6.19.3-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 6.19.3-rc1 review
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 6.19.3-rc1
Chao Yu <[email protected]>
f2fs: fix to do sanity check on node footer in {read,write}_end_io
Chao Yu <[email protected]>
f2fs: fix to do sanity check on node footer in __write_node_folio()
Fabio Porcedda <[email protected]>
USB: serial: option: add Telit FN920C04 RNDIS compositions
Chao Yu <[email protected]>
Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
Danilo Krummrich <[email protected]>
iommu/arm-smmu-qcom: do not register driver in probe()
Yeongjin Gil <[email protected]>
f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin
Chao Yu <[email protected]>
f2fs: fix to avoid mapping wrong physical block for swapfile
Daeho Jeong <[email protected]>
f2fs: support non-4KB block size without packed_ssa feature
Chao Yu <[email protected]>
f2fs: fix to avoid UAF in f2fs_write_end_io()
Yongpeng Yang <[email protected]>
f2fs: fix out-of-bounds access in sysfs attribute read/write
Yongpeng Yang <[email protected]>
f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
Chao Yu <[email protected]>
f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
Zhiguo Niu <[email protected]>
f2fs: fix to add gc count stat in f2fs_gc_range
Greg Kroah-Hartman <[email protected]>
fbdev: smscufx: properly copy ioctl memory to kernelspace
Guangshuo Li <[email protected]>
fbdev: rivafb: fix divide error in nv3_arb()
Tiezhu Yang <[email protected]>
LoongArch: Rework KASAN initialization for PTW-enabled systems
Otto Pflüger <[email protected]>
arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
Anil Gurumurthy <[email protected]>
scsi: qla2xxx: Fix bsg_done() causing double free
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 ++++++++++--- arch/loongarch/mm/kasan_init.c | 80 +++++++++++++-------------- drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 +++++ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 +++-- drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 ++++++++- drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 ++ drivers/scsi/qla2xxx/qla_bsg.c | 28 ++++++---- drivers/usb/serial/option.c | 6 +++ drivers/video/fbdev/riva/riva_hw.c | 3 ++ drivers/video/fbdev/smscufx.c | 8 ++- fs/f2fs/data.c | 53 ++++++++++++------ fs/f2fs/f2fs.h | 67 +++++++++++++++++------ fs/f2fs/gc.c | 24 +++++---- fs/f2fs/node.c | 50 ++++++++++------- fs/f2fs/node.h | 8 --- fs/f2fs/recovery.c | 6 +-- fs/f2fs/segment.c | 86 ++++++++++++++++-------------- fs/f2fs/segment.h | 9 ++-- fs/f2fs/super.c | 64 +++++++--------------- fs/f2fs/sysfs.c | 62 +++++++++++++++++---- include/linux/f2fs_fs.h | 73 +++++++++++++++---------- 22 files changed, 460 insertions(+), 265 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/18 scsi: qla2xxx: Fix bsg_done() causing double free
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anil Gurumurthy <[email protected]>
commit c2c68225b1456f4d0d393b5a8778d51bb0d5b1d0 upstream.
Kernel panic observed on system,
[5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page [5353358.825196] PGD 100006067 P4D 0 [5353358.825198] Oops: 0002 [#1] PREEMPT SMP NOPTI [5353358.825200] CPU: 5 PID: 2132085 Comm: qlafwupdate.sub Kdump: loaded Tainted: G W L ------- --- 5.14.0-503.34.1.el9_5.x86_64 #1 [5353358.825203] Hardware name: HPE ProLiant DL360 Gen11/ProLiant DL360 Gen11, BIOS 2.44 01/17/2025 [5353358.825204] RIP: 0010:memcpy_erms+0x6/0x10 [5353358.825211] RSP: 0018:ff591da8f4f6b710 EFLAGS: 00010246 [5353358.825212] RAX: ff5f5e897b024000 RBX: 0000000000007090 RCX: 0000000000001000 [5353358.825213] RDX: 0000000000001000 RSI: ff591da8f4fed090 RDI: ff5f5e897b024000 [5353358.825214] RBP: 0000000000010000 R08: ff5f5e897b024000 R09: 0000000000000000 [5353358.825215] R10: ff46cf8c40517000 R11: 0000000000000001 R12: 0000000000008090 [5353358.825216] R13: ff591da8f4f6b720 R14: 0000000000001000 R15: 0000000000000000 [5353358.825218] FS: 00007f1e88d47740(0000) GS:ff46cf935f940000(0000) knlGS:0000000000000000 [5353358.825219] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [5353358.825220] CR2: ff5f5e897b024000 CR3: 0000000231532004 CR4: 0000000000771ef0 [5353358.825221] PKRU: 55555554 [5353358.825222] Call Trace: [5353358.825223] <TASK> [5353358.825224] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825229] ? show_trace_log_lvl+0x1c4/0x2df [5353358.825232] ? sg_copy_buffer+0xc8/0x110 [5353358.825236] ? __die_body.cold+0x8/0xd [5353358.825238] ? page_fault_oops+0x134/0x170 [5353358.825242] ? kernelmode_fixup_or_oops+0x84/0x110 [5353358.825244] ? exc_page_fault+0xa8/0x150 [5353358.825247] ? asm_exc_page_fault+0x22/0x30 [5353358.825252] ? memcpy_erms+0x6/0x10 [5353358.825253] sg_copy_buffer+0xc8/0x110 [5353358.825259] qla2x00_process_vendor_specific+0x652/0x1320 [qla2xxx] [5353358.825317] qla24xx_bsg_request+0x1b2/0x2d0 [qla2xxx]
Most routines in qla_bsg.c call bsg_done() only for success cases. However a few invoke it for failure case as well leading to a double free. Validate before calling bsg_done().
--- drivers/scsi/qla2xxx/qla_bsg.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
drivers/scsi/qla2xxx/qla_bsg.c +17 -11
@@ -1546,8 +1546,9 @@ qla2x00_update_optrom(struct bsg_job *bs ha->optrom_buffer =NULL ; ha->optrom_state =QLA_SWAITING ;mutex_unlock (&ha->optrom_mutex); -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!rval) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return rval; }
@@ -2612,8 +2613,9 @@ qla2x00_manage_host_stats(struct bsg_job sizeof(struct ql_vnd_mng_host_stats_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
@@ -2702,8 +2704,9 @@ qla2x00_get_host_stats(struct bsg_job *b bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);kfree (data); host_stat_out:
@@ -2802,8 +2805,9 @@ reply: bsg_job->reply_payload.sg_cnt, data, response_len); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len); tgt_stat_out:kfree (data);
@@ -2864,8 +2868,9 @@ qla2x00_manage_host_port(struct bsg_job bsg_job->reply_payload.sg_cnt, &rsp_data, sizeof(struct ql_vnd_mng_host_port_resp)); bsg_reply->result =DID_OK ; -bsg_job_done (bsg_job, bsg_reply->result, - bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, + bsg_reply->reply_payload_rcv_len);return ret; }
@@ -3240,7 +3245,8 @@ int qla2x00_mailbox_passthru(struct bsg_ bsg_job->reply_len =sizeof (*bsg_job->reply); bsg_reply->result =DID_OK <<16 ; -bsg_job_done (bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len); +if (!ret) +bsg_job_done (bsg_job, bsg_reply->result, bsg_reply->reply_payload_rcv_len);kfree (req_data);
Greg Kroah-Hartman
maintainerPATCH 2/18 arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graph
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Otto Pflüger <[email protected]>
commit be0b304eeb8c5f77e4f98f64e58729d879195f2f upstream.
The endpoint IDs in the display graph are expected to match the associated display path number, i.e. all endpoints connected to mmsys_ep_main must have reg = <0> and all endpoints connected to mmsys_ep_ext must have reg = <1>.
Add the missing ID to all endpoints in the display graph, based on mt8365.dtsi as an existing example that does this correctly.
--- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 +++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 6 deletions(-)
arch/arm64/boot/dts/mediatek/mt8183.dtsi +31 -6
@@ -1812,15 +1812,23 @@ #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - ovl_2l1_in: endpoint { + + ovl_2l1_in: endpoint@1 { + reg = <1>; remote-endpoint = <&mmsys_ep_ext>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - ovl_2l1_out: endpoint { + + ovl_2l1_out: endpoint@1 { + reg = <1>; remote-endpoint = <&rdma1_in>; }; };
@@ -1872,15 +1880,23 @@ #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - rdma1_in: endpoint { + + rdma1_in: endpoint@1 { + reg = <1>; remote-endpoint = <&ovl_2l1_out>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - rdma1_out: endpoint { + + rdma1_out: endpoint@1 { + reg = <1>; remote-endpoint = <&dpi_in>; }; };
@@ -2076,15 +2092,24 @@ #size-cells = <0>; port@0 { + #address-cells = <1>; + #size-cells = <0>; reg = <0>; - dpi_in: endpoint { + + dpi_in: endpoint@1 { + reg = <1>; remote-endpoint = <&rdma1_out>; }; }; port@1 { + #address-cells = <1>; + #size-cells = <0>; reg = <1>; - dpi_out: endpoint { }; + + dpi_out: endpoint@1 { + reg = <1>; + }; }; }; };
Greg Kroah-Hartman
maintainerPATCH 3/18 LoongArch: Rework KASAN initialization for PTW-enabled systems
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <[email protected]>
commit 5ec5ac4ca27e4daa234540ac32f9fc5219377d53 upstream.
kasan_init_generic() indicates that kasan is fully initialized, so it should be put at end of kasan_init().
Otherwise bringing up the primary CPU failed when CONFIG_KASAN is set on PTW-enabled systems, here are the call chains:
kernel_entry()
start_kernel()
setup_arch()
kasan_init()
kasan_init_generic()
The reason is PTW-enabled systems have speculative accesses which means memory accesses to the shadow memory after kasan_init() may be executed by hardware before. However, accessing shadow memory is safe only after kasan fully initialized because kasan_init() uses a temporary PGD table until we have populated all levels of shadow page tables and writen the PGD register. Moving kasan_init_generic() later can defer the occasion of kasan_enabled(), so as to avoid speculative accesses on shadow pages.
