[meta,07/11] linux-yocto/7.2: yaffs2: backport upstream fixes and restore remount handling

From: Bruce Ashfield <bruce.ashfield@gmail.com>

Integrating the following commit(s) to linux-yocto/7.2:

1/7 [
    Author: george pee
    Email: georgepee@gmail.com
    Subject: fs/yaffs2: hold gross lock across rename link-count update
    Date: Tue, 27 Oct 2026 12:08:20 -0400

    yaffs_rename() dropped the yaffs gross lock before calling
    inode_dec_link_count() on the replaced target. Another thread can delete
    that inode in the window and NULL new_dentry->d_inode, giving:

      Unable to handle kernel NULL pointer dereference at virtual address 0000002c
      drop_nlink+0x4/0x3c
      yaffs_rename+0xd9/0x144
      vfs_rename2+0x2d9/0x63c

    Keep the gross lock held until after the link count is updated, and drop
    it on both the success and -ENOTEMPTY paths.

    Backport of yaffs2 upstream commit 5b23c73940bab871c0b4c9d89be349a4e325ec92
    ("Increase scope of yaffs gross lock to avoid race and kernel panic"),
    adapted to the single fs/yaffs2/yaffs_vfs.c in linux-yocto.

    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

2/7 [
    Author: Charles Manning
    Email: cdhmanning@gmail.com
    Subject: fs/yaffs2: fix size of unmanaged temp buffer allocation
    Date: Tue, 27 Oct 2026 12:08:41 -0400

    When all managed temp buffers are in use, yaffs_get_temp_buffer() falls
    back to kmalloc()ing an unmanaged one sized data_bytes_per_chunk. Callers
    such as yaffs_tags_marshall_read() read total_bytes_per_chunk into a temp
    buffer, which is larger when inband tags are in use, so the fallback
    buffer could be overrun. Allocate total_bytes_per_chunk to match the
    managed buffers.

    Backport of yaffs2 upstream commit c5d2e7ac441855236e39fff1f0de899e20676dc9
    ("yaffs_guts.c Fix size of allocated buffer for unmanaged buffers").

    Signed-off-by: Charles Manning <cdhmanning@gmail.com>
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

3/7 [
    Author: Charles Manning
    Email: cdhmanning@gmail.com
    Subject: fs/yaffs2: release temp buffers on read failure paths
    Date: Tue, 27 Oct 2026 12:08:42 -0400

    yaffs_check_obj_details_loaded() and yaffs_tags_marshall_read() take a
    temp buffer but return early on a failed chunk read without releasing it,
    leaking a managed buffer slot (or an unmanaged allocation) on every I/O
    error. Release the buffer before returning.

    Backport of yaffs2 upstream commit 42909262aa6077a60cf18dac024fd21df3b4b18a
    ("Fix unmatched temporary buffer allocations").

    Signed-off-by: Charles Manning <cdhmanning@gmail.com>
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

4/7 [
    Author: Charles Manning
    Email: cdhmanning@gmail.com
    Subject: fs/yaffs2: clear ll_init on deinitialise
    Date: Tue, 27 Oct 2026 12:08:55 -0400

    yaffs_deinitialise() tears the device down and clears is_mounted, but
    leaves ll_init set, so a subsequent initialise can believe the low-level
    layer is still set up. Clear it alongside is_mounted.

    Backport of yaffs2 upstream commit 89c47bd92c6accf5955184ba65742b20523b05a9
    ("Clear ll_init flag during de-initialisation").

    Signed-off-by: Charles Manning <cdhmanning@gmail.com>
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

5/7 [
    Author: Charles Manning
    Email: cdhmanning@gmail.com
    Subject: fs/yaffs2: fix inverted tags_marshall_query_block return value
    Date: Tue, 27 Oct 2026 12:08:56 -0400

    drv_check_bad_fn() returns YAFFS_OK for a good block, but
    yaffs_tags_marshall_query_block() treated 0 (YAFFS_FAIL) as success, so
    it reported YAFFS_FAIL for good blocks and YAFFS_OK for bad ones. No
    caller currently uses the return value (block state is passed back via
    *state), so this is benign, but return the check result directly.

    Backport of yaffs2 upstream commit b19d3c9f0ada46534e44308f72d7e70ab1e301ee
    ("Begign bug: Fix incorrect return value").

    Signed-off-by: Charles Manning <cdhmanning@gmail.com>
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

6/7 [
    Author: Bruce Ashfield
    Email: bruce.ashfield@gmail.com
    Subject: fs/yaffs2: restore remount handling via fs_context reconfigure
    Date: Tue, 27 Oct 2026 12:09:34 -0400

    The v7.0 conversion to the init_fs_context mount API removed
    .remount_fs from yaffs_super_ops but did not add a .reconfigure
    fs_context operation. As a result a remount (e.g. "mount -o remount,rw")
    never reached yaffs: dev->read_only kept its mount-time value, and
    yaffs_remount_fs() was left as an unused static function.

    Add yaffs_reconfigure() to yaffs_context_ops so a remount updates
    dev->read_only from fc->sb_flags, forcing SB_RDONLY when the MTD is not
    writeable (as the old remount_fs did), and drop the dead
    yaffs_remount_fs(). Use the already-attached MTD via yaffs_dev_to_mtd()
    instead of re-looking it up with get_mtd_device(), which leaked a
    reference on every remount.

    Fixes: 3fa3b91cc457 ("fs/yaffs2: convert to init_fs_context mount API for v7.0")
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

7/7 [
    Author: Charles Manning
    Email: cdhmanning@gmail.com
    Subject: fs/yaffs2: run deferred cleanup when remounting read-write
    Date: Tue, 27 Oct 2026 12:10:08 -0400

    When yaffs is mounted read-only, the post-scan cleanup in
    yaffs_guts_initialise() (strip deleted objects, fix hanging objects,
    empty lost+found) is skipped because those helpers bail on read_only.
    Nothing ran it later on a remount to read-write, so the deferred cleanup
    never happened, and the background GC thread was not started (or stopped
    on a rw->ro remount).

    Factor the cleanup into yaffs_guts_cleanup() and, in the remount path,
    run it under the gross lock and start the background thread on a ro->rw
    transition; stop the background thread on rw->ro.

    Backport of yaffs2 upstream commit 334eb5fc4472c791e4c4ce6d50e650d2b2732f02
    ("Handle cleanup when remounting rw after mounting read-only"), adapted
    from the old super_operations.remount_fs hook to the fs_context
    .reconfigure operation used since v7.0.

    Signed-off-by: Charles Manning <cdhmanning@gmail.com>
    Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
]

Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
---
 .../linux/linux-yocto-rt_7.2.bb               |  4 ++--
 .../linux/linux-yocto-tiny_7.2.bb             |  4 ++--
 meta/recipes-kernel/linux/linux-yocto_7.2.bb  | 20 +++++++++----------
 3 files changed, 14 insertions(+), 14 deletions(-)