) { ++ ASSERT(0); ++ btrfs_err(fs_info, ++ "root %llu has two reloc roots associated with it", ++ reloc_root->root_key.offset); ++ return -EUCLEAN; ++ } + + return btrfs_record_root_in_trans(trans, root); + } diff --git a/patches.suse/btrfs-handle-_add_reloc_root-failures-in-btrfs_recover_relocation.patch b/patches.suse/btrfs-handle-_add_reloc_root-failures-in-btrfs_recover_relocation.patch new file mode 100644 index 0000000..769fb44 --- /dev/null +++ b/patches.suse/btrfs-handle-_add_reloc_root-failures-in-btrfs_recover_relocation.patch @@ -0,0 +1,45 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:29 -0500 +Subject: btrfs: handle __add_reloc_root failures in btrfs_recover_relocation +Git-commit: 3c9258632c49436558f10776be1809ae051cdb9e +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We can already handle errors appropriately from this function, deal with +an error coming from __add_reloc_root appropriately. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4955,7 +4955,11 @@ int btrfs_recover_relocation(struct btrf + } + + err = __add_reloc_root(reloc_root); +- BUG_ON(err < 0); /* -ENOMEM or logic error */ ++ if (err) { ++ list_add_tail(&reloc_root->root_list, &reloc_roots); ++ btrfs_end_transaction(trans); ++ goto out_unset; ++ } + fs_root->reloc_root = reloc_root; + } + +@@ -5172,7 +5176,8 @@ int btrfs_reloc_post_snapshot(struct btr + return PTR_ERR(reloc_root); + + ret = __add_reloc_root(reloc_root); +- BUG_ON(ret < 0); ++ if (ret) ++ return ret; + new_root->reloc_root = reloc_root; + + if (rc->create_reloc_tree) diff --git a/patches.suse/btrfs-handle-btrfs_cow_block-errors-in-replace_path.patch b/patches.suse/btrfs-handle-btrfs_cow_block-errors-in-replace_path.patch new file mode 100644 index 0000000..0afd9e5 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_cow_block-errors-in-replace_path.patch @@ -0,0 +1,47 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:22 -0500 +Subject: btrfs: handle btrfs_cow_block errors in replace_path +Git-commit: 45b87c5d2557a327bb702d00040cfbf2271b56ed +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +If we error out COWing the root node when doing a replace_path then we +simply unlock and free the buffer and return the error. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1907,7 +1907,11 @@ again: + + if (cow) { + ret = btrfs_cow_block(trans, dest, eb, NULL, 0, &eb); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_tree_unlock(eb); ++ free_extent_buffer(eb); ++ return ret; ++ } + } + btrfs_set_lock_blocking(eb); + +@@ -1975,7 +1979,11 @@ again: + if (cow) { + ret = btrfs_cow_block(trans, dest, eb, parent, + slot, &eb); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_tree_unlock(eb); ++ free_extent_buffer(eb); ++ break; ++ } + } + btrfs_set_lock_blocking(eb); + diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_recover_log_trees.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_recover_log_trees.patch new file mode 100644 index 0000000..b698e93 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_recover_log_trees.patch @@ -0,0 +1,46 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:05 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in + btrfs_recover_log_trees +Git-commit: 2002ae112a7415403896c66971532c2bb8d09ab7 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in btrfs_recover_log_trees. + +This appears tricky, however we have a reference count on the +destination root, so if this fails we need to continue on in the loop to +make sure the proper cleanup is done. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/tree-log.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 72c4b66ed516..c1353b84ae54 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6280,8 +6280,13 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree) + } + + wc.replay_dest->log_root = log; +- btrfs_record_root_in_trans(trans, wc.replay_dest); +- ret = walk_log_tree(trans, log, &wc); ++ ret = btrfs_record_root_in_trans(trans, wc.replay_dest); ++ if (ret) ++ /* The loop needs to continue due to the root refs */ ++ btrfs_handle_fs_error(fs_info, ret, ++ "failed to record the log root in transaction"); ++ else ++ ret = walk_log_tree(trans, log, &wc); + + if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) { + ret = fixup_inode_link_counts(trans, wc.replay_dest, + diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename.patch new file mode 100644 index 0000000..1172294 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename.patch @@ -0,0 +1,37 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:03 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in btrfs_rename +Git-commit: b0fec6fd330fe10cb68c137f6b7a17898ee69671 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in btrfs_rename. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/inode.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 179ffb9529d4..b8863537d31d 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9416,8 +9416,11 @@ static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry, + goto out_notrans; + } + +- if (dest != root) +- btrfs_record_root_in_trans(trans, dest); ++ if (dest != root) { ++ ret = btrfs_record_root_in_trans(trans, dest); ++ if (ret) ++ goto out_fail; ++ } + + ret = btrfs_set_inode_index(BTRFS_I(new_dir), &index); + if (ret) + diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename_exchange.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename_exchange.patch new file mode 100644 index 0000000..89ccf1b --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename_exchange.patch @@ -0,0 +1,39 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:02 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in + btrfs_rename_exchange +Git-commit: 00aa8e87c9dc63bf145bee00d890198cf7c45a24 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in btrfs_rename_exchange. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/inode.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 41517d14c950..179ffb9529d4 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9108,8 +9108,11 @@ static int btrfs_rename_exchange(struct inode *old_dir, + goto out_notrans; + } + +- if (dest != root) +- btrfs_record_root_in_trans(trans, dest); ++ if (dest != root) { ++ ret = btrfs_record_root_in_trans(trans, dest); ++ if (ret) ++ goto out_fail; ++ } + + /* + * We need to find a free sequence number both in the source and + diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-create_subvol.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-create_subvol.patch new file mode 100644 index 0000000..a13a249 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-create_subvol.patch @@ -0,0 +1,33 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:06 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in create_subvol +Git-commit: 221581e485751811db3b43148177be2a0bdb2f3c +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in create_subvol. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/ioctl.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -581,7 +581,11 @@ static noinline int create_subvol(struct + goto fail; + } + +- btrfs_record_root_in_trans(trans, new_root); ++ ret = btrfs_record_root_in_trans(trans, new_root); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + + ret = btrfs_create_subvol_root(trans, new_root, root, new_dirid); + if (ret) { diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-relocate_tree_block.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-relocate_tree_block.patch new file mode 100644 index 0000000..68ab5e2 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-relocate_tree_block.patch @@ -0,0 +1,33 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:07 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in + relocate_tree_block +Git-commit: d18c7bd95c3d1adf5de385acc8c0bdb64b1a8d68 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in relocate_tree_block. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -3260,7 +3260,9 @@ static int relocate_tree_block(struct bt + ret = -EUCLEAN; + goto out; + } +- btrfs_record_root_in_trans(trans, root); ++ ret = btrfs_record_root_in_trans(trans, root); ++ if (ret) ++ goto out; + root = root->reloc_root; + node->new_bytenr = root->node->start; + node->root = root; diff --git a/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-start_transaction.patch b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-start_transaction.patch new file mode 100644 index 0000000..52e613b --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-start_transaction.patch @@ -0,0 +1,40 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:08 -0500 +Subject: btrfs: handle btrfs_record_root_in_trans failure in start_transaction +Git-commit: 68075ea8d760d6136900a268d65b7fd072977ccb +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_record_root_in_trans will return errors in the future, so handle +the error properly in start_transaction. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -643,7 +643,16 @@ got_it: + * Thus it need to be called after current->journal_info initialized, + * or we can deadlock. + */ +- btrfs_record_root_in_trans(h, root); ++ ret = btrfs_record_root_in_trans(h, root); ++ if (ret) { ++ /* ++ * The transaction handle is fully initialized and linked with ++ * other structures so it needs to be ended in case of errors, ++ * not just freed. ++ */ ++ btrfs_end_transaction(h); ++ return ERR_PTR(ret); ++ } + return h; + + join_fail: diff --git a/patches.suse/btrfs-handle-btrfs_search_slot-failure-in-replace_path.patch b/patches.suse/btrfs-handle-btrfs_search_slot-failure-in-replace_path.patch new file mode 100644 index 0000000..810d81e --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_search_slot-failure-in-replace_path.patch @@ -0,0 +1,39 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:23 -0500 +Subject: btrfs: handle btrfs_search_slot failure in replace_path +Git-commit: 0e9873e2fe43ea098e70c30c996ebb90a22cce43 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +The search can fail for various reasons, in case of errors there's no +cleanup to be done so we can pass the error to the caller, adjusting for +the case where the key is not found and search slot returns 1. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ update changelog ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index f1702157532a..b62f5e46cf34 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1323,7 +1323,11 @@ int replace_path(struct btrfs_trans_handle *trans, struct reloc_control *rc, + path->lowest_level = level; + ret = btrfs_search_slot(trans, src, &key, path, 0, 1); + path->lowest_level = 0; +- BUG_ON(ret); ++ if (ret) { ++ if (ret > 0) ++ ret = -ENOENT; ++ break; ++ } + + /* + * Info qgroup to trace both subtrees. + diff --git a/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-commit_fs_roots.patch b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-commit_fs_roots.patch new file mode 100644 index 0000000..eeab863 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-commit_fs_roots.patch @@ -0,0 +1,39 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:16 -0500 +Subject: btrfs: handle btrfs_update_reloc_root failure in commit_fs_roots +Git-commit: 2dd8298eb3e90103f3cb36a975aee84bae66f218 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_update_reloc_root will will return errors in the future, so handle +the error properly in commit_fs_roots. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1242,13 +1242,16 @@ static noinline int commit_fs_roots(stru + break; + for (i = 0; i < ret; i++) { + struct btrfs_root *root = gang[i]; ++ int ret2; + radix_tree_tag_clear(&fs_info->fs_roots_radix, + (unsigned long)root->root_key.objectid, + BTRFS_ROOT_TRANS_TAG); + spin_unlock(&fs_info->fs_roots_radix_lock); + + btrfs_free_log(trans, root); +- btrfs_update_reloc_root(trans, root); ++ ret2 = btrfs_update_reloc_root(trans, root); ++ if (ret2) ++ return ret2; + + btrfs_save_ino_cache(root, trans); + diff --git a/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-insert_dirty_subvol.patch b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-insert_dirty_subvol.patch new file mode 100644 index 0000000..1e74351 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-insert_dirty_subvol.patch @@ -0,0 +1,39 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:18 -0500 +Subject: btrfs: handle btrfs_update_reloc_root failure in insert_dirty_subvol +Git-commit: 7934133fae5ea08346b224ecabffdbf14dd076c6 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_update_reloc_root will will return errors in the future, so handle +the error properly in insert_dirty_subvol. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2268,6 +2268,7 @@ static int insert_dirty_subvol(struct bt + { + struct btrfs_root *reloc_root = root->reloc_root; + struct btrfs_root_item *reloc_root_item; ++ int ret; + + /* @root must be a subvolume tree root with a valid reloc tree */ + ASSERT(root->root_key.objectid != BTRFS_TREE_RELOC_OBJECTID); +@@ -2278,7 +2279,9 @@ static int insert_dirty_subvol(struct bt + sizeof(reloc_root_item->drop_progress)); + reloc_root_item->drop_level = 0; + btrfs_set_root_refs(reloc_root_item, 0); +- btrfs_update_reloc_root(trans, root); ++ ret = btrfs_update_reloc_root(trans, root); ++ if (ret) ++ return ret; + + if (list_empty(&root->reloc_dirty_list)) { + btrfs_grab_fs_root(root); diff --git a/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-prepare_to_merge.patch b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-prepare_to_merge.patch new file mode 100644 index 0000000..aad6ee7 --- /dev/null +++ b/patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-prepare_to_merge.patch @@ -0,0 +1,42 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:19 -0500 +Subject: btrfs: handle btrfs_update_reloc_root failure in prepare_to_merge +Git-commit: bbae13f8ab22fb997403ee8a67f87432f4751a8d +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +btrfs_update_reloc_root will will return errors in the future, so handle +an error properly in prepare_to_merge. