* [PATCH 6.19 01/18] scsi: qla2xxx: Fix bsg_done() causing double free
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
@ 2026-02-17 20:31 ` Greg Kroah-Hartman
2026-02-17 20:31 ` [PATCH 6.19 02/18] arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph Greg Kroah-Hartman
` (27 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:31 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anil Gurumurthy, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen, Sasha Levin
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <agurumurthy@marvell.com>
commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 upstream.
Kernel panic observed on system,
[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000
[5353358.825194] #PF: supervisor write access in kernel mode
[5353358.825195] #PF: error_code(0x0002) - not-present page
[5353358.825196] PGD 100006067 P4D 0
[5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI
[5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1
[5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025
[5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10
[5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246
[5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000
[5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000
[5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000
[5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090
[5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000
[5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000
[5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0
[5353358.825221] PKRU: 55555554
[5353358.825222] Call Trace:
[5353358.825223] <TASK>
[5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df
[5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df
[5353358.825232] ? sg_copy_buffer+0xc8/0x110
[5353358.825236] ? __die_body.cold+0x8/0xd
[5353358.825238] ? page_fault_oops+0x134/0x170
[5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110
[5353358.825244] ? exc_page_fault+0xa8/0x150
[5353358.825247] ? asm_exc_page_fault+0x22/0x30
[5353358.825252] ? memcpy_erms+0x6/0x10
[5353358.825253] sg_copy_buffer+0xc8/0x110
[5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx]
[5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]
Most routines in qla_bsg.c call bsg_done() only for success cases.
However a few invoke it for failure case as well leading to a double
free. Validate before calling bsg_done().
Cc: stable@vger.kernel.org
Signed-off-by: Anil Gurumurthy <agurumurthy@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Reviewed-by: Himanshu Madhani <hmadhani2024@gmail.com>
Link: https://patch.msgid.link/20251210101604.431868-12-njavali@marvell.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_bsg.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_bsg.c
+++ b/drivers/scsi/qla2xxx/qla_bsg.c
@@ -1546,8 +1546,9 @@ qla2x00_update_optrom(struct bsg_job *bs
ha->optrom_buffer = NULL;
ha->optrom_state = QLA_SWAITING;
mutex_unlock(&ha->optrom_mutex);
- bsg_job_done(bsg_job, bsg_reply->result,
- bsg_reply->reply_payload_rcv_len);
+ if (!rval)
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
return rval;
}
@@ -2612,8 +2613,9 @@ qla2x00_manage_host_stats(struct bsg_job
sizeof(struct ql_vnd_mng_host_stats_resp));
bsg_reply->result = DID_OK;
- bsg_job_done(bsg_job, bsg_reply->result,
- bsg_reply->reply_payload_rcv_len);
+ if (!ret)
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
return ret;
}
@@ -2702,8 +2704,9 @@ qla2x00_get_host_stats(struct bsg_job *b
bsg_job->reply_payload.sg_cnt,
data, response_len);
bsg_reply->result = DID_OK;
- bsg_job_done(bsg_job, bsg_reply->result,
- bsg_reply->reply_payload_rcv_len);
+ if (!ret)
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
kfree(data);
host_stat_out:
@@ -2802,8 +2805,9 @@ reply:
bsg_job->reply_payload.sg_cnt, data,
response_len);
bsg_reply->result = DID_OK;
- bsg_job_done(bsg_job, bsg_reply->result,
- bsg_reply->reply_payload_rcv_len);
+ if (!ret)
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
tgt_stat_out:
kfree(data);
@@ -2864,8 +2868,9 @@ qla2x00_manage_host_port(struct bsg_job
bsg_job->reply_payload.sg_cnt, &rsp_data,
sizeof(struct ql_vnd_mng_host_port_resp));
bsg_reply->result = DID_OK;
- bsg_job_done(bsg_job, bsg_reply->result,
- bsg_reply->reply_payload_rcv_len);
+ if (!ret)
+ bsg_job_done(bsg_job, bsg_reply->result,
+ bsg_reply->reply_payload_rcv_len);
return ret;
}
@@ -3240,7 +3245,8 @@ int qla2x00_mailbox_passthru(struct bsg_
bsg_job->reply_len = sizeof(*bsg_job->reply);
bsg_reply->result = DID_OK << 16;
- bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
+ if (!ret)
+ bsg_job_done(bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);
kfree(req_data);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 02/18] arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
2026-02-17 20:31 ` [PATCH 6.19 01/18] scsi: qla2xxx: Fix bsg_done() causing double free Greg Kroah-Hartman
@ 2026-02-17 20:31 ` Greg Kroah-Hartman
2026-02-17 20:31 ` [PATCH 6.19 03/18] LoongArch: Rework KASAN initialization for PTW-enabled systems Greg Kroah-Hartman
` (26 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:31 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Evans Jahja, Chen-Yu Tsai,
Otto Pflüger, AngeloGioacchino Del Regno, Thorsten Leemhuis
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Otto Pflüger <otto.pflueger@abscue.de>
commit be0b304eeb8c5f77e4f98f64e58729d879195f2f upstream.
The endpoint IDs in the display graph are expected to match the
associated display path number, i.e. all endpoints connected to
mmsys_ep_main must have reg = <0> and all endpoints connected to
mmsys_ep_ext must have reg = <1>.
Add the missing ID to all endpoints in the display graph, based on
mt8365.dtsi as an existing example that does this correctly.
Fixes: e72d63fa0563 ("arm64: dts: mediatek: mt8183: Migrate to display controller OF graph")
Reported-by: Evans Jahja <evansjahja13@gmail.com>
Closes: https://lore.kernel.org/linux-mediatek/CAAq5pW9o3itC0G16LnJO7KMAQ_XoqXUpB=cuJ_7e3-H11zKd5Q@mail.gmail.com/
Tested-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Otto Pflüger <otto.pflueger@abscue.de>
[Angelo: Fixed dtbs_check issues]
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: Thorsten Leemhuis <regressions@leemhuis.info>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 +++++++++++++++++++++++++------
1 file changed, 31 insertions(+), 6 deletions(-)
--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi
@@ -1812,15 +1812,23 @@
#size-cells = <0>;
port@0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <0>;
- ovl_2l1_in: endpoint {
+
+ ovl_2l1_in: endpoint@1 {
+ reg = <1>;
remote-endpoint = <&mmsys_ep_ext>;
};
};
port@1 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <1>;
- ovl_2l1_out: endpoint {
+
+ ovl_2l1_out: endpoint@1 {
+ reg = <1>;
remote-endpoint = <&rdma1_in>;
};
};
@@ -1872,15 +1880,23 @@
#size-cells = <0>;
port@0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <0>;
- rdma1_in: endpoint {
+
+ rdma1_in: endpoint@1 {
+ reg = <1>;
remote-endpoint = <&ovl_2l1_out>;
};
};
port@1 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <1>;
- rdma1_out: endpoint {
+
+ rdma1_out: endpoint@1 {
+ reg = <1>;
remote-endpoint = <&dpi_in>;
};
};
@@ -2076,15 +2092,24 @@
#size-cells = <0>;
port@0 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <0>;
- dpi_in: endpoint {
+
+ dpi_in: endpoint@1 {
+ reg = <1>;
remote-endpoint = <&rdma1_out>;
};
};
port@1 {
+ #address-cells = <1>;
+ #size-cells = <0>;
reg = <1>;
- dpi_out: endpoint { };
+
+ dpi_out: endpoint@1 {
+ reg = <1>;
+ };
};
};
};
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 03/18] LoongArch: Rework KASAN initialization for PTW-enabled systems
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
2026-02-17 20:31 ` [PATCH 6.19 01/18] scsi: qla2xxx: Fix bsg_done() causing double free Greg Kroah-Hartman
2026-02-17 20:31 ` [PATCH 6.19 02/18] arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph Greg Kroah-Hartman
@ 2026-02-17 20:31 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 04/18] fbdev: rivafb: fix divide error in nv3_arb() Greg Kroah-Hartman
` (25 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:31 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Huacai Chen
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
commit 5ec5ac4ca27e4daa234540ac32f9fc5219377d53 upstream.
kasan_init_generic() indicates that kasan is fully initialized, so it
should be put at end of kasan_init().
Otherwise bringing up the primary CPU failed when CONFIG_KASAN is set
on PTW-enabled systems, here are the call chains:
kernel_entry()
start_kernel()
setup_arch()
kasan_init()
kasan_init_generic()
The reason is PTW-enabled systems have speculative accesses which means
memory accesses to the shadow memory after kasan_init() may be executed
by hardware before. However, accessing shadow memory is safe only after
kasan fully initialized because kasan_init() uses a temporary PGD table
until we have populated all levels of shadow page tables and writen the
PGD register. Moving kasan_init_generic() later can defer the occasion
of kasan_enabled(), so as to avoid speculative accesses on shadow pages.
After moving kasan_init_generic() to the end, kasan_init() can no longer
call kasan_mem_to_shadow() for shadow address conversion because it will
always return kasan_early_shadow_page. On the other hand, we should keep
the current logic of kasan_mem_to_shadow() for both the early and final
stage because there may be instrumentation before kasan_init().
To solve this, we factor out a new mem_to_shadow() function from current
kasan_mem_to_shadow() for the shadow address conversion in kasan_init().
Cc: stable@vger.kernel.org
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/loongarch/mm/kasan_init.c | 78 +++++++++++++++++++++--------------------
1 file changed, 40 insertions(+), 38 deletions(-)
--- a/arch/loongarch/mm/kasan_init.c
+++ b/arch/loongarch/mm/kasan_init.c
@@ -40,39 +40,43 @@ static pgd_t kasan_pg_dir[PTRS_PER_PGD]
#define __pte_none(early, pte) (early ? pte_none(pte) : \
((pte_val(pte) & _PFN_MASK) == (unsigned long)__pa(kasan_early_shadow_page)))
-void *kasan_mem_to_shadow(const void *addr)
+static void *mem_to_shadow(const void *addr)
{
- if (!kasan_enabled()) {
+ unsigned long offset = 0;
+ unsigned long maddr = (unsigned long)addr;
+ unsigned long xrange = (maddr >> XRANGE_SHIFT) & 0xffff;
+
+ if (maddr >= FIXADDR_START)
return (void *)(kasan_early_shadow_page);
- } else {
- unsigned long maddr = (unsigned long)addr;
- unsigned long xrange = (maddr >> XRANGE_SHIFT) & 0xffff;
- unsigned long offset = 0;
-
- if (maddr >= FIXADDR_START)
- return (void *)(kasan_early_shadow_page);
-
- maddr &= XRANGE_SHADOW_MASK;
- switch (xrange) {
- case XKPRANGE_CC_SEG:
- offset = XKPRANGE_CC_SHADOW_OFFSET;
- break;
- case XKPRANGE_UC_SEG:
- offset = XKPRANGE_UC_SHADOW_OFFSET;
- break;
- case XKPRANGE_WC_SEG:
- offset = XKPRANGE_WC_SHADOW_OFFSET;
- break;
- case XKVRANGE_VC_SEG:
- offset = XKVRANGE_VC_SHADOW_OFFSET;
- break;
- default:
- WARN_ON(1);
- return NULL;
- }
- return (void *)((maddr >> KASAN_SHADOW_SCALE_SHIFT) + offset);
+ maddr &= XRANGE_SHADOW_MASK;
+ switch (xrange) {
+ case XKPRANGE_CC_SEG:
+ offset = XKPRANGE_CC_SHADOW_OFFSET;
+ break;
+ case XKPRANGE_UC_SEG:
+ offset = XKPRANGE_UC_SHADOW_OFFSET;
+ break;
+ case XKPRANGE_WC_SEG:
+ offset = XKPRANGE_WC_SHADOW_OFFSET;
+ break;
+ case XKVRANGE_VC_SEG:
+ offset = XKVRANGE_VC_SHADOW_OFFSET;
+ break;
+ default:
+ WARN_ON(1);
+ return NULL;
}
+
+ return (void *)((maddr >> KASAN_SHADOW_SCALE_SHIFT) + offset);
+}
+
+void *kasan_mem_to_shadow(const void *addr)
+{
+ if (kasan_enabled())
+ return mem_to_shadow(addr);
+ else
+ return (void *)(kasan_early_shadow_page);
}
const void *kasan_shadow_to_mem(const void *shadow_addr)
@@ -293,11 +297,8 @@ void __init kasan_init(void)
/* Maps everything to a single page of zeroes */
kasan_pgd_populate(KASAN_SHADOW_START, KASAN_SHADOW_END, NUMA_NO_NODE, true);
- kasan_populate_early_shadow(kasan_mem_to_shadow((void *)VMALLOC_START),
- kasan_mem_to_shadow((void *)KFENCE_AREA_END));
-
- /* Enable KASAN here before kasan_mem_to_shadow(). */
- kasan_init_generic();
+ kasan_populate_early_shadow(mem_to_shadow((void *)VMALLOC_START),
+ mem_to_shadow((void *)KFENCE_AREA_END));
/* Populate the linear mapping */
for_each_mem_range(i, &pa_start, &pa_end) {
@@ -307,13 +308,13 @@ void __init kasan_init(void)
if (start >= end)
break;
- kasan_map_populate((unsigned long)kasan_mem_to_shadow(start),
- (unsigned long)kasan_mem_to_shadow(end), NUMA_NO_NODE);
+ kasan_map_populate((unsigned long)mem_to_shadow(start),
+ (unsigned long)mem_to_shadow(end), NUMA_NO_NODE);
}
/* Populate modules mapping */
- kasan_map_populate((unsigned long)kasan_mem_to_shadow((void *)MODULES_VADDR),
- (unsigned long)kasan_mem_to_shadow((void *)MODULES_END), NUMA_NO_NODE);
+ kasan_map_populate((unsigned long)mem_to_shadow((void *)MODULES_VADDR),
+ (unsigned long)mem_to_shadow((void *)MODULES_END), NUMA_NO_NODE);
/*
* KAsan may reuse the contents of kasan_early_shadow_pte directly, so we
* should make sure that it maps the zero page read-only.