After moving kasan_init_generic() to the end, kasan_init() can no longer call kasan_mem_to_shadow() for shadow address conversion because it will always return kasan_early_shadow_page. On the other hand, we should keep the current logic of kasan_mem_to_shadow() for both the early and final stage because there may be instrumentation before kasan_init().
To solve this, we factor out a new mem_to_shadow() function from current kasan_mem_to_shadow() for the shadow address conversion in kasan_init().
--- arch/loongarch/mm/kasan_init.c | 78 +++++++++++++++++++++-------------------- 1 file changed, 40 insertions(+), 38 deletions(-)
arch/loongarch/mm/kasan_init.c +40 -38
@@ -40,39 +40,43 @@ static pgd_t kasan_pg_dir[PTRS_PER_PGD]#define __pte_none (early, pte) (early ? pte_none(pte) : \ ((pte_val(pte) & _PFN_MASK) == (unsigned long)__pa(kasan_early_shadow_page))) -void *kasan_mem_to_shadow (const void *addr) +static void *mem_to_shadow (const void *addr) { -if (!kasan_enabled ()) { +unsigned long offset =0 ; +unsigned long maddr = (unsigned long )addr; +unsigned long xrange = (maddr >>XRANGE_SHIFT ) &0xffff ; + +if (maddr >=FIXADDR_START )return (void *)(kasan_early_shadow_page); - }else { -unsigned long maddr = (unsigned long )addr; -unsigned long xrange = (maddr >>XRANGE_SHIFT ) &0xffff ; -unsigned long offset =0 ; - -if (maddr >=FIXADDR_START ) -return (void *)(kasan_early_shadow_page); - - maddr &=XRANGE_SHADOW_MASK ; -switch (xrange) { -case XKPRANGE_CC_SEG : - offset =XKPRANGE_CC_SHADOW_OFFSET ; -break ; -case XKPRANGE_UC_SEG : - offset =XKPRANGE_UC_SHADOW_OFFSET ; -break ; -case XKPRANGE_WC_SEG : - offset =XKPRANGE_WC_SHADOW_OFFSET ; -break ; -case XKVRANGE_VC_SEG : - offset =XKVRANGE_VC_SHADOW_OFFSET ; -break ; -default : -WARN_ON (1 ); -return NULL ; - } -return (void *)((maddr >>KASAN_SHADOW_SCALE_SHIFT ) + offset); + maddr &=XRANGE_SHADOW_MASK ; +switch (xrange) { +case XKPRANGE_CC_SEG : + offset =XKPRANGE_CC_SHADOW_OFFSET ; +break ; +case XKPRANGE_UC_SEG : + offset =XKPRANGE_UC_SHADOW_OFFSET ; +break ; +case XKPRANGE_WC_SEG : + offset =XKPRANGE_WC_SHADOW_OFFSET ; +break ; +case XKVRANGE_VC_SEG : + offset =XKVRANGE_VC_SHADOW_OFFSET ; +break ; +default : +WARN_ON (1 ); +return NULL ; } + +return (void *)((maddr >>KASAN_SHADOW_SCALE_SHIFT ) + offset); +} + +void *kasan_mem_to_shadow (const void *addr) +{ +if (kasan_enabled ()) +return mem_to_shadow (addr); +else +return (void *)(kasan_early_shadow_page); }const void *kasan_shadow_to_mem (const void *shadow_addr)
@@ -293,11 +297,8 @@ void __init kasan_init(void)/* Maps everything to a single page of zeroes */ kasan_pgd_populate (KASAN_SHADOW_START ,KASAN_SHADOW_END ,NUMA_NO_NODE , true); -kasan_populate_early_shadow (kasan_mem_to_shadow ((void *)VMALLOC_START ), -kasan_mem_to_shadow ((void *)KFENCE_AREA_END )); - -/* Enable KASAN here before kasan_mem_to_shadow(). */ -kasan_init_generic (); +kasan_populate_early_shadow (mem_to_shadow ((void *)VMALLOC_START ), +mem_to_shadow ((void *)KFENCE_AREA_END ));/* Populate the linear mapping */ for_each_mem_range (i, &pa_start, &pa_end) {
@@ -307,13 +308,13 @@ void __init kasan_init(void)if (start >= end)break ; -kasan_map_populate ((unsigned long )kasan_mem_to_shadow (start), - (unsigned long )kasan_mem_to_shadow (end),NUMA_NO_NODE ); +kasan_map_populate ((unsigned long )mem_to_shadow (start), + (unsigned long )mem_to_shadow (end),NUMA_NO_NODE ); }/* Populate modules mapping */ -kasan_map_populate ((unsigned long )kasan_mem_to_shadow ((void *)MODULES_VADDR ), - (unsigned long )kasan_mem_to_shadow ((void *)MODULES_END ),NUMA_NO_NODE ); +kasan_map_populate ((unsigned long )mem_to_shadow ((void *)MODULES_VADDR ), + (unsigned long )mem_to_shadow ((void *)MODULES_END ),NUMA_NO_NODE );/* * KAsan may reuse the contents of kasan_early_shadow_pte directly, so we * should make sure that it maps the zero page read-only.
@@ -328,4 +329,5 @@ void __init kasan_init(void)/* At this point kasan is fully initialized. Enable error messages */ init_task.kasan_depth =0 ; +kasan_init_generic (); }
Greg Kroah-Hartman
maintainerPATCH 4/18 fbdev: rivafb: fix divide error in nv3_arb()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangshuo Li <[email protected]>
commit 0209e21e3c372fa2da04c39214bec0b64e4eb5f4 upstream.
A userspace program can trigger the RIVA NV3 arbitration code by calling the FBIOPUT_VSCREENINFO ioctl on /dev/fb*. When doing so, the driver recomputes FIFO arbitration parameters in nv3_arb(), using state->mclk_khz (derived from the PRAMDAC MCLK PLL) as a divisor without validating it first.
In a normal setup, state->mclk_khz is provided by the real hardware and is non-zero. However, an attacker can construct a malicious or misconfigured device (e.g. a crafted/emulated PCI device) that exposes a bogus PLL configuration, causing state->mclk_khz to become zero. Once nv3_get_param() calls nv3_arb(), the division by state->mclk_khz in the gns calculation causes a divide error and crashes the kernel.
Fix this by checking whether state->mclk_khz is zero and bailing out before doing the division.
The following log reveals it:
rivafb: setting virtual Y resolution to 2184
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
CPU: 0 PID: 2187 Comm: syz-executor.0 Not tainted 5.18.0-rc1+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:nv3_arb drivers/video/fbdev/riva/riva_hw.c:439 [inline] RIP: 0010:nv3_get_param+0x3ab/0x13b0 drivers/video/fbdev/riva/riva_hw.c:546 Call Trace: nv3CalcArbitration.constprop.0+0x255/0x460 drivers/video/fbdev/riva/riva_hw.c:603 nv3UpdateArbitrationSettings drivers/video/fbdev/riva/riva_hw.c:637 [inline] CalcStateExt+0x447/0x1b90 drivers/video/fbdev/riva/riva_hw.c:1246 riva_load_video_mode+0x8a9/0xea0 drivers/video/fbdev/riva/fbdev.c:779 rivafb_set_par+0xc0/0x5f0 drivers/video/fbdev/riva/fbdev.c:1196 fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1033 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1109 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1188 __x64_sys_ioctl+0x122/0x190 fs/ioctl.c:856
--- drivers/video/fbdev/riva/riva_hw.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/riva/riva_hw.c +3 -0
@@ -436,6 +436,9 @@ static char nv3_arb(nv3_fifo_info * res_ vmisses =2 ; eburst_size = state->memory_width *1 ; mburst_size =32 ; +if (!state->mclk_khz) +return (0 ); + gns =1000000 * (gmisses*state->mem_page_miss + state->mem_latency)/state->mclk_khz; ainfo->by_gfacc = gns*ainfo->gdrain_rate/1000000 ; ainfo->wcmocc =0 ;
Greg Kroah-Hartman
maintainerPATCH 5/18 fbdev: smscufx: properly copy ioctl memory to kernelspace
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 120adae7b42faa641179270c067864544a50ab69 upstream.
The UFX_IOCTL_REPORT_DAMAGE ioctl does not properly copy data from userspace to kernelspace, and instead directly references the memory, which can cause problems if invalid data is passed from userspace. Fix this all up by correctly copying the memory before accessing it within the kernel.
--- drivers/video/fbdev/smscufx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/video/fbdev/smscufx.c +6 -2
@@ -932,7 +932,6 @@ static int ufx_ops_ioctl(struct fb_info unsigned long arg) {struct ufx_data *dev = info->par; -struct dloarea *area =NULL ;if (!atomic_read (&dev->usb_active))return 0 ;
@@ -947,6 +946,10 @@ static int ufx_ops_ioctl(struct fb_info/* TODO: Help propose a standard fb.h ioctl to report mmap damage */ if (cmd ==UFX_IOCTL_REPORT_DAMAGE ) { + struct dloarea *area __free(kfree) = kmalloc(sizeof(*area), GFP_KERNEL); +if (!area) +return -ENOMEM ; +/* If we have a damage-aware client, turn fb_defio "off" * To avoid perf imact of unnecessary page fault handling. * Done by resetting the delay for this fb_info to a very
@@ -956,7 +959,8 @@ static int ufx_ops_ioctl(struct fb_infoif (info->fbdefio) info->fbdefio->delay =UFX_DEFIO_WRITE_DISABLE ; - area = (struct dloarea *)arg; +if (copy_from_user (area, (u8 __user *)arg,sizeof (*area))) +return -EFAULT ;if (area->x <0 ) area->x =0 ;
Greg Kroah-Hartman
maintainerPATCH 6/18 f2fs: fix to add gc count stat in f2fs_gc_range
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhiguo Niu <[email protected]>
commit 761dac9073cd67d4705a94cd1af674945a117f4c upstream.
It missed the stat count in f2fs_gc_range.
--- fs/f2fs/gc.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/gc.c +1 -0
@@ -2096,6 +2096,7 @@ int f2fs_gc_range(struct f2fs_sb_info *sif (unlikely (f2fs_cp_error (sbi)))return -EIO ; +stat_inc_gc_call_count (sbi,FOREGROUND );for (segno = start_seg; segno <= end_seg; segno +=SEGS_PER_SEC (sbi)) {struct gc_inode_list gc_list = { .ilist =LIST_HEAD_INIT (gc_list.ilist),
Greg Kroah-Hartman
maintainerPATCH 7/18 f2fs: fix to check sysfs filename w/ gc_pin_file_thresh correctly
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 0eda086de85e140f53c6123a4c00662f4e614ee4 upstream.