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2552,9 +2552,20 @@ again: + */ + if (!err) + btrfs_set_root_refs(&reloc_root->root_item, 1); +- btrfs_update_reloc_root(trans, root); ++ ret = btrfs_update_reloc_root(trans, root); + ++ /* ++ * Even if we have an error we need this reloc root back on our ++ * list so we can clean up properly. ++ */ + list_add(&reloc_root->root_list, &reloc_roots); ++ ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ if (!err) ++ err = ret; ++ break; ++ } + } + + list_splice(&reloc_roots, &rc->reloc_roots); diff --git a/patches.suse/btrfs-handle-errors-from-select_reloc_root.patch b/patches.suse/btrfs-handle-errors-from-select_reloc_root.patch new file mode 100644 index 0000000..9271fa5 --- /dev/null +++ b/patches.suse/btrfs-handle-errors-from-select_reloc_root.patch @@ -0,0 +1,61 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:24:58 -0500 +Subject: btrfs: handle errors from select_reloc_root() +Git-commit: cbdc2ebc7c42a744d2f52a8a4adb0b725798469e +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +Currently select_reloc_root() doesn't return an error, but followup +patches will make it possible for it to return an error. We do have +proper error recovery in do_relocation however, so handle the +possibility of select_reloc_root() having an error properly instead of +BUG_ON(!root). + +I've also adjusted select_reloc_root() to return ERR_PTR(-ENOENT) if we +don't find a root, instead of NULL, to make the error case easier to +deal with. I've replaced the BUG_ON(!root) with an ASSERT(0) for this +case as it indicates we messed up the backref walking code, but it could +also indicate corruption. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index e5fbc2c00166..146c7dbcf04c 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2024,8 +2024,14 @@ struct btrfs_root *select_reloc_root(struct btrfs_trans_handle *trans, + if (!next || next->level <= node->level) + break; + } +- if (!root) +- return NULL; ++ if (!root) { ++ /* ++ * This can happen if there's fs corruption or if there's a bug ++ * in the backref lookup code. ++ */ ++ ASSERT(0); ++ return ERR_PTR(-ENOENT); ++ } + + next = node; + /* setup backref node path for btrfs_reloc_cow_block */ +@@ -2196,7 +2202,10 @@ static int do_relocation(struct btrfs_trans_handle *trans, + + upper = edge->node[UPPER]; + root = select_reloc_root(trans, rc, upper, edges); +- BUG_ON(!root); ++ if (IS_ERR(root)) { ++ ret = PTR_ERR(root); ++ goto next; ++ } + + if (upper->eb && !upper->locked) { + if (!lowest) { + diff --git a/patches.suse/btrfs-handle-errors-in-reference-count-manipulation-in-replace_path.patch b/patches.suse/btrfs-handle-errors-in-reference-count-manipulation-in-replace_path.patch new file mode 100644 index 0000000..73c583a --- /dev/null +++ b/patches.suse/btrfs-handle-errors-in-reference-count-manipulation-in-replace_path.patch @@ -0,0 +1,66 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:24 -0500 +Subject: btrfs: handle errors in reference count manipulation in replace_path +Git-commit: 253e258c34262c50ce2622b38d2769911a9cddfd +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +If any of the reference count manipulation stuff fails in replace_path +we need to abort the transaction, as we've modified the blocks already. +We can simply break at this point and everything will be cleaned up. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2052,27 +2052,39 @@ again: + ref.skip_qgroup = true; + btrfs_init_tree_ref(&ref, level - 1, src->root_key.objectid); + ret = btrfs_inc_extent_ref(trans, src, &ref); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + btrfs_init_generic_ref(&ref, BTRFS_ADD_DELAYED_REF, new_bytenr, + blocksize, 0); + ref.skip_qgroup = true; + btrfs_init_tree_ref(&ref, level - 1, dest->root_key.objectid); + ret = btrfs_inc_extent_ref(trans, dest, &ref); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + + btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, new_bytenr, + blocksize, path->nodes[level]->start); + btrfs_init_tree_ref(&ref, level - 1, src->root_key.objectid); + ref.skip_qgroup = true; + ret = btrfs_free_extent(trans, src, &ref); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + + btrfs_init_generic_ref(&ref, BTRFS_DROP_DELAYED_REF, old_bytenr, + blocksize, 0); + btrfs_init_tree_ref(&ref, level - 1, dest->root_key.objectid); + ref.skip_qgroup = true; + ret = btrfs_free_extent(trans, dest, &ref); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + + btrfs_unlock_up_safe(path, 0); + diff --git a/patches.suse/btrfs-handle-extent-corruption-with-select_one_root-properly.patch b/patches.suse/btrfs-handle-extent-corruption-with-select_one_root-properly.patch new file mode 100644 index 0000000..06d443a --- /dev/null +++ b/patches.suse/btrfs-handle-extent-corruption-with-select_one_root-properly.patch @@ -0,0 +1,55 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:32 -0500 +Subject: btrfs: handle extent corruption with select_one_root properly +Git-commit: 8717cf440db670ba87596d8f5f6660d2a94f4401 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +In corruption cases we could have paths from a block up to no root at +all, and thus we'll BUG_ON(!root) in select_one_root. Handle this by +adding an ASSERT() for developers, and returning an error for normal +users. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2893,7 +2893,13 @@ struct btrfs_root *select_one_root(struc + cond_resched(); + next = walk_up_backref(next, edges, &index); + root = next->root; +- BUG_ON(!root); ++ ++ /* ++ * This can occur if we have incomplete extent refs leading all ++ * the way up a particular path, in this case return -EUCLEAN. ++ */ ++ if (!root) ++ return ERR_PTR(-EUCLEAN); + + /* no other choice for non-references counted tree */ + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) +@@ -3308,8 +3314,15 @@ static int relocate_tree_block(struct bt + + BUG_ON(node->processed); + root = select_one_root(node); +- if (root == ERR_PTR(-ENOENT)) { +- update_processed_blocks(rc, node); ++ if (IS_ERR(root)) { ++ ret = PTR_ERR(root); ++ ++ /* See explanation in select_one_root for the -EUCLEAN case. */ ++ ASSERT(ret == -ENOENT); ++ if (ret == -ENOENT) { ++ ret = 0; ++ update_processed_blocks(rc, node); ++ } + goto out; + } + diff --git a/patches.suse/btrfs-handle-extent-reference-errors-in-do_relocation.patch b/patches.suse/btrfs-handle-extent-reference-errors-in-do_relocation.patch new file mode 100644 index 0000000..7018fef --- /dev/null +++ b/patches.suse/btrfs-handle-extent-reference-errors-in-do_relocation.patch @@ -0,0 +1,38 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:25 -0500 +Subject: btrfs: handle extent reference errors in do_relocation +Git-commit: eb6b7fb4b544ae0ab19a85b55ca548d838dc4beb +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We can already deal with errors appropriately from do_relocation, simply +handle any errors that come from changing the refs at this point +cleanly. We have to abort the transaction if we fail here as we've +modified metadata at this point. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -3126,10 +3126,11 @@ static int do_relocation(struct btrfs_tr + btrfs_init_tree_ref(&ref, node->level, + btrfs_header_owner(upper->eb)); + ret = btrfs_inc_extent_ref(trans, root, &ref); +- BUG_ON(ret); +- +- ret = btrfs_drop_subtree(trans, root, eb, upper->eb); +- BUG_ON(ret); ++ if (!ret) ++ ret = btrfs_drop_subtree(trans, root, eb, ++ upper->eb); ++ if (ret) ++ btrfs_abort_transaction(trans, ret); + } + next: + if (!upper->pending) diff --git a/patches.suse/btrfs-handle-record_root_in_trans-failure-in-btrfs_record_root_in_trans.patch b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-btrfs_record_root_in_trans.patch new file mode 100644 index 0000000..c43e883 --- /dev/null +++ b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-btrfs_record_root_in_trans.patch @@ -0,0 +1,41 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:10 -0500 +Subject: btrfs: handle record_root_in_trans failure in + btrfs_record_root_in_trans +Git-commit: 1409e6cc7461d091b2ef1ad16954972d4ca1c784 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +record_root_in_trans can fail currently, handle this failure properly. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -387,6 +387,7 @@ int btrfs_record_root_in_trans(struct bt + struct btrfs_root *root) + { + struct btrfs_fs_info *fs_info = root->fs_info; ++ int ret; + + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) + return 0; +@@ -401,10 +402,10 @@ int btrfs_record_root_in_trans(struct bt + return 0; + + mutex_lock(&fs_info->reloc_mutex); +- record_root_in_trans(trans, root, 0); ++ ret = record_root_in_trans(trans, root, 0); + mutex_unlock(&fs_info->reloc_mutex); + +- return 0; ++ return ret; + } + + static inline int is_transaction_blocked(struct btrfs_transaction *trans) diff --git a/patches.suse/btrfs-handle-record_root_in_trans-failure-in-create_pending_snapshot.patch b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-create_pending_snapshot.patch new file mode 100644 index 0000000..ca38f7a --- /dev/null +++ b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-create_pending_snapshot.patch @@ -0,0 +1,49 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:11 -0500 +Subject: btrfs: handle record_root_in_trans failure in create_pending_snapshot +Git-commit: f0118cb6bcd3afefd01b5bcaa4baaddbb6085092 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +record_root_in_trans can currently fail, so handle this failure +properly. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 0b72fe0e5c52..461baad8760c 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1603,8 +1603,9 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, + dentry = pending->dentry; + parent_inode = pending->dir; + parent_root = BTRFS_I(parent_inode)->root; +- record_root_in_trans(trans, parent_root, 0); +- ++ ret = record_root_in_trans(trans, parent_root, 0); ++ if (ret) ++ goto fail; + cur_time = current_time(parent_inode); + + /* +@@ -1640,7 +1641,11 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans, + goto fail; + } + +- record_root_in_trans(trans, root, 0); ++ ret = record_root_in_trans(trans, root, 0); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ goto fail; ++ } + btrfs_set_root_last_snapshot(&root->root_item, trans->transid); + memcpy(new_root_item, &root->root_item, sizeof(*new_root_item)); + btrfs_check_and_init_root_item(new_root_item); + diff --git a/patches.suse/btrfs-handle-record_root_in_trans-failure-in-qgroup_account_snapshot.patch b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-qgroup_account_snapshot.patch new file mode 100644 index 0000000..bb1e7f1 --- /dev/null +++ b/patches.suse/btrfs-handle-record_root_in_trans-failure-in-qgroup_account_snapshot.patch @@ -0,0 +1,41 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:09 -0500 +Subject: btrfs: handle record_root_in_trans failure in qgroup_account_snapshot +Git-commit: 1c442d22466074b8290d89ddda2c2edbf8be1eaf +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +record_root_in_trans can fail currently, so handle this failure +properly. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1341,7 +1341,9 @@ static int qgroup_account_snapshot(struc + * recorded root will never be updated again, causing an outdated root + * item. + */ +- record_root_in_trans(trans, src, 1); ++ ret = record_root_in_trans(trans, src, 1); ++ if (ret) ++ return ret; + + /* + * We are going to commit transaction, see btrfs_commit_transaction() +@@ -1394,7 +1396,7 @@ out: + * insert_dir_item() + */ + if (!ret) +- record_root_in_trans(trans, parent, 1); ++ ret = record_root_in_trans(trans, parent, 1); + return ret; + } + diff --git a/patches.suse/btrfs-have-proper-error-handling-in-btrfs_init_reloc_root.patch b/patches.suse/btrfs-have-proper-error-handling-in-btrfs_init_reloc_root.patch new file mode 100644 index 0000000..d59ea79 --- /dev/null +++ b/patches.suse/btrfs-have-proper-error-handling-in-btrfs_init_reloc_root.patch @@ -0,0 +1,35 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:13 -0500 +Subject: btrfs: have proper error handling in btrfs_init_reloc_root +Git-commit: 00bb36a0e76ab7e94bdd70d561baf25f9bc1415d +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +create_reloc_root will return errors in the future, and __add_reloc_root +can return ENOMEM or EEXIST, so handle these errors properly. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ add comment ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1537,9 +1537,12 @@ int btrfs_init_reloc_root(struct btrfs_t + reloc_root = create_reloc_root(trans, root, root->root_key.objectid); + if (clear_rsv) + trans->block_rsv = rsv; ++ if (IS_ERR(reloc_root)) ++ return PTR_ERR(reloc_root); + + ret = __add_reloc_root(reloc_root); +- BUG_ON(ret < 0); ++ if (ret) ++ return ret; + root->reloc_root = reloc_root; + return 0; + } diff --git a/patches.suse/btrfs-reloc-clean-dirty-subvols-if-we-fail-to-start-a-transaction.patch b/patches.suse/btrfs-reloc-clean-dirty-subvols-if-we-fail-to-start-a-transaction.patch new file mode 100644 index 0000000..5565184 --- /dev/null +++ b/patches.suse/btrfs-reloc-clean-dirty-subvols-if-we-fail-to-start-a-transaction.patch @@ -0,0 +1,48 @@ +From: Josef Bacik +Date: Wed, 4 Mar 2020 11:18:27 -0500 +Subject: btrfs: reloc: clean dirty subvols if we fail to start a transaction +Git-commit: 6217b0fadd4473a16fabc6aecd7527a9f71af534 +Patch-mainline: v5.7-rc1 +References: bsc#1187833 + +If we do merge_reloc_roots() we could insert a few roots onto the dirty +subvol roots list, where we hold a ref on them. If we fail to start the +transaction we need to run clean_dirty_subvols() in order to cleanup the +refs. + +CC: stable@vger.kernel.org # 5.4+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4369,10 +4369,10 @@ restart: + goto out_free; + } + btrfs_commit_transaction(trans); ++out_free: + ret = clean_dirty_subvols(rc); + if (ret < 0 && !err) + err = ret; +-out_free: + btrfs_free_block_rsv(fs_info, rc->block_rsv); + btrfs_free_path(path); + return err; +@@ -4784,10 +4784,11 @@ int btrfs_recover_relocation(struct btrf + trans = btrfs_join_transaction(rc->extent_root); + if (IS_ERR(trans)) { + err = PTR_ERR(trans); +- goto out_unset; ++ goto out_clean; + } + err = btrfs_commit_transaction(trans); + ++out_clean: + ret = clean_dirty_subvols(rc); + if (ret < 0 && !err) + err = ret; diff --git a/patches.suse/btrfs-remove-err-variable-from-do_relocation.patch b/patches.suse/btrfs-remove-err-variable-from-do_relocation.patch new file mode 100644 index 0000000..abe01f2 --- /dev/null +++ b/patches.suse/btrfs-remove-err-variable-from-do_relocation.patch @@ -0,0 +1,126 @@ +From: Nikolay Borisov +Date: Tue, 24 Nov 2020 17:49:32 +0200 +Subject: btrfs: remove err variable from do_relocation +Git-commit: 8df01fddb77998a46b1b59563e1c5d094dc2586a +Patch-mainline: v5.11-rc1 +References: bsc#1187833 + +It simply gets assigned to 'ret' in case of errors. The flow of the +while loop is not changed by this commit since the few call sites +that 'goto next' will simply break from the loop. + +Signed-off-by: Nikolay Borisov +Reviewed-by: David Sterba +Signed-off-by: David Sterba +--- + fs/btrfs/relocation.c | 35 +++++++++++++---------------------- + 1 file changed, 13 insertions(+), 22 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2863,8 +2863,7 @@ static int do_relocation(struct btrfs_tr + u64 bytenr; + u64 generation; + int slot; +- int ret; +- int err = 0; ++ int ret = 0; + + BUG_ON(lowest && node->eb); + +@@ -2884,10 +2883,8 @@ static int do_relocation(struct btrfs_tr + if (!lowest) { + ret = btrfs_bin_search(upper->eb, key, + upper->level, &slot); +- if (ret < 0) { +- err = ret; ++ if (ret < 0) + goto next; +- } + BUG_ON(ret); + bytenr = btrfs_node_blockptr(upper->eb, slot); + if (node->eb->start == bytenr) +@@ -2899,10 +2896,8 @@ static int do_relocation(struct btrfs_tr + if (!upper->eb) { + ret = btrfs_search_slot(trans, root, key, path, 0, 1); + if (ret) { +- if (ret < 0) +- err = ret; +- else +- err = -ENOENT; ++ if (ret > 0) ++ ret = -ENOENT; + + btrfs_release_path(path); + break; +@@ -2923,10 +2918,8 @@ static int do_relocation(struct btrfs_tr + } else { + ret = btrfs_bin_search(upper->eb, key, upper->level, + &slot); +- if (ret < 0) { +- err = ret; ++ if (ret < 0) + goto next; +- } + BUG_ON(ret); + } + +@@ -2937,7 +2930,7 @@ static int do_relocation(struct btrfs_tr + "lowest leaf/node mismatch: bytenr %llu node->bytenr %llu slot %d upper %llu", + bytenr, node->bytenr, slot, + upper->eb->start); +- err = -EIO; ++ ret = -EIO; + goto next; + } + } else { +@@ -2951,11 +2944,11 @@ static int do_relocation(struct btrfs_tr + eb = read_tree_block(fs_info, bytenr, generation, + upper->level - 1, &first_key); + if (IS_ERR(eb)) { +- err = PTR_ERR(eb); ++ ret = PTR_ERR(eb); + goto next; + } else if (!extent_buffer_uptodate(eb)) { + free_extent_buffer(eb); +- err = -EIO; ++ ret = -EIO; + goto next; + } + btrfs_tree_lock(eb); +@@ -2966,10 +2959,8 @@ static int do_relocation(struct btrfs_tr + slot, &eb); + btrfs_tree_unlock(eb); + free_extent_buffer(eb); +- if (ret < 0) { +- err = ret; ++ if (ret < 0) + goto next; +- } + BUG_ON(node->eb != eb); + } else { + btrfs_set_node_blockptr(upper->eb, slot, +@@ -2995,19 +2986,19 @@ next: + drop_node_buffer(upper); + else + unlock_node_buffer(upper); +- if (err) ++ if (ret) + break; + } + +- if (!err && node->pending) { ++ if (!ret && node->pending) { + drop_node_buffer(node); + list_move_tail(&node->list, &rc->backref_cache.changed); + node->pending = 0; + } + + path->lowest_level = 0; +- BUG_ON(err == -ENOSPC); +- return err; ++ BUG_ON(ret == -ENOSPC); ++ return ret; + } + + static int link_to_upper(struct btrfs_trans_handle *trans, diff --git a/patches.suse/btrfs-remove-the-extent-item-sanity-checks-in-relocate_block_group.patch b/patches.suse/btrfs-remove-the-extent-item-sanity-checks-in-relocate_block_group.patch new file mode 100644 index 0000000..5ae7004 --- /dev/null +++ b/patches.suse/btrfs-remove-the-extent-item-sanity-checks-in-relocate_block_group.patch @@ -0,0 +1,104 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:27 -0500 +Subject: btrfs: remove the extent item sanity checks in relocate_block_group +Git-commit: 24cd638902d4c6b05eae958707ce01729631d012 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +These checks are all taken care of for us by the tree checker code: + +- the flags don't change or are updated consistently +- the v0 extent item format is invalid and caught in many other places + too + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +[ update changelog ] +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 58 +------------------------------------------------- + 1 file changed, 2 insertions(+), 56 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4315,20 +4315,6 @@ static void unset_reloc_control(struct r + mutex_unlock(&fs_info->reloc_mutex); + } + +-static int check_extent_flags(u64 flags) +-{ +- if ((flags & BTRFS_EXTENT_FLAG_DATA) && +- (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK)) +- return 1; +- if (!(flags & BTRFS_EXTENT_FLAG_DATA) && +- !(flags & BTRFS_EXTENT_FLAG_TREE_BLOCK)) +- return 1; +- if ((flags & BTRFS_EXTENT_FLAG_DATA) && +- (flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) +- return 1; +- return 0; +-} +- + static noinline_for_stack + int prepare_to_relocate(struct reloc_control *rc) + { +@@ -4380,7 +4366,6 @@ static noinline_for_stack int relocate_b + struct btrfs_path *path; + struct btrfs_extent_item *ei; + u64 flags; +- u32 item_size; + int ret; + int err = 0; + int progress = 0; +@@ -4428,47 +4413,8 @@ restart: + + ei = btrfs_item_ptr(path->nodes[0], path->slots[0], + struct btrfs_extent_item); +- item_size = btrfs_item_size_nr(path->nodes[0], path->slots[0]); +- if (item_size >= sizeof(*ei)) { +- flags = btrfs_extent_flags(path->nodes[0], ei); +- ret = check_extent_flags(flags); +- BUG_ON(ret); +- +- } else { +-#ifdef BTRFS_COMPAT_EXTENT_TREE_V0 +- u64 ref_owner; +- int path_change = 0; +- +- BUG_ON(item_size != +- sizeof(struct btrfs_extent_item_v0)); +- ret = get_ref_objectid_v0(rc, path, &key, &ref_owner, +- &path_change); +- if (ret < 0) { +- err = ret; +- break; +- } +- if (ref_owner < BTRFS_FIRST_FREE_OBJECTID) +- flags = BTRFS_EXTENT_FLAG_TREE_BLOCK; +- else +- flags = BTRFS_EXTENT_FLAG_DATA; +- +- if (path_change) { +- btrfs_release_path(path); +- +- path->search_commit_root = 1; +- path->skip_locking = 1; +- ret = btrfs_search_slot(NULL, rc->extent_root, +- &key, path, 0, 0); +- if (ret < 0) { +- err = ret; +- break; +- } +- BUG_ON(ret > 0); +- } +-#else +- BUG(); +-#endif +- } ++ ++ flags = btrfs_extent_flags(path->nodes[0], ei); + + if (flags & BTRFS_EXTENT_FLAG_TREE_BLOCK) { + ret = add_tree_block(rc, &key, path, &blocks); diff --git a/patches.suse/btrfs-return-an-error-from-btrfs_record_root_in_trans.patch b/patches.suse/btrfs-return-an-error-from-btrfs_record_root_in_trans.patch new file mode 100644 index 0000000..984f8cc --- /dev/null +++ b/patches.suse/btrfs-return-an-error-from-btrfs_record_root_in_trans.patch @@ -0,0 +1,45 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:12 -0500 +Subject: btrfs: return an error from btrfs_record_root_in_trans +Git-commit: 03a7e111a94961092e2832a6259d39c8c01d6def +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We can create a reloc root when we record the root in the trans, which +can fail for all sorts of different reasons. Propagate this error up +the chain of callers. Future patches will fix the callers of +btrfs_record_root_in_trans() to handle the error. + +Reviewed-by: Qu Wenruo +Reviewed-by: Johannes Thumshirn +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/transaction.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -308,6 +308,7 @@ static int record_root_in_trans(struct b + int force) + { + struct btrfs_fs_info *fs_info = root->fs_info; ++ int ret = 0; + + if ((test_bit(BTRFS_ROOT_REF_COWS, &root->state) && + root->last_trans < trans->transid) || force) { +@@ -356,11 +357,11 @@ static int record_root_in_trans(struct b + * lock. smp_wmb() makes sure that all the writes above are + * done before we pop in the zero below + */ +- btrfs_init_reloc_root(trans, root); ++ ret = btrfs_init_reloc_root(trans, root); + smp_mb__before_atomic(); + clear_bit(BTRFS_ROOT_IN_TRANS_SETUP, &root->state); + } +- return 0; ++ return ret; + } + + diff --git a/patches.suse/btrfs-suspend-qgroups-during-relocation-recovery.patch b/patches.suse/btrfs-suspend-qgroups-during-relocation-recovery.patch index 9537f27..f04ced2 100644 --- a/patches.suse/btrfs-suspend-qgroups-during-relocation-recovery.patch +++ b/patches.suse/btrfs-suspend-qgroups-during-relocation-recovery.patch @@ -26,7 +26,7 @@ Signed-off-by: Jeff Mahoney --- a/fs/btrfs/qgroup.c +++ b/fs/btrfs/qgroup.c -@@ -3358,6 +3358,85 @@ btrfs_qgroup_rescan(struct btrfs_fs_info +@@ -3270,6 +3270,85 @@ btrfs_qgroup_rescan(struct btrfs_fs_info return 0; } @@ -114,7 +114,7 @@ Signed-off-by: Jeff Mahoney { --- a/fs/btrfs/qgroup.h +++ b/fs/btrfs/qgroup.h -@@ -414,5 +414,11 @@ int btrfs_qgroup_add_swapped_blocks(stru +@@ -413,5 +413,11 @@ int btrfs_qgroup_add_swapped_blocks(stru u64 last_snapshot); int btrfs_qgroup_trace_subtree_after_cow(struct btrfs_trans_handle *trans, struct btrfs_root *root, struct extent_buffer *eb); @@ -128,7 +128,7 @@ Signed-off-by: Jeff Mahoney #endif /* __BTRFS_QGROUP__ */ --- a/fs/btrfs/relocation.c +++ b/fs/btrfs/relocation.c -@@ -4519,6 +4519,7 @@ int btrfs_recover_relocation(struct btrf +@@ -4907,6 +4907,7 @@ int btrfs_recover_relocation(struct btrf struct extent_buffer *leaf; struct reloc_control *rc = NULL; struct btrfs_trans_handle *trans; @@ -136,7 +136,7 @@ Signed-off-by: Jeff Mahoney int ret; int err = 0; -@@ -4586,6 +4587,15 @@ int btrfs_recover_relocation(struct btrf +@@ -4974,6 +4975,15 @@ int btrfs_recover_relocation(struct btrf if (list_empty(&reloc_roots)) goto out; @@ -152,9 +152,9 @@ Signed-off-by: Jeff Mahoney rc = alloc_reloc_control(fs_info); if (!rc) { err = -ENOMEM; -@@ -4640,6 +4650,12 @@ int btrfs_recover_relocation(struct btrf +@@ -5033,6 +5043,12 @@ int btrfs_recover_relocation(struct btrf err = PTR_ERR(trans); - goto out_free; + goto out_clean; } + + if (resume_qgroups) { @@ -164,4 +164,4 @@ Signed-off-by: Jeff Mahoney + } err = btrfs_commit_transaction(trans); - ret = clean_dirty_subvols(rc); + out_clean: diff --git a/patches.suse/btrfs-tree-checker-check-for-btrfs_block_flag_full_backref-being-set-improperly.patch b/patches.suse/btrfs-tree-checker-check-for-btrfs_block_flag_full_backref-being-set-improperly.patch new file mode 100644 index 0000000..6dc6a55 --- /dev/null +++ b/patches.suse/btrfs-tree-checker-check-for-btrfs_block_flag_full_backref-being-set-improperly.patch @@ -0,0 +1,37 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:26 -0500 +Subject: btrfs: tree-checker: check for BTRFS_BLOCK_FLAG_FULL_BACKREF being + set improperly +Git-commit: 0ebb6bbbd499987248b4ce8f4f7c5eeb6e1fa905 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +We need to validate that a data extent item does not have the +FULL_BACKREF flag set on its flags. + +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/tree-checker.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c +index f4ade821307d..a8b2e0d2c025 100644 +--- a/fs/btrfs/tree-checker.c ++++ b/fs/btrfs/tree-checker.c +@@ -1290,6 +1290,11 @@ static int check_extent_item(struct extent_buffer *leaf, + key->offset, fs_info->sectorsize); + return -EUCLEAN; + } ++ if (unlikely(flags & BTRFS_BLOCK_FLAG_FULL_BACKREF)) { ++ extent_err(leaf, slot, ++ "invalid extent flag, data has full backref set"); ++ return -EUCLEAN; ++ } + } + ptr = (unsigned long)(struct btrfs_extent_item *)(ei + 1); + + diff --git a/patches.suse/btrfs-unset-reloc-control-if-we-fail-to-recover.patch b/patches.suse/btrfs-unset-reloc-control-if-we-fail-to-recover.patch new file mode 100644 index 0000000..319aca3 --- /dev/null +++ b/patches.suse/btrfs-unset-reloc-control-if-we-fail-to-recover.patch @@ -0,0 +1,75 @@ +From: Josef Bacik +Date: Wed, 4 Mar 2020 11:18:25 -0500 +Subject: btrfs: unset reloc control if we fail to recover +Git-commit: fb2d83eefef4e1c717205bac71cb1941edf8ae11 +Patch-mainline: v5.7-rc1 +References: bsc#1187833 + +If we fail to load an fs root, or fail to start a transaction we can +bail without unsetting the reloc control, which leads to problems later +when we free the reloc control but still have it attached to the file +system. + +In the normal path we'll end up calling unset_reloc_control() twice, but +all it does is set fs_info->reloc_control = NULL, and we can only have +one balance at a time so it's not racey. + +CC: stable@vger.kernel.org # 5.4+ +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -4744,9 +4744,8 @@ int btrfs_recover_relocation(struct btrf + + trans = btrfs_join_transaction(rc->extent_root); + if (IS_ERR(trans)) { +- unset_reloc_control(rc); + err = PTR_ERR(trans); +- goto out_free; ++ goto out_unset; + } + + rc->merge_reloc_tree = 1; +@@ -4766,7 +4765,7 @@ int btrfs_recover_relocation(struct btrf + if (IS_ERR(fs_root)) { + err = PTR_ERR(fs_root); + list_add_tail(&reloc_root->root_list, &reloc_roots); +- goto out_free; ++ goto out_unset; + } + + err = __add_reloc_root(reloc_root); +@@ -4776,7 +4775,7 @@ int btrfs_recover_relocation(struct btrf + + err = btrfs_commit_transaction(trans); + if (err) +- goto out_free; ++ goto out_unset; + + merge_reloc_roots(rc); + +@@ -4785,14 +4784,15 @@ int btrfs_recover_relocation(struct btrf + trans = btrfs_join_transaction(rc->extent_root); + if (IS_ERR(trans)) { + err = PTR_ERR(trans); +- goto out_free; ++ goto out_unset; + } + err = btrfs_commit_transaction(trans); + + ret = clean_dirty_subvols(rc); + if (ret < 0 && !err) + err = ret; +-out_free: ++out_unset: ++ unset_reloc_control(rc); + kfree(rc); + out: + if (!list_empty(&reloc_roots)) diff --git a/patches.suse/btrfs-validate-root-reloc_root-after-recording-root-in-trans.patch b/patches.suse/btrfs-validate-root-reloc_root-after-recording-root-in-trans.patch new file mode 100644 index 0000000..d0cabb6 --- /dev/null +++ b/patches.suse/btrfs-validate-root-reloc_root-after-recording-root-in-trans.patch @@ -0,0 +1,57 @@ +From: Josef Bacik +Date: Fri, 12 Mar 2021 15:25:15 -0500 +Subject: btrfs: validate root::reloc_root after recording root in trans +Git-commit: 39200e59089e260af8edb9feeb69c54ba51699c5 +Patch-mainline: v5.13-rc1 +References: bsc#1187833 + +If we fail to setup a root->reloc_root in a different thread that path +will error out, however it still leaves root->reloc_root NULL but would +still appear set up in the transaction. Subsequent calls to +btrfs_record_root_in_transaction would succeed without attempting to +create the reloc root, as the transid has already been updated. + +Handle this case by making sure we have a root->reloc_root set after a +btrfs_record_root_in_transaction call so we don't end up dereferencing a +NULL pointer. + +Reported-by: Zygo Blaxell +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Acked-by: Nikolay Borisov +--- + fs/btrfs/relocation.c | 15 +++++++++++++++ + 1 file changed, 15 insertions(+) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -2764,6 +2764,13 @@ struct btrfs_root *select_reloc_root(str + return ERR_PTR(ret); + root = root->reloc_root; + ++ /* ++ * We could have raced with another thread which failed, so ++ * root->reloc_root may not be set, return ENOENT in this case. ++ */ ++ if (!root) ++ return ERR_PTR(-ENOENT); ++ + if (next->new_bytenr != root->node->start) { + /* + * We just created the reloc root, so we shouldn't have +@@ -3287,6 +3294,14 @@ static int relocate_tree_block(struct bt + ret = btrfs_record_root_in_trans(trans, root); + if (ret) + goto out; ++ /* ++ * Another thread could have failed, need to check if we ++ * have reloc_root actually set. ++ */ ++ if (!root->reloc_root) { ++ ret = -ENOENT; ++ goto out; ++ } + root = root->reloc_root; + node->new_bytenr = root->node->start; + node->root = root; diff --git a/patches.suse/can-flexcan-disable-completely-the-ECC-mechanism.patch b/patches.suse/can-flexcan-disable-completely-the-ECC-mechanism.patch new file mode 100644 index 0000000..9346c33 --- /dev/null +++ b/patches.suse/can-flexcan-disable-completely-the-ECC-mechanism.patch @@ -0,0 +1,38 @@ +From 0d07bb32873250ca90bbca8c7e433849c21e6b30 Mon Sep 17 00:00:00 2001 +From: Joakim Zhang +Date: Thu, 15 Aug 2019 08:00:26 +0000 +Subject: [PATCH 5/6] can: flexcan: disable completely the ECC mechanism +Git-commit: 5e269324db5adb2f5f6ec9a93a9c7b0672932b47 +Patch-mainline: v5.4-rc7 +References: git-fixes + +The ECC (memory error detection and correction) mechanism can be +activated or not, controlled by the ECCDIS bit in CAN_MECR. When +disabled, updates on indications and reporting registers are stopped. +So if want to disable ECC completely, had better assert ECCDIS bit, not +just mask the related interrupts. + +Fixes: cdce844865be ("can: flexcan: add vf610 support for FlexCAN") +Signed-off-by: Joakim Zhang +Cc: linux-stable +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Denis Kirjanov +--- + drivers/net/can/flexcan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 69014e6fa81e..d29656ae991f 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1018,6 +1018,7 @@ static int flexcan_chip_start(struct net_device *dev) + reg_mecr = flexcan_read(®s->mecr); + reg_mecr &= ~FLEXCAN_MECR_ECRWRDIS; + flexcan_write(reg_mecr, ®s->mecr); ++ reg_mecr |= FLEXCAN_MECR_ECCDIS; + reg_mecr &= ~(FLEXCAN_MECR_NCEFAFRZ | FLEXCAN_MECR_HANCEI_MSK | + FLEXCAN_MECR_FANCEI_MSK); + flexcan_write(reg_mecr, ®s->mecr); +-- +2.16.4 + diff --git a/patches.suse/can-xilinx_can-xcan_chip_start-fix-failure-with-inva.patch b/patches.suse/can-xilinx_can-xcan_chip_start-fix-failure-with-inva.patch new file mode 100644 index 0000000..f25af5d --- /dev/null +++ b/patches.suse/can-xilinx_can-xcan_chip_start-fix-failure-with-inva.patch @@ -0,0 +1,84 @@ +From 9cea6e5f62a55a4b42f22b50998c5e32676d4524 Mon Sep 17 00:00:00 2001 +From: Anssi Hannula +Date: Wed, 3 Apr 2019 15:18:53 +0300 +Subject: [PATCH 2/6] can: xilinx_can: xcan_chip_start(): fix failure with + invalid bus +Git-commit: 3486cc40ccbfe4cbf55feecce88a792e3043c178 +Patch-mainline: v5.4-rc1 +References: git-fixes + +Currently the xilinx_can xcan_chip_start() function, called from +.ndo_open() and via CAN_MODE_START (bus-off restart), waits for the SR +register to show the wanted operating state, with a 1 sec timeout. + +However, that register bit will only be set once the HW has observed 11 +consecutive recessive bits (BusIdle) on the bus. + +If the bus will not see the 11 bits (e.g. it is stuck dominant), the +function will timeout and return an error. If this was done as part of a +scheduled restart from bus-off, the interface will stay in bus-off state +forever even if the bus recovers later. + +According to M_CAN and FLEXCAN documentation they also wait for 11 +consecutive recessive bits, but their drivers do not seem to wait for +that. + +To make the behavior consistent, modify xilinx_can to also not wait for +the synchronization to complete. + +The only way for users to know for sure that the bus has been joined +successfully is to see successfully received or transmitted frames. That +does not seem optimal, but it is consistent with other drivers and we +should have a properly working restart-ms with xilinx_can. + +Tested on ZynqMP with Xilinx CAN-FD 1.0. + +Fixes: b1201e44f50b ("can: xilinx CAN controller support") +Signed-off-by: Anssi Hannula +Tested-by: Appana Durga Kedareswara Rao +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Denis Kirjanov +--- + drivers/net/can/xilinx_can.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 79f2e89f6b17..fcd993bb2503 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -315,7 +315,7 @@ static int xcan_set_bittiming(struct net_device *ndev) + static int xcan_chip_start(struct net_device *ndev) + { + struct xcan_priv *priv = netdev_priv(ndev); +- u32 reg_msr, reg_sr_mask; ++ u32 reg_msr; + int err; + unsigned long timeout; + +@@ -334,23 +334,13 @@ static int xcan_chip_start(struct net_device *ndev) + /* Check whether it is loopback mode or normal mode */ + if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK) { + reg_msr = XCAN_MSR_LBACK_MASK; +- reg_sr_mask = XCAN_SR_LBACK_MASK; + } else { + reg_msr = 0x0; +- reg_sr_mask = XCAN_SR_NORMAL_MASK; + } + + priv->write_reg(priv, XCAN_MSR_OFFSET, reg_msr); + priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_CEN_MASK); + +- timeout = jiffies + XCAN_TIMEOUT; +- while (!(priv->read_reg(priv, XCAN_SR_OFFSET) & reg_sr_mask)) { +- if (time_after(jiffies, timeout)) { +- netdev_warn(ndev, +- "timed out for correct mode\n"); +- return -ETIMEDOUT; +- } +- } + netdev_dbg(ndev, "status:#x%08x\n", + priv->read_reg(priv, XCAN_SR_OFFSET)); + +-- +2.16.4 + diff --git a/patches.suse/cgroup1-don-t-allow-n-in-renaming.patch b/patches.suse/cgroup1-don-t-allow-n-in-renaming.patch new file mode 100644 index 0000000..4100c93 --- /dev/null +++ b/patches.suse/cgroup1-don-t-allow-n-in-renaming.patch @@ -0,0 +1,58 @@ +From: Alexander Kuznetsov +Date: Wed, 9 Jun 2021 10:17:19 +0300 +Subject: cgroup1: don't allow '\n' in renaming +Git-commit: b7e24eb1caa5f8da20d405d262dba67943aedc42 +Patch-mainline: v5.13-rc6 +References: bsc#1187972 + +cgroup_mkdir() have restriction on newline usage in names: +$ mkdir $'/sys/fs/cgroup/cpu/test\ntest2' +mkdir: cannot create directory +'/sys/fs/cgroup/cpu/test\ntest2': Invalid argument + +But in cgroup1_rename() such check is missed. +This allows us to make /proc//cgroup unparsable: +$ mkdir /sys/fs/cgroup/cpu/test +$ mv /sys/fs/cgroup/cpu/test $'/sys/fs/cgroup/cpu/test\ntest2' +$ echo $$ > $'/sys/fs/cgroup/cpu/test\ntest2' +$ cat /proc/self/cgroup +11:pids:/ +10:freezer:/ +9:hugetlb:/ +8:cpuset:/ +7:blkio:/user.slice +6:memory:/user.slice +5:net_cls,net_prio:/ +4:perf_event:/ +3:devices:/user.slice +2:cpu,cpuacct:/test +test2 +1:name=systemd:/ +0::/ + +Signed-off-by: Alexander Kuznetsov +Reported-by: Andrey Krasichkov +Acked-by: Dmitry Yakunin +Cc: stable@vger.kernel.org +Signed-off-by: Tejun Heo +Acked-by: Michal Koutný +--- + kernel/cgroup/cgroup-v1.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 8190b6bfc978..1f274d7fc934 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -820,6 +820,10 @@ static int cgroup1_rename(struct kernfs_node *kn, struct kernfs_node *new_parent + struct cgroup *cgrp = kn->priv; + int ret; + ++ /* do not accept '\n' to prevent making /proc//cgroup unparsable */ ++ if (strchr(new_name_str, '\n')) ++ return -EINVAL; ++ + if (kernfs_type(kn) != KERNFS_DIR) + return -ENOTDIR; + if (kn->parent != new_parent) + diff --git a/patches.suse/crypto-ccp-fix-a-resource-leak-in-an-error-handling-path.patch b/patches.suse/crypto-ccp-fix-a-resource-leak-in-an-error-handling-path.patch new file mode 100644 index 0000000..cbae32e --- /dev/null +++ b/patches.suse/crypto-ccp-fix-a-resource-leak-in-an-error-handling-path.patch @@ -0,0 +1,46 @@ +From: Christophe JAILLET +Date: Sun, 16 May 2021 08:58:04 +0200 +Subject: crypto: ccp - Fix a resource leak in an error handling path +Git-commit: a6f8e68e238a15bb15f1726b35c695136c64eaba +Patch-mainline: v5.13 or v5.13-rc8 (next release) +References: 12sp5 + +If an error occurs after calling 'sp_get_irqs()', 'sp_free_irqs()' must be +called as already done in the error handling path. + +Fixes: f4d18d656f88 ("crypto: ccp - Abstract interrupt registeration") +Signed-off-by: Christophe JAILLET +Acked-by: John Allen +Signed-off-by: Herbert Xu +Acked-by: Borislav Petkov +--- + drivers/crypto/ccp/sp-pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/ccp/sp-pci.c ++++ b/drivers/crypto/ccp/sp-pci.c +@@ -225,7 +225,7 @@ static int sp_pci_probe(struct pci_dev * + if (ret) { + dev_err(dev, "dma_set_mask_and_coherent failed (%d)\n", + ret); +- goto e_err; ++ goto free_irqs; + } + } + +@@ -233,12 +233,14 @@ static int sp_pci_probe(struct pci_dev * + + ret = sp_init(sp); + if (ret) +- goto e_err; ++ goto free_irqs; + + dev_notice(dev, "enabled\n"); + + return 0; + ++free_irqs: ++ sp_free_irqs(sp); + e_err: + dev_notice(dev, "initialization failed\n"); + return ret; diff --git a/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch b/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch index d90f1d3..b1c4af8 100644 --- a/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch +++ b/patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch @@ -4,8 +4,7 @@ Date: Thu, 20 May 2021 08:50:34 +0200 Subject: [PATCH] ibmvnic: remove default label from to_string switch References: bsc#1152457 ltc#174432 git-fixes -Patch-mainline: queued -Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git +Patch-mainline: v5.14-rc1 Git-commit: 07b5dc1d515a9a9b3973e0bdc716a78adf6db8f8 This way the compiler warns when a new value is added to the enum but diff --git a/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch b/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch index 0d40a55..4747023 100644 --- a/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch +++ b/patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch @@ -3,8 +3,7 @@ From: Petr Pavlu Date: Thu, 13 May 2021 14:26:36 +0200 Subject: [PATCH] ipmi/watchdog: Stop watchdog timer when the current action is 'none' -Patch-mainline: Queued in subsystem maintainer repository -Git-repo: git://github.com/cminyard/linux-ipmi.git +Patch-mainline: v5.14-rc1 Git-commit: 2253042d86f57d90a621ac2513a7a7a13afcf809 References: bsc#1184855 diff --git a/patches.suse/kthread-prevent-deadlock-when-kthread_mod_delayed_wo.patch b/patches.suse/kthread-prevent-deadlock-when-kthread_mod_delayed_wo.patch new file mode 100644 index 0000000..e0b7cc6 --- /dev/null +++ b/patches.suse/kthread-prevent-deadlock-when-kthread_mod_delayed_wo.patch @@ -0,0 +1,186 @@ +From 5fa54346caf67b4b1b10b1f390316ae466da4d53 Mon Sep 17 00:00:00 2001 +From: Petr Mladek +Date: Thu, 24 Jun 2021 18:39:48 -0700 +Subject: [PATCH] kthread: prevent deadlock when kthread_mod_delayed_work() + races with kthread_cancel_delayed_work_sync() +Git-commit: 5fa54346caf67b4b1b10b1f390316ae466da4d53 +Patch-mainline: v5.13 +References: bsc#1187867 + +The system might hang with the following backtrace: + + schedule+0x80/0x100 + schedule_timeout+0x48/0x138 + wait_for_common+0xa4/0x134 + wait_for_completion+0x1c/0x2c + kthread_flush_work+0x114/0x1cc + kthread_cancel_work_sync.llvm.16514401384283632983+0xe8/0x144 + kthread_cancel_delayed_work_sync+0x18/0x2c + xxxx_pm_notify+0xb0/0xd8 + blocking_notifier_call_chain_robust+0x80/0x194 + pm_notifier_call_chain_robust+0x28/0x4c + suspend_prepare+0x40/0x260 + enter_state+0x80/0x3f4 + pm_suspend+0x60/0xdc + state_store+0x108/0x144 + kobj_attr_store+0x38/0x88 + sysfs_kf_write+0x64/0xc0 + kernfs_fop_write_iter+0x108/0x1d0 + vfs_write+0x2f4/0x368 + ksys_write+0x7c/0xec + +It is caused by the following race between kthread_mod_delayed_work() +and kthread_cancel_delayed_work_sync(): + +CPU0 CPU1 + +Context: Thread A Context: Thread B + +kthread_mod_delayed_work() + spin_lock() + __kthread_cancel_work() + spin_unlock() + del_timer_sync() + kthread_cancel_delayed_work_sync() + spin_lock() + __kthread_cancel_work() + spin_unlock() + del_timer_sync() + spin_lock() + + work->canceling++ + spin_unlock + spin_lock() + queue_delayed_work() + // dwork is put into the worker->delayed_work_list + + spin_unlock() + + kthread_flush_work() + // flush_work is put at the tail of the dwork + + wait_for_completion() + +Context: IRQ + + kthread_delayed_work_timer_fn() + spin_lock() + list_del_init(&work->node); + spin_unlock() + +Bang: flush_work is not longer linked and will never get proceed. + +The problem is that kthread_mod_delayed_work() checks work->canceling +flag before canceling the timer. + +A simple solution is to (re)check work->canceling after +__kthread_cancel_work(). But then it is not clear what should be +returned when __kthread_cancel_work() removed the work from the queue +(list) and it can't queue it again with the new @delay. + +The return value might be used for reference counting. The caller has +to know whether a new work has been queued or an existing one was +replaced. + +The proper solution is that kthread_mod_delayed_work() will remove the +work from the queue (list) _only_ when work->canceling is not set. The +flag must be checked after the timer is stopped and the remaining +operations can be done under worker->lock. + +Note that kthread_mod_delayed_work() could remove the timer and then +bail out. It is fine. The other canceling caller needs to cancel the +timer as well. The important thing is that the queue (list) +manipulation is done atomically under worker->lock. + +Link: https://lkml.kernel.org/r/20210610133051.15337-3-pmladek@suse.com +Fixes: 9a6b06c8d9a220860468a ("kthread: allow to modify delayed kthread work") +Signed-off-by: Petr Mladek +Reported-by: Martin Liu +Cc: +Cc: Minchan Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Oleg Nesterov +Cc: Tejun Heo +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +--- + kernel/kthread.