@@ -328,4 +329,5 @@ void __init kasan_init(void)
/* At this point kasan is fully initialized. Enable error messages */
init_task.kasan_depth = 0;
+ kasan_init_generic();
}
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 04/18] fbdev: rivafb: fix divide error in nv3_arb()
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2026-02-17 20:31 ` [PATCH 6.19 03/18] LoongArch: Rework KASAN initialization for PTW-enabled systems Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 05/18] fbdev: smscufx: properly copy ioctl memory to kernelspace Greg Kroah-Hartman
` (24 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guangshuo Li, Helge Deller
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <lgs201920130244@gmail.com>
commit 0209e21e3c372fa2da04c39214bec0b64e4eb5f4 upstream.
A userspace program can trigger the RIVA NV3 arbitration code by calling
the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver
recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz
(derived from the PRAMDAC MCLK PLL) as a divisor without validating it
first.
In a normal setup, state->mclk_khz is provided by the real hardware and is
non-zero. However, an attacker can construct a malicious or misconfigured
device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL
configuration, causing state->mclk_khz to become zero. Once
nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns
calculation causes a divide error and crashes the kernel.
Fix this by checking whether state->mclk_khz is zero and bailing out before
doing the division.
The following log reveals it:
rivafb: setting virtual Y resolution to 2184
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline]
RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546
Call Trace:
nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603
nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline]
CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246
riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779
rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196
fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033
do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109
fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188
__x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/riva/riva_hw.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/video/fbdev/riva/riva_hw.c
+++ b/drivers/video/fbdev/riva/riva_hw.c
@@ -436,6 +436,9 @@ static char nv3_arb(nv3_fifo_info * res_
vmisses = 2;
eburst_size = state->memory_width * 1;
mburst_size = 32;
+ if (!state->mclk_khz)
+ return (0);
+
gns = 1000000 * (gmisses*state->mem_page_miss + state->mem_latency)/state->mclk_khz;
ainfo->by_gfacc = gns*ainfo->gdrain_rate/1000000;
ainfo->wcmocc = 0;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 05/18] fbdev: smscufx: properly copy ioctl memory to kernelspace
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 04/18] fbdev: rivafb: fix divide error in nv3_arb() Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 06/18] f2fs: fix to add gc count stat in f2fs_gc_range Greg Kroah-Hartman
` (23 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tianchu Chen, stable,
Steve Glendinning, Helge Deller
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 120adae7b42faa641179270c067864544a50ab69 upstream.
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from
userspace to kernelspace, and instead directly references the memory,
which can cause problems if invalid data is passed from userspace. Fix
this all up by correctly copying the memory before accessing it within
the kernel.
Reported-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Cc: Steve Glendinning <steve.glendinning@shawell.net>
Cc: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/smscufx.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/smscufx.c
+++ b/drivers/video/fbdev/smscufx.c
@@ -932,7 +932,6 @@ static int ufx_ops_ioctl(struct fb_info
unsigned long arg)
{
struct ufx_data *dev = info->par;
- struct dloarea *area = NULL;
if (!atomic_read(&dev->usb_active))
return 0;
@@ -947,6 +946,10 @@ static int ufx_ops_ioctl(struct fb_info
/* TODO: Help propose a standard fb.h ioctl to report mmap damage */
if (cmd == UFX_IOCTL_REPORT_DAMAGE) {
+ struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL);
+ if (!area)
+ return -ENOMEM;
+
/* If we have a damage-aware client, turn fb_defio "off"
* To avoid perf imact of unnecessary page fault handling.
* Done by resetting the delay for this fb_info to a very
@@ -956,7 +959,8 @@ static int ufx_ops_ioctl(struct fb_info
if (info->fbdefio)
info->fbdefio->delay = UFX_DEFIO_WRITE_DISABLE;
- area = (struct dloarea *)arg;
+ if (copy_from_user(area, (u8 __user *)arg, sizeof(*area)))
+ return -EFAULT;
if (area->x < 0)
area->x = 0;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 06/18] f2fs: fix to add gc count stat in f2fs_gc_range
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 05/18] fbdev: smscufx: properly copy ioctl memory to kernelspace Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 07/18] f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly Greg Kroah-Hartman
` (22 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Zhiguo Niu, Chao Yu,
Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <zhiguo.niu@unisoc.com>
commit 761dac9073cd67d4705a94cd1af674945a117f4c upstream.
It missed the stat count in f2fs_gc_range.
Cc: stable@kernel.org
Fixes: 9bf1dcbdfdc8 ("f2fs: fix to account gc stats correctly")
Signed-off-by: Zhiguo Niu <zhiguo.niu@unisoc.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/gc.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -2096,6 +2096,7 @@ int f2fs_gc_range(struct f2fs_sb_info *s
if (unlikely(f2fs_cp_error(sbi)))
return -EIO;
+ stat_inc_gc_call_count(sbi, FOREGROUND);
for (segno = start_seg; segno <= end_seg; segno += SEGS_PER_SEC(sbi)) {
struct gc_inode_list gc_list = {
.ilist = LIST_HEAD_INIT(gc_list.ilist),
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 07/18] f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 06/18] f2fs: fix to add gc count stat in f2fs_gc_range Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 08/18] f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes Greg Kroah-Hartman
` (21 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit 0eda086de85e140f53c6123a4c00662f4e614ee4 upstream.
Sysfs entry name is gc_pin_file_thresh instead of gc_pin_file_threshold,
fix it.
Cc: stable@kernel.org
Fixes: c521a6ab4ad7 ("f2fs: fix to limit gc_pin_file_threshold")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/sysfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -749,7 +749,7 @@ out:
return count;
}
- if (!strcmp(a->attr.name, "gc_pin_file_threshold")) {
+ if (!strcmp(a->attr.name, "gc_pin_file_thresh")) {
if (t > MAX_GC_FAILED_PINNED_FILES)
return -EINVAL;
sbi->gc_pin_file_threshold = t;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 08/18] f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 07/18] f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 09/18] f2fs: fix out-of-bounds access in sysfs attribute read/write Greg Kroah-Hartman
` (20 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sheng Yong, Jinbao Liu,
Yongpeng Yang, Chao Yu, Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
commit 7633a7387eb4d0259d6bea945e1d3469cd135bbc upstream.
During SPO tests, when mounting F2FS, an -EINVAL error was returned from
f2fs_recover_inode_page. The issue occurred under the following scenario
Thread A Thread B
f2fs_ioc_commit_atomic_write
- f2fs_do_sync_file // atomic = true
- f2fs_fsync_node_pages
: last_folio = inode folio
: schedule before folio_lock(last_folio) f2fs_write_checkpoint
- block_operations// writeback last_folio
- schedule before f2fs_flush_nat_entries
: set_fsync_mark(last_folio, 1)
: set_dentry_mark(last_folio, 1)
: folio_mark_dirty(last_folio)
- __write_node_folio(last_folio)
: f2fs_down_read(&sbi->node_write)//block
- f2fs_flush_nat_entries
: {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED)
- unblock_operations
: f2fs_up_write(&sbi->node_write)
f2fs_write_checkpoint//return
: f2fs_do_write_node_page()
f2fs_ioc_commit_atomic_write//return
SPO
Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has
already been written once. However, the {struct nat_entry}->flag did not
have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and
write last_folio again after Thread B finishes f2fs_write_checkpoint.
After SPO and reboot, it was detected that {struct node_info}->blk_addr
was not NULL_ADDR because Thread B successfully write the checkpoint.
This issue only occurs in atomic write scenarios. For regular file
fsync operations, the folio must be dirty. If
block_operations->f2fs_sync_node_pages successfully submit the folio
write, this path will not be executed. Otherwise, the
f2fs_write_checkpoint will need to wait for the folio write submission
to complete, as sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Therefore, the
situation where f2fs_need_dentry_mark checks that the {struct
nat_entry}->flag /wo the IS_CHECKPOINTED flag, but the folio write has
already been submitted, will not occur.
Therefore, for atomic file fsync, sbi->node_write should be acquired
through __write_node_folio to ensure that the IS_CHECKPOINTED flag
correctly indicates that the checkpoint write has been completed.
Fixes: 608514deba38 ("f2fs: set fsync mark only for the last dnode")
Cc: stable@kernel.org
Signed-off-by: Sheng Yong <shengyong1@xiaomi.com>
Signed-off-by: Jinbao Liu <liujinbao1@xiaomi.com>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/node.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1774,8 +1774,13 @@ static bool __write_node_folio(struct fo
goto redirty_out;
}
- if (atomic && !test_opt(sbi, NOBARRIER))
- fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+ if (atomic) {
+ if (!test_opt(sbi, NOBARRIER))
+ fio.op_flags |= REQ_PREFLUSH | REQ_FUA;
+ if (IS_INODE(folio))
+ set_dentry_mark(folio,
+ f2fs_need_dentry_mark(sbi, ino_of_node(folio)));
+ }
/* should add to global list before clearing PAGECACHE status */
if (f2fs_in_warm_node_list(sbi, folio)) {
@@ -1916,8 +1921,9 @@ continue_unlock:
if (is_inode_flag_set(inode,
FI_DIRTY_INODE))
f2fs_update_inode(inode, folio);
- set_dentry_mark(folio,
- f2fs_need_dentry_mark(sbi, ino));
+ if (!atomic)
+ set_dentry_mark(folio,
+ f2fs_need_dentry_mark(sbi, ino));
}
/* may be written by other thread */
if (!folio_test_dirty(folio))
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 09/18] f2fs: fix out-of-bounds access in sysfs attribute read/write
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 08/18] f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 10/18] f2fs: fix to avoid UAF in f2fs_write_end_io() Greg Kroah-Hartman
` (19 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jinbao Liu, Yongpeng Yang,
Chao Yu, Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
commit 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 upstream.
Some f2fs sysfs attributes suffer from out-of-bounds memory access and
incorrect handling of integer values whose size is not 4 bytes.
For example:
vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out
vm:~# cat /sys/fs/f2fs/vde/carve_out
65537
vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold
vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold
1
carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit
integer. However, the sysfs interface allows setting it to a value
larger than 255, resulting in an out-of-range update.
atgc_age_threshold maps to {struct atgc_management}->age_threshold,
which is a 64-bit integer, but its sysfs interface cannot correctly set
values larger than UINT_MAX.
The root causes are:
1. __sbi_store() treats all default values as unsigned int, which
prevents updating integers larger than 4 bytes and causes out-of-bounds
writes for integers smaller than 4 bytes.
2. f2fs_sbi_show() also assumes all default values are unsigned int,
leading to out-of-bounds reads and incorrect access to integers larger
than 4 bytes.
This patch introduces {struct f2fs_attr}->size to record the actual size
of the integer associated with each sysfs attribute. With this
information, sysfs read and write operations can correctly access and
update values according to their real data size, avoiding memory
corruption and truncation.