Sysfs entry name is gc_pin_file_thresh instead of gc_pin_file_threshold, fix it.
--- fs/f2fs/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/sysfs.c +1 -1
@@ -749,7 +749,7 @@ out:return count; } -if (!strcmp (a->attr.name,"gc_pin_file_threshold" )) { +if (!strcmp (a->attr.name,"gc_pin_file_thresh" )) {if (t >MAX_GC_FAILED_PINNED_FILES )return -EINVAL ; sbi->gc_pin_file_threshold = t;
Greg Kroah-Hartman
maintainerPATCH 8/18 f2fs: fix IS_CHECKPOINTED flag inconsistency issue caused by concurrent atomic commit and checkpoint writes
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit 7633a7387eb4d0259d6bea945e1d3469cd135bbc upstream.
During SPO tests, when mounting F2FS, an -EINVAL error was returned from f2fs_recover_inode_page. The issue occurred under the following scenario
Thread A Thread Bf2fs_ioc_commit_atomic_write
- f2fs_do_sync_file // atomic = true
- f2fs_fsync_node_pages
: last_folio = inode folio
: schedule before folio_lock(last_folio) f2fs_write_checkpoint
- block_operations// writeback last_folio
- schedule before f2fs_flush_nat_entries
: set_fsync_mark(last_folio, 1)
: set_dentry_mark(last_folio, 1)
: folio_mark_dirty(last_folio)
- __write_node_folio(last_folio)
: f2fs_down_read(&sbi->node_write)//block
- f2fs_flush_nat_entries
: {struct nat_entry}->flag |= BIT(IS_CHECKPOINTED)
- unblock_operations
: f2fs_up_write(&sbi->node_write)
f2fs_write_checkpoint//return
: f2fs_do_write_node_page()
f2fs_ioc_commit_atomic_write//return
SPO
Thread A calls f2fs_need_dentry_mark(sbi, ino), and the last_folio has already been written once. However, the {struct nat_entry}->flag did not have the IS_CHECKPOINTED set, causing set_dentry_mark(last_folio, 1) and write last_folio again after Thread B finishes f2fs_write_checkpoint.
After SPO and reboot, it was detected that {struct node_info}->blk_addr was not NULL_ADDR because Thread B successfully write the checkpoint.
This issue only occurs in atomic write scenarios. For regular file fsync operations, the folio must be dirty. If block_operations->f2fs_sync_node_pages successfully submit the folio write, this path will not be executed. Otherwise, the f2fs_write_checkpoint will need to wait for the folio write submission to complete, as sbi->nr_pages[F2FS_DIRTY_NODES] > 0. Therefore, the situation where f2fs_need_dentry_mark checks that the {struct nat_entry}->flag /wo the IS_CHECKPOINTED flag, but the folio write has already been submitted, will not occur.
Therefore, for atomic file fsync, sbi->node_write should be acquired through __write_node_folio to ensure that the IS_CHECKPOINTED flag correctly indicates that the checkpoint write has been completed.
--- fs/f2fs/node.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/f2fs/node.c +10 -4
@@ -1774,8 +1774,13 @@ static bool __write_node_folio(struct fo goto redirty_out; } -if (atomic && !test_opt (sbi,NOBARRIER )) - fio.op_flags |=REQ_PREFLUSH |REQ_FUA ; +if (atomic) { +if (!test_opt (sbi,NOBARRIER )) + fio.op_flags |=REQ_PREFLUSH |REQ_FUA ; +if (IS_INODE (folio)) +set_dentry_mark (folio, +f2fs_need_dentry_mark (sbi,ino_of_node (folio))); + }/* should add to global list before clearing PAGECACHE status */ if (f2fs_in_warm_node_list (sbi, folio)) {
@@ -1916,8 +1921,9 @@ continue_unlock:if (is_inode_flag_set (inode,FI_DIRTY_INODE ))f2fs_update_inode (inode, folio); -set_dentry_mark (folio, -f2fs_need_dentry_mark (sbi, ino)); +if (!atomic) +set_dentry_mark (folio, +f2fs_need_dentry_mark (sbi, ino)); }/* may be written by other thread */ if (!folio_test_dirty (folio))
Greg Kroah-Hartman
maintainerPATCH 9/18 f2fs: fix out-of-bounds access in sysfs attribute read/write
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <[email protected]>
commit 98ea0039dbfdd00e5cc1b9a8afa40434476c0955 upstream.
Some f2fs sysfs attributes suffer from out-of-bounds memory access and incorrect handling of integer values whose size is not 4 bytes.
For example:
vm:~# echo 65537 > /sys/fs/f2fs/vde/carve_out vm:~# cat /sys/fs/f2fs/vde/carve_out 65537 vm:~# echo 4294967297 > /sys/fs/f2fs/vde/atgc_age_threshold vm:~# cat /sys/fs/f2fs/vde/atgc_age_threshold 1
carve_out maps to {struct f2fs_sb_info}->carve_out, which is a 8-bit integer. However, the sysfs interface allows setting it to a value larger than 255, resulting in an out-of-range update.
atgc_age_threshold maps to {struct atgc_management}->age_threshold, which is a 64-bit integer, but its sysfs interface cannot correctly set values larger than UINT_MAX.
The root causes are:
1. __sbi_store() treats all default values as unsigned int, which prevents updating integers larger than 4 bytes and causes out-of-bounds writes for integers smaller than 4 bytes.
2. f2fs_sbi_show() also assumes all default values are unsigned int, leading to out-of-bounds reads and incorrect access to integers larger than 4 bytes.
This patch introduces {struct f2fs_attr}->size to record the actual size of the integer associated with each sysfs attribute. With this information, sysfs read and write operations can correctly access and update values according to their real data size, avoiding memory corruption and truncation.
--- fs/f2fs/sysfs.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 52 insertions(+), 8 deletions(-)
fs/f2fs/sysfs.c +52 -8
@@ -58,6 +58,7 @@ struct f2fs_attr { const char *buf, size_t len);int struct_type;int offset; +int size;int id; };
@@ -344,11 +345,30 @@ static ssize_t main_blkaddr_show(struct (unsigned long long)MAIN_BLKADDR(sbi)); } +static ssize_t __sbi_show_value (struct f2fs_attr *a, +struct f2fs_sb_info *sbi,char *buf, +unsigned char *value) +{ +switch (a->size) { +case 1 : +return sysfs_emit (buf,"%u\n" , *(u8 *)value); +case 2 : +return sysfs_emit (buf,"%u\n" , *(u16 *)value); +case 4 : +return sysfs_emit (buf,"%u\n" , *(u32 *)value); +case 8 : +return sysfs_emit (buf,"%llu\n" , *(u64 *)value); +default : +f2fs_bug_on (sbi,1 ); +return sysfs_emit (buf, +"show sysfs node value with wrong type\n" ); + } +} +static ssize_t f2fs_sbi_show (struct f2fs_attr *a,struct f2fs_sb_info *sbi,char *buf) {unsigned char *ptr =NULL ; -unsigned int *ui; ptr =__struct_ptr (sbi, a->struct_type);if (!ptr)
@@ -428,9 +448,30 @@ static ssize_t f2fs_sbi_show(struct f2fs atomic_read(&sbi->cp_call_count[BACKGROUND]));#endif - ui = (unsigned int *)(ptr + a->offset); +return __sbi_show_value (a, sbi, buf, ptr + a->offset); +} -return sysfs_emit (buf,"%u\n" , *ui); +static void __sbi_store_value (struct f2fs_attr *a, +struct f2fs_sb_info *sbi, +unsigned char *ui,unsigned long value) +{ +switch (a->size) { +case 1 : + *(u8 *)ui = value; +break ; +case 2 : + *(u16 *)ui = value; +break ; +case 4 : + *(u32 *)ui = value; +break ; +case 8 : + *(u64 *)ui = value; +break ; +default : +f2fs_bug_on (sbi,1 ); +f2fs_err (sbi,"store sysfs node value with wrong type" ); + } } static ssize_t __sbi_store(struct f2fs_attr *a,
@@ -906,7 +947,7 @@ out:return count; } - *ui = (unsigned int )t; +__sbi_store_value (a, sbi, ptr + a->offset, t);return count; }
@@ -1053,24 +1094,27 @@ static struct f2fs_attr f2fs_attr_sb_##_ .id = F2FS_FEATURE_##_feat, \ } -#define F2FS_ATTR_OFFSET (_struct_type, _name, _mode, _show, _store, _offset) \ +#define F2FS_ATTR_OFFSET (_struct_type, _name, _mode, _show, _store, _offset, _size) \ static struct f2fs_attr f2fs_attr_##_name = { \ .attr = {.name = __stringify(_name), .mode = _mode }, \ .show = _show, \ .store = _store, \ .struct_type = _struct_type, \ - .offset = _offset \ + .offset = _offset, \ + .size = _size \ }#define F2FS_RO_ATTR (struct_type, struct_name, name, elname) \ F2FS_ATTR_OFFSET(struct_type, name, 0444, \ f2fs_sbi_show, NULL, \ - offsetof(struct struct_name, elname)) + offsetof(struct struct_name, elname), \ + sizeof_field(struct struct_name, elname))#define F2FS_RW_ATTR (struct_type, struct_name, name, elname) \ F2FS_ATTR_OFFSET(struct_type, name, 0644, \ f2fs_sbi_show, f2fs_sbi_store, \ - offsetof(struct struct_name, elname)) + offsetof(struct struct_name, elname), \ + sizeof_field(struct struct_name, elname))#define F2FS_GENERAL_RO_ATTR (name) \ static struct f2fs_attr f2fs_attr_##name = __ATTR(name, 0444, name##_show, NULL)
Greg Kroah-Hartman
maintainerPATCH 10/18 f2fs: fix to avoid UAF in f2fs_write_end_io()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit ce2739e482bce8d2c014d76c4531c877f382aa54 upstream.
As syzbot reported an use-after-free issue in f2fs_write_end_io().