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 121a0e1fc659..0fccf7d0c6a1 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -1120,8 +1120,11 @@ static void kthread_cancel_delayed_work_timer(struct kthread_work *work, + } + + /* +- * This function removes the work from the worker queue. Also it makes sure +- * that it won't get queued later via the delayed work's timer. ++ * This function removes the work from the worker queue. ++ * ++ * It is called under worker->lock. The caller must make sure that ++ * the timer used by delayed work is not running, e.g. by calling ++ * kthread_cancel_delayed_work_timer(). + * + * The work might still be in use when this function finishes. See the + * current_work proceed by the worker. +@@ -1129,13 +1132,8 @@ static void kthread_cancel_delayed_work_timer(struct kthread_work *work, + * Return: %true if @work was pending and successfully canceled, + * %false if @work was not pending + */ +-static bool __kthread_cancel_work(struct kthread_work *work, bool is_dwork, +- unsigned long *flags) ++static bool __kthread_cancel_work(struct kthread_work *work) + { +- /* Try to cancel the timer if exists. */ +- if (is_dwork) +- kthread_cancel_delayed_work_timer(work, flags); +- + /* + * Try to remove the work from a worker list. It might either + * be from worker->work_list or from worker->delayed_work_list. +@@ -1188,11 +1186,23 @@ bool kthread_mod_delayed_work(struct kthread_worker *worker, + /* Work must not be used with >1 worker, see kthread_queue_work() */ + WARN_ON_ONCE(work->worker != worker); + +- /* Do not fight with another command that is canceling this work. */ ++ /* ++ * Temporary cancel the work but do not fight with another command ++ * that is canceling the work as well. ++ * ++ * It is a bit tricky because of possible races with another ++ * mod_delayed_work() and cancel_delayed_work() callers. ++ * ++ * The timer must be canceled first because worker->lock is released ++ * when doing so. But the work can be removed from the queue (list) ++ * only when it can be queued again so that the return value can ++ * be used for reference counting. ++ */ ++ kthread_cancel_delayed_work_timer(work, &flags); + if (work->canceling) + goto out; ++ ret = __kthread_cancel_work(work); + +- ret = __kthread_cancel_work(work, true, &flags); + fast_queue: + __kthread_queue_delayed_work(worker, dwork, delay); + out: +@@ -1214,7 +1224,10 @@ static bool __kthread_cancel_work_sync(struct kthread_work *work, bool is_dwork) + /* Work must not be used with >1 worker, see kthread_queue_work(). */ + WARN_ON_ONCE(work->worker != worker); + +- ret = __kthread_cancel_work(work, is_dwork, &flags); ++ if (is_dwork) ++ kthread_cancel_delayed_work_timer(work, &flags); ++ ++ ret = __kthread_cancel_work(work); + + if (worker->current_work != work) + goto out_fast; +-- +2.26.2 + diff --git a/patches.suse/kthread_worker-split-code-for-canceling-the-delayed-.patch b/patches.suse/kthread_worker-split-code-for-canceling-the-delayed-.patch new file mode 100644 index 0000000..a5e10ac --- /dev/null +++ b/patches.suse/kthread_worker-split-code-for-canceling-the-delayed-.patch @@ -0,0 +1,107 @@ +From 34b3d5344719d14fd2185b2d9459b3abcb8cf9d8 Mon Sep 17 00:00:00 2001 +From: Petr Mladek +Date: Thu, 24 Jun 2021 18:39:45 -0700 +Subject: [PATCH] kthread_worker: split code for canceling the delayed work + timer +Git-commit: 34b3d5344719d14fd2185b2d9459b3abcb8cf9d8 +Patch-mainline: v5.13 +References: bsc#1187867 + +Patch series "kthread_worker: Fix race between kthread_mod_delayed_work() +and kthread_cancel_delayed_work_sync()". + +This patchset fixes the race between kthread_mod_delayed_work() and +kthread_cancel_delayed_work_sync() including proper return value +handling. + +This patch (of 2): + +Simple code refactoring as a preparation step for fixing a race between +kthread_mod_delayed_work() and kthread_cancel_delayed_work_sync(). + +It does not modify the existing behavior. + +Link: https://lkml.kernel.org/r/20210610133051.15337-2-pmladek@suse.com +Signed-off-by: Petr Mladek +Cc: +Cc: Martin Liu +Cc: Minchan Kim +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Oleg Nesterov +Cc: Tejun Heo +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds + +--- + kernel/kthread.c | 46 +++++++++++++++++++++++++++++----------------- + 1 file changed, 29 insertions(+), 17 deletions(-) + +diff --git a/kernel/kthread.c b/kernel/kthread.c +index fe3f2a40d61e..121a0e1fc659 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -1092,6 +1092,33 @@ void kthread_flush_work(struct kthread_work *work) + } + EXPORT_SYMBOL_GPL(kthread_flush_work); + ++/* ++ * Make sure that the timer is neither set nor running and could ++ * not manipulate the work list_head any longer. ++ * ++ * The function is called under worker->lock. The lock is temporary ++ * released but the timer can't be set again in the meantime. ++ */ ++static void kthread_cancel_delayed_work_timer(struct kthread_work *work, ++ unsigned long *flags) ++{ ++ struct kthread_delayed_work *dwork = ++ container_of(work, struct kthread_delayed_work, work); ++ struct kthread_worker *worker = work->worker; ++ ++ /* ++ * del_timer_sync() must be called to make sure that the timer ++ * callback is not running. The lock must be temporary released ++ * to avoid a deadlock with the callback. In the meantime, ++ * any queuing is blocked by setting the canceling counter. ++ */ ++ work->canceling++; ++ spin_unlock_irqrestore(&worker->lock, *flags); ++ del_timer_sync(&dwork->timer); ++ spin_lock_irqsave(&worker->lock, *flags); ++ work->canceling--; ++} ++ + /* + * This function removes the work from the worker queue. Also it makes sure + * that it won't get queued later via the delayed work's timer. +@@ -1106,23 +1133,8 @@ static bool __kthread_cancel_work(struct kthread_work *work, bool is_dwork, + unsigned long *flags) + { + /* Try to cancel the timer if exists. */ +- if (is_dwork) { +- struct kthread_delayed_work *dwork = +- container_of(work, struct kthread_delayed_work, work); +- struct kthread_worker *worker = work->worker; +- +- /* +- * del_timer_sync() must be called to make sure that the timer +- * callback is not running. The lock must be temporary released +- * to avoid a deadlock with the callback. In the meantime, +- * any queuing is blocked by setting the canceling counter. +- */ +- work->canceling++; +- spin_unlock_irqrestore(&worker->lock, *flags); +- del_timer_sync(&dwork->timer); +- spin_lock_irqsave(&worker->lock, *flags); +- work->canceling--; +- } ++ if (is_dwork) ++ kthread_cancel_delayed_work_timer(work, flags); + + /* + * Try to remove the work from a worker list. It might either +-- +2.26.2 + diff --git a/patches.suse/mlxsw-spectrum-Do-not-process-learned-records-with-a.patch b/patches.suse/mlxsw-spectrum-Do-not-process-learned-records-with-a.patch new file mode 100644 index 0000000..0ccdb04 --- /dev/null +++ b/patches.suse/mlxsw-spectrum-Do-not-process-learned-records-with-a.patch @@ -0,0 +1,105 @@ +From 095ef038a6952558967359c7ff449d982750d24b Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 17 Jul 2019 23:29:08 +0300 +Subject: [PATCH 1/6] mlxsw: spectrum: Do not process learned records with a + dummy FID +Git-commit: 577fa14d210073ba1ce6237c659a8820312104ad +Patch-mainline: v5.3-rc1 +References: git-fixes + +The switch periodically sends notifications about learned FDB entries. +Among other things, the notification includes the FID (Filtering +Identifier) and the port on which the MAC was learned. + +In case the driver does not have the FID defined on the relevant port, +the following error will be periodically generated: + +mlxsw_spectrum2 0000:06:00.0 swp32: Failed to find a matching {Port, VID} following FDB notification + +This is not supposed to happen under normal conditions, but can happen +if an ingress tc filter with a redirect action is installed on a bridged +port. The redirect action will cause the packet's FID to be changed to +the dummy FID and a learning notification will be emitted with this FID +- which is not defined on the bridged port. + +Fix this by having the driver ignore learning notifications generated +with the dummy FID and delete them from the device. + +Another option is to chain an ignore action after the redirect action +which will cause the device to disable learning, but this means that we +need to consume another action whenever a redirect action is used. In +addition, the scenario described above is merely a corner case. + +Fixes: cedbb8b25948 ("mlxsw: spectrum_flower: Set dummy FID before forward action") +Signed-off-by: Ido Schimmel +Reported-by: Alex Kushnarov +Acked-by: Jiri Pirko +Tested-by: Alex Kushnarov +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 1 + + drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c | 10 ++++++++++ + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 6 ++++++ + 3 files changed, 17 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index 0875a79cbe7b..8f7772b39dcc 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -721,6 +721,7 @@ int mlxsw_sp_setup_tc_prio(struct mlxsw_sp_port *mlxsw_sp_port, + struct tc_prio_qopt_offload *p); + + /* spectrum_fid.c */ ++bool mlxsw_sp_fid_is_dummy(struct mlxsw_sp *mlxsw_sp, u16 fid_index); + struct mlxsw_sp_fid *mlxsw_sp_fid_lookup_by_vni(struct mlxsw_sp *mlxsw_sp, + __be32 vni); + int mlxsw_sp_fid_vni(const struct mlxsw_sp_fid *fid, __be32 *vni); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +index b490589ef25c..dbecdbb69e22 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +@@ -113,6 +113,16 @@ static const int *mlxsw_sp_packet_type_sfgc_types[] = { + [MLXSW_SP_FLOOD_TYPE_MC] = mlxsw_sp_sfgc_mc_packet_types, + }; + ++bool mlxsw_sp_fid_is_dummy(struct mlxsw_sp *mlxsw_sp, u16 fid_index) ++{ ++ enum mlxsw_sp_fid_type fid_type = MLXSW_SP_FID_TYPE_DUMMY; ++ struct mlxsw_sp_fid_family *fid_family; ++ ++ fid_family = mlxsw_sp->fid_core->fid_family_arr[fid_type]; ++ ++ return fid_family->start_index == fid_index; ++} ++ + struct mlxsw_sp_fid *mlxsw_sp_fid_lookup_by_vni(struct mlxsw_sp *mlxsw_sp, + __be32 vni) + { +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index d2000f6f95af..d939a579a970 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -2355,6 +2355,9 @@ static void mlxsw_sp_fdb_notify_mac_process(struct mlxsw_sp *mlxsw_sp, + goto just_remove; + } + ++ if (mlxsw_sp_fid_is_dummy(mlxsw_sp, fid)) ++ goto just_remove; ++ + mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_fid(mlxsw_sp_port, fid); + if (!mlxsw_sp_port_vlan) { + netdev_err(mlxsw_sp_port->dev, "Failed to find a matching {Port, VID} following FDB notification\n"); +@@ -2414,6 +2417,9 @@ static void mlxsw_sp_fdb_notify_mac_lag_process(struct mlxsw_sp *mlxsw_sp, + goto just_remove; + } + ++ if (mlxsw_sp_fid_is_dummy(mlxsw_sp, fid)) ++ goto just_remove; ++ + mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_fid(mlxsw_sp_port, fid); + if (!mlxsw_sp_port_vlan) { + netdev_err(mlxsw_sp_port->dev, "Failed to find a matching {Port, VID} following FDB notification\n"); +-- +2.16.4 + diff --git a/patches.suse/net-caif-Fix-debugfs-on-64-bit-platforms.patch b/patches.suse/net-caif-Fix-debugfs-on-64-bit-platforms.patch new file mode 100644 index 0000000..871bade --- /dev/null +++ b/patches.suse/net-caif-Fix-debugfs-on-64-bit-platforms.patch @@ -0,0 +1,41 @@ +From 2fcd83fd260570ab86940d66625706cecb2b9ea9 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Fri, 25 Oct 2019 11:41:26 +0200 +Subject: [PATCH 6/6] net: caif: Fix debugfs on 64-bit platforms +Git-commit: b52517e456f8bb6ae720feab891af6d5b8a8f217 +Patch-mainline: v5.5-rc1 +References: git-fixes + +"ser_device.state" is "unsigned long", i.e. 32-bit or 64-bit, depending +on the platform. Hence casting its address to "u32 *", and calling +debugfs_create_x32() breaks operation on 64-bit platforms. + +Fix this by using the new debugfs_create_xul() helper instead. + +Fixes: 9b27105b4a44c54b ("net-caif-driver: add CAIF serial driver (ldisc)") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20191025094130.26033-4-geert+renesas@glider.be +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Denis Kirjanov +--- + drivers/net/caif/caif_serial.