Fixes: b59d0bae6ca3 ("f2fs: add sysfs support for controlling the gc_thread")
Cc: stable@kernel.org
Signed-off-by: Jinbao Liu <liujinbao1@xiaomi.com>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/sysfs.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++--------
1 file changed, 52 insertions(+), 8 deletions(-)
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -58,6 +58,7 @@ struct f2fs_attr {
const char *buf, size_t len);
int struct_type;
int offset;
+ int size;
int id;
};
@@ -344,11 +345,30 @@ static ssize_t main_blkaddr_show(struct
(unsigned long long)MAIN_BLKADDR(sbi));
}
+static ssize_t __sbi_show_value(struct f2fs_attr *a,
+ struct f2fs_sb_info *sbi, char *buf,
+ unsigned char *value)
+{
+ switch (a->size) {
+ case 1:
+ return sysfs_emit(buf, "%u\n", *(u8 *)value);
+ case 2:
+ return sysfs_emit(buf, "%u\n", *(u16 *)value);
+ case 4:
+ return sysfs_emit(buf, "%u\n", *(u32 *)value);
+ case 8:
+ return sysfs_emit(buf, "%llu\n", *(u64 *)value);
+ default:
+ f2fs_bug_on(sbi, 1);
+ return sysfs_emit(buf,
+ "show sysfs node value with wrong type\n");
+ }
+}
+
static ssize_t f2fs_sbi_show(struct f2fs_attr *a,
struct f2fs_sb_info *sbi, char *buf)
{
unsigned char *ptr = NULL;
- unsigned int *ui;
ptr = __struct_ptr(sbi, a->struct_type);
if (!ptr)
@@ -428,9 +448,30 @@ static ssize_t f2fs_sbi_show(struct f2fs
atomic_read(&sbi->cp_call_count[BACKGROUND]));
#endif
- ui = (unsigned int *)(ptr + a->offset);
+ return __sbi_show_value(a, sbi, buf, ptr + a->offset);
+}
- return sysfs_emit(buf, "%u\n", *ui);
+static void __sbi_store_value(struct f2fs_attr *a,
+ struct f2fs_sb_info *sbi,
+ unsigned char *ui, unsigned long value)
+{
+ switch (a->size) {
+ case 1:
+ *(u8 *)ui = value;
+ break;
+ case 2:
+ *(u16 *)ui = value;
+ break;
+ case 4:
+ *(u32 *)ui = value;
+ break;
+ case 8:
+ *(u64 *)ui = value;
+ break;
+ default:
+ f2fs_bug_on(sbi, 1);
+ f2fs_err(sbi, "store sysfs node value with wrong type");
+ }
}
static ssize_t __sbi_store(struct f2fs_attr *a,
@@ -906,7 +947,7 @@ out:
return count;
}
- *ui = (unsigned int)t;
+ __sbi_store_value(a, sbi, ptr + a->offset, t);
return count;
}
@@ -1053,24 +1094,27 @@ static struct f2fs_attr f2fs_attr_sb_##_
.id = F2FS_FEATURE_##_feat, \
}
-#define F2FS_ATTR_OFFSET(_struct_type, _name, _mode, _show, _store, _offset) \
+#define F2FS_ATTR_OFFSET(_struct_type, _name, _mode, _show, _store, _offset, _size) \
static struct f2fs_attr f2fs_attr_##_name = { \
.attr = {.name = __stringify(_name), .mode = _mode }, \
.show = _show, \
.store = _store, \
.struct_type = _struct_type, \
- .offset = _offset \
+ .offset = _offset, \
+ .size = _size \
}
#define F2FS_RO_ATTR(struct_type, struct_name, name, elname) \
F2FS_ATTR_OFFSET(struct_type, name, 0444, \
f2fs_sbi_show, NULL, \
- offsetof(struct struct_name, elname))
+ offsetof(struct struct_name, elname), \
+ sizeof_field(struct struct_name, elname))
#define F2FS_RW_ATTR(struct_type, struct_name, name, elname) \
F2FS_ATTR_OFFSET(struct_type, name, 0644, \
f2fs_sbi_show, f2fs_sbi_store, \
- offsetof(struct struct_name, elname))
+ offsetof(struct struct_name, elname), \
+ sizeof_field(struct struct_name, elname))
#define F2FS_GENERAL_RO_ATTR(name) \
static struct f2fs_attr f2fs_attr_##name = __ATTR(name, 0444, name##_show, NULL)
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 10/18] f2fs: fix to avoid UAF in f2fs_write_end_io()
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 09/18] f2fs: fix out-of-bounds access in sysfs attribute read/write Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature Greg Kroah-Hartman
` (18 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+b4444e3c972a7a124187,
Chao Yu, Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit ce2739e482bce8d2c014d76c4531c877f382aa54 upstream.
As syzbot reported an use-after-free issue in f2fs_write_end_io().
It is caused by below race condition:
loop device umount
- worker_thread
- loop_process_work
- do_req_filebacked
- lo_rw_aio
- lo_rw_aio_complete
- blk_mq_end_request
- blk_update_request
- f2fs_write_end_io
- dec_page_count
- folio_end_writeback
- kill_f2fs_super
- kill_block_super
- f2fs_put_super
: free(sbi)
: get_pages(, F2FS_WB_CP_DATA)
accessed sbi which is freed
In kill_f2fs_super(), we will drop all page caches of f2fs inodes before
call free(sbi), it guarantee that all folios should end its writeback, so
it should be safe to access sbi before last folio_end_writeback().
Let's relocate ckpt thread wakeup flow before folio_end_writeback() to
resolve this issue.
Cc: stable@kernel.org
Fixes: e234088758fc ("f2fs: avoid wait if IO end up when do_checkpoint for better performance")
Reported-by: syzbot+b4444e3c972a7a124187@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b4444e3c972a7a124187
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -356,14 +356,20 @@ static void f2fs_write_end_io(struct bio
folio->index != nid_of_node(folio));
dec_page_count(sbi, type);
+
+ /*
+ * we should access sbi before folio_end_writeback() to
+ * avoid racing w/ kill_f2fs_super()
+ */
+ if (type == F2FS_WB_CP_DATA && !get_pages(sbi, type) &&
+ wq_has_sleeper(&sbi->cp_wait))
+ wake_up(&sbi->cp_wait);
+
if (f2fs_in_warm_node_list(sbi, folio))
f2fs_del_fsync_node_entry(sbi, folio);
folio_clear_f2fs_gcing(folio);
folio_end_writeback(folio);
}
- if (!get_pages(sbi, F2FS_WB_CP_DATA) &&
- wq_has_sleeper(&sbi->cp_wait))
- wake_up(&sbi->cp_wait);
bio_put(bio);
}
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 10/18] f2fs: fix to avoid UAF in f2fs_write_end_io() Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-19 7:33 ` Jiri Slaby
2026-02-17 20:32 ` [PATCH 6.19 12/18] f2fs: fix to avoid mapping wrong physical block for swapfile Greg Kroah-Hartman
` (17 subsequent siblings)
28 siblings, 1 reply; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <daehojeong@google.com>
commit e48e16f3e37fac76e2f0c14c58df2b0398a323b0 upstream.
Currently, F2FS requires the packed_ssa feature to be enabled when
utilizing non-4KB block sizes (e.g., 16KB). This restriction limits
the flexibility of filesystem formatting options.
This patch allows F2FS to support non-4KB block sizes even when the
packed_ssa feature is disabled. It adjusts the SSA calculation logic to
correctly handle summary entries in larger blocks without the packed
layout.
Cc: stable@kernel.org
Fixes: 7ee8bc3942f2 ("f2fs: revert summary entry count from 2048 to 512 in 16kb block support")
Signed-off-by: Daeho Jeong <daehojeong@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/f2fs.h | 52 ++++++++++++++++++++---------
fs/f2fs/gc.c | 23 ++++++------
fs/f2fs/node.c | 12 +++---
fs/f2fs/recovery.c | 6 +--
fs/f2fs/segment.c | 86 +++++++++++++++++++++++++-----------------------
fs/f2fs/segment.h | 9 ++---
fs/f2fs/super.c | 26 ++++++--------
include/linux/f2fs_fs.h | 73 +++++++++++++++++++++++++---------------
8 files changed, 165 insertions(+), 122 deletions(-)
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -521,13 +521,25 @@ struct fsync_inode_entry {
#define nats_in_cursum(jnl) (le16_to_cpu((jnl)->n_nats))
#define sits_in_cursum(jnl) (le16_to_cpu((jnl)->n_sits))
-#define nat_in_journal(jnl, i) ((jnl)->nat_j.entries[i].ne)
-#define nid_in_journal(jnl, i) ((jnl)->nat_j.entries[i].nid)
-#define sit_in_journal(jnl, i) ((jnl)->sit_j.entries[i].se)
-#define segno_in_journal(jnl, i) ((jnl)->sit_j.entries[i].segno)
+#define nat_in_journal(jnl, i) \
+ (((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].ne)
+#define nid_in_journal(jnl, i) \
+ (((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].nid)
+#define sit_in_journal(jnl, i) \
+ (((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].se)
+#define segno_in_journal(jnl, i) \
+ (((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].segno)
+
+#define sum_entries(sum) ((struct f2fs_summary *)(sum))
+#define sum_journal(sbi, sum) \
+ ((struct f2fs_journal *)((char *)(sum) + \
+ ((sbi)->entries_in_sum * sizeof(struct f2fs_summary))))
+#define sum_footer(sbi, sum) \
+ ((struct summary_footer *)((char *)(sum) + (sbi)->sum_blocksize - \
+ sizeof(struct summary_footer)))
-#define MAX_NAT_JENTRIES(jnl) (NAT_JOURNAL_ENTRIES - nats_in_cursum(jnl))
-#define MAX_SIT_JENTRIES(jnl) (SIT_JOURNAL_ENTRIES - sits_in_cursum(jnl))
+#define MAX_NAT_JENTRIES(sbi, jnl) ((sbi)->nat_journal_entries - nats_in_cursum(jnl))
+#define MAX_SIT_JENTRIES(sbi, jnl) ((sbi)->sit_journal_entries - sits_in_cursum(jnl))
static inline int update_nats_in_cursum(struct f2fs_journal *journal, int i)
{
@@ -545,14 +557,6 @@ static inline int update_sits_in_cursum(
return before;
}
-static inline bool __has_cursum_space(struct f2fs_journal *journal,
- int size, int type)
-{
- if (type == NAT_JOURNAL)
- return size <= MAX_NAT_JENTRIES(journal);
- return size <= MAX_SIT_JENTRIES(journal);
-}
-
/* for inline stuff */
#define DEF_INLINE_RESERVED_SIZE 1
static inline int get_extra_isize(struct inode *inode);
@@ -1764,6 +1768,15 @@ struct f2fs_sb_info {
bool readdir_ra; /* readahead inode in readdir */
u64 max_io_bytes; /* max io bytes to merge IOs */
+ /* variable summary block units */
+ unsigned int sum_blocksize; /* sum block size */
+ unsigned int sums_per_block; /* sum block count per block */
+ unsigned int entries_in_sum; /* entry count in sum block */
+ unsigned int sum_entry_size; /* total entry size in sum block */
+ unsigned int sum_journal_size; /* journal size in sum block */
+ unsigned int nat_journal_entries; /* nat journal entry count in the journal */
+ unsigned int sit_journal_entries; /* sit journal entry count in the journal */
+
block_t user_block_count; /* # of user blocks */
block_t total_valid_block_count; /* # of valid blocks */
block_t discard_blks; /* discard command candidats */
@@ -2813,6 +2826,14 @@ static inline block_t __start_sum_addr(s
return le32_to_cpu(F2FS_CKPT(sbi)->cp_pack_start_sum);
}
+static inline bool __has_cursum_space(struct f2fs_sb_info *sbi,
+ struct f2fs_journal *journal, int size, int type)
+{
+ if (type == NAT_JOURNAL)
+ return size <= MAX_NAT_JENTRIES(sbi, journal);
+ return size <= MAX_SIT_JENTRIES(sbi, journal);
+}
+
extern void f2fs_mark_inode_dirty_sync(struct inode *inode, bool sync);
static inline int inc_valid_node_count(struct f2fs_sb_info *sbi,
struct inode *inode, bool is_inode)
@@ -3956,7 +3977,8 @@ void f2fs_wait_on_block_writeback_range(
block_t len);
void f2fs_write_data_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
void f2fs_write_node_summaries(struct f2fs_sb_info *sbi, block_t start_blk);
-int f2fs_lookup_journal_in_cursum(struct f2fs_journal *journal, int type,
+int f2fs_lookup_journal_in_cursum(struct f2fs_sb_info *sbi,
+ struct f2fs_journal *journal, int type,
unsigned int val, int alloc);
void f2fs_flush_sit_entries(struct f2fs_sb_info *sbi, struct cp_control *cpc);
int f2fs_check_and_fix_write_pointer(struct f2fs_sb_info *sbi);
--- a/fs/f2fs/gc.c
+++ b/fs/f2fs/gc.c
@@ -1769,8 +1769,8 @@ static int do_garbage_collect(struct f2f
sanity_check_seg_type(sbi, get_seg_entry(sbi, segno)->type);
- segno = rounddown(segno, SUMS_PER_BLOCK);
- sum_blk_cnt = DIV_ROUND_UP(end_segno - segno, SUMS_PER_BLOCK);
+ segno = rounddown(segno, sbi->sums_per_block);
+ sum_blk_cnt = DIV_ROUND_UP(end_segno - segno, sbi->sums_per_block);
/* readahead multi ssa blocks those have contiguous address */
if (__is_large_section(sbi))
f2fs_ra_meta_pages(sbi, GET_SUM_BLOCK(sbi, segno),
@@ -1780,17 +1780,17 @@ static int do_garbage_collect(struct f2f
while (segno < end_segno) {
struct folio *sum_folio = f2fs_get_sum_folio(sbi, segno);
- segno += SUMS_PER_BLOCK;
+ segno += sbi->sums_per_block;
if (IS_ERR(sum_folio)) {
int err = PTR_ERR(sum_folio);
- end_segno = segno - SUMS_PER_BLOCK;
- segno = rounddown(start_segno, SUMS_PER_BLOCK);
+ end_segno = segno - sbi->sums_per_block;
+ segno = rounddown(start_segno, sbi->sums_per_block);
while (segno < end_segno) {
sum_folio = filemap_get_folio(META_MAPPING(sbi),
GET_SUM_BLOCK(sbi, segno));
folio_put_refs(sum_folio, 2);
- segno += SUMS_PER_BLOCK;
+ segno += sbi->sums_per_block;
}
return err;
}
@@ -1806,8 +1806,8 @@ static int do_garbage_collect(struct f2f
/* find segment summary of victim */
struct folio *sum_folio = filemap_get_folio(META_MAPPING(sbi),
GET_SUM_BLOCK(sbi, segno));
- unsigned int block_end_segno = rounddown(segno, SUMS_PER_BLOCK)
- + SUMS_PER_BLOCK;
+ unsigned int block_end_segno = rounddown(segno, sbi->sums_per_block)
+ + sbi->sums_per_block;
if (block_end_segno > end_segno)
block_end_segno = end_segno;
@@ -1833,12 +1833,13 @@ static int do_garbage_collect(struct f2f
migrated >= sbi->migration_granularity)
continue;
- sum = SUM_BLK_PAGE_ADDR(sum_folio, cur_segno);
- if (type != GET_SUM_TYPE((&sum->footer))) {
+ sum = SUM_BLK_PAGE_ADDR(sbi, sum_folio, cur_segno);
+ if (type != GET_SUM_TYPE(sum_footer(sbi, sum))) {
f2fs_err(sbi, "Inconsistent segment (%u) type "
"[%d, %d] in SSA and SIT",
cur_segno, type,
- GET_SUM_TYPE((&sum->footer)));
+ GET_SUM_TYPE(
+ sum_footer(sbi, sum)));
f2fs_stop_checkpoint(sbi, false,
STOP_CP_REASON_CORRUPTED_SUMMARY);
continue;
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -606,7 +606,7 @@ retry:
goto retry;
}
- i = f2fs_lookup_journal_in_cursum(journal, NAT_JOURNAL, nid, 0);
+ i = f2fs_lookup_journal_in_cursum(sbi, journal, NAT_JOURNAL, nid, 0);
if (i >= 0) {
ne = nat_in_journal(journal, i);
node_info_from_raw_nat(ni, &ne);
@@ -2943,7 +2943,7 @@ int f2fs_restore_node_summary(struct f2f
/* scan the node segment */
last_offset = BLKS_PER_SEG(sbi);
addr = START_BLOCK(sbi, segno);
- sum_entry = &sum->entries[0];
+ sum_entry = sum_entries(sum);
for (i = 0; i < last_offset; i += nrpages, addr += nrpages) {
nrpages = bio_max_segs(last_offset - i);
@@ -3084,7 +3084,7 @@ static int __flush_nat_entry_set(struct
* #2, flush nat entries to nat page.