It is caused by below race condition:
loop device umount
- worker_thread
- loop_process_work
- do_req_filebacked
- lo_rw_aio
- lo_rw_aio_complete
- blk_mq_end_request
- blk_update_request
- f2fs_write_end_io
- dec_page_count
- folio_end_writeback
- kill_f2fs_super
- kill_block_super
- f2fs_put_super
: free(sbi)
: get_pages(, F2FS_WB_CP_DATA)
accessed sbi which is freed
In kill_f2fs_super(), we will drop all page caches of f2fs inodes before call free(sbi), it guarantee that all folios should end its writeback, so it should be safe to access sbi before last folio_end_writeback().
Let's relocate ckpt thread wakeup flow before folio_end_writeback() to resolve this issue.
--- fs/f2fs/data.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
fs/f2fs/data.c +9 -3
@@ -356,14 +356,20 @@ static void f2fs_write_end_io(struct bio folio->index != nid_of_node(folio));dec_page_count (sbi, type); + +/* +* we should access sbi before folio_end_writeback() to +* avoid racing w/ kill_f2fs_super() +*/ +if (type ==F2FS_WB_CP_DATA && !get_pages (sbi, type) && +wq_has_sleeper (&sbi->cp_wait)) +wake_up (&sbi->cp_wait); +if (f2fs_in_warm_node_list (sbi, folio))f2fs_del_fsync_node_entry (sbi, folio);folio_clear_f2fs_gcing (folio);folio_end_writeback (folio); } -if (!get_pages (sbi,F2FS_WB_CP_DATA ) && -wq_has_sleeper (&sbi->cp_wait)) -wake_up (&sbi->cp_wait);bio_put (bio); }
Greg Kroah-Hartman
maintainerPATCH 11/18 f2fs: support non-4KB block size without packed_ssa feature
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
commit e48e16f3e37fac76e2f0c14c58df2b0398a323b0 upstream.
Currently, F2FS requires the packed_ssa feature to be enabled when utilizing non-4KB block sizes (e.g., 16KB). This restriction limits the flexibility of filesystem formatting options.
This patch allows F2FS to support non-4KB block sizes even when the packed_ssa feature is disabled. It adjusts the SSA calculation logic to correctly handle summary entries in larger blocks without the packed layout.
--- fs/f2fs/f2fs.h | 52 ++++++++++++++++++++--------- fs/f2fs/gc.c | 23 ++++++------ fs/f2fs/node.c | 12 +++--- fs/f2fs/recovery.c | 6 +-- fs/f2fs/segment.c | 86 +++++++++++++++++++++++++----------------------- fs/f2fs/segment.h | 9 ++--- fs/f2fs/super.c | 26 ++++++-------- include/linux/f2fs_fs.h | 73 +++++++++++++++++++++++++--------------- 8 files changed, 165 insertions(+), 122 deletions(-)
fs/f2fs/f2fs.h +37 -15
@@ -521,13 +521,25 @@ struct fsync_inode_entry {#define nats_in_cursum (jnl) (le16_to_cpu((jnl)->n_nats))#define sits_in_cursum (jnl) (le16_to_cpu((jnl)->n_sits)) -#define nat_in_journal (jnl, i) ((jnl)->nat_j.entries[i].ne) -#define nid_in_journal (jnl, i) ((jnl)->nat_j.entries[i].nid) -#define sit_in_journal (jnl, i) ((jnl)->sit_j.entries[i].se) -#define segno_in_journal (jnl, i) ((jnl)->sit_j.entries[i].segno) +#define nat_in_journal (jnl, i) \ + (((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].ne) +#define nid_in_journal (jnl, i) \ + (((struct nat_journal_entry *)(jnl)->nat_j.entries)[i].nid) +#define sit_in_journal (jnl, i) \ + (((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].se) +#define segno_in_journal (jnl, i) \ + (((struct sit_journal_entry *)(jnl)->sit_j.entries)[i].segno) + +#define sum_entries (sum) ((struct f2fs_summary *)(sum)) +#define sum_journal (sbi, sum) \ + ((struct f2fs_journal *)((char *)(sum) + \ + ((sbi)->entries_in_sum * sizeof(struct f2fs_summary)))) +#define sum_footer (sbi, sum) \ + ((struct summary_footer *)((char *)(sum) + (sbi)->sum_blocksize - \ + sizeof(struct summary_footer))) -#define MAX_NAT_JENTRIES (jnl) (NAT_JOURNAL_ENTRIES - nats_in_cursum(jnl)) -#define MAX_SIT_JENTRIES (jnl) (SIT_JOURNAL_ENTRIES - sits_in_cursum(jnl)) +#define MAX_NAT_JENTRIES (sbi, jnl) ((sbi)->nat_journal_entries - nats_in_cursum(jnl)) +#define MAX_SIT_JENTRIES (sbi, jnl) ((sbi)->sit_journal_entries - sits_in_cursum(jnl))static inline int update_nats_in_cursum (struct f2fs_journal *journal,int i) {
@@ -545,14 +557,6 @@ static inline int update_sits_in_cursum(return before; } -static inline bool __has_cursum_space (struct f2fs_journal *journal, -int size,int type) -{ -if (type ==NAT_JOURNAL ) -return size <=MAX_NAT_JENTRIES (journal); -return size <=MAX_SIT_JENTRIES (journal); -} -/* for inline stuff */ #define DEF_INLINE_RESERVED_SIZE 1static inline int get_extra_isize (struct inode *inode);
@@ -1764,6 +1768,15 @@ struct f2fs_sb_info {bool readdir_ra;/* readahead inode in readdir */ u64 max_io_bytes;/* max io bytes to merge IOs */ +/* variable summary block units */ +unsigned int sum_blocksize;/* sum block size */ +unsigned int sums_per_block;/* sum block count per block */ +unsigned int entries_in_sum;/* entry count in sum block */ +unsigned int sum_entry_size;/* total entry size in sum block */ +unsigned int sum_journal_size;/* journal size in sum block */ +unsigned int nat_journal_entries;/* nat journal entry count in the journal */ +unsigned int sit_journal_entries;/* sit journal entry count in the journal */ +block_t user_block_count;/* # of user blocks */ block_t total_valid_block_count;/* # of valid blocks */ block_t discard_blks;/* discard command candidats */
@@ -2813,6 +2826,14 @@ static inline block_t __start_sum_addr(sreturn le32_to_cpu (F2FS_CKPT (sbi)->cp_pack_start_sum); } +static inline bool __has_cursum_space (struct f2fs_sb_info *sbi, +struct f2fs_journal *journal,int size,int type) +{ +if (type ==NAT_JOURNAL ) +return size <=MAX_NAT_JENTRIES (sbi, journal); +return size <=MAX_SIT_JENTRIES (sbi, journal); +} +extern void f2fs_mark_inode_dirty_sync (struct inode *inode,bool sync);static inline int inc_valid_node_count (struct f2fs_sb_info *sbi,struct inode *inode,bool is_inode)
@@ -3956,7 +3977,8 @@ void f2fs_wait_on_block_writeback_range( block_t len);void f2fs_write_data_summaries (struct f2fs_sb_info *sbi,block_t start_blk);void f2fs_write_node_summaries (struct f2fs_sb_info *sbi,block_t start_blk); -int f2fs_lookup_journal_in_cursum (struct f2fs_journal *journal,int type, +int f2fs_lookup_journal_in_cursum (struct f2fs_sb_info *sbi, +struct f2fs_journal *journal,int type,unsigned int val,int alloc);void f2fs_flush_sit_entries (struct f2fs_sb_info *sbi,struct cp_control *cpc);int f2fs_check_and_fix_write_pointer (struct f2fs_sb_info *sbi);
fs/f2fs/gc.c +12 -11
@@ -1769,8 +1769,8 @@ static int do_garbage_collect(struct f2fsanity_check_seg_type (sbi,get_seg_entry (sbi, segno)->type); - segno =rounddown (segno,SUMS_PER_BLOCK ); - sum_blk_cnt =DIV_ROUND_UP (end_segno - segno,SUMS_PER_BLOCK ); + segno =rounddown (segno, sbi->sums_per_block); + sum_blk_cnt =DIV_ROUND_UP (end_segno - segno, sbi->sums_per_block);/* readahead multi ssa blocks those have contiguous address */ if (__is_large_section (sbi)) f2fs_ra_meta_pages(sbi, GET_SUM_BLOCK(sbi, segno),
@@ -1780,17 +1780,17 @@ static int do_garbage_collect(struct f2fwhile (segno < end_segno) {struct folio *sum_folio =f2fs_get_sum_folio (sbi, segno); - segno +=SUMS_PER_BLOCK ; + segno += sbi->sums_per_block;if (IS_ERR (sum_folio)) {int err =PTR_ERR (sum_folio); - end_segno = segno -SUMS_PER_BLOCK ; - segno =rounddown (start_segno,SUMS_PER_BLOCK ); + end_segno = segno - sbi->sums_per_block; + segno =rounddown (start_segno, sbi->sums_per_block);while (segno < end_segno) { sum_folio =filemap_get_folio (META_MAPPING (sbi),GET_SUM_BLOCK (sbi, segno));folio_put_refs (sum_folio,2 ); - segno +=SUMS_PER_BLOCK ; + segno += sbi->sums_per_block; }return err; }
@@ -1806,8 +1806,8 @@ static int do_garbage_collect(struct f2f/* find segment summary of victim */ struct folio *sum_folio =filemap_get_folio (META_MAPPING (sbi),GET_SUM_BLOCK (sbi, segno)); -unsigned int block_end_segno =rounddown (segno,SUMS_PER_BLOCK ) - +SUMS_PER_BLOCK ; +unsigned int block_end_segno =rounddown (segno, sbi->sums_per_block) + + sbi->sums_per_block;if (block_end_segno > end_segno) block_end_segno = end_segno;