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c +index 820ada5186c7..80bd7eb91c26 100644 +--- a/drivers/net/caif/caif_serial.c ++++ b/drivers/net/caif/caif_serial.c +@@ -102,8 +102,8 @@ static inline void debugfs_init(struct ser_device *ser, struct tty_struct *tty) + debugfs_create_blob("last_rx_msg", 0400, ser->debugfs_tty_dir, + &ser->rx_blob); + +- debugfs_create_x32("ser_state", 0400, ser->debugfs_tty_dir, +- (u32 *)&ser->state); ++ debugfs_create_xul("ser_state", 0400, ser->debugfs_tty_dir, ++ &ser->state); + + debugfs_create_x8("tty_status", 0400, ser->debugfs_tty_dir, + &ser->tty_status); +-- +2.16.4 + diff --git a/patches.suse/net-dsa-qca8k-Use-up-to-7-ports-for-all-operations.patch b/patches.suse/net-dsa-qca8k-Use-up-to-7-ports-for-all-operations.patch new file mode 100644 index 0000000..d879fd6 --- /dev/null +++ b/patches.suse/net-dsa-qca8k-Use-up-to-7-ports-for-all-operations.patch @@ -0,0 +1,53 @@ +From 0f086e2b4f61de8613b10ede7815a0ee06f5d3c8 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michal=20Vok=C3=A1=C4=8D?= +Date: Thu, 26 Sep 2019 10:59:17 +0200 +Subject: [PATCH 3/6] net: dsa: qca8k: Use up to 7 ports for all operations +Git-commit: 7ae6d93c8f052b7a77ba56ed0f654e22a2876739 +Patch-mainline: v5.4-rc2 +References: git-fixes + +The QCA8K family supports up to 7 ports. So use the existing +QCA8K_NUM_PORTS define to allocate the switch structure and limit all +operations with the switch ports. + +This was not an issue until commit 0394a63acfe2 ("net: dsa: enable and +disable all ports") disabled all unused ports. Since the unused ports 7-11 +are outside of the correct register range on this switch some registers +were rewritten with invalid content. + +Fixes: 6b93fb46480a ("net-next: dsa: add new driver for qca8xxx family") +Fixes: a0c02161ecfc ("net: dsa: variable number of ports") +Fixes: 0394a63acfe2 ("net: dsa: enable and disable all ports") +Signed-off-by: Michal Vokáč +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/dsa/qca8k.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index 4ee5e6895ed2..e9f5013558c8 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -552,7 +552,7 @@ qca8k_setup(struct dsa_switch *ds) + BIT(0) << QCA8K_GLOBAL_FW_CTRL1_UC_DP_S); + + /* Setup connection between CPU port & user ports */ +- for (i = 0; i < DSA_MAX_PORTS; i++) { ++ for (i = 0; i < QCA8K_NUM_PORTS; i++) { + /* CPU port gets connected to all user ports of the switch */ + if (dsa_is_cpu_port(ds, i)) { + qca8k_rmw(priv, QCA8K_PORT_LOOKUP_CTRL(QCA8K_CPU_PORT), +@@ -979,7 +979,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev) + if (id != QCA8K_ID_QCA8337) + return -ENODEV; + +- priv->ds = dsa_switch_alloc(&mdiodev->dev, DSA_MAX_PORTS); ++ priv->ds = dsa_switch_alloc(&mdiodev->dev, QCA8K_NUM_PORTS); + if (!priv->ds) + return -ENOMEM; + +-- +2.16.4 + diff --git a/patches.suse/net-stmmac-Correctly-take-timestamp-for-PTPv2.patch b/patches.suse/net-stmmac-Correctly-take-timestamp-for-PTPv2.patch new file mode 100644 index 0000000..703fb29 --- /dev/null +++ b/patches.suse/net-stmmac-Correctly-take-timestamp-for-PTPv2.patch @@ -0,0 +1,34 @@ +From 459ec8c36a6736c30c1da3353e375a5bba25927e Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Mon, 30 Sep 2019 10:19:09 +0200 +Subject: [PATCH 4/6] net: stmmac: Correctly take timestamp for PTPv2 +Git-commit: 14f347334bf232074616e29e29103dd0c7c54dec +Patch-mainline: v5.4-rc2 +References: git-fixes + +The case for PTPV2_EVENT requires event packets to be captured so add +this setting to the list of enabled captures. + +Fixes: 891434b18ec0 ("stmmac: add IEEE PTPv1 and PTPv2 support.") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index df4e0acd0d3e..ffea05a76368 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -628,6 +628,7 @@ static int stmmac_hwtstamp_ioctl(struct net_device *dev, struct ifreq *ifr) + else + snap_type_sel = PTP_TCR_SNAPTYPSEL_1; + ++ ts_event_en = PTP_TCR_TSEVNTENA; + ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA; + ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA; + ptp_over_ethernet = PTP_TCR_TSIPENA; +-- +2.16.4 + diff --git a/patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch b/patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch new file mode 100644 index 0000000..2ffb8b9 --- /dev/null +++ b/patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch @@ -0,0 +1,97 @@ +From: Hannes Reinecke +Date: Wed, 9 Jun 2021 11:49:56 +0200 +Subject: qla2xxx: synchronize rport dev_loss_tmo setting +Patch-mainline: Not yet, submitted upstream linux-scsi 2021-07-02 +References: bsc#1182470 bsc#1185486 + +Currently, the dev_loss_tmo setting is only ever used for SCSI +devices. This patch reshuffles initialisation such that the SCSI +remote ports are registered before the NVMe ones, allowing the +dev_loss_tmo setting to be synchronized between SCSI and NVMe. + +Signed-off-by: Hannes Reinecke +Signed-off-by: Daniel Wagner +[lkp: Do not depend on nvme_fc_set_remoteport_devloss() for !NVME_FC] +Reported-by: kernel test robot +--- + + https://lore.kernel.org/linux-scsi/20210702092052.93202-1-dwagner@suse.de/ + + drivers/scsi/qla2xxx/qla_attr.c | 6 ++++++ + drivers/scsi/qla2xxx/qla_init.c | 10 +++------- + drivers/scsi/qla2xxx/qla_nvme.c | 5 ++++- + 3 files changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 3aa9869f6fae..dad48a982804 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2648,7 +2648,13 @@ qla2x00_get_starget_port_id(struct scsi_target *starget) + static inline void + qla2x00_set_rport_loss_tmo(struct fc_rport *rport, uint32_t timeout) + { ++ fc_port_t *fcport = *(fc_port_t **)rport->dd_data; ++ + rport->dev_loss_tmo = timeout ? timeout : 1; ++ ++ if (IS_ENABLED(CONFIG_NVME_FC) && fcport->nvme_remote_port) ++ nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, ++ rport->dev_loss_tmo); + } + + static void +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 0de250570e39..d078f16933c0 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -5631,13 +5631,6 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + + qla2x00_dfs_create_rport(vha, fcport); + +- if (NVME_TARGET(vha->hw, fcport)) { +- qla_nvme_register_remote(vha, fcport); +- qla2x00_set_fcport_disc_state(fcport, DSC_LOGIN_COMPLETE); +- qla2x00_set_fcport_state(fcport, FCS_ONLINE); +- return; +- } +- + qla24xx_update_fcport_fcp_prio(vha, fcport); + + switch (vha->host->active_mode) { +@@ -5659,6 +5652,9 @@ qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + break; + } + ++ if (NVME_TARGET(vha->hw, fcport)) ++ qla_nvme_register_remote(vha, fcport); ++ + qla2x00_set_fcport_state(fcport, FCS_ONLINE); + + if (IS_IIDMA_CAPABLE(vha->hw) && vha->hw->flags.gpsc_supported) { +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 0cacb667a88b..678083a34e4d 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c + +@@ -41,7 +41,7 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + req.port_name = wwn_to_u64(fcport->port_name); + req.node_name = wwn_to_u64(fcport->node_name); + req.port_role = 0; +- req.dev_loss_tmo = 0; ++ req.dev_loss_tmo = fcport->dev_loss_tmo; + + if (fcport->nvme_prli_service_param & NVME_PRLI_SP_INITIATOR) + req.port_role = FC_PORT_ROLE_NVME_INITIATOR; +@@ -68,6 +68,9 @@ int qla_nvme_register_remote(struct scsi_qla_host *vha, struct fc_port *fcport) + return ret; + } + ++ nvme_fc_set_remoteport_devloss(fcport->nvme_remote_port, ++ fcport->dev_loss_tmo); ++ + if (fcport->nvme_prli_service_param & NVME_PRLI_SP_SLER) + ql_log(ql_log_info, vha, 0x212a, + "PortID:%06x Supports SLER\n", req.port_id); +-- +2.29.2 + diff --git a/patches.suse/s390-stack-fix-possible-register-corruption-with-stack-switch-helper.patch b/patches.suse/s390-stack-fix-possible-register-corruption-with-stack-switch-helper.patch new file mode 100644 index 0000000..34989b7 --- /dev/null +++ b/patches.suse/s390-stack-fix-possible-register-corruption-with-stack-switch-helper.patch @@ -0,0 +1,68 @@ +From: Heiko Carstens +Date: Fri, 18 Jun 2021 16:58:47 +0200 +Subject: s390/stack: fix possible register corruption with stack switch helper +Git-commit: 67147e96a332b56c7206238162771d82467f86c0 +Patch-mainline: v5.13 +References: bsc#1185677 + +The CALL_ON_STACK macro is used to call a C function from inline +assembly, and therefore must consider the C ABI, which says that only +registers 6-13, and 15 are non-volatile (restored by the called +function). + +The inline assembly incorrectly marks all registers used to pass +parameters to the called function as read-only input operands, instead +of operands that are read and written to. This might result in +register corruption depending on usage, compiler, and compile options. + +Fix this by marking all operands used to pass parameters as read/write +operands. To keep the code simple even register 6, if used, is marked +as read-write operand. + +Fixes: ff340d2472ec ("s390: add stack switch helper") +Cc: # 4.20 +Reviewed-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Acked-by: Miroslav Benes +--- + arch/s390/include/asm/stacktrace.h | 18 +++++++++++------- + 1 file changed, 11 insertions(+), 7 deletions(-) + +diff --git a/arch/s390/include/asm/stacktrace.h b/arch/s390/include/asm/stacktrace.h +index 2b543163d90a..76c6034428be 100644 +--- a/arch/s390/include/asm/stacktrace.h ++++ b/arch/s390/include/asm/stacktrace.h +@@ -91,12 +91,16 @@ struct stack_frame { + CALL_ARGS_4(arg1, arg2, arg3, arg4); \ + register unsigned long r4 asm("6") = (unsigned long)(arg5) + +-#define CALL_FMT_0 "=&d" (r2) : +-#define CALL_FMT_1 "+&d" (r2) : +-#define CALL_FMT_2 CALL_FMT_1 "d" (r3), +-#define CALL_FMT_3 CALL_FMT_2 "d" (r4), +-#define CALL_FMT_4 CALL_FMT_3 "d" (r5), +-#define CALL_FMT_5 CALL_FMT_4 "d" (r6), ++/* ++ * To keep this simple mark register 2-6 as being changed (volatile) ++ * by the called function, even though register 6 is saved/nonvolatile. ++ */ ++#define CALL_FMT_0 "=&d" (r2) ++#define CALL_FMT_1 "+&d" (r2) ++#define CALL_FMT_2 CALL_FMT_1, "+&d" (r3) ++#define CALL_FMT_3 CALL_FMT_2, "+&d" (r4) ++#define CALL_FMT_4 CALL_FMT_3, "+&d" (r5) ++#define CALL_FMT_5 CALL_FMT_4, "+&d" (r6) + + #define CALL_CLOBBER_5 "0", "1", "14", "cc", "memory" + #define CALL_CLOBBER_4 CALL_CLOBBER_5 +@@ -118,7 +122,7 @@ struct stack_frame { + " brasl 14,%[_fn]\n" \ + " la 15,0(%[_prev])\n" \ + : [_prev] "=&a" (prev), CALL_FMT_##nr \ +- [_stack] "R" (stack), \ ++ : [_stack] "R" (stack), \ + [_bc] "i" (offsetof(struct stack_frame, back_chain)), \ + [_frame] "d" (frame), \ + [_fn] "X" (fn) : CALL_CLOBBER_##nr); \ + diff --git a/patches.suse/scsi-hisi_sas-remove-preemptible b/patches.suse/scsi-hisi_sas-remove-preemptible new file mode 100644 index 0000000..399b409 --- /dev/null +++ b/patches.suse/scsi-hisi_sas-remove-preemptible @@ -0,0 +1,51 @@ +From: "Ahmed S. Darwish" +Date: Thu, 26 Nov 2020 14:29:40 +0100 +Subject: scsi: hisi_sas: Remove preemptible() +Git-commit: 18577cdcaeeb7a1ca5c3adc4d92ed2ba75699625 +Patch-mainline: v5.11-rc1 +References: bsc#1186638 + +hisi_sas_task_exec() uses preemptible() to see if it's safe to block. This +does not work for CONFIG_PREEMPT_COUNT=n kernels in which preemptible() +always returns 0. + +The problem is masked when enabling some of the common Kconfig.debug +options (like CONFIG_DEBUG_ATOMIC_SLEEP), as they implicitly enable the +preemption counter. + +In general, driver leaf functions should not make logic decisions based on +the context they're called from. The caller should be the entity +responsible for explicitly indicating context. + +Since hisi_sas_task_exec() already has a gfp_t flags parameter, use it as +the explicit context marker. + +[lduncan: modified since commit 550c0d89d52d not present.] + +Link: https://lore.kernel.org/r/20201126132952.2287996-3-bigeasy@linutronix.de +Fixes: 214e702d4b70 ("scsi: hisi_sas: Adjust task reject period during host reset") +Fixes: 550c0d89d52d ("scsi: hisi_sas: Replace in_softirq() check in hisi_sas_task_exec()") +Cc: Xiaofei Tan +Cc: Xiang Chen +Cc: John Garry +Acked-by: John Garry +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/hisi_sas/hisi_sas_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/hisi_sas/hisi_sas_main.