*/
if (enabled_nat_bits(sbi, cpc) ||
- !__has_cursum_space(journal, set->entry_cnt, NAT_JOURNAL))
+ !__has_cursum_space(sbi, journal, set->entry_cnt, NAT_JOURNAL))
to_journal = false;
if (to_journal) {
@@ -3107,7 +3107,7 @@ static int __flush_nat_entry_set(struct
f2fs_bug_on(sbi, nat_get_blkaddr(ne) == NEW_ADDR);
if (to_journal) {
- offset = f2fs_lookup_journal_in_cursum(journal,
+ offset = f2fs_lookup_journal_in_cursum(sbi, journal,
NAT_JOURNAL, nid, 1);
f2fs_bug_on(sbi, offset < 0);
raw_ne = &nat_in_journal(journal, offset);
@@ -3178,7 +3178,7 @@ int f2fs_flush_nat_entries(struct f2fs_s
* into nat entry set.
*/
if (enabled_nat_bits(sbi, cpc) ||
- !__has_cursum_space(journal,
+ !__has_cursum_space(sbi, journal,
nm_i->nat_cnt[DIRTY_NAT], NAT_JOURNAL))
remove_nats_in_journal(sbi);
@@ -3189,7 +3189,7 @@ int f2fs_flush_nat_entries(struct f2fs_s
set_idx = setvec[found - 1]->set + 1;
for (idx = 0; idx < found; idx++)
__adjust_nat_entry_set(setvec[idx], &sets,
- MAX_NAT_JENTRIES(journal));
+ MAX_NAT_JENTRIES(sbi, journal));
}
/* flush dirty nats in nat entry set */
--- a/fs/f2fs/recovery.c
+++ b/fs/f2fs/recovery.c
@@ -514,7 +514,7 @@ static int check_index_in_prev_nodes(str
struct curseg_info *curseg = CURSEG_I(sbi, i);
if (curseg->segno == segno) {
- sum = curseg->sum_blk->entries[blkoff];
+ sum = sum_entries(curseg->sum_blk)[blkoff];
goto got_it;
}
}
@@ -522,8 +522,8 @@ static int check_index_in_prev_nodes(str
sum_folio = f2fs_get_sum_folio(sbi, segno);
if (IS_ERR(sum_folio))
return PTR_ERR(sum_folio);
- sum_node = SUM_BLK_PAGE_ADDR(sum_folio, segno);
- sum = sum_node->entries[blkoff];
+ sum_node = SUM_BLK_PAGE_ADDR(sbi, sum_folio, segno);
+ sum = sum_entries(sum_node)[blkoff];
f2fs_folio_put(sum_folio, true);
got_it:
/* Use the locked dnode page and inode */
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -2685,12 +2685,12 @@ int f2fs_npages_for_summary_flush(struct
valid_sum_count += f2fs_curseg_valid_blocks(sbi, i);
}
- sum_in_page = (PAGE_SIZE - 2 * SUM_JOURNAL_SIZE -
+ sum_in_page = (sbi->sum_blocksize - 2 * sbi->sum_journal_size -
SUM_FOOTER_SIZE) / SUMMARY_SIZE;
if (valid_sum_count <= sum_in_page)
return 1;
else if ((valid_sum_count - sum_in_page) <=
- (PAGE_SIZE - SUM_FOOTER_SIZE) / SUMMARY_SIZE)
+ (sbi->sum_blocksize - SUM_FOOTER_SIZE) / SUMMARY_SIZE)
return 2;
return 3;
}
@@ -2710,7 +2710,7 @@ void f2fs_update_meta_page(struct f2fs_s
{
struct folio *folio;
- if (SUMS_PER_BLOCK == 1)
+ if (!f2fs_sb_has_packed_ssa(sbi))
folio = f2fs_grab_meta_folio(sbi, blk_addr);
else
folio = f2fs_get_meta_folio_retry(sbi, blk_addr);
@@ -2728,7 +2728,7 @@ static void write_sum_page(struct f2fs_s
{
struct folio *folio;
- if (SUMS_PER_BLOCK == 1)
+ if (!f2fs_sb_has_packed_ssa(sbi))
return f2fs_update_meta_page(sbi, (void *)sum_blk,
GET_SUM_BLOCK(sbi, segno));
@@ -2736,7 +2736,8 @@ static void write_sum_page(struct f2fs_s
if (IS_ERR(folio))
return;
- memcpy(SUM_BLK_PAGE_ADDR(folio, segno), sum_blk, sizeof(*sum_blk));
+ memcpy(SUM_BLK_PAGE_ADDR(sbi, folio, segno), sum_blk,
+ sbi->sum_blocksize);
folio_mark_dirty(folio);
f2fs_folio_put(folio, true);
}
@@ -2755,11 +2756,11 @@ static void write_current_sum_page(struc
mutex_lock(&curseg->curseg_mutex);
down_read(&curseg->journal_rwsem);
- memcpy(&dst->journal, curseg->journal, SUM_JOURNAL_SIZE);
+ memcpy(sum_journal(sbi, dst), curseg->journal, sbi->sum_journal_size);
up_read(&curseg->journal_rwsem);
- memcpy(dst->entries, src->entries, SUM_ENTRY_SIZE);
- memcpy(&dst->footer, &src->footer, SUM_FOOTER_SIZE);
+ memcpy(sum_entries(dst), sum_entries(src), sbi->sum_entry_size);
+ memcpy(sum_footer(sbi, dst), sum_footer(sbi, src), SUM_FOOTER_SIZE);
mutex_unlock(&curseg->curseg_mutex);
@@ -2932,7 +2933,7 @@ static void reset_curseg(struct f2fs_sb_
curseg->next_blkoff = 0;
curseg->next_segno = NULL_SEGNO;
- sum_footer = &(curseg->sum_blk->footer);
+ sum_footer = sum_footer(sbi, curseg->sum_blk);
memset(sum_footer, 0, sizeof(struct summary_footer));
sanity_check_seg_type(sbi, seg_type);
@@ -3078,11 +3079,11 @@ static int change_curseg(struct f2fs_sb_
sum_folio = f2fs_get_sum_folio(sbi, new_segno);
if (IS_ERR(sum_folio)) {
/* GC won't be able to use stale summary pages by cp_error */
- memset(curseg->sum_blk, 0, SUM_ENTRY_SIZE);
+ memset(curseg->sum_blk, 0, sbi->sum_entry_size);
return PTR_ERR(sum_folio);
}
- sum_node = SUM_BLK_PAGE_ADDR(sum_folio, new_segno);
- memcpy(curseg->sum_blk, sum_node, SUM_ENTRY_SIZE);
+ sum_node = SUM_BLK_PAGE_ADDR(sbi, sum_folio, new_segno);
+ memcpy(curseg->sum_blk, sum_node, sbi->sum_entry_size);
f2fs_folio_put(sum_folio, true);
return 0;
}
@@ -3814,7 +3815,7 @@ int f2fs_allocate_data_block(struct f2fs
f2fs_wait_discard_bio(sbi, *new_blkaddr);
- curseg->sum_blk->entries[curseg->next_blkoff] = *sum;
+ sum_entries(curseg->sum_blk)[curseg->next_blkoff] = *sum;
if (curseg->alloc_type == SSR) {
curseg->next_blkoff = f2fs_find_next_ssr_block(sbi, curseg);
} else {
@@ -4183,7 +4184,7 @@ void f2fs_do_replace_block(struct f2fs_s
}
curseg->next_blkoff = GET_BLKOFF_FROM_SEG0(sbi, new_blkaddr);
- curseg->sum_blk->entries[curseg->next_blkoff] = *sum;
+ sum_entries(curseg->sum_blk)[curseg->next_blkoff] = *sum;
if (!recover_curseg || recover_newaddr) {
if (!from_gc)
@@ -4303,12 +4304,12 @@ static int read_compacted_summaries(stru
/* Step 1: restore nat cache */
seg_i = CURSEG_I(sbi, CURSEG_HOT_DATA);
- memcpy(seg_i->journal, kaddr, SUM_JOURNAL_SIZE);
+ memcpy(seg_i->journal, kaddr, sbi->sum_journal_size);
/* Step 2: restore sit cache */
seg_i = CURSEG_I(sbi, CURSEG_COLD_DATA);
- memcpy(seg_i->journal, kaddr + SUM_JOURNAL_SIZE, SUM_JOURNAL_SIZE);
- offset = 2 * SUM_JOURNAL_SIZE;
+ memcpy(seg_i->journal, kaddr + sbi->sum_journal_size, sbi->sum_journal_size);
+ offset = 2 * sbi->sum_journal_size;
/* Step 3: restore summary entries */
for (i = CURSEG_HOT_DATA; i <= CURSEG_COLD_DATA; i++) {
@@ -4330,9 +4331,9 @@ static int read_compacted_summaries(stru
struct f2fs_summary *s;
s = (struct f2fs_summary *)(kaddr + offset);
- seg_i->sum_blk->entries[j] = *s;
+ sum_entries(seg_i->sum_blk)[j] = *s;
offset += SUMMARY_SIZE;
- if (offset + SUMMARY_SIZE <= PAGE_SIZE -
+ if (offset + SUMMARY_SIZE <= sbi->sum_blocksize -
SUM_FOOTER_SIZE)
continue;
@@ -4388,7 +4389,7 @@ static int read_normal_summaries(struct
if (IS_NODESEG(type)) {
if (__exist_node_summaries(sbi)) {
- struct f2fs_summary *ns = &sum->entries[0];
+ struct f2fs_summary *ns = sum_entries(sum);
int i;
for (i = 0; i < BLKS_PER_SEG(sbi); i++, ns++) {
@@ -4408,11 +4409,13 @@ static int read_normal_summaries(struct
/* update journal info */
down_write(&curseg->journal_rwsem);
- memcpy(curseg->journal, &sum->journal, SUM_JOURNAL_SIZE);
+ memcpy(curseg->journal, sum_journal(sbi, sum), sbi->sum_journal_size);
up_write(&curseg->journal_rwsem);
- memcpy(curseg->sum_blk->entries, sum->entries, SUM_ENTRY_SIZE);
- memcpy(&curseg->sum_blk->footer, &sum->footer, SUM_FOOTER_SIZE);
+ memcpy(sum_entries(curseg->sum_blk), sum_entries(sum),
+ sbi->sum_entry_size);
+ memcpy(sum_footer(sbi, curseg->sum_blk), sum_footer(sbi, sum),
+ SUM_FOOTER_SIZE);
curseg->next_segno = segno;
reset_curseg(sbi, type, 0);
curseg->alloc_type = ckpt->alloc_type[type];
@@ -4456,8 +4459,8 @@ static int restore_curseg_summaries(stru
}
/* sanity check for summary blocks */
- if (nats_in_cursum(nat_j) > NAT_JOURNAL_ENTRIES ||
- sits_in_cursum(sit_j) > SIT_JOURNAL_ENTRIES) {
+ if (nats_in_cursum(nat_j) > sbi->nat_journal_entries ||
+ sits_in_cursum(sit_j) > sbi->sit_journal_entries) {
f2fs_err(sbi, "invalid journal entries nats %u sits %u",
nats_in_cursum(nat_j), sits_in_cursum(sit_j));
return -EINVAL;
@@ -4481,13 +4484,13 @@ static void write_compacted_summaries(st
/* Step 1: write nat cache */
seg_i = CURSEG_I(sbi, CURSEG_HOT_DATA);
- memcpy(kaddr, seg_i->journal, SUM_JOURNAL_SIZE);
- written_size += SUM_JOURNAL_SIZE;
+ memcpy(kaddr, seg_i->journal, sbi->sum_journal_size);
+ written_size += sbi->sum_journal_size;
/* Step 2: write sit cache */
seg_i = CURSEG_I(sbi, CURSEG_COLD_DATA);
- memcpy(kaddr + written_size, seg_i->journal, SUM_JOURNAL_SIZE);
- written_size += SUM_JOURNAL_SIZE;
+ memcpy(kaddr + written_size, seg_i->journal, sbi->sum_journal_size);
+ written_size += sbi->sum_journal_size;
/* Step 3: write summary entries */
for (i = CURSEG_HOT_DATA; i <= CURSEG_COLD_DATA; i++) {
@@ -4500,7 +4503,7 @@ static void write_compacted_summaries(st
written_size = 0;
}
summary = (struct f2fs_summary *)(kaddr + written_size);
- *summary = seg_i->sum_blk->entries[j];
+ *summary = sum_entries(seg_i->sum_blk)[j];
written_size += SUMMARY_SIZE;
if (written_size + SUMMARY_SIZE <= PAGE_SIZE -
@@ -4545,8 +4548,9 @@ void f2fs_write_node_summaries(struct f2
write_normal_summaries(sbi, start_blk, CURSEG_HOT_NODE);
}
-int f2fs_lookup_journal_in_cursum(struct f2fs_journal *journal, int type,
- unsigned int val, int alloc)
+int f2fs_lookup_journal_in_cursum(struct f2fs_sb_info *sbi,
+ struct f2fs_journal *journal, int type,
+ unsigned int val, int alloc)
{
int i;
@@ -4555,13 +4559,13 @@ int f2fs_lookup_journal_in_cursum(struct
if (le32_to_cpu(nid_in_journal(journal, i)) == val)
return i;
}
- if (alloc && __has_cursum_space(journal, 1, NAT_JOURNAL))
+ if (alloc && __has_cursum_space(sbi, journal, 1, NAT_JOURNAL))
return update_nats_in_cursum(journal, 1);
} else if (type == SIT_JOURNAL) {
for (i = 0; i < sits_in_cursum(journal); i++)
if (le32_to_cpu(segno_in_journal(journal, i)) == val)
return i;
- if (alloc && __has_cursum_space(journal, 1, SIT_JOURNAL))
+ if (alloc && __has_cursum_space(sbi, journal, 1, SIT_JOURNAL))
return update_sits_in_cursum(journal, 1);
}
return -1;
@@ -4709,8 +4713,8 @@ void f2fs_flush_sit_entries(struct f2fs_
* entries, remove all entries from journal and add and account
* them in sit entry set.