@@ -1833,12 +1833,13 @@ static int do_garbage_collect(struct f2f migrated >= sbi->migration_granularity)continue ; - sum =SUM_BLK_PAGE_ADDR (sum_folio, cur_segno); -if (type !=GET_SUM_TYPE ((&sum->footer))) { + sum =SUM_BLK_PAGE_ADDR (sbi, sum_folio, cur_segno); +if (type !=GET_SUM_TYPE (sum_footer (sbi, sum))) {f2fs_err (sbi,"Inconsistent segment (%u) type " "[%d, %d] in SSA and SIT" , cur_segno, type, -GET_SUM_TYPE ((&sum->footer))); +GET_SUM_TYPE ( +sum_footer (sbi, sum)));f2fs_stop_checkpoint (sbi, false,STOP_CP_REASON_CORRUPTED_SUMMARY );continue ;
fs/f2fs/node.c +6 -6
@@ -606,7 +606,7 @@ retry: goto retry; } - i =f2fs_lookup_journal_in_cursum (journal,NAT_JOURNAL , nid,0 ); + i =f2fs_lookup_journal_in_cursum (sbi, journal,NAT_JOURNAL , nid,0 );if (i >=0 ) { ne =nat_in_journal (journal, i);node_info_from_raw_nat (ni, &ne);
@@ -2943,7 +2943,7 @@ int f2fs_restore_node_summary(struct f2f/* scan the node segment */ last_offset =BLKS_PER_SEG (sbi); addr =START_BLOCK (sbi, segno); - sum_entry = &sum->entries[0 ]; + sum_entry =sum_entries (sum);for (i =0 ; i < last_offset; i += nrpages, addr += nrpages) { nrpages =bio_max_segs (last_offset - i);
@@ -3084,7 +3084,7 @@ static int __flush_nat_entry_set(struct* #2, flush nat entries to nat page. */ if (enabled_nat_bits (sbi, cpc) || - !__has_cursum_space (journal, set->entry_cnt,NAT_JOURNAL )) + !__has_cursum_space (sbi, journal, set->entry_cnt,NAT_JOURNAL )) to_journal = false;if (to_journal) {
@@ -3107,7 +3107,7 @@ static int __flush_nat_entry_set(structf2fs_bug_on (sbi,nat_get_blkaddr (ne) ==NEW_ADDR );if (to_journal) { - offset =f2fs_lookup_journal_in_cursum (journal, + offset =f2fs_lookup_journal_in_cursum (sbi, journal,NAT_JOURNAL , nid,1 );f2fs_bug_on (sbi, offset <0 ); raw_ne = &nat_in_journal (journal, offset);
@@ -3178,7 +3178,7 @@ int f2fs_flush_nat_entries(struct f2fs_s* into nat entry set. */ if (enabled_nat_bits (sbi, cpc) || - !__has_cursum_space (journal, + !__has_cursum_space (sbi, journal, nm_i->nat_cnt[DIRTY_NAT ],NAT_JOURNAL ))remove_nats_in_journal (sbi);
@@ -3189,7 +3189,7 @@ int f2fs_flush_nat_entries(struct f2fs_s set_idx = setvec[found -1 ]->set +1 ;for (idx =0 ; idx < found; idx++)__adjust_nat_entry_set (setvec[idx], &sets, -MAX_NAT_JENTRIES (journal)); +MAX_NAT_JENTRIES (sbi, journal)); }/* flush dirty nats in nat entry set */
fs/f2fs/recovery.c +3 -3
@@ -514,7 +514,7 @@ static int check_index_in_prev_nodes(strstruct curseg_info *curseg =CURSEG_I (sbi, i);if (curseg->segno == segno) { - sum = curseg->sum_blk->entries[blkoff]; + sum =sum_entries (curseg->sum_blk)[blkoff]; goto got_it; } }
@@ -522,8 +522,8 @@ static int check_index_in_prev_nodes(str sum_folio =f2fs_get_sum_folio (sbi, segno);if (IS_ERR (sum_folio))return PTR_ERR (sum_folio); - sum_node =SUM_BLK_PAGE_ADDR (sum_folio, segno); - sum = sum_node->entries[blkoff]; + sum_node =SUM_BLK_PAGE_ADDR (sbi, sum_folio, segno); + sum =sum_entries (sum_node)[blkoff];f2fs_folio_put (sum_folio, true); got_it:/* Use the locked dnode page and inode */
fs/f2fs/segment.c +46 -40
244 lines not on this page · raw message
fs/f2fs/segment.h +4 -5
@@ -90,12 +90,11 @@ static inline void sanity_check_seg_type#define GET_ZONE_FROM_SEG (sbi, segno) \ GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno)) -#define SUMS_PER_BLOCK (F2FS_BLKSIZE / F2FS_SUM_BLKSIZE)#define GET_SUM_BLOCK (sbi, segno) \ - (SM_I(sbi)->ssa_blkaddr + (segno / SUMS_PER_BLOCK)) -#define GET_SUM_BLKOFF (segno) (segno % SUMS_PER_BLOCK) -#define SUM_BLK_PAGE_ADDR (folio, segno) \ - (folio_address(folio) + GET_SUM_BLKOFF(segno) * F2FS_SUM_BLKSIZE) + (SM_I(sbi)->ssa_blkaddr + (segno / (sbi)->sums_per_block)) +#define GET_SUM_BLKOFF (sbi, segno) (segno % (sbi)->sums_per_block) +#define SUM_BLK_PAGE_ADDR (sbi, folio, segno) \ + (folio_address(folio) + GET_SUM_BLKOFF(sbi, segno) * (sbi)->sum_blocksize)#define GET_SUM_TYPE (footer) ((footer)->entry_type)#define SET_SUM_TYPE (footer, type) ((footer)->entry_type = (type))
fs/f2fs/super.c +12 -14
@@ -4080,20 +4080,6 @@ static int sanity_check_raw_super(structif (sanity_check_area_boundary (sbi, folio, index))return -EFSCORRUPTED ; -/* -* Check for legacy summary layout on 16KB+ block devices. -* Modern f2fs-tools packs multiple 4KB summary areas into one block, -* whereas legacy versions used one block per summary, leading -* to a much larger SSA. -*/ -if (SUMS_PER_BLOCK >1 && - !(__F2FS_HAS_FEATURE (raw_super,F2FS_FEATURE_PACKED_SSA ))) { -f2fs_info (sbi,"Error: Device formatted with a legacy version. " -"Please reformat with a tool supporting the packed ssa " -"feature for block sizes larger than 4kb." ); -return -EOPNOTSUPP ; - } -return 0 ; }
@@ -4304,6 +4290,18 @@ static void init_sb_info(struct f2fs_sb_spin_lock_init (&sbi->gc_remaining_trials_lock);atomic64_set (&sbi->current_atomic_write,0 ); + sbi->sum_blocksize =f2fs_sb_has_packed_ssa (sbi) ? +4096 : sbi->blocksize; + sbi->sums_per_block = sbi->blocksize / sbi->sum_blocksize; + sbi->entries_in_sum = sbi->sum_blocksize /8 ; + sbi->sum_entry_size =SUMMARY_SIZE * sbi->entries_in_sum; + sbi->sum_journal_size = sbi->sum_blocksize -SUM_FOOTER_SIZE - + sbi->sum_entry_size; + sbi->nat_journal_entries = (sbi->sum_journal_size -2 ) / +sizeof (struct nat_journal_entry ); + sbi->sit_journal_entries = (sbi->sum_journal_size -2 ) / +sizeof (struct sit_journal_entry ); + sbi->dir_level =DEF_DIR_LEVEL ; sbi->interval_time[CP_TIME ] =DEF_CP_INTERVAL ; sbi->interval_time[REQ_TIME ] =DEF_IDLE_INTERVAL ;
include/linux/f2fs_fs.h +45 -28
118 lines not on this page · raw message
Re: [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature
Hi,
Quoted 7 lines · Greg Kroah-Hartman
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
commit
e48e16f3e37fac76e2f0c14c58df2b0398a323b0upstream.
There is a fresh fix for this one:
commit 91b76f1059b60f453b51877f29f0e35693737383
Author: Daeho Jeong <[email protected]> Date: Mon Jan 26 14:28:01 2026 -0800
f2fs: fix incomplete block usage in compact SSA summaries
thanks,
Signature · 2 lines
js suse labs
Greg Kroah-Hartman
maintainerRe: [PATCH 6.19 11/18] f2fs: support non-4KB block size without packed_ssa feature
Quoted 9 lines · Jiri Slaby
Hi,
Quoted 6 lines · Greg Kroah-Hartman
6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daeho Jeong <[email protected]>
Quoted 8 lines
Quoted 1 line
commit
e48e16f3e37fac76e2f0c14c58df2b0398a323b0upstream.There is a fresh fix for this one:
commit91b76f1059b60f453b51877f29f0e35693737383Author: Daeho Jeong <[email protected]> Date: Mon Jan 26 14:28:01 2026 -0800f2fs: fix incomplete block usage in compact SSA summaries
Thanks for that, now queued up.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 12/18 f2fs: fix to avoid mapping wrong physical block for swapfile
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
commit 5c145c03188bc9ba1c29e0bc4d527a5978fc47f9 upstream.
Xiaolong Guo reported a f2fs bug in bugzilla [1]
[1] https://bugzilla.kernel.org/show_bug.cgi?id=220951
Quoted:
"When using stress-ng's swap stress test on F2FS filesystem with kernel 6.6+, the system experiences data corruption leading to either:
1 dm-verity corruption errors and device reboot
2 F2FS node corruption errors and boot hangs
The issue occurs specifically when:
1 Using F2FS filesystem (ext4 is unaffected)
2 Swapfile size is less than F2FS section size (2MB)
3 Swapfile has fragmented physical layout (multiple non-contiguous extents) 4 Kernel version is 6.6+ (6.1 is unaffected)
The root cause is in check_swap_activate() function in fs/f2fs/data.c. When the first extent of a small swapfile (< 2MB) is not aligned to section boundaries, the function incorrectly treats it as the last extent, failing to map subsequent extents. This results in incorrect swap_extent creation where only the first extent is mapped, causing subsequent swap writes to overwrite wrong physical locations (other files' data).