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_main.c +@@ -628,7 +628,7 @@ static int hisi_sas_task_exec(struct sas + dev = hisi_hba->dev; + + if (unlikely(test_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags))) { +- if (in_softirq()) ++ if (!gfpflags_allow_blocking(gfp_flags)) + return -EINVAL; + + down(&hisi_hba->sem); + diff --git a/patches.suse/scsi-qla2xxx-Make-sure-that-aborted-commands-are-fre.patch b/patches.suse/scsi-qla2xxx-Make-sure-that-aborted-commands-are-fre.patch deleted file mode 100644 index 9b9f768..0000000 --- a/patches.suse/scsi-qla2xxx-Make-sure-that-aborted-commands-are-fre.patch +++ /dev/null @@ -1,104 +0,0 @@ -From: Bart Van Assche -Date: Thu, 8 Aug 2019 20:02:10 -0700 -Subject: scsi: qla2xxx: Make sure that aborted commands are freed -Patch-mainline: v5.4-rc1 -Git-commit: 0dcec41acb85da33841c2ab56dbf337ed00a3914 -References: bsc#1123034 bsc#1131304 bsc#1127988 bsc#1143706 - -The LIO core requires that the target driver callback functions -.queue_data_in() and .queue_status() call target_put_sess_cmd() or -transport_generic_free_cmd(). These calls may happen synchronously or -asynchronously. Make sure that one of these LIO functions is called in case -a command has been aborted. This patch avoids that the code for removing a -session hangs due to commands that do not make progress. - -Cc: Himanshu Madhani -Fixes: 694833ee00c4 ("scsi: tcm_qla2xxx: Do not allow aborted cmd to advance.") # v4.13. -Fixes: a07100e00ac4 ("qla2xxx: Fix TMR ABORT interaction issue between qla2xxx and TCM") # v4.5. -Signed-off-by: Bart Van Assche -Tested-by: Himanshu Madhani -Reviewed-by: Himanshu Madhani -Signed-off-by: Martin K. Petersen -Acked-by: Daniel Wagner ---- - drivers/scsi/qla2xxx/qla_target.c | 13 ++++++++----- - drivers/scsi/qla2xxx/tcm_qla2xxx.c | 4 ++++ - 2 files changed, 12 insertions(+), 5 deletions(-) - ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -3220,7 +3220,8 @@ int qlt_xmit_response(struct qla_tgt_cmd - if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) || - (cmd->sess && cmd->sess->deleted)) { - cmd->state = QLA_TGT_STATE_PROCESSED; -- return 0; -+ res = 0; -+ goto free; - } - - ql_dbg_qp(ql_dbg_tgt, qpair, 0xe018, -@@ -3231,9 +3232,8 @@ int qlt_xmit_response(struct qla_tgt_cmd - - res = qlt_pre_xmit_response(cmd, &prm, xmit_type, scsi_status, - &full_req_cnt); -- if (unlikely(res != 0)) { -- return res; -- } -+ if (unlikely(res != 0)) -+ goto free; - - spin_lock_irqsave(qpair->qp_lock_ptr, flags); - -@@ -3253,7 +3253,8 @@ int qlt_xmit_response(struct qla_tgt_cmd - vha->flags.online, qla2x00_reset_active(vha), - cmd->reset_count, qpair->chip_reset); - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); -- return 0; -+ res = 0; -+ goto free; - } - - /* Does F/W have an IOCBs for this request */ -@@ -3356,6 +3357,8 @@ out_unmap_unlock: - qlt_unmap_sg(vha, cmd); - spin_unlock_irqrestore(qpair->qp_lock_ptr, flags); - -+free: -+ vha->hw->tgt.tgt_ops->free_cmd(cmd); - return res; - } - EXPORT_SYMBOL(qlt_xmit_response); ---- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c -+++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c -@@ -667,6 +667,7 @@ static int tcm_qla2xxx_queue_data_in(str - { - struct qla_tgt_cmd *cmd = container_of(se_cmd, - struct qla_tgt_cmd, se_cmd); -+ struct scsi_qla_host *vha = cmd->vha; - - if (cmd->aborted) { - /* Cmd can loop during Q-full. tcm_qla2xxx_aborted_task -@@ -679,6 +680,7 @@ static int tcm_qla2xxx_queue_data_in(str - cmd->se_cmd.transport_state, - cmd->se_cmd.t_state, - cmd->se_cmd.se_cmd_flags); -+ vha->hw->tgt.tgt_ops->free_cmd(cmd); - return 0; - } - -@@ -706,6 +708,7 @@ static int tcm_qla2xxx_queue_status(stru - { - struct qla_tgt_cmd *cmd = container_of(se_cmd, - struct qla_tgt_cmd, se_cmd); -+ struct scsi_qla_host *vha = cmd->vha; - int xmit_type = QLA_TGT_XMIT_STATUS; - - if (cmd->aborted) { -@@ -719,6 +722,7 @@ static int tcm_qla2xxx_queue_status(stru - cmd, kref_read(&cmd->se_cmd.cmd_kref), - cmd->se_cmd.transport_state, cmd->se_cmd.t_state, - cmd->se_cmd.se_cmd_flags); -+ vha->hw->tgt.tgt_ops->free_cmd(cmd); - return 0; - } - cmd->bufflen = se_cmd->data_length; diff --git a/patches.suse/scsi-sg-add-sg_remove_request-in-sg_write b/patches.suse/scsi-sg-add-sg_remove_request-in-sg_write new file mode 100644 index 0000000..94fb547 --- /dev/null +++ b/patches.suse/scsi-sg-add-sg_remove_request-in-sg_write @@ -0,0 +1,36 @@ +From: Wu Bo +Date: Tue, 14 Apr 2020 10:13:28 +0800 +Subject: scsi: sg: add sg_remove_request in sg_write +Git-commit: 83c6f2390040f188cc25b270b4befeb5628c1aee +Patch-mainline: v5.7-rc3 +References: bsc#1186635 + +If the __copy_from_user function failed we need to call sg_remove_request +in sg_write. + +[lduncan: modified since we are still using __copy_from_user()] + +Link: https://lore.kernel.org/r/610618d9-e983-fd56-ed0f-639428343af7@huawei.com +Acked-by: Douglas Gilbert +Signed-off-by: Wu Bo +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/sg.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -695,8 +695,10 @@ sg_write(struct file *filp, const char _ + hp->flags = input_size; /* structure abuse ... */ + hp->pack_id = old_hdr.pack_id; + hp->usr_ptr = NULL; +- if (__copy_from_user(cmnd, buf, cmd_size)) ++ if (__copy_from_user(cmnd, buf, cmd_size)) { ++ sg_remove_request(sfp, srp); + return -EFAULT; ++ } + /* + * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV, + * but is is possible that the app intended SG_DXFER_TO_DEV, because there + diff --git a/patches.suse/scsi-ufs-core-narrow-down-fast-path-in-system-suspend-path b/patches.suse/scsi-ufs-core-narrow-down-fast-path-in-system-suspend-path new file mode 100644 index 0000000..dee9b2e --- /dev/null +++ b/patches.suse/scsi-ufs-core-narrow-down-fast-path-in-system-suspend-path @@ -0,0 +1,41 @@ +From: Can Guo +Date: Sun, 25 Apr 2021 20:48:40 -0700 +Subject: scsi: ufs: core: Narrow down fast path in system suspend path +Git-commit: ce4f62f9dd8cf43ac044045ed598a0b80ef33890 +Patch-mainline: v5.13-rc1 +References: bsc#1186551 + +If spm_lvl is set to 0 or 1, when system suspend kicks start and HBA is +runtime active, system suspend may just bail without doing anything (the +fast path), leaving other contexts still running, e.g., clock gating and +clock scaling. When system resume kicks start, concurrency can happen +between ufshcd_resume() and these contexts, leading to various stability +issues. + +Add a check against HBA's runtime state and allowing fast path only if HBA +is runtime suspended, otherwise let system suspend go ahead call +ufshcd_suspend(). This will guarantee that these contexts are stopped by +either runtime suspend or system suspend. + +Link: https://lore.kernel.org/r/1619408921-30426-4-git-send-email-cang@codeaurora.org +Fixes: 0b257734344a ("scsi: ufs: optimize system suspend handling") +Reviewed-by: Daejun Park +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/ufs/ufshcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -7621,7 +7621,8 @@ int ufshcd_system_suspend(struct ufs_hba + if ((ufs_get_pm_lvl_to_dev_pwr_mode(hba->spm_lvl) == + hba->curr_dev_pwr_mode) && + (ufs_get_pm_lvl_to_link_pwr_state(hba->spm_lvl) == +- hba->uic_link_state)) ++ hba->uic_link_state) && ++ pm_runtime_suspended(hba->dev)) + goto out; + + if (pm_runtime_suspended(hba->dev)) { diff --git a/patches.suse/scsi-ufs-fix-imprecise-load-calculation-in-devfreq-window b/patches.suse/scsi-ufs-fix-imprecise-load-calculation-in-devfreq-window new file mode 100644 index 0000000..b06f542 --- /dev/null +++ b/patches.suse/scsi-ufs-fix-imprecise-load-calculation-in-devfreq-window @@ -0,0 +1,116 @@ +From: Stanley Chu +Date: Thu, 11 Jun 2020 18:10:43 +0800 +Subject: scsi: ufs: Fix imprecise load calculation in devfreq window +Git-commit: b1bf66d1d5a8fcb54f0e584db5d196ef015b5172 +Patch-mainline: v5.9-rc1 +References: bsc#1187630 + +The UFS load calculation is based on "total_time" and "busy_time" in a +devfreq window. However, the source of time is different for both +parameters: "busy_time" is assigned from "jiffies" thus has different +accuracy from "total_time" which is assigned from ktime_get(). + +In addition, the time of window boundary is not exactly the same as the +starting busy time in this window if UFS is actually busy in the beginning +of the window. A similar accuracy error may also happen for the end of busy +time in current window. + +To guarantee the precision of load calculation, we need to + +1. Align time accuracy of both devfreq_dev_status.total_time and + devfreq_dev_status.busy_time. For example, use "ktime_get()" directly. + +2. Align the following timelines: + - The beginning time of devfreq windows + - The beginning of busy time in a new window + - The end of busy time in the current window + +[lduncan: modified to apply given we have some missing commits.] + +Link: https://lore.kernel.org/r/20200611101043.6379-1-stanley.chu@mediatek.com +Fixes: a3cd5ec55f6c ("scsi: ufs: add load based scaling of UFS gear") +Reviewed-by: Avri Altman +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/ufs/ufshcd.c | 19 +++++++++++-------- + drivers/scsi/ufs/ufshcd.h | 2 +- + 2 files changed, 12 insertions(+), 9 deletions(-) + +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1299,6 +1299,8 @@ static int ufshcd_devfreq_get_dev_status + struct ufs_hba *hba = dev_get_drvdata(dev); + struct ufs_clk_scaling *scaling = &hba->clk_scaling; + unsigned long flags; ++ ktime_t curr_t; ++ + + if (!ufshcd_is_clkscaling_supported(hba)) + return -EINVAL; +@@ -1306,22 +1308,22 @@ static int ufshcd_devfreq_get_dev_status + memset(stat, 0, sizeof(*stat)); + + spin_lock_irqsave(hba->host->host_lock, flags); ++ curr_t = ktime_get(); + if (!scaling->window_start_t) + goto start_window; + + if (scaling->is_busy_started) +- scaling->tot_busy_t += ktime_to_us(ktime_sub(ktime_get(), +- scaling->busy_start_t)); ++ scaling->tot_busy_t += ktime_us_delta(curr_t, ++ scaling->busy_start_t); + +- stat->total_time = jiffies_to_usecs((long)jiffies - +- (long)scaling->window_start_t); ++ stat->total_time = ktime_us_delta(curr_t, scaling->window_start_t); + stat->busy_time = scaling->tot_busy_t; + start_window: +- scaling->window_start_t = jiffies; ++ scaling->window_start_t = curr_t; + scaling->tot_busy_t = 0; + + if (hba->outstanding_reqs) { +- scaling->busy_start_t = ktime_get(); ++ scaling->busy_start_t = curr_t; + scaling->is_busy_started = true; + } else { + scaling->busy_start_t = 0; +@@ -1776,6 +1778,7 @@ static void ufshcd_exit_clk_gating(struc + static void ufshcd_clk_scaling_start_busy(struct ufs_hba *hba) + { + bool queue_resume_work = false; ++ ktime_t curr_t = ktime_get(); + + if (!ufshcd_is_clkscaling_supported(hba)) + return; +@@ -1791,13 +1794,13 @@ static void ufshcd_clk_scaling_start_bus + &hba->clk_scaling.resume_work); + + if (!hba->clk_scaling.window_start_t) { +- hba->clk_scaling.window_start_t = jiffies; ++ hba->clk_scaling.window_start_t = curr_t; + hba->clk_scaling.tot_busy_t = 0; + hba->clk_scaling.is_busy_started = false; + } + + if (!hba->clk_scaling.is_busy_started) { +- hba->clk_scaling.busy_start_t = ktime_get(); ++ hba->clk_scaling.busy_start_t = curr_t; + hba->clk_scaling.is_busy_started = true; + } + } +--- a/drivers/scsi/ufs/ufshcd.h ++++ b/drivers/scsi/ufs/ufshcd.h +@@ -391,7 +391,7 @@ struct ufs_saved_pwr_info { + struct ufs_clk_scaling { + int active_reqs; + unsigned long tot_busy_t; +- unsigned long window_start_t; ++ ktime_t window_start_t; + ktime_t busy_start_t; + struct device_attribute enable_attr; + struct ufs_saved_pwr_info saved_pwr_info; + diff --git a/patches.suse/scsi-ufs-ufshcd-pltfrm-depends-on-has_iomem b/patches.suse/scsi-ufs-ufshcd-pltfrm-depends-on-has_iomem new file mode 100644 index 0000000..7122bd3 --- /dev/null +++ b/patches.suse/scsi-ufs-ufshcd-pltfrm-depends-on-has_iomem @@ -0,0 +1,45 @@ +From: Randy Dunlap +Date: Tue, 5 Jan 2021 20:08:22 -0800 +Subject: scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM +Git-commit: 5e6ddadf7637d336acaad1df1f3bcbb07f7d104d +Patch-mainline: v5.11-rc5 +References: bsc#1188010 + +Building ufshcd-pltfrm.c on arch/s390/ has a linker error since S390 does +not support IOMEM, so add a dependency on HAS_IOMEM. + +s390-linux-ld: drivers/scsi/ufs/ufshcd-pltfrm.o: in function `ufshcd_pltfrm_init': +ufshcd-pltfrm.c:(.text+0x38e): undefined reference to `devm_platform_ioremap_resource' + +where that devm_ function is inside an #ifdef CONFIG_HAS_IOMEM/#endif +block. + +[lduncan: refreshed to match our current context] + +Link: lore.kernel.org/r/202101031125.ZEFCUiKi-lkp@intel.com +Link: https://lore.kernel.org/r/20210106040822.933-1-rdunlap@infradead.org +Fixes: 03b1781aa978 ("[SCSI] ufs: Add Platform glue driver for ufshcd") +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Alim Akhtar +Cc: Avri Altman +Cc: linux-scsi@vger.kernel.org +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/ufs/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/scsi/ufs/Kconfig ++++ b/drivers/scsi/ufs/Kconfig +@@ -72,6 +72,7 @@ config SCSI_UFS_DWC_TC_PCI + config SCSI_UFSHCD_PLATFORM + tristate "Platform bus based UFS Controller support" + depends on SCSI_UFSHCD ++ depends on HAS_IOMEM + ---help--- + This selects the UFS host controller support. Select this if + you have an UFS controller on Platform bus. + diff --git a/patches.suse/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing b/patches.suse/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing new file mode 100644 index 0000000..5f82c95 --- /dev/null +++ b/patches.suse/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing @@ -0,0 +1,35 @@ +From: Sergey Shtylyov +Date: Mon, 29 Mar 2021 23:50:58 +0300 +Subject: scsi: ufs: ufshcd-pltfrm: Fix deferred probing +Git-commit: 339c9b63cc7ce779ce45c675bf709cb58b807fc3 +Patch-mainline: v5.13-rc1 +References: bsc#1187631 + +The driver overrides the error codes returned by platform_get_irq() to +-ENODEV, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Propagate the error code +upstream as it should have been done from the start... + +[lduncan: modified, since we have a dev_err() not present upstream] + +Link: https://lore.kernel.org/r/420364ca-614a-45e3-4e35-0e0653c7bc53@omprussia.ru +Fixes: 2953f850c3b8 ("[SCSI] ufs: use devres functions for ufshcd") +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Acked-by: Lee Duncan +--- + drivers/scsi/ufs/ufshcd-pltfrm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/ufs/ufshcd-pltfrm.c ++++ b/drivers/scsi/ufs/ufshcd-pltfrm.c +@@ -315,7 +315,7 @@ int ufshcd_pltfrm_init(struct platform_d + irq = platform_get_irq(pdev, 0); + if (irq < 0) { + dev_err(dev, "IRQ resource not available\n"); +- err = -ENODEV; ++ err = irq; + goto out; + } + + diff --git a/series.conf b/series.conf index c71b15e..27e235c 100644 --- a/series.conf +++ b/series.conf @@ -47290,6 +47290,7 @@ patches.suse/btrfs-fix-fsync-after-succession-of-renames-of-diffe.patch patches.suse/btrfs-fix-fsync-after-succession-of-renames-and-unli.patch patches.suse/btrfs-ensure-that-a-dup-or-raid1-block-group-has-exactly-two-stripes.patch + patches.suse/btrfs-add-missing-error-handling-after-doing-leaf-node-binary-search.patch patches.suse/xfs-don-t-overflow-xattr-listent-buffer.patch patches.suse/xfs-fix-reporting-supported-extra-file-attributes-fo.patch patches.suse/selinux-never-allow-relabeling-on-context-mounts.patch @@ -51215,6 +51216,7 @@ patches.suse/caif-hsi-fix-possible-deadlock-in-cfhsi_exit_module.patch