*/
- if (!__has_cursum_space(journal, sit_i->dirty_sentries, SIT_JOURNAL) ||
- !to_journal)
+ if (!__has_cursum_space(sbi, journal,
+ sit_i->dirty_sentries, SIT_JOURNAL) || !to_journal)
remove_sits_in_journal(sbi);
/*
@@ -4727,7 +4731,8 @@ void f2fs_flush_sit_entries(struct f2fs_
unsigned int segno = start_segno;
if (to_journal &&
- !__has_cursum_space(journal, ses->entry_cnt, SIT_JOURNAL))
+ !__has_cursum_space(sbi, journal, ses->entry_cnt,
+ SIT_JOURNAL))
to_journal = false;
if (to_journal) {
@@ -4755,7 +4760,7 @@ void f2fs_flush_sit_entries(struct f2fs_
}
if (to_journal) {
- offset = f2fs_lookup_journal_in_cursum(journal,
+ offset = f2fs_lookup_journal_in_cursum(sbi, journal,
SIT_JOURNAL, segno, 1);
f2fs_bug_on(sbi, offset < 0);
segno_in_journal(journal, offset) =
@@ -4962,12 +4967,13 @@ static int build_curseg(struct f2fs_sb_i
for (i = 0; i < NO_CHECK_TYPE; i++) {
mutex_init(&array[i].curseg_mutex);
- array[i].sum_blk = f2fs_kzalloc(sbi, PAGE_SIZE, GFP_KERNEL);
+ array[i].sum_blk = f2fs_kzalloc(sbi, sbi->sum_blocksize,
+ GFP_KERNEL);
if (!array[i].sum_blk)
return -ENOMEM;
init_rwsem(&array[i].journal_rwsem);
array[i].journal = f2fs_kzalloc(sbi,
- sizeof(struct f2fs_journal), GFP_KERNEL);
+ sbi->sum_journal_size, GFP_KERNEL);
if (!array[i].journal)
return -ENOMEM;
array[i].seg_type = log_type_to_seg_type(i);
--- a/fs/f2fs/segment.h
+++ b/fs/f2fs/segment.h
@@ -90,12 +90,11 @@ static inline void sanity_check_seg_type
#define GET_ZONE_FROM_SEG(sbi, segno) \
GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno))
-#define SUMS_PER_BLOCK (F2FS_BLKSIZE / F2FS_SUM_BLKSIZE)
#define GET_SUM_BLOCK(sbi, segno) \
- (SM_I(sbi)->ssa_blkaddr + (segno / SUMS_PER_BLOCK))
-#define GET_SUM_BLKOFF(segno) (segno % SUMS_PER_BLOCK)
-#define SUM_BLK_PAGE_ADDR(folio, segno) \
- (folio_address(folio) + GET_SUM_BLKOFF(segno) * F2FS_SUM_BLKSIZE)
+ (SM_I(sbi)->ssa_blkaddr + (segno / (sbi)->sums_per_block))
+#define GET_SUM_BLKOFF(sbi, segno) (segno % (sbi)->sums_per_block)
+#define SUM_BLK_PAGE_ADDR(sbi, folio, segno) \
+ (folio_address(folio) + GET_SUM_BLKOFF(sbi, segno) * (sbi)->sum_blocksize)
#define GET_SUM_TYPE(footer) ((footer)->entry_type)
#define SET_SUM_TYPE(footer, type) ((footer)->entry_type = (type))
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -4080,20 +4080,6 @@ static int sanity_check_raw_super(struct
if (sanity_check_area_boundary(sbi, folio, index))
return -EFSCORRUPTED;
- /*
- * Check for legacy summary layout on 16KB+ block devices.
- * Modern f2fs-tools packs multiple 4KB summary areas into one block,
- * whereas legacy versions used one block per summary, leading
- * to a much larger SSA.
- */
- if (SUMS_PER_BLOCK > 1 &&
- !(__F2FS_HAS_FEATURE(raw_super, F2FS_FEATURE_PACKED_SSA))) {
- f2fs_info(sbi, "Error: Device formatted with a legacy version. "
- "Please reformat with a tool supporting the packed ssa "
- "feature for block sizes larger than 4kb.");
- return -EOPNOTSUPP;
- }
-
return 0;
}
@@ -4304,6 +4290,18 @@ static void init_sb_info(struct f2fs_sb_
spin_lock_init(&sbi->gc_remaining_trials_lock);
atomic64_set(&sbi->current_atomic_write, 0);
+ sbi->sum_blocksize = f2fs_sb_has_packed_ssa(sbi) ?
+ 4096 : sbi->blocksize;
+ sbi->sums_per_block = sbi->blocksize / sbi->sum_blocksize;
+ sbi->entries_in_sum = sbi->sum_blocksize / 8;
+ sbi->sum_entry_size = SUMMARY_SIZE * sbi->entries_in_sum;
+ sbi->sum_journal_size = sbi->sum_blocksize - SUM_FOOTER_SIZE -
+ sbi->sum_entry_size;
+ sbi->nat_journal_entries = (sbi->sum_journal_size - 2) /
+ sizeof(struct nat_journal_entry);
+ sbi->sit_journal_entries = (sbi->sum_journal_size - 2) /
+ sizeof(struct sit_journal_entry);
+
sbi->dir_level = DEF_DIR_LEVEL;
sbi->interval_time[CP_TIME] = DEF_CP_INTERVAL;
sbi->interval_time[REQ_TIME] = DEF_IDLE_INTERVAL;
--- a/include/linux/f2fs_fs.h
+++ b/include/linux/f2fs_fs.h
@@ -17,7 +17,6 @@
#define F2FS_LOG_SECTORS_PER_BLOCK (PAGE_SHIFT - 9) /* log number for sector/blk */
#define F2FS_BLKSIZE PAGE_SIZE /* support only block == page */
#define F2FS_BLKSIZE_BITS PAGE_SHIFT /* bits for F2FS_BLKSIZE */
-#define F2FS_SUM_BLKSIZE 4096 /* only support 4096 byte sum block */
#define F2FS_MAX_EXTENSION 64 /* # of extension entries */
#define F2FS_EXTENSION_LEN 8 /* max size of extension */
@@ -442,10 +441,8 @@ struct f2fs_sit_block {
* from node's page's beginning to get a data block address.
* ex) data_blkaddr = (block_t)(nodepage_start_address + ofs_in_node)
*/
-#define ENTRIES_IN_SUM (F2FS_SUM_BLKSIZE / 8)
#define SUMMARY_SIZE (7) /* sizeof(struct f2fs_summary) */
#define SUM_FOOTER_SIZE (5) /* sizeof(struct summary_footer) */
-#define SUM_ENTRY_SIZE (SUMMARY_SIZE * ENTRIES_IN_SUM)
/* a summary entry for a block in a segment */
struct f2fs_summary {
@@ -468,22 +465,6 @@ struct summary_footer {
__le32 check_sum; /* summary checksum */
} __packed;
-#define SUM_JOURNAL_SIZE (F2FS_SUM_BLKSIZE - SUM_FOOTER_SIZE -\
- SUM_ENTRY_SIZE)
-#define NAT_JOURNAL_ENTRIES ((SUM_JOURNAL_SIZE - 2) /\
- sizeof(struct nat_journal_entry))
-#define NAT_JOURNAL_RESERVED ((SUM_JOURNAL_SIZE - 2) %\
- sizeof(struct nat_journal_entry))
-#define SIT_JOURNAL_ENTRIES ((SUM_JOURNAL_SIZE - 2) /\
- sizeof(struct sit_journal_entry))
-#define SIT_JOURNAL_RESERVED ((SUM_JOURNAL_SIZE - 2) %\
- sizeof(struct sit_journal_entry))
-
-/* Reserved area should make size of f2fs_extra_info equals to
- * that of nat_journal and sit_journal.
- */
-#define EXTRA_INFO_RESERVED (SUM_JOURNAL_SIZE - 2 - 8)
-
/*
* frequently updated NAT/SIT entries can be stored in the spare area in
* summary blocks
@@ -498,9 +479,16 @@ struct nat_journal_entry {
struct f2fs_nat_entry ne;
} __packed;
+/*
+ * The nat_journal structure is a placeholder whose actual size varies depending
+ * on the use of packed_ssa. Therefore, it must always be accessed only through
+ * specific sets of macros and fields, and size calculations should use
+ * size-related macros instead of sizeof().
+ * Relevant macros: sbi->nat_journal_entries, nat_in_journal(),
+ * nid_in_journal(), MAX_NAT_JENTRIES().
+ */
struct nat_journal {
- struct nat_journal_entry entries[NAT_JOURNAL_ENTRIES];
- __u8 reserved[NAT_JOURNAL_RESERVED];
+ struct nat_journal_entry entries[0];
} __packed;
struct sit_journal_entry {
@@ -508,14 +496,21 @@ struct sit_journal_entry {
struct f2fs_sit_entry se;
} __packed;
+/*
+ * The sit_journal structure is a placeholder whose actual size varies depending
+ * on the use of packed_ssa. Therefore, it must always be accessed only through
+ * specific sets of macros and fields, and size calculations should use
+ * size-related macros instead of sizeof().
+ * Relevant macros: sbi->sit_journal_entries, sit_in_journal(),
+ * segno_in_journal(), MAX_SIT_JENTRIES().
+ */
struct sit_journal {
- struct sit_journal_entry entries[SIT_JOURNAL_ENTRIES];
- __u8 reserved[SIT_JOURNAL_RESERVED];
+ struct sit_journal_entry entries[0];
} __packed;
struct f2fs_extra_info {
__le64 kbytes_written;
- __u8 reserved[EXTRA_INFO_RESERVED];
+ __u8 reserved[];
} __packed;
struct f2fs_journal {
@@ -531,11 +526,33 @@ struct f2fs_journal {
};
} __packed;
-/* Block-sized summary block structure */
+/*
+ * Block-sized summary block structure
+ *
+ * The f2fs_summary_block structure is a placeholder whose actual size varies
+ * depending on the use of packed_ssa. Therefore, it must always be accessed
+ * only through specific sets of macros and fields, and size calculations should
+ * use size-related macros instead of sizeof().
+ * Relevant macros: sbi->sum_blocksize, sbi->entries_in_sum,
+ * sbi->sum_entry_size, sum_entries(), sum_journal(), sum_footer().