Steps to Reproduce
1 Setup a device with F2FS-formatted userdata partition
2 Compile stress-ng from https://github.com/ColinIanKing/stress-ng
3 Run swap stress test: (Android devices)
adb shell "cd /data/stressng; ./stress-ng-64 --metrics-brief --timeout 60 --swap 0"
Log:
1 Ftrace shows in kernel 6.6, only first extent is mapped during second f2fs_map_blocks call in check_swap_activate():
stress-ng-swap-8990: f2fs_map_blocks: ino=11002, file offset=0, start blkaddr=0x43143, len=0x1
(Only 4KB mapped, not the full swapfile)
2 in kernel 6.1, both extents are correctly mapped:
stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=0, start blkaddr=0x13cd4, len=0x1
stress-ng-swap-5966: f2fs_map_blocks: ino=28011, file offset=1, start blkaddr=0x60c84b, len=0xff
The problematic code is in check_swap_activate():
if ((pblock - SM_I(sbi)->main_blkaddr) % blks_per_sec ||
nr_pblocks % blks_per_sec ||
!f2fs_valid_pinned_area(sbi, pblock)) {
bool last_extent = false;
not_aligned++;
nr_pblocks = roundup(nr_pblocks, blks_per_sec);
if (cur_lblock + nr_pblocks > sis->max)
nr_pblocks -= blks_per_sec;
/* this extent is last one */
if (!nr_pblocks) {
nr_pblocks = last_lblock - cur_lblock;
last_extent = true;
}
ret = f2fs_migrate_blocks(inode, cur_lblock, nr_pblocks);
if (ret) {
if (ret == -ENOENT)
ret = -EINVAL;
goto out;
}
if (!last_extent)
goto retry;
}When the first extent is unaligned and roundup(nr_pblocks, blks_per_sec) exceeds sis->max, we subtract blks_per_sec resulting in nr_pblocks = 0. The code then incorrectly assumes this is the last extent, sets nr_pblocks = last_lblock - cur_lblock (entire swapfile), and performs migration. After migration, it doesn't retry mapping, so subsequent extents are never processed. "
In order to fix this issue, we need to lookup block mapping info after we migrate all blocks in the tail of swapfile.
--- fs/f2fs/data.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
fs/f2fs/data.c +7 -7
@@ -3935,6 +3935,7 @@ static int check_swap_activate(struct swwhile (cur_lblock < last_lblock && cur_lblock < sis->max) {struct f2fs_map_blocks map; +bool last_extent = false; retry:cond_resched ();
@@ -3960,11 +3961,10 @@ retry: pblock = map.m_pblk; nr_pblocks = map.m_len; -if ((pblock -SM_I (sbi)->main_blkaddr) % blks_per_sec || - nr_pblocks % blks_per_sec || -f2fs_is_sequential_zone_area (sbi, pblock)) { -bool last_extent = false; - +if (!last_extent && + ((pblock -SM_I (sbi)->main_blkaddr) % blks_per_sec || + nr_pblocks % blks_per_sec || +f2fs_is_sequential_zone_area (sbi, pblock))) { not_aligned++; nr_pblocks =roundup (nr_pblocks, blks_per_sec);
@@ -3985,8 +3985,8 @@ retry: goto out; } -if (!last_extent) - goto retry; +/* lookup block mapping info after block migration */ + goto retry; }if (cur_lblock + nr_pblocks >= sis->max)
Greg Kroah-Hartman
maintainerPATCH 13/18 f2fs: optimize f2fs_overwrite_io() for f2fs_iomap_begin
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yeongjin Gil <[email protected]>
commit d860974a7e38d35e9e2c4dc8a9f4223b38b6ad99 upstream.
When overwriting already allocated blocks, f2fs_iomap_begin() calls f2fs_overwrite_io() to check block mappings. However, f2fs_overwrite_io() iterates through all mapped blocks in the range, which can be inefficient for fragmented files with large I/O requests.
This patch optimizes f2fs_overwrite_io() by adding a 'check_first' parameter and introducing __f2fs_overwrite_io() helper. When called from f2fs_iomap_begin(), we only check the first mapping to determine if the range is already allocated, which is sufficient for setting map.m_may_create.
This optimization significantly reduces the number of f2fs_map_blocks() calls in f2fs_overwrite_io() when called from f2fs_iomap_begin(), especially for fragmented files with large I/O requests.
--- fs/f2fs/data.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/f2fs/data.c +10 -2
@@ -1799,7 +1799,8 @@ out:return err; } -bool f2fs_overwrite_io (struct inode *inode,loff_t pos,size_t len) +static bool __f2fs_overwrite_io (struct inode *inode,loff_t pos,size_t len, +bool check_first) {struct f2fs_map_blocks map;block_t last_lblk;
@@ -1821,10 +1822,17 @@ bool f2fs_overwrite_io(struct inode *inoif (err || map.m_len ==0 )return false; map.m_lblk += map.m_len; +if (check_first) +break ; }return true; } +bool f2fs_overwrite_io (struct inode *inode,loff_t pos,size_t len) +{ +return __f2fs_overwrite_io (inode, pos, len, false); +} +static int f2fs_xattr_fiemap (struct inode *inode,struct fiemap_extent_info *fieinfo) {
@@ -4187,7 +4195,7 @@ static int f2fs_iomap_begin(struct inode* f2fs_map_lock and f2fs_balance_fs are not necessary. */ if ((flags &IOMAP_WRITE ) && - !f2fs_overwrite_io (inode, offset, length)) + !__f2fs_overwrite_io (inode, offset, length, true)) map.m_may_create = true; err =f2fs_map_blocks (inode, &map,F2FS_GET_BLOCK_DIO );
Greg Kroah-Hartman
maintainerPATCH 14/18 iommu/arm-smmu-qcom: do not register driver in probe()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danilo Krummrich <[email protected]>
commit ed1ac3c977dd6b119405fa36dd41f7151bd5b4de upstream.
Commit 0b4eeee2876f ("iommu/arm-smmu-qcom: Register the TBU driver in qcom_smmu_impl_init") intended to also probe the TBU driver when CONFIG_ARM_SMMU_QCOM_DEBUG is disabled, but also moved the corresponding platform_driver_register() call into qcom_smmu_impl_init() which is called from arm_smmu_device_probe().
However, it neither makes sense to register drivers from probe() callbacks of other drivers, nor does the driver core allow registering drivers with a device lock already being held.
The latter was revealed by commit dc23806a7c47 ("driver core: enforce device_lock for driver_match_device()") leading to a deadlock condition described in [1].
Additionally, it was noted by Robin that the current approach is potentially racy with async probe [2].
Hence, fix this by registering the qcom_smmu_tbu_driver from module_init(). Unfortunately, due to the vendoring of the driver, this requires an indirection through arm-smmu-impl.c.
--- drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 ++++++++++++++ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 ++++++++++---- drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 +++++++++++++++++++++++- drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 +++++ 4 files changed, 52 insertions(+), 5 deletions(-)
drivers/iommu/arm/arm-smmu/arm-smmu-impl.c +14 -0
@@ -228,3 +228,17 @@ struct arm_smmu_device *arm_smmu_impl_inreturn smmu; } + +int __init arm_smmu_impl_module_init (void ) +{ +if (IS_ENABLED (CONFIG_ARM_SMMU_QCOM )) +return qcom_smmu_module_init (); + +return 0 ; +} + +void __exit arm_smmu_impl_module_exit(void) +{ +if (IS_ENABLED (CONFIG_ARM_SMMU_QCOM )) +qcom_smmu_module_exit (); +}
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c +10 -4
@@ -774,10 +774,6 @@ struct arm_smmu_device *qcom_smmu_impl_i {const struct device_node *np = smmu->dev->of_node;const struct of_device_id *match; -static u8 tbu_registered; - -if (!tbu_registered++) -platform_driver_register (&qcom_smmu_tbu_driver);#ifdef CONFIG_ACPI if (np ==NULL ) {
@@ -802,3 +798,13 @@ struct arm_smmu_device *qcom_smmu_impl_ireturn smmu; } + +int __init qcom_smmu_module_init (void ) +{ +return platform_driver_register (&qcom_smmu_tbu_driver); +} + +void __exit qcom_smmu_module_exit(void) +{ +platform_driver_unregister (&qcom_smmu_tbu_driver); +}
drivers/iommu/arm/arm-smmu/arm-smmu.c +23 -1
@@ -2365,7 +2365,29 @@ static struct platform_driver arm_smmu_d .remove = arm_smmu_device_remove, .shutdown = arm_smmu_device_shutdown, }; -module_platform_driver (arm_smmu_driver); + +static int __init arm_smmu_init (void ) +{ +int ret; + + ret =platform_driver_register (&arm_smmu_driver); +if (ret) +return ret; + + ret =arm_smmu_impl_module_init (); +if (ret) +platform_driver_unregister (&arm_smmu_driver); + +return ret; +} +module_init (arm_smmu_init); + +static void __exit arm_smmu_exit(void) +{ +arm_smmu_impl_module_exit (); +platform_driver_unregister (&arm_smmu_driver); +} +module_exit (arm_smmu_exit);MODULE_DESCRIPTION ("IOMMU API for ARM architected SMMU implementations" );MODULE_AUTHOR ("Will Deacon <[email protected]>" );
drivers/iommu/arm/arm-smmu/arm-smmu.h +5 -0
@@ -540,6 +540,11 @@ struct arm_smmu_device *arm_smmu_impl_instruct arm_smmu_device *nvidia_smmu_impl_init (struct arm_smmu_device *smmu);struct arm_smmu_device *qcom_smmu_impl_init (struct arm_smmu_device *smmu); +int __init arm_smmu_impl_module_init (void ); +void __exit arm_smmu_impl_module_exit(void); +int __init qcom_smmu_module_init (void ); +void __exit qcom_smmu_module_exit(void); +void arm_smmu_write_context_bank (struct arm_smmu_device *smmu,int idx);int arm_mmu500_reset (struct arm_smmu_device *smmu);
Greg Kroah-Hartman
maintainerPATCH 15/18 Revert "f2fs: block cache/dio write during f2fs_enable_checkpoint()"
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 3996b70209f145bfcf2afc7d05dd92c27b233b48 ]
This reverts commit 196c81fdd438f7ac429d5639090a9816abb9760a.