patches.suse/net_sched-unset-TCQ_F_CAN_BYPASS-when-adding-filters.patch patches.suse/mlxsw-spectrum_dcb-Configure-DSCP-map-as-the-last-ru.patch + patches.suse/mlxsw-spectrum-Do-not-process-learned-records-with-a.patch patches.suse/net-bcmgenet-use-promisc-for-unsupported-filters.patch patches.suse/xdp-fix-possible-cq-entry-leak.patch patches.suse/usb-qmi_wwan-add-D-Link-DWM-222-A2-device-ID.patch @@ -51958,6 +51960,7 @@ patches.suse/0052-xgbe-no-need-to-check-return-value-of-debugfs_create.patch patches.suse/0005-caif-no-need-to-check-return-value-of-debugfs_create.patch patches.suse/netfilter-connlabels-prefer-static-lock-initialiser.patch + patches.suse/can-xilinx_can-xcan_chip_start-fix-failure-with-inva.patch patches.suse/can-xilinx_can-xcan_probe-skip-error-message-on-defe.patch patches.suse/net-hns3-prevent-unnecessary-MAC-TNL-interrupt.patch patches.suse/libertas-Add-missing-sentinel-at-end-of-if_usb.c-fw_.patch @@ -52245,7 +52248,6 @@ patches.suse/scsi-qla2xxx-Make-qlt_handle_abts_completion-more-ro.patch patches.suse/scsi-qla2xxx-Modify-NVMe-include-directives.patch patches.suse/scsi-qla2xxx-Introduce-qla2xxx_get_next_handle.patch - patches.suse/scsi-qla2xxx-Make-sure-that-aborted-commands-are-fre.patch patches.suse/scsi-qla2xxx-Complain-if-sp-done-is-not-called-from-.patch patches.suse/scsi-qla2xxx-Let-the-compiler-check-the-type-of-the-.patch patches.suse/scsi-qla2xxx-Remove-superfluous-sts_entry_-casts.patch @@ -52510,6 +52512,7 @@ patches.suse/kvm-x86-powerpc-do-not-allow-clearing-largepages-debugfs-entry patches.suse/s390-cpumsf-check-for-cpu-measurement-sampling patches.suse/kvm-s390-fix-_insn32_query-inline-assembly + patches.suse/net-dsa-qca8k-Use-up-to-7-ports-for-all-operations.patch patches.suse/sch_cbq-validate-TCA_CBQ_WRROPT-to-avoid-crash.patch patches.suse/net-Unpublish-sk-from-sk_reuseport_cb-before-call_rc.patch patches.suse/ieee802154-atusb-fix-use-after-free-at-disconnect.patch @@ -52518,6 +52521,7 @@ patches.suse/nl80211-fix-null-pointer-dereference.patch patches.suse/mac80211-fix-txq-null-pointer-dereference.patch patches.suse/net-sched-cbs-Avoid-division-by-zero-when-calculatin.patch + patches.suse/net-stmmac-Correctly-take-timestamp-for-PTPv2.patch patches.suse/hso-fix-NULL-deref-on-tty-open.patch patches.suse/vsock-Fix-a-lockdep-warning-in-__vsock_release.patch patches.suse/0001-xen-netfront-do-not-use-0U-as-error-return-value-for.patch @@ -52842,6 +52846,7 @@ patches.suse/can-gs_usb-gs_can_open-prevent-memory-leak.patch patches.suse/can-mcba_usb-fix-use-after-free-on-disconnect.patch patches.suse/can-usb_8dev-fix-use-after-free-on-disconnect.patch + patches.suse/can-flexcan-disable-completely-the-ECC-mechanism.patch patches.suse/can-peak_usb-fix-a-potential-out-of-sync-while-decod.patch patches.suse/can-peak_usb-fix-slab-info-leak.patch patches.suse/can-peak_usb-report-bus-recovery-as-well.patch @@ -53337,6 +53342,7 @@ patches.suse/debugfs-add-debugfs_create_xul-for-hexadecimal-unsigned-long.patch patches.suse/mmc-atmel-mci-fix-debugfs-on-64-bit-platforms.patch patches.suse/mmc-dw_mmc-fix-debugfs-on-64-bit-platforms.patch + patches.suse/net-caif-Fix-debugfs-on-64-bit-platforms.patch patches.suse/powerpc-book3s64-Fix-link-stack-flush-on-context-swi.patch patches.suse/KVM-PPC-Book3S-HV-Flush-link-stack-on-guest-exit-to-.patch patches.suse/ftrace-introduce-permanent-ftrace_ops-flag.patch @@ -53755,6 +53761,7 @@ patches.suse/btrfs-abort-transaction-after-failed-inode-updates-i.patch patches.suse/btrfs-handle-ENOENT-in-btrfs_uuid_tree_iterate.patch patches.suse/btrfs-skip-log-replay-on-orphaned-roots.patch + patches.suse/btrfs-do-not-leak-reloc-root-if-we-fail-to-read-the-fs-root.patch patches.suse/ALSA-pcm-Avoid-possible-info-leaks-from-PCM-stream-b.patch patches.suse/ALSA-hda-ca0132-Keep-power-on-during-processing-DSP-.patch patches.suse/ALSA-hda-ca0132-Avoid-endless-loop.patch @@ -54961,6 +54968,8 @@ patches.suse/0003-btrfs-relocation-Check-cancel-request-after-each-ext.patch patches.suse/btrfs-account-ticket-size-at-add-delete-time.patch patches.suse/btrfs-fix-missing-file-extent-item-for-hole-after-ra.patch + patches.suse/btrfs-unset-reloc-control-if-we-fail-to-recover.patch + patches.suse/btrfs-reloc-clean-dirty-subvols-if-we-fail-to-start-a-transaction.patch patches.suse/btrfs-remove-a-BUG_ON-from-merge_reloc_roots.patch patches.suse/btrfs-fix-missing-semaphore-unlock-in-btrfs_sync_fil.patch patches.suse/cifs-do-not-ignore-the-SYNC-flags-in-getattr.patch @@ -55415,6 +55424,7 @@ patches.suse/ALSA-hda-realtek-Add-new-codec-supported-for-ALC245.patch patches.suse/ALSA-hda-Always-use-jackpoll-helper-for-jack-update-.patch patches.suse/0019-pnp-Use-list_for_each_entry-instead-of-open-coding.patch + patches.suse/scsi-sg-add-sg_remove_request-in-sg_write patches.suse/net-netrom-Fix-potential-nr_neigh-refcnt-leak-in-nr_.patch patches.suse/wimax-i2400m-Fix-potential-urb-refcnt-leak.patch patches.suse/net-mlx4_en-avoid-indirect-call-in-TX-completion.patch @@ -56620,6 +56630,7 @@ patches.suse/RDMA-mlx5-Fix-typo-in-enum-name.patch patches.suse/RDMA-core-Fix-return-error-value-in-_ib_modify_qp-to.patch patches.suse/scsi-Fix-trivial-spelling.patch + patches.suse/scsi-ufs-fix-imprecise-load-calculation-in-devfreq-window patches.suse/scsi-cumana_2-fix-different-dev_id-between-request_irq-and-free_irq patches.suse/scsi-qla2xxx-Check-the-size-of-struct-fcp_hdr-at-com.patch patches.suse/scsi-qla2xxx-Remove-the-__packed-annotation-from-str.patch @@ -57994,6 +58005,7 @@ patches.suse/Revert-ACPI-resources-Use-AE_CTRL_TERMINATE-to-termi.patch patches.suse/PCI-Fix-pci_slot_release-NULL-pointer-dereference.patch patches.suse/PCI-Add-function-1-DMA-alias-quirk-for-Marvell-9215-.patch + patches.suse/btrfs-remove-err-variable-from-do_relocation.patch patches.suse/jfs-Fix-array-index-bounds-check-in-dbAdjTree.patch patches.suse/nfsd-Fix-message-level-for-normal-termination.patch patches.suse/nfs_common-need-lock-during-iterate-through-the-list.patch @@ -58055,6 +58067,7 @@ patches.suse/scsi-lpfc-Fix-missing-prototype-for-lpfc_nvmet_prep_.patch patches.suse/scsi-lpfc-Fix-variable-vport-set-but-not-used-in-lpf.patch patches.suse/scsi-lpfc-Use-generic-power-management.patch + patches.suse/scsi-hisi_sas-remove-preemptible patches.suse/scsi-qla4xxx-remove-in_interrupt patches.suse/scsi-qla2xxx-Remove-in_interrupt-from-qla82xx-specif.patch patches.suse/scsi-target-tcm_qla2xxx-Remove-BUG_ON-in_interrupt.patch @@ -58251,6 +58264,7 @@ patches.suse/mmc-sdhci-xenon-fix-1.8v-regulator-stabilization.patch patches.suse/dm-avoid-filesystem-lookup-in-dm_get_dev_t.patch patches.suse/scsi-megaraid_sas-Fix-MEGASAS_IOC_FIRMWARE-regression + patches.suse/scsi-ufs-ufshcd-pltfrm-depends-on-has_iomem patches.suse/scsi-libfc-Avoid-invoking-response-handler-twice-if-.patch patches.suse/scsi-ibmvfc-Set-default-timeout-to-avoid-crash-durin.patch patches.suse/i2c-octeon-check-correct-size-of-maximum-RECV_LEN-pa.patch @@ -58740,6 +58754,44 @@ patches.suse/USB-serial-fix-return-value-for-unsupported-ioctls.patch patches.suse/bus-qcom-Put-child-node-before-return.patch patches.suse/soc-qcom-mdt_loader-Validate-that-p_filesz-p_memsz.patch + patches.suse/btrfs-convert-some-bug_on-s-to-assert-s-in-do_relocation.patch + patches.suse/btrfs-convert-bug_on-s-in-relocate_tree_block.patch + patches.suse/btrfs-handle-errors-from-select_reloc_root.patch + patches.suse/btrfs-convert-bug_on-s-in-select_reloc_root-to-proper-errors.patch + patches.suse/btrfs-check-record_root_in_trans-related-failures-in-select_reloc_root.patch + patches.suse/btrfs-do-proper-error-handling-in-record_reloc_root_in_trans.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename_exchange.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_rename.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-btrfs_recover_log_trees.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-create_subvol.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-relocate_tree_block.patch + patches.suse/btrfs-handle-btrfs_record_root_in_trans-failure-in-start_transaction.patch + patches.suse/btrfs-handle-record_root_in_trans-failure-in-qgroup_account_snapshot.patch + patches.suse/btrfs-handle-record_root_in_trans-failure-in-btrfs_record_root_in_trans.patch + patches.suse/btrfs-handle-record_root_in_trans-failure-in-create_pending_snapshot.patch + patches.suse/btrfs-return-an-error-from-btrfs_record_root_in_trans.patch + patches.suse/btrfs-have-proper-error-handling-in-btrfs_init_reloc_root.patch + patches.suse/btrfs-do-proper-error-handling-in-create_reloc_root.patch + patches.suse/btrfs-validate-root-reloc_root-after-recording-root-in-trans.patch + patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-commit_fs_roots.patch + patches.suse/btrfs-change-insert_dirty_subvol-to-return-errors.patch + patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-insert_dirty_subvol.patch + patches.suse/btrfs-handle-btrfs_update_reloc_root-failure-in-prepare_to_merge.patch + patches.suse/btrfs-do-proper-error-handling-in-btrfs_update_reloc_root.patch + patches.suse/btrfs-convert-logic-bug_on-s-in-replace_path-to-assert-s.patch + patches.suse/btrfs-handle-btrfs_cow_block-errors-in-replace_path.patch + patches.suse/btrfs-handle-btrfs_search_slot-failure-in-replace_path.patch + patches.suse/btrfs-handle-errors-in-reference-count-manipulation-in-replace_path.patch + patches.suse/btrfs-handle-extent-reference-errors-in-do_relocation.patch + patches.suse/btrfs-tree-checker-check-for-btrfs_block_flag_full_backref-being-set-improperly.patch + patches.suse/btrfs-remove-the-extent-item-sanity-checks-in-relocate_block_group.patch + patches.suse/btrfs-do-proper-error-handling-in-create_reloc_inode.patch + patches.suse/btrfs-handle-_add_reloc_root-failures-in-btrfs_recover_relocation.patch + patches.suse/btrfs-do-not-panic-in-_add_reloc_root.patch + patches.suse/btrfs-cleanup-error-handling-in-prepare_to_merge.patch + patches.suse/btrfs-handle-extent-corruption-with-select_one_root-properly.patch + patches.suse/btrfs-do-proper-error-handling-in-merge_reloc_roots.patch + patches.suse/btrfs-check-return-value-of-btrfs_commit_transaction-in-relocation.patch patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch patches.suse/btrfs-fix-race-when-picking-most-recent-mod-log-oper.patch patches.suse/ACPI-CPPC-Replace-cppc_attr-with-kobj_attribute.patch @@ -58854,6 +58906,7 @@ patches.suse/scsi-qla2xxx-Update-version-to-10.02.00.106-k.patch patches.suse/scsi-lpfc-Fix-gcc-Wstringop-overread-warning.patch patches.suse/scsi-fcoe-fix-mismatched-fcoe_wwn_from_mac-declaration + patches.suse/scsi-ufs-ufshcd-pltfrm-fix-deferred-probing patches.suse/scsi-hisi_sas-fix-irq-checks patches.suse/scsi-jazz_esp-add-irq-check patches.suse/scsi-sun3x_esp-add-irq-check @@ -58996,6 +59049,7 @@ patches.suse/scsi-lpfc-Fix-DMA-virtual-address-ptr-assignment-in-.patch patches.suse/scsi-lpfc-Fix-bad-memory-access-during-VPD-DUMP-mail.patch patches.suse/scsi-qla2xxx-Prevent-PRLI-in-target-mode.patch + patches.suse/scsi-ufs-core-narrow-down-fast-path-in-system-suspend-path patches.suse/x86-cpu-initialize-msr_tsc_aux-if-rdtscp-or-rdpid-is-supported.patch patches.suse/Revert-337f13046ff0-futex-Allow-FUTEX_CLOCK_REALTIME.patch patches.suse/drm-radeon-Fix-off-by-one-power_state-index-heap-ove.patch @@ -59097,6 +59151,7 @@ patches.suse/ext4-fix-bug-on-in-ext4_es_cache_extent-as-ext4_spli.patch patches.suse/ext4-fix-memory-leak-in-ext4_fill_super.patch patches.suse/scsi-lpfc-Fix-failure-to-transmit-ABTS-on-FC-link.patch + patches.suse/cgroup1-don-t-allow-n-in-renaming.patch patches.suse/drm-Fix-use-after-free-read-in-drm_getunique.patch patches.suse/drm-Lock-pointer-access-in-drm_master_release.patch patches.suse/ftrace-Do-not-blindly-read-the-ip-address-in-ftrace_bug.patch @@ -59116,11 +59171,16 @@ patches.suse/tracing-Do-no-increment-trace_clock_global-by-one.patch patches.suse/batman-adv-Avoid-WARN_ON-timing-related-checks.patch patches.suse/alx-Fix-an-error-handling-path-in-alx_probe.patch + patches.suse/bpf-Fix-leakage-under-speculation-on-mispredicted-br.patch patches.suse/can-bcm-fix-infoleak-in-struct-bcm_msg_head.patch patches.suse/can-mcba_usb-fix-memory-leak-in-mcba_usb.patch - - # netdev/net-next + patches.suse/kthread_worker-split-code-for-canceling-the-delayed-.patch + patches.suse/kthread-prevent-deadlock-when-kthread_mod_delayed_wo.patch + patches.suse/s390-stack-fix-possible-register-corruption-with-stack-switch-helper.patch + patches.suse/crypto-ccp-fix-a-resource-leak-in-an-error-handling-path.patch + patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch + patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch # jejb/scsi for-next patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch @@ -59148,9 +59208,6 @@ patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch - # git://github.com/cminyard/linux-ipmi.git for-next - patches.suse/ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch - # out-of-tree patches patches.suse/net-mvpp2-fix-condition-for-setting-up-link-interrup.patch patches.suse/cifs-handle-netapp-error-codes.patch @@ -59184,6 +59241,7 @@ patches.suse/netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch patches.kabi/kABI-powerpc-64-add-back-start_tb-and-accum_tb-to-th.patch patches.kabi/fcoe-fcoe_wwn_from_mac-kabi-fix + patches.kabi/scsi-ufs-fix-ktime_t-kabi-change ######################################################## # end of sorted patches @@ -59583,6 +59641,7 @@ patches.suse/ch-add-missing-mutex_lock-mutex_unlock-in-ch_release.patch patches.suse/ch-fixup-refcounting-imbalance-for-SCSI-devices.patch patches.suse/qla2xxx-always-allocate-qla_tgt_wq.patch + patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch patches.suse/block-Fix-a-NULL-pointer-dereference-in-generic_make.patch patches.suse/dasd_fba-Display-00000000-for-zero-page-when-dumping.patch