+ *
+ * Summary Block Layout
+ *
+ * +-----------------------+ <--- Block Start
+ * | struct f2fs_summary |
+ * | entries[0] |
+ * | ... |
+ * | entries[N-1] |
+ * +-----------------------+
+ * | struct f2fs_journal |
+ * +-----------------------+
+ * | struct summary_footer |
+ * +-----------------------+ <--- Block End
+ */
struct f2fs_summary_block {
- struct f2fs_summary entries[ENTRIES_IN_SUM];
- struct f2fs_journal journal;
- struct summary_footer footer;
+ struct f2fs_summary entries[0];
+ // struct f2fs_journal journal;
+ // struct summary_footer footer;
} __packed;
/*
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature
2026-02-17 20:32 ` [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature Greg Kroah-Hartman
@ 2026-02-19 7:33 ` Jiri Slaby
2026-02-19 9:55 ` Greg Kroah-Hartman
0 siblings, 1 reply; 32+ messages in thread
From: Jiri Slaby @ 2026-02-19 7:33 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, stable, Daeho Jeong, Chao Yu, Jaegeuk Kim
Hi,
On 17. 02. 26, 21:32, Greg Kroah-Hartman wrote:
> 6.19-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Daeho Jeong <daehojeong@google.com>
>
> commit e48e16f3e37fac76e2f0c14c58df2b0398a323b0 upstream.
There is a fresh fix for this one:
commit 91b76f1059b60f453b51877f29f0e35693737383
Author: Daeho Jeong <daehojeong@google.com>
Date: Mon Jan 26 14:28:01 2026 -0800
f2fs: fix incomplete block usage in compact SSA summaries
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature
2026-02-19 7:33 ` Jiri Slaby
@ 2026-02-19 9:55 ` Greg Kroah-Hartman
0 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-19 9:55 UTC (permalink / raw)
To: Jiri Slaby; +Cc: stable, patches, stable, Daeho Jeong, Chao Yu, Jaegeuk Kim
On Thu, Feb 19, 2026 at 08:33:54AM +0100, Jiri Slaby wrote:
> Hi,
>
> On 17. 02. 26, 21:32, Greg Kroah-Hartman wrote:
> > 6.19-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Daeho Jeong <daehojeong@google.com>
> >
> > commit e48e16f3e37fac76e2f0c14c58df2b0398a323b0 upstream.
>
> There is a fresh fix for this one:
> commit 91b76f1059b60f453b51877f29f0e35693737383
> Author: Daeho Jeong <daehojeong@google.com>
> Date: Mon Jan 26 14:28:01 2026 -0800
>
> f2fs: fix incomplete block usage in compact SSA summaries
Thanks for that, now queued up.
greg k-h
^ permalink raw reply [flat|nested] 32+ messages in thread
* [PATCH 6.19 12/18] f2fs: fix to avoid mapping wrong physical block for swapfile
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 13/18] f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin Greg Kroah-Hartman
` (16 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Daeho Jeong, Chao Yu,
Jaegeuk Kim, Xiaolong Guo
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit 5c145c03188bc9ba1c29e0bc4d527a5978fc47f9 upstream.
Xiaolong Guo reported a f2fs bug in bugzilla [1]
[1] https://bugzilla.kernel.org/show_bug.cgi?id=220951
Quoted:
"When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+,
the system experiences data corruption leading to either:
1 dm-verity corruption errors and device reboot
2 F2FS node corruption errors and boot hangs
The issue occurs specifically when:
1 Using F2FS filesystem (ext4 is unaffected)
2 Swapfile size is less than F2FS section size (2MB)
3 Swapfile has fragmented physical layout (multiple non-contiguous extents)
4 Kernel version is 6.6+ (6.1 is unaffected)
The root cause is in check_swap_activate() function in fs/f2fs/data.c. When the
first extent of a small swapfile (< 2MB) is not aligned to section boundaries,
the function incorrectly treats it as the last extent, failing to map
subsequent extents. This results in incorrect swap_extent creation where only
the first extent is mapped, causing subsequent swap writes to overwrite wrong
physical locations (other files' data).
Steps to Reproduce
1 Setup a device with F2FS-formatted userdata partition
2 Compile stress-ng from https://github.com/ColinIanKing/stress-ng
3 Run swap stress test: (Android devices)
adb shell "cd /data/stressng; ./stress-ng-64 --metrics-brief --timeout 60
--swap 0"
Log:
1 Ftrace shows in kernel 6.6, only first extent is mapped during second
f2fs_map_blocks call in check_swap_activate():
stress-ng-swap-8990: f2fs_map_blocks: ino=11002, file offset=0, start
blkaddr=0x43143, len=0x1
(Only 4KB mapped, not the full swapfile)
2 in kernel 6.1, both extents are correctly mapped:
stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=0, start
blkaddr=0x13cd4, len=0x1
stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=1, start
blkaddr=0x60c84b, len=0xff
The problematic code is in check_swap_activate():
if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec ||
nr_pblocks % blks_per_sec ||
!f2fs_valid_pinned_area(sbi, pblock)) {
bool last_extent = false;
not_aligned++;
nr_pblocks = roundup(nr_pblocks, blks_per_sec);
if (cur_lblock + nr_pblocks > sis->max)
nr_pblocks -= blks_per_sec;
/* this extent is last one */
if (!nr_pblocks) {
nr_pblocks = last_lblock - cur_lblock;
last_extent = true;
}
ret = f2fs_migrate_blocks(inode, cur_lblock, nr_pblocks);
if (ret) {
if (ret == -ENOENT)
ret = -EINVAL;
goto out;
}
if (!last_extent)
goto retry;
}
When the first extent is unaligned and roundup(nr_pblocks, blks_per_sec)
exceeds sis->max, we subtract blks_per_sec resulting in nr_pblocks = 0. The
code then incorrectly assumes this is the last extent, sets nr_pblocks =
last_lblock - cur_lblock (entire swapfile), and performs migration. After
migration, it doesn't retry mapping, so subsequent extents are never processed.
"
In order to fix this issue, we need to lookup block mapping info after
we migrate all blocks in the tail of swapfile.
Cc: stable@kernel.org
Fixes: 9703d69d9d15 ("f2fs: support file pinning for zoned devices")
Cc: Daeho Jeong <daehojeong@google.com>
Reported-and-tested-by: Xiaolong Guo <guoxiaolong2008@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220951
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -3935,6 +3935,7 @@ static int check_swap_activate(struct sw
while (cur_lblock < last_lblock && cur_lblock < sis->max) {
struct f2fs_map_blocks map;
+ bool last_extent = false;
retry:
cond_resched();
@@ -3960,11 +3961,10 @@ retry:
pblock = map.m_pblk;
nr_pblocks = map.m_len;
- if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec ||
- nr_pblocks % blks_per_sec ||
- f2fs_is_sequential_zone_area(sbi, pblock)) {
- bool last_extent = false;
-
+ if (!last_extent &&
+ ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec ||
+ nr_pblocks % blks_per_sec ||
+ f2fs_is_sequential_zone_area(sbi, pblock))) {
not_aligned++;
nr_pblocks = roundup(nr_pblocks, blks_per_sec);
@@ -3985,8 +3985,8 @@ retry:
goto out;
}
- if (!last_extent)
- goto retry;
+ /* lookup block mapping info after block migration */
+ goto retry;
}
if (cur_lblock + nr_pblocks >= sis->max)
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 13/18] f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 12/18] f2fs: fix to avoid mapping wrong physical block for swapfile Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 14/18] iommu/arm-smmu-qcom: do not register driver in probe() Greg Kroah-Hartman
` (15 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Sungjong Seo, Sunmin Jeong,
Yeongjin Gil, Chao Yu, Jaegeuk Kim
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeongjin Gil <youngjin.gil@samsung.com>
commit d860974a7e38d35e9e2c4dc8a9f4223b38b6ad99 upstream.
When overwriting already allocated blocks, f2fs_iomap_begin() calls
f2fs_overwrite_io() to check block mappings. However,
f2fs_overwrite_io() iterates through all mapped blocks in the range,
which can be inefficient for fragmented files with large I/O requests.
This patch optimizes f2fs_overwrite_io() by adding a 'check_first'
parameter and introducing __f2fs_overwrite_io() helper. When called from
f2fs_iomap_begin(), we only check the first mapping to determine if the
range is already allocated, which is sufficient for setting
map.m_may_create.
This optimization significantly reduces the number of f2fs_map_blocks()
calls in f2fs_overwrite_io() when called from f2fs_iomap_begin(),
especially for fragmented files with large I/O requests.
Cc: stable@kernel.org
Fixes: 351bc761338d ("f2fs: optimize f2fs DIO overwrites")
Reviewed-by: Sungjong Seo <sj1557.seo@samsung.com>
Reviewed-by: Sunmin Jeong <s_min.jeong@samsung.com>
Signed-off-by: Yeongjin Gil <youngjin.gil@samsung.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1799,7 +1799,8 @@ out:
return err;
}
-bool f2fs_overwrite_io(struct inode *inode, loff_t pos, size_t len)
+static bool __f2fs_overwrite_io(struct inode *inode, loff_t pos, size_t len,
+ bool check_first)
{
struct f2fs_map_blocks map;
block_t last_lblk;
@@ -1821,10 +1822,17 @@ bool f2fs_overwrite_io(struct inode *ino
if (err || map.m_len == 0)
return false;
map.m_lblk += map.m_len;
+ if (check_first)
+ break;
}
return true;
}
+bool f2fs_overwrite_io(struct inode *inode, loff_t pos, size_t len)
+{
+ return __f2fs_overwrite_io(inode, pos, len, false);
+}
+
static int f2fs_xattr_fiemap(struct inode *inode,
struct fiemap_extent_info *fieinfo)
{
@@ -4187,7 +4195,7 @@ static int f2fs_iomap_begin(struct inode
* f2fs_map_lock and f2fs_balance_fs are not necessary.
*/
if ((flags & IOMAP_WRITE) &&
- !f2fs_overwrite_io(inode, offset, length))
+ !__f2fs_overwrite_io(inode, offset, length, true))
map.m_may_create = true;
err = f2fs_map_blocks(inode, &map, F2FS_GET_BLOCK_DIO);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 14/18] iommu/arm-smmu-qcom: do not register driver in probe()
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 13/18] f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 15/18] Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()" Greg Kroah-Hartman
` (14 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Brown, Robin Murphy,
Bjorn Andersson, Konrad Dybcio, Wang Jiayue, Joerg Roedel,
Danilo Krummrich, Ioana Ciornei
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <dakr@kernel.org>
commit ed1ac3c977dd6b119405fa36dd41f7151bd5b4de upstream.
Commit 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in
qcom_smmu_impl_init") intended to also probe the TBU driver when
CONFIG_ARM_SMMU_QCOM_DEBUG is disabled, but also moved the corresponding
platform_driver_register() call into qcom_smmu_impl_init() which is
called from arm_smmu_device_probe().
However, it neither makes sense to register drivers from probe()
callbacks of other drivers, nor does the driver core allow registering
drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce
device_lock for driver_match_device()") leading to a deadlock condition
described in [1].
Additionally, it was noted by Robin that the current approach is
potentially racy with async probe [2].
Hence, fix this by registering the qcom_smmu_tbu_driver from
module_init(). Unfortunately, due to the vendoring of the driver, this
requires an indirection through arm-smmu-impl.c.
Reported-by: Mark Brown <broonie@kernel.org>
Closes: https://lore.kernel.org/lkml/7ae38e31-ef31-43ad-9106-7c76ea0e8596@sirena.org.uk/
Link: https://lore.kernel.org/lkml/DFU7CEPUSG9A.1KKGVW4HIPMSH@kernel.org/ [1]
Link: https://lore.kernel.org/lkml/0c0d3707-9ea5-44f9-88a1-a65c62e3df8d@arm.com/ [2]
Fixes: dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()")
Fixes: 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init")
Acked-by: Robin Murphy <robin.murphy@arm.com>
Tested-by: Bjorn Andersson <andersson@kernel.org>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Acked-by: Konrad Dybcio <konradybcio@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Ioana Ciornei <ioana.ciornei@nxp.com> #LX2160ARDB
Tested-by: Wang Jiayue <akaieurus@gmail.com>
Reviewed-by: Wang Jiayue <akaieurus@gmail.com>
Tested-by: Mark Brown <broonie@kernel.org>
Acked-by: Joerg Roedel <joerg.roedel@amd.com>
Link: https://patch.msgid.link/20260121141215.29658-1-dakr@kernel.org
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 ++++++++++++++
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 ++++++++++----
drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 +++++++++++++++++++++++-
drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 +++++
4 files changed, 52 insertions(+), 5 deletions(-)
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-impl.c
@@ -228,3 +228,17 @@ struct arm_smmu_device *arm_smmu_impl_in
return smmu;
}
+
+int __init arm_smmu_impl_module_init(void)
+{
+ if (IS_ENABLED(CONFIG_ARM_SMMU_QCOM))
+ return qcom_smmu_module_init();
+
+ return 0;
+}
+
+void __exit arm_smmu_impl_module_exit(void)
+{
+ if (IS_ENABLED(CONFIG_ARM_SMMU_QCOM))
+ qcom_smmu_module_exit();
+}
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -774,10 +774,6 @@ struct arm_smmu_device *qcom_smmu_impl_i
{
const struct device_node *np = smmu->dev->of_node;
const struct of_device_id *match;
- static u8 tbu_registered;
-
- if (!tbu_registered++)
- platform_driver_register(&qcom_smmu_tbu_driver);
#ifdef CONFIG_ACPI
if (np == NULL) {
@@ -802,3 +798,13 @@ struct arm_smmu_device *qcom_smmu_impl_i
return smmu;
}
+
+int __init qcom_smmu_module_init(void)
+{
+ return platform_driver_register(&qcom_smmu_tbu_driver);
+}
+
+void __exit qcom_smmu_module_exit(void)
+{
+ platform_driver_unregister(&qcom_smmu_tbu_driver);
+}
--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c
@@ -2365,7 +2365,29 @@ static struct platform_driver arm_smmu_d
.remove = arm_smmu_device_remove,
.shutdown = arm_smmu_device_shutdown,
};
-module_platform_driver(arm_smmu_driver);
+
+static int __init arm_smmu_init(void)
+{
+ int ret;
+
+ ret = platform_driver_register(&arm_smmu_driver);
+ if (ret)
+ return ret;
+
+ ret = arm_smmu_impl_module_init();
+ if (ret)
+ platform_driver_unregister(&arm_smmu_driver);
+
+ return ret;
+}
+module_init(arm_smmu_init);
+
+static void __exit arm_smmu_exit(void)
+{
+ arm_smmu_impl_module_exit();
+ platform_driver_unregister(&arm_smmu_driver);
+}
+module_exit(arm_smmu_exit);
MODULE_DESCRIPTION("IOMMU API for ARM architected SMMU implementations");
MODULE_AUTHOR("Will Deacon <will@kernel.org>");
--- a/drivers/iommu/arm/arm-smmu/arm-smmu.h
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.h
@@ -540,6 +540,11 @@ struct arm_smmu_device *arm_smmu_impl_in
struct arm_smmu_device *nvidia_smmu_impl_init(struct arm_smmu_device *smmu);
struct arm_smmu_device *qcom_smmu_impl_init(struct arm_smmu_device *smmu);
+int __init arm_smmu_impl_module_init(void);
+void __exit arm_smmu_impl_module_exit(void);
+int __init qcom_smmu_module_init(void);
+void __exit qcom_smmu_module_exit(void);
+
void arm_smmu_write_context_bank(struct arm_smmu_device *smmu, int idx);
int arm_mmu500_reset(struct arm_smmu_device *smmu);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 15/18] Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 14/18] iommu/arm-smmu-qcom: do not register driver in probe() Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 16/18] USB: serial: option: add Telit FN920C04 RNDIS compositions Greg Kroah-Hartman
` (13 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Chao Yu, Jaegeuk Kim,
Sasha Levin
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 3996b70209f145bfcf2afc7d05dd92c27b233b48 ]
This reverts commit 196c81fdd438f7ac429d5639090a9816abb9760a.