Original patch may cause below deadlock, revert it.
write remount
- write_begin
- lock_page --- lock A
- prepare_write_begin
- f2fs_map_lock
- f2fs_enable_checkpoint
- down_write(cp_enable_rwsem) --- lock B
- sync_inode_sb
- writepages
- lock_page --- lock A
- down_read(cp_enable_rwsem) --- lock A
--- fs/f2fs/data.c | 2 -- fs/f2fs/f2fs.h | 3 +-- fs/f2fs/super.c | 38 ++++++++------------------------------ 3 files changed, 9 insertions(+), 34 deletions(-)
fs/f2fs/data.c +0 -2
@@ -1424,7 +1424,6 @@ static int __allocate_data_block(structstatic void f2fs_map_lock (struct f2fs_sb_info *sbi,int flag) { -f2fs_down_read (&sbi->cp_enable_rwsem);if (flag ==F2FS_GET_BLOCK_PRE_AIO )f2fs_down_read (&sbi->node_change);else
@@ -1437,7 +1436,6 @@ static void f2fs_map_unlock(struct f2fs_f2fs_up_read (&sbi->node_change); elsef2fs_unlock_op (sbi ); -f2fs_up_read (&sbi->cp_enable_rwsem); }int f2fs_get_block_locked (struct dnode_of_data *dn,pgoff_t index)
fs/f2fs/f2fs.h +1 -2
@@ -287,7 +287,7 @@ enum {#define DEF_CP_INTERVAL 60/* 60 secs */ #define DEF_IDLE_INTERVAL 5/* 5 secs */ #define DEF_DISABLE_INTERVAL 5/* 5 secs */ -#define DEF_ENABLE_INTERVAL 5/* 5 secs */ +#define DEF_ENABLE_INTERVAL 16/* 16 secs */ #define DEF_DISABLE_QUICK_INTERVAL 1/* 1 secs */ #define DEF_UMOUNT_DISCARD_TIMEOUT 5/* 5 secs */
@@ -1720,7 +1720,6 @@ struct f2fs_sb_info {long interval_time[MAX_TIME ];/* to store thresholds */ struct ckpt_req_control cprc_info;/* for checkpoint request control */ struct cp_stats cp_stats;/* for time stat of checkpoint */ -struct f2fs_rwsem cp_enable_rwsem;/* block cache/dio write */ struct inode_management im[MAX_INO_ENTRY ];/* manage inode cache */
fs/f2fs/super.c +8 -30
@@ -2636,11 +2636,10 @@ restore_flag:static int f2fs_enable_checkpoint (struct f2fs_sb_info *sbi) {unsigned int nr_pages =get_pages (sbi,F2FS_DIRTY_DATA ) /16 ; -long long start, writeback, lock, sync_inode, end; +long long start, writeback, end;int ret; -f2fs_info (sbi,"%s start, meta: %lld, node: %lld, data: %lld" , - __func__, +f2fs_info (sbi,"f2fs_enable_checkpoint() starts, meta: %lld, node: %lld, data: %lld" ,get_pages (sbi,F2FS_DIRTY_META ),get_pages (sbi,F2FS_DIRTY_NODES ),get_pages (sbi,F2FS_DIRTY_DATA ));
@@ -2659,18 +2658,11 @@ static int f2fs_enable_checkpoint(struct } writeback =ktime_get (); -f2fs_down_write (&sbi->cp_enable_rwsem); - - lock =ktime_get (); - -if (get_pages (sbi,F2FS_DIRTY_DATA )) -sync_inodes_sb (sbi->sb); +sync_inodes_sb (sbi->sb);if (unlikely (get_pages (sbi,F2FS_DIRTY_DATA ))) -f2fs_warn (sbi,"%s: has some unwritten data: %lld" , - __func__,get_pages (sbi,F2FS_DIRTY_DATA )); - - sync_inode =ktime_get (); +f2fs_warn (sbi,"checkpoint=enable has some unwritten data: %lld" , +get_pages (sbi,F2FS_DIRTY_DATA ));f2fs_down_write (&sbi->gc_lock);f2fs_dirty_to_prefree (sbi);
@@ -2679,13 +2671,6 @@ static int f2fs_enable_checkpoint(structset_sbi_flag (sbi,SBI_IS_DIRTY );f2fs_up_write (&sbi->gc_lock); -f2fs_info (sbi,"%s sync_fs, meta: %lld, imeta: %lld, node: %lld, dents: %lld, qdata: %lld" , - __func__, -get_pages (sbi,F2FS_DIRTY_META ), -get_pages (sbi,F2FS_DIRTY_IMETA ), -get_pages (sbi,F2FS_DIRTY_NODES ), -get_pages (sbi,F2FS_DIRTY_DENTS ), -get_pages (sbi,F2FS_DIRTY_QDATA )); ret =f2fs_sync_fs (sbi->sb,1 );if (ret)f2fs_err (sbi,"%s sync_fs failed, ret: %d" , __func__, ret);
@@ -2693,17 +2678,11 @@ static int f2fs_enable_checkpoint(struct/* Let's ensure there's no pending checkpoint anymore */ f2fs_flush_ckpt_thread (sbi); -f2fs_up_write (&sbi->cp_enable_rwsem); - end =ktime_get (); -f2fs_info (sbi,"%s end, writeback:%llu, " -"lock:%llu, sync_inode:%llu, sync_fs:%llu" , - __func__, -ktime_ms_delta (writeback, start), -ktime_ms_delta (lock, writeback), -ktime_ms_delta (sync_inode, lock), -ktime_ms_delta (end, sync_inode)); +f2fs_info (sbi,"f2fs_enable_checkpoint() finishes, writeback:%llu, sync:%llu" , +ktime_ms_delta (writeback, start), +ktime_ms_delta (end, writeback));return ret; }
@@ -4904,7 +4883,6 @@ try_onemore:init_f2fs_rwsem (&sbi->node_change);spin_lock_init (&sbi->stat_lock);init_f2fs_rwsem (&sbi->cp_rwsem); -init_f2fs_rwsem (&sbi->cp_enable_rwsem);init_f2fs_rwsem (&sbi->quota_sem);init_waitqueue_head (&sbi->cp_wait);spin_lock_init (&sbi->error_lock);
Greg Kroah-Hartman
maintainerPATCH 16/18 USB: serial: option: add Telit FN920C04 RNDIS compositions
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <[email protected]>
commit 509f403f3ccec14188036212118651bf23599396 upstream.
Add the following compositions:
0x10a1: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a1 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10a6: RNDIS + tty (AT/NMEA) + tty (AT) + tty (diag)
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10a6 Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
0x10ab: RNDIS + tty (AT) + tty (diag) + DPL (Data Packet Logging) + adb
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=10ab Rev=05.15 S: Manufacturer=Telit Cinterion S: Product=FN920 S: SerialNumber=d128dba9 C: #Ifs= 6 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=82(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=80 Driver=(none) E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1401,12 +1401,16 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a1, 0xff), /* Telit FN20C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a2, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a3, 0xff), /* Telit FN920C04 (ECM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff), /* Telit FN20C04 (rmnet) */ .driver_info = RSVD(0) | NCTRL(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a6, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a7, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a8, 0xff), /* Telit FN920C04 (ECM) */
@@ -1415,6 +1419,8 @@ static const struct usb_device_id option .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10aa, 0xff), /* Telit FN920C04 (MBIM) */ .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10ab, 0xff), /* Telit FN920C04 (RNDIS) */ + .driver_info = NCTRL(3) | RSVD(4) | RSVD(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x30), /* Telit FE990B (rmnet) */ .driver_info = NCTRL(5) }, { USB_DEVICE_AND_INTERFACE_INFO(TELIT_VENDOR_ID, 0x10b0, 0xff, 0xff, 0x40) },
Greg Kroah-Hartman
maintainerPATCH 17/18 f2fs: fix to do sanity check on node footer in __write_node_folio()
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 0a736109c9d29de0c26567e42cb99b27861aa8ba ]
Add node footer sanity check during node folio's writeback, if sanity check fails, let's shutdown filesystem to avoid looping to redirty and writeback in .writepages.
--- fs/f2fs/node.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/node.c +5 -1
@@ -1751,7 +1751,11 @@ static bool __write_node_folio(struct fo/* get old block addr of this node page */ nid =nid_of_node (folio); -f2fs_bug_on (sbi, folio->index != nid); + +if (sanity_check_node_footer (sbi, folio, nid,NODE_TYPE_REGULAR )) { +f2fs_handle_critical_error (sbi,STOP_CP_REASON_CORRUPTED_NID ); + goto redirty_out; + }if (f2fs_get_node_info (sbi, nid, &ni, !do_balance)) goto redirty_out;
Greg Kroah-Hartman
maintainerPATCH 18/18 f2fs: fix to do sanity check on node footer in {read,write}_end_io
In reply to Greg Kroah-Hartman6.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 50ac3ecd8e05b6bcc350c71a4307d40c030ec7e4 ]
-----------[ cut here ]------------
kernel BUG at fs/f2fs/data.c:358!
Call Trace: <IRQ> blk_update_request+0x5eb/0xe70 block/blk-mq.c:987 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149 blk_complete_reqs block/blk-mq.c:1224 [inline] blk_done_softirq+0x107/0x160 block/blk-mq.c:1229 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 </IRQ>
In f2fs_write_end_io(), it detects there is inconsistency in between node page index (nid) and footer.nid of node page.
If footer of node page is corrupted in fuzzed image, then we load corrupted node page w/ async method, e.g. f2fs_ra_node_pages() or f2fs_ra_node_page(), in where we won't do sanity check on node footer, once node page becomes dirty, we will encounter this bug after node page writeback.