Original patch may cause below deadlock, revert it.
write remount
- write_begin
- lock_page --- lock A
- prepare_write_begin
- f2fs_map_lock
- f2fs_enable_checkpoint
- down_write(cp_enable_rwsem) --- lock B
- sync_inode_sb
- writepages
- lock_page --- lock A
- down_read(cp_enable_rwsem) --- lock A
Cc: stable@kernel.org
Fixes: 196c81fdd438 ("f2fs: block cache/dio write during f2fs_enable_checkpoint()")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[ drop tracing bits ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 2 --
fs/f2fs/f2fs.h | 3 +--
fs/f2fs/super.c | 38 ++++++++------------------------------
3 files changed, 9 insertions(+), 34 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -1424,7 +1424,6 @@ static int __allocate_data_block(struct
static void f2fs_map_lock(struct f2fs_sb_info *sbi, int flag)
{
- f2fs_down_read(&sbi->cp_enable_rwsem);
if (flag == F2FS_GET_BLOCK_PRE_AIO)
f2fs_down_read(&sbi->node_change);
else
@@ -1437,7 +1436,6 @@ static void f2fs_map_unlock(struct f2fs_
f2fs_up_read(&sbi->node_change);
else
f2fs_unlock_op(sbi);
- f2fs_up_read(&sbi->cp_enable_rwsem);
}
int f2fs_get_block_locked(struct dnode_of_data *dn, pgoff_t index)
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -287,7 +287,7 @@ enum {
#define DEF_CP_INTERVAL 60 /* 60 secs */
#define DEF_IDLE_INTERVAL 5 /* 5 secs */
#define DEF_DISABLE_INTERVAL 5 /* 5 secs */
-#define DEF_ENABLE_INTERVAL 5 /* 5 secs */
+#define DEF_ENABLE_INTERVAL 16 /* 16 secs */
#define DEF_DISABLE_QUICK_INTERVAL 1 /* 1 secs */
#define DEF_UMOUNT_DISCARD_TIMEOUT 5 /* 5 secs */
@@ -1720,7 +1720,6 @@ struct f2fs_sb_info {
long interval_time[MAX_TIME]; /* to store thresholds */
struct ckpt_req_control cprc_info; /* for checkpoint request control */
struct cp_stats cp_stats; /* for time stat of checkpoint */
- struct f2fs_rwsem cp_enable_rwsem; /* block cache/dio write */
struct inode_management im[MAX_INO_ENTRY]; /* manage inode cache */
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -2636,11 +2636,10 @@ restore_flag:
static int f2fs_enable_checkpoint(struct f2fs_sb_info *sbi)
{
unsigned int nr_pages = get_pages(sbi, F2FS_DIRTY_DATA) / 16;
- long long start, writeback, lock, sync_inode, end;
+ long long start, writeback, end;
int ret;
- f2fs_info(sbi, "%s start, meta: %lld, node: %lld, data: %lld",
- __func__,
+ f2fs_info(sbi, "f2fs_enable_checkpoint() starts, meta: %lld, node: %lld, data: %lld",
get_pages(sbi, F2FS_DIRTY_META),
get_pages(sbi, F2FS_DIRTY_NODES),
get_pages(sbi, F2FS_DIRTY_DATA));
@@ -2659,18 +2658,11 @@ static int f2fs_enable_checkpoint(struct
}
writeback = ktime_get();
- f2fs_down_write(&sbi->cp_enable_rwsem);
-
- lock = ktime_get();
-
- if (get_pages(sbi, F2FS_DIRTY_DATA))
- sync_inodes_sb(sbi->sb);
+ sync_inodes_sb(sbi->sb);
if (unlikely(get_pages(sbi, F2FS_DIRTY_DATA)))
- f2fs_warn(sbi, "%s: has some unwritten data: %lld",
- __func__, get_pages(sbi, F2FS_DIRTY_DATA));
-
- sync_inode = ktime_get();
+ f2fs_warn(sbi, "checkpoint=enable has some unwritten data: %lld",
+ get_pages(sbi, F2FS_DIRTY_DATA));
f2fs_down_write(&sbi->gc_lock);
f2fs_dirty_to_prefree(sbi);
@@ -2679,13 +2671,6 @@ static int f2fs_enable_checkpoint(struct
set_sbi_flag(sbi, SBI_IS_DIRTY);
f2fs_up_write(&sbi->gc_lock);
- f2fs_info(sbi, "%s sync_fs, meta: %lld, imeta: %lld, node: %lld, dents: %lld, qdata: %lld",
- __func__,
- get_pages(sbi, F2FS_DIRTY_META),
- get_pages(sbi, F2FS_DIRTY_IMETA),
- get_pages(sbi, F2FS_DIRTY_NODES),
- get_pages(sbi, F2FS_DIRTY_DENTS),
- get_pages(sbi, F2FS_DIRTY_QDATA));
ret = f2fs_sync_fs(sbi->sb, 1);
if (ret)
f2fs_err(sbi, "%s sync_fs failed, ret: %d", __func__, ret);
@@ -2693,17 +2678,11 @@ static int f2fs_enable_checkpoint(struct
/* Let's ensure there's no pending checkpoint anymore */
f2fs_flush_ckpt_thread(sbi);
- f2fs_up_write(&sbi->cp_enable_rwsem);
-
end = ktime_get();
- f2fs_info(sbi, "%s end, writeback:%llu, "
- "lock:%llu, sync_inode:%llu, sync_fs:%llu",
- __func__,
- ktime_ms_delta(writeback, start),
- ktime_ms_delta(lock, writeback),
- ktime_ms_delta(sync_inode, lock),
- ktime_ms_delta(end, sync_inode));
+ f2fs_info(sbi, "f2fs_enable_checkpoint() finishes, writeback:%llu, sync:%llu",
+ ktime_ms_delta(writeback, start),
+ ktime_ms_delta(end, writeback));
return ret;
}
@@ -4904,7 +4883,6 @@ try_onemore:
init_f2fs_rwsem(&sbi->node_change);
spin_lock_init(&sbi->stat_lock);
init_f2fs_rwsem(&sbi->cp_rwsem);
- init_f2fs_rwsem(&sbi->cp_enable_rwsem);
init_f2fs_rwsem(&sbi->quota_sem);
init_waitqueue_head(&sbi->cp_wait);
spin_lock_init(&sbi->error_lock);
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 16/18] USB: serial: option: add Telit FN920C04 RNDIS compositions
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 15/18] Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()" Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 17/18] f2fs: fix to do sanity check on node footer in __write_node_folio() Greg Kroah-Hartman
` (12 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Porcedda, Johan Hovold
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <fabio.porcedda@gmail.com>
commit 509f403f3ccec14188036212118651bf23599396 upstream.
Add the following compositions:
0x10a1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=10a1 Rev=05.15
S: Manufacturer=Telit Cinterion
S: Product=FN920
S: SerialNumber=d128dba9
C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a6: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=10a6 Rev=05.15
S: Manufacturer=Telit Cinterion
S: Product=FN920
S: SerialNumber=d128dba9
C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10ab: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=10ab Rev=05.15
S: Manufacturer=Telit Cinterion
S: Product=FN920
S: SerialNumber=d128dba9
C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host
E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none)
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Cc: stable@vger.kernel.org
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1401,12 +1401,16 @@ static const struct usb_device_id option
.driver_info = NCTRL(0) | RSVD(1) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */
.driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a1, 0xff), /* Telit FN20C04 (RNDIS) */
+ .driver_info = NCTRL(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */
.driver_info = NCTRL(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */
.driver_info = NCTRL(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */
.driver_info = RSVD(0) | NCTRL(3) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a6, 0xff), /* Telit FN920C04 (RNDIS) */
+ .driver_info = NCTRL(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */
.driver_info = NCTRL(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */
@@ -1415,6 +1419,8 @@ static const struct usb_device_id option
.driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */
.driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10ab, 0xff), /* Telit FN920C04 (RNDIS) */
+ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) },
{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */
.driver_info = NCTRL(5) },
{ USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 17/18] f2fs: fix to do sanity check on node footer in __write_node_folio()
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 16/18] USB: serial: option: add Telit FN920C04 RNDIS compositions Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 20:32 ` [PATCH 6.19 18/18] f2fs: fix to do sanity check on node footer in {read,write}_end_io Greg Kroah-Hartman
` (11 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 0a736109c9d29de0c26567e42cb99b27861aa8ba ]
Add node footer sanity check during node folio's writeback, if sanity
check fails, let's shutdown filesystem to avoid looping to redirty
and writeback in .writepages.
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/node.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1751,7 +1751,11 @@ static bool __write_node_folio(struct fo
/* get old block addr of this node page */
nid = nid_of_node(folio);
- f2fs_bug_on(sbi, folio->index != nid);
+
+ if (sanity_check_node_footer(sbi, folio, nid, NODE_TYPE_REGULAR)) {
+ f2fs_handle_critical_error(sbi, STOP_CP_REASON_CORRUPTED_NID);
+ goto redirty_out;
+ }
if (f2fs_get_node_info(sbi, nid, &ni, !do_balance))
goto redirty_out;
^ permalink raw reply [flat|nested] 32+ messages in thread* [PATCH 6.19 18/18] f2fs: fix to do sanity check on node footer in {read,write}_end_io
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 17/18] f2fs: fix to do sanity check on node footer in __write_node_folio() Greg Kroah-Hartman
@ 2026-02-17 20:32 ` Greg Kroah-Hartman
2026-02-17 23:15 ` [PATCH 6.19 00/18] 6.19.3-rc1 review Florian Fainelli
` (10 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Greg Kroah-Hartman @ 2026-02-17 20:32 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+803dd716c4310d16ff3a,
Chao Yu, Jaegeuk Kim, Sasha Levin
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4 ]
-----------[ cut here ]------------
kernel BUG at fs/f2fs/data.c:358!
Call Trace:
<IRQ>
blk_update_request+0x5eb/0xe70 block/blk-mq.c:987
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149
blk_complete_reqs block/blk-mq.c:1224 [inline]
blk_done_softirq+0x107/0x160 block/blk-mq.c:1229
handle_softirqs+0x283/0x870 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050
</IRQ>
In f2fs_write_end_io(), it detects there is inconsistency in between
node page index (nid) and footer.nid of node page.
If footer of node page is corrupted in fuzzed image, then we load corrupted
node page w/ async method, e.g. f2fs_ra_node_pages() or f2fs_ra_node_page(),
in where we won't do sanity check on node footer, once node page becomes
dirty, we will encounter this bug after node page writeback.
Cc: stable@kernel.org
Reported-by: syzbot+803dd716c4310d16ff3a@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=803dd716c4310d16ff3a
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
[ Context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/data.c | 13 +++++++++++--
fs/f2fs/f2fs.h | 12 ++++++++++++
fs/f2fs/node.c | 20 +++++++++++---------
fs/f2fs/node.h | 8 --------
4 files changed, 34 insertions(+), 19 deletions(-)
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -151,6 +151,12 @@ static void f2fs_finish_read_bio(struct
}
dec_page_count(F2FS_F_SB(folio), __read_io_type(folio));
+
+ if (F2FS_F_SB(folio)->node_inode && is_node_folio(folio) &&
+ f2fs_sanity_check_node_footer(F2FS_F_SB(folio),
+ folio, folio->index, NODE_TYPE_REGULAR, true))
+ bio->bi_status = BLK_STS_IOERR;
+
folio_end_read(folio, bio->bi_status == BLK_STS_OK);
}
@@ -352,8 +358,11 @@ static void f2fs_write_end_io(struct bio
STOP_CP_REASON_WRITE_FAIL);
}
- f2fs_bug_on(sbi, is_node_folio(folio) &&
- folio->index != nid_of_node(folio));
+ if (is_node_folio(folio)) {
+ f2fs_sanity_check_node_footer(sbi, folio,
+ folio->index, NODE_TYPE_REGULAR, true);
+ f2fs_bug_on(sbi, folio->index != nid_of_node(folio));
+ }
dec_page_count(sbi, type);
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -1529,6 +1529,15 @@ enum f2fs_lookup_mode {
LOOKUP_AUTO,
};
+/* For node type in __get_node_folio() */
+enum node_type {
+ NODE_TYPE_REGULAR,
+ NODE_TYPE_INODE,
+ NODE_TYPE_XATTR,
+ NODE_TYPE_NON_INODE,
+};
+
+
static inline int f2fs_test_bit(unsigned int nr, char *addr);
static inline void f2fs_set_bit(unsigned int nr, char *addr);
static inline void f2fs_clear_bit(unsigned int nr, char *addr);
@@ -3877,6 +3886,9 @@ struct folio *f2fs_new_node_folio(struct
void f2fs_ra_node_page(struct f2fs_sb_info *sbi, nid_t nid);
struct folio *f2fs_get_node_folio(struct f2fs_sb_info *sbi, pgoff_t nid,
enum node_type node_type);
+int f2fs_sanity_check_node_footer(struct f2fs_sb_info *sbi,
+ struct folio *folio, pgoff_t nid,
+ enum node_type ntype, bool in_irq);
struct folio *f2fs_get_inode_folio(struct f2fs_sb_info *sbi, pgoff_t ino);
struct folio *f2fs_get_xnode_folio(struct f2fs_sb_info *sbi, pgoff_t xnid);
int f2fs_move_node_folio(struct folio *node_folio, int gc_type);
--- a/fs/f2fs/node.c
+++ b/fs/f2fs/node.c
@@ -1500,9 +1500,9 @@ void f2fs_ra_node_page(struct f2fs_sb_in
f2fs_folio_put(afolio, err ? true : false);
}
-static int sanity_check_node_footer(struct f2fs_sb_info *sbi,
+int f2fs_sanity_check_node_footer(struct f2fs_sb_info *sbi,
struct folio *folio, pgoff_t nid,
- enum node_type ntype)
+ enum node_type ntype, bool in_irq)
{
if (unlikely(nid != nid_of_node(folio)))
goto out_err;
@@ -1527,12 +1527,13 @@ static int sanity_check_node_footer(stru
goto out_err;
return 0;
out_err:
- f2fs_warn(sbi, "inconsistent node block, node_type:%d, nid:%lu, "
- "node_footer[nid:%u,ino:%u,ofs:%u,cpver:%llu,blkaddr:%u]",
- ntype, nid, nid_of_node(folio), ino_of_node(folio),
- ofs_of_node(folio), cpver_of_node(folio),
- next_blkaddr_of_node(folio));
set_sbi_flag(sbi, SBI_NEED_FSCK);
+ f2fs_warn_ratelimited(sbi, "inconsistent node block, node_type:%d, nid:%lu, "
+ "node_footer[nid:%u,ino:%u,ofs:%u,cpver:%llu,blkaddr:%u]",
+ ntype, nid, nid_of_node(folio), ino_of_node(folio),
+ ofs_of_node(folio), cpver_of_node(folio),
+ next_blkaddr_of_node(folio));
+
f2fs_handle_error(sbi, ERROR_INCONSISTENT_FOOTER);
return -EFSCORRUPTED;
}
@@ -1578,7 +1579,7 @@ repeat:
goto out_err;
}
page_hit:
- err = sanity_check_node_footer(sbi, folio, nid, ntype);
+ err = f2fs_sanity_check_node_footer(sbi, folio, nid, ntype, false);
if (!err)
return folio;
out_err:
@@ -1752,7 +1753,8 @@ static bool __write_node_folio(struct fo
/* get old block addr of this node page */
nid = nid_of_node(folio);
- if (sanity_check_node_footer(sbi, folio, nid, NODE_TYPE_REGULAR)) {
+ if (f2fs_sanity_check_node_footer(sbi, folio, nid,
+ NODE_TYPE_REGULAR, false)) {
f2fs_handle_critical_error(sbi, STOP_CP_REASON_CORRUPTED_NID);
goto redirty_out;
}
--- a/fs/f2fs/node.h
+++ b/fs/f2fs/node.h
@@ -52,14 +52,6 @@ enum {
IS_PREALLOC, /* nat entry is preallocated */
};
-/* For node type in __get_node_folio() */
-enum node_type {
- NODE_TYPE_REGULAR,
- NODE_TYPE_INODE,
- NODE_TYPE_XATTR,
- NODE_TYPE_NON_INODE,
-};
-
/*
* For node information
*/
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2026-02-17 20:32 ` [PATCH 6.19 18/18] f2fs: fix to do sanity check on node footer in {read,write}_end_io Greg Kroah-Hartman
@ 2026-02-17 23:15 ` Florian Fainelli
2026-02-17 23:40 ` Takeshi Ogasawara
` (9 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Florian Fainelli @ 2026-02-17 23:15 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 2/17/26 12:31, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2026-02-17 23:15 ` [PATCH 6.19 00/18] 6.19.3-rc1 review Florian Fainelli
@ 2026-02-17 23:40 ` Takeshi Ogasawara
2026-02-18 4:25 ` Peter Schneider
` (8 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Takeshi Ogasawara @ 2026-02-17 23:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Hi Greg
On Wed, Feb 18, 2026 at 5:50 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
6.19.3-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.19.3-rc1rv-g40e4767c6df5
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20260209, GNU ld (GNU
Binutils) 2.46) #1 SMP PREEMPT_DYNAMIC Wed Feb 18 08:05:33 JST 2026
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2026-02-17 23:40 ` Takeshi Ogasawara
@ 2026-02-18 4:25 ` Peter Schneider
2026-02-18 8:23 ` Jon Hunter
` (7 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Peter Schneider @ 2026-02-18 4:25 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
Am 17.02.2026 um 21:31 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2026-02-18 4:25 ` Peter Schneider
@ 2026-02-18 8:23 ` Jon Hunter
2026-02-18 9:09 ` Brett A C Sheffield
` (6 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Jon Hunter @ 2026-02-18 8:23 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
linux-tegra, stable
On Tue, 17 Feb 2026 21:31:56 +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v6.19:
9 builds: 9 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 fail
Linux version: 6.19.3-rc1-g40e4767c6df5
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2026-02-18 8:23 ` Jon Hunter
@ 2026-02-18 9:09 ` Brett A C Sheffield
2026-02-18 11:40 ` Mark Brown
` (5 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Brett A C Sheffield @ 2026-02-18 9:09 UTC (permalink / raw)
To: gregkh
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Brett A C Sheffield
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.19.3-rc1-g40e4767c6df5 #3 SMP PREEMPT_DYNAMIC Wed Feb 18 08:36:31 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Tested-by: Brett A C Sheffield <bacs@librecast.net>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2026-02-18 9:09 ` Brett A C Sheffield
@ 2026-02-18 11:40 ` Mark Brown
2026-02-18 12:16 ` Luna Jernberg
` (4 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Mark Brown @ 2026-02-18 11:40 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 344 bytes --]
On Tue, Feb 17, 2026 at 09:31:56PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2026-02-18 11:40 ` Mark Brown
@ 2026-02-18 12:16 ` Luna Jernberg
2026-02-18 14:44 ` Ronald Warsow
` (3 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Luna Jernberg @ 2026-02-18 12:16 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Tested-by: Luna Jernberg <droidbittin@gmail.com>
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den tis 17 feb. 2026 kl 21:51 skrev Greg Kroah-Hartman
<gregkh@linuxfoundation.org>:
>
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.19.3-rc1
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to do sanity check on node footer in {read,write}_end_io
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to do sanity check on node footer in __write_node_folio()
>
> Fabio Porcedda <fabio.porcedda@gmail.com>
> USB: serial: option: add Telit FN920C04 RNDIS compositions
>
> Chao Yu <chao@kernel.org>
> Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
>
> Danilo Krummrich <dakr@kernel.org>
> iommu/arm-smmu-qcom: do not register driver in probe()
>
> Yeongjin Gil <youngjin.gil@samsung.com>
> f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to avoid mapping wrong physical block for swapfile
>
> Daeho Jeong <daehojeong@google.com>
> f2fs: support non-4KB block size without packed_ssa feature
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to avoid UAF in f2fs_write_end_io()
>
> Yongpeng Yang <yangyongpeng@xiaomi.com>
> f2fs: fix out-of-bounds access in sysfs attribute read/write
>
> Yongpeng Yang <yangyongpeng@xiaomi.com>
> f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
>
> Zhiguo Niu <zhiguo.niu@unisoc.com>
> f2fs: fix to add gc count stat in f2fs_gc_range
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> fbdev: smscufx: properly copy ioctl memory to kernelspace
>
> Guangshuo Li <lgs201920130244@gmail.com>
> fbdev: rivafb: fix divide error in nv3_arb()
>
> Tiezhu Yang <yangtiezhu@loongson.cn>
> LoongArch: Rework KASAN initialization for PTW-enabled systems
>
> Otto Pflüger <otto.pflueger@abscue.de>
> arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
>
> Anil Gurumurthy <agurumurthy@marvell.com>
> scsi: qla2xxx: Fix bsg_done() causing double free
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 ++++++++++---
> arch/loongarch/mm/kasan_init.c | 80 +++++++++++++--------------
> drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 +++++
> drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 +++--
> drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 ++++++++-
> drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 ++
> drivers/scsi/qla2xxx/qla_bsg.c | 28 ++++++----
> drivers/usb/serial/option.c | 6 +++
> drivers/video/fbdev/riva/riva_hw.c | 3 ++
> drivers/video/fbdev/smscufx.c | 8 ++-
> fs/f2fs/data.c | 53 ++++++++++++------
> fs/f2fs/f2fs.h | 67 +++++++++++++++++------
> fs/f2fs/gc.c | 24 +++++----
> fs/f2fs/node.c | 50 ++++++++++-------
> fs/f2fs/node.h | 8 ---
> fs/f2fs/recovery.c | 6 +--
> fs/f2fs/segment.c | 86 ++++++++++++++++--------------
> fs/f2fs/segment.h | 9 ++--
> fs/f2fs/super.c | 64 +++++++---------------
> fs/f2fs/sysfs.c | 62 +++++++++++++++++----
> include/linux/f2fs_fs.h | 73 +++++++++++++++----------
> 22 files changed, 460 insertions(+), 265 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2026-02-18 12:16 ` Luna Jernberg
@ 2026-02-18 14:44 ` Ronald Warsow
2026-02-19 1:00 ` Justin Forbes
` (2 subsequent siblings)
28 siblings, 0 replies; 32+ messages in thread
From: Ronald Warsow @ 2026-02-18 14:44 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
conor, hargar, broonie, achill, sr
Hi
no regressions here on x86_64 (Intel 11th Gen. CPU)
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2026-02-18 14:44 ` Ronald Warsow
@ 2026-02-19 1:00 ` Justin Forbes
2026-02-19 6:21 ` Ron Economos
2026-02-19 13:02 ` Miguel Ojeda
28 siblings, 0 replies; 32+ messages in thread
From: Justin Forbes @ 2026-02-19 1:00 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
On Tue, Feb 17, 2026 at 09:31:56PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2026-02-19 1:00 ` Justin Forbes
@ 2026-02-19 6:21 ` Ron Economos
2026-02-19 13:02 ` Miguel Ojeda
28 siblings, 0 replies; 32+ messages in thread
From: Ron Economos @ 2026-02-19 6:21 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
On 2/17/26 12:31, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 32+ messages in thread* Re: [PATCH 6.19 00/18] 6.19.3-rc1 review
2026-02-17 20:31 [PATCH 6.19 00/18] 6.19.3-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2026-02-19 6:21 ` Ron Economos
@ 2026-02-19 13:02 ` Miguel Ojeda
28 siblings, 0 replies; 32+ messages in thread
From: Miguel Ojeda @ 2026-02-19 13:02 UTC (permalink / raw)
To: gregkh
Cc: achill, akpm, broonie, conor, f.fainelli, hargar, jonathanh,
linux-kernel, linux, lkft-triage, patches, patches, pavel,
rwarsow, shuah, sr, stable, sudipm.mukherjee, torvalds,
Miguel Ojeda
On Tue, 17 Feb 2026 21:31:56 +0100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.19.3 release.
> There are 18 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000.
> Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested
for loongarch64:
Tested-by: Miguel Ojeda <ojeda@kernel.org>
The same couple build errors and the warning still apply, from 6.19.1
(and 6.19.2):
https://lore.kernel.org/stable/20260215023627.56245-1-ojeda@kernel.org/
Thanks!
Cheers,
Miguel
^ permalink raw reply [flat|nested] 32+ messages in thread