--- fs/f2fs/data.c | 13 +++++++++++-- fs/f2fs/f2fs.h | 12 ++++++++++++ fs/f2fs/node.c | 20 +++++++++++--------- fs/f2fs/node.h | 8 -------- 4 files changed, 34 insertions(+), 19 deletions(-)
fs/f2fs/data.c +11 -2
@@ -151,6 +151,12 @@ static void f2fs_finish_read_bio(struct }dec_page_count (F2FS_F_SB (folio),__read_io_type (folio)); + +if (F2FS_F_SB (folio)->node_inode &&is_node_folio (folio) && +f2fs_sanity_check_node_footer (F2FS_F_SB (folio), + folio, folio->index,NODE_TYPE_REGULAR , true)) + bio->bi_status =BLK_STS_IOERR ; +folio_end_read (folio, bio->bi_status ==BLK_STS_OK ); }
@@ -352,8 +358,11 @@ static void f2fs_write_end_io(struct bio STOP_CP_REASON_WRITE_FAIL); } -f2fs_bug_on (sbi,is_node_folio (folio) && - folio->index !=nid_of_node (folio)); +if (is_node_folio (folio)) { +f2fs_sanity_check_node_footer (sbi, folio, + folio->index,NODE_TYPE_REGULAR , true); +f2fs_bug_on (sbi, folio->index !=nid_of_node (folio)); + }dec_page_count (sbi, type);
fs/f2fs/f2fs.h +12 -0
@@ -1529,6 +1529,15 @@ enum f2fs_lookup_mode { LOOKUP_AUTO, }; +/* For node type in __get_node_folio() */ +enum node_type { +NODE_TYPE_REGULAR , +NODE_TYPE_INODE , +NODE_TYPE_XATTR , +NODE_TYPE_NON_INODE , +}; + +static inline int f2fs_test_bit (unsigned int nr,char *addr);static inline void f2fs_set_bit (unsigned int nr,char *addr);static inline void f2fs_clear_bit (unsigned int nr,char *addr);
@@ -3877,6 +3886,9 @@ struct folio *f2fs_new_node_folio(structvoid f2fs_ra_node_page (struct f2fs_sb_info *sbi,nid_t nid);struct folio *f2fs_get_node_folio (struct f2fs_sb_info *sbi,pgoff_t nid,enum node_type node_type); +int f2fs_sanity_check_node_footer (struct f2fs_sb_info *sbi, +struct folio *folio,pgoff_t nid, +enum node_type ntype,bool in_irq);struct folio *f2fs_get_inode_folio (struct f2fs_sb_info *sbi,pgoff_t ino);struct folio *f2fs_get_xnode_folio (struct f2fs_sb_info *sbi,pgoff_t xnid);int f2fs_move_node_folio (struct folio *node_folio,int gc_type);
fs/f2fs/node.c +11 -9
@@ -1500,9 +1500,9 @@ void f2fs_ra_node_page(struct f2fs_sb_inf2fs_folio_put (afolio, err ? true : false); } -static int sanity_check_node_footer (struct f2fs_sb_info *sbi, +int f2fs_sanity_check_node_footer (struct f2fs_sb_info *sbi,struct folio *folio,pgoff_t nid, -enum node_type ntype) +enum node_type ntype,bool in_irq) {if (unlikely (nid !=nid_of_node (folio))) goto out_err;
@@ -1527,12 +1527,13 @@ static int sanity_check_node_footer(stru goto out_err;return 0 ; out_err: -f2fs_warn (sbi,"inconsistent node block, node_type:%d, nid:%lu, " -"node_footer[nid:%u,ino:%u,ofs:%u,cpver:%llu,blkaddr:%u]" , - ntype, nid,nid_of_node (folio),ino_of_node (folio), -ofs_of_node (folio),cpver_of_node (folio), -next_blkaddr_of_node (folio));set_sbi_flag (sbi,SBI_NEED_FSCK ); +f2fs_warn_ratelimited (sbi,"inconsistent node block, node_type:%d, nid:%lu, " +"node_footer[nid:%u,ino:%u,ofs:%u,cpver:%llu,blkaddr:%u]" , + ntype, nid,nid_of_node (folio),ino_of_node (folio), +ofs_of_node (folio),cpver_of_node (folio), +next_blkaddr_of_node (folio)); +f2fs_handle_error (sbi,ERROR_INCONSISTENT_FOOTER );return -EFSCORRUPTED ; }
@@ -1578,7 +1579,7 @@ repeat: goto out_err; } page_hit: - err =sanity_check_node_footer (sbi, folio, nid, ntype); + err =f2fs_sanity_check_node_footer (sbi, folio, nid, ntype, false);if (!err)return folio; out_err:
@@ -1752,7 +1753,8 @@ static bool __write_node_folio(struct fo/* get old block addr of this node page */ nid =nid_of_node (folio); -if (sanity_check_node_footer (sbi, folio, nid,NODE_TYPE_REGULAR )) { +if (f2fs_sanity_check_node_footer (sbi, folio, nid, +NODE_TYPE_REGULAR , false)) {f2fs_handle_critical_error (sbi,STOP_CP_REASON_CORRUPTED_NID ); goto redirty_out; }
fs/f2fs/node.h +0 -8
@@ -52,14 +52,6 @@ enum { IS_PREALLOC, /* nat entry is preallocated */ }; -/* For node type in __get_node_folio() */ -enum node_type { -NODE_TYPE_REGULAR , -NODE_TYPE_INODE , -NODE_TYPE_XATTR , -NODE_TYPE_NON_INODE , -}; -/* * For node information */
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Hi Greg
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
6.19.3-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.19.3-rc1rv-g40e4767c6df5
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 15.2.1 20260209, GNU ld (GNU Binutils) 2.46) #1 SMP PREEMPT_DYNAMIC Wed Feb 18 08:05:33 JST 2026
Thanks
Am 17.02.2026 um 21:31 schrieb Greg Kroah-Hartman:
Quoted 4 lines
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg oddities or regressions found.
Beste Grüße,
Peter Schneider
Signature · 8 lines
Climb the mountain not to plant your flag, but to embrace the challenge, enjoy the air and behold the view. Climb it so you can see the world, not so the world can see you. -- David McCullough Jr. OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244 Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc https://keys.mailvelope.com/pks/lookup?op=get&[email protected] https://keys.mailvelope.com/pks/lookup?op=get&[email protected]
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v6.19:
9 builds: 9 pass, 0 fail
28 boots: 28 pass, 0 fail
133 tests: 133 pass, 0 failLinux version: 6.19.3-rc1-g40e4767c6df5
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra186-p3509-0000+p3636-0001, tegra194-p2972-0000,
tegra194-p3509-0000+p3668-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
# Librecast Test Results
020/020 [ OK ] liblcrq
010/010 [ OK ] libmld
120/120 [ OK ] liblibrecast
CPU/kernel: Linux auntie 6.19.3-rc1-g40e4767c6df5 #3 SMP PREEMPT_DYNAMIC Wed Feb 18 08:36:31 -00 2026 x86_64 AMD Ryzen 9 9950X 16-Core Processor AuthenticAMD GNU/Linux
Quoted 4 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den tis 17 feb. 2026 kl 21:51 skrev Greg Kroah-Hartman <[email protected]>:
Quoted 110 lines
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 6.19.3-rc1Chao Yu <[email protected]>
f2fs: fix to do sanity check on node footer in {read,write}_end_ioChao Yu <[email protected]>
f2fs: fix to do sanity check on node footer in__write_node_folio()Fabio Porcedda <[email protected]>
USB: serial: option: add Telit FN920C04 RNDIS compositionsChao Yu <[email protected]>
Revert "f2fs: block cache/dio write duringf2fs_enable_checkpoint()"Danilo Krummrich <[email protected]>
iommu/arm-smmu-qcom: do not register driver inprobe()Yeongjin Gil <[email protected]>
f2fs: optimizef2fs_overwrite_io()forf2fs_iomap_beginChao Yu <[email protected]>
f2fs: fix to avoid mapping wrong physical block for swapfileDaeho Jeong <[email protected]>
f2fs: support non-4KB block size withoutpacked_ssafeatureChao Yu <[email protected]>
f2fs: fix to avoid UAF inf2fs_write_end_io()Yongpeng Yang <[email protected]>
f2fs: fix out-of-bounds access in sysfs attribute read/writeYongpeng Yang <[email protected]>
f2fs: fixIS_CHECKPOINTEDflag inconsistency issue caused by concurrent atomic commit and checkpoint writesChao Yu <[email protected]>
f2fs: fix to check sysfs filename w/gc_pin_file_threshcorrectlyZhiguo Niu <[email protected]>
f2fs: fix to add gc count stat inf2fs_gc_rangeGreg Kroah-Hartman <[email protected]>
fbdev: smscufx: properly copy ioctl memory to kernelspaceGuangshuo Li <[email protected]>
fbdev: rivafb: fix divide error innv3_arb()Tiezhu Yang <[email protected]>
LoongArch: Rework KASAN initialization for PTW-enabled systemsOtto Pflüger <[email protected]>
arm64: dts: mediatek: mt8183: Add missing endpoint IDs to display graphAnil Gurumurthy <[email protected]>
scsi: qla2xxx: Fixbsg_done()causing double free-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/mediatek/mt8183.dtsi | 37 ++++++++++--- arch/loongarch/mm/kasan_init.c | 80 +++++++++++++-------------- drivers/iommu/arm/arm-smmu/arm-smmu-impl.c | 14 +++++ drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 14 +++-- drivers/iommu/arm/arm-smmu/arm-smmu.c | 24 ++++++++- drivers/iommu/arm/arm-smmu/arm-smmu.h | 5 ++ drivers/scsi/qla2xxx/qla_bsg.c | 28 ++++++---- drivers/usb/serial/option.c | 6 +++ drivers/video/fbdev/riva/riva_hw.c | 3 ++ drivers/video/fbdev/smscufx.c | 8 ++- fs/f2fs/data.c | 53 ++++++++++++------ fs/f2fs/f2fs.h | 67 +++++++++++++++++------ fs/f2fs/gc.c | 24 +++++---- fs/f2fs/node.c | 50 ++++++++++------- fs/f2fs/node.h | 8 --- fs/f2fs/recovery.c | 6 +-- fs/f2fs/segment.c | 86 ++++++++++++++++-------------- fs/f2fs/segment.h | 9 ++-- fs/f2fs/super.c | 64 +++++++--------------- fs/f2fs/sysfs.c | 62 +++++++++++++++++---- include/linux/f2fs_fs.h | 73 +++++++++++++++---------- 22 files changed, 460 insertions(+), 265 deletions(-)
Hi
no regressions here on x86_64 (Intel 11th Gen. CPU)
Thanks
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x, x86_64), and boot tested x86_64. No regressions noted.
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.19.3-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-6.19.y
and the diffstat can be found below.thanks,
greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Quoted 8 lines · On Tue, 17 Feb 2026 21:31:56 +0100 Greg Kroah-Hartman…
This is the start of the stable review cycle for the 6.19.3 release. There are 18 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 19 Feb 2026 19:59:50 +0000. Anything received after that time might be too late.
Boot-tested under QEMU for Rust x86_64, arm64 and riscv64; built-tested for loongarch64:
The same couple build errors and the warning still apply, from 6.19.1 (and 6.19.2):
https://lore.kernel.org/stable/[email protected]/
Thanks!
Cheers,
Miguel