4.19-stable patches

added patches:
	rpmsg-core-clean-up-resources-on-announce_create-failure.patch
	ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch

diff --git a/queue-4.19/rpmsg-core-clean-up-resources-on-announce_create-failure.patch b/queue-4.19/rpmsg-core-clean-up-resources-on-announce_create-failure.patch
new file mode 100644 (file)
index 0000000..cbf30c6
--- /dev/null
+++ b/queue-4.19/rpmsg-core-clean-up-resources-on-announce_create-failure.patch
@@ -0,0 +1,57 @@
+From 8066c615cb69b7da8a94f59379847b037b3a5e46 Mon Sep 17 00:00:00 2001
+From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+Date: Mon, 6 Dec 2021 20:07:58 +0100
+Subject: rpmsg: core: Clean up resources on announce_create failure.
+
+From: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+
+commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream.
+
+During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an
+error, the rpmsg device and default endpoint should be freed before
+exiting the function.
+
+Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend")
+Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com>
+Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com
+Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/rpmsg/rpmsg_core.c |   20 ++++++++++++++++----
+ 1 file changed, 16 insertions(+), 4 deletions(-)
+
+--- a/drivers/rpmsg/rpmsg_core.c
++++ b/drivers/rpmsg/rpmsg_core.c
+@@ -473,13 +473,25 @@ static int rpmsg_dev_probe(struct device
+       err = rpdrv->probe(rpdev);
+       if (err) {
+               dev_err(dev, "%s: failed: %d\n", __func__, err);
+-              if (ept)
+-                      rpmsg_destroy_ept(ept);
+-              goto out;
++              goto destroy_ept;
+       }
+ 
+-      if (ept && rpdev->ops->announce_create)
++      if (ept && rpdev->ops->announce_create) {
+               err = rpdev->ops->announce_create(rpdev);
++              if (err) {
++                      dev_err(dev, "failed to announce creation\n");
++                      goto remove_rpdev;
++              }
++      }
++
++      return 0;
++
++remove_rpdev:
++      if (rpdrv->remove)
++              rpdrv->remove(rpdev);
++destroy_ept:
++      if (ept)
++              rpmsg_destroy_ept(ept);
+ out:
+       return err;
+ }

diff --git a/queue-4.19/series b/queue-4.19/series
index 3d0224d285f52d0a0028cb5e73f51afc81036159..aa29d6320f3a3097072151a7d4f62350148fd629 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -192,3 +192,5 @@ mips-octeon-fix-build-errors-using-clang.patch
 scsi-sr-don-t-use-gfp_dma.patch
 asoc-mediatek-mt8173-fix-device_node-leak.patch
 power-bq25890-enable-continuous-conversion-for-adc-a.patch
+rpmsg-core-clean-up-resources-on-announce_create-failure.patch
+ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch

diff --git a/queue-4.19/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch b/queue-4.19/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch
new file mode 100644 (file)
index 0000000..251fec6
--- /dev/null
+++ b/queue-4.19/ubifs-error-path-in-ubifs_remount_rw-seems-to-wrongly-free-write-buffers.patch
@@ -0,0 +1,105 @@
+From 3fea4d9d160186617ff40490ae01f4f4f36b28ff Mon Sep 17 00:00:00 2001
+From: Petr Cvachoucek <cvachoucek@gmail.com>
+Date: Mon, 30 Aug 2021 21:20:37 +0200
+Subject: ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers
+
+From: Petr Cvachoucek <cvachoucek@gmail.com>
+
+commit 3fea4d9d160186617ff40490ae01f4f4f36b28ff upstream.
+
+it seems freeing the write buffers in the error path of the
+ubifs_remount_rw() is wrong. It leads later to a kernel oops like this:
+
+[10016.431274] UBIFS (ubi0:0): start fixing up free space
+[10090.810042] UBIFS (ubi0:0): free space fixup complete
+[10090.814623] UBIFS error (ubi0:0 pid 512): ubifs_remount_fs: cannot
+spawn "ubifs_bgt0_0", error -4
+[10101.915108] UBIFS (ubi0:0): background thread "ubifs_bgt0_0" started,
+PID 517
+[10105.275498] Unable to handle kernel NULL pointer dereference at
+virtual address 0000000000000030
+[10105.284352] Mem abort info:
+[10105.287160]   ESR = 0x96000006
+[10105.290252]   EC = 0x25: DABT (current EL), IL = 32 bits
+[10105.295592]   SET = 0, FnV = 0
+[10105.298652]   EA = 0, S1PTW = 0
+[10105.301848] Data abort info:
+[10105.304723]   ISV = 0, ISS = 0x00000006
+[10105.308573]   CM = 0, WnR = 0
+[10105.311564] user pgtable: 4k pages, 48-bit VAs, pgdp=00000000f03d1000
+[10105.318034] [0000000000000030] pgd=00000000f6cee003,
+pud=00000000f4884003, pmd=0000000000000000
+[10105.326783] Internal error: Oops: 96000006 [#1] PREEMPT SMP
+[10105.332355] Modules linked in: ath10k_pci ath10k_core ath mac80211
+libarc4 cfg80211 nvme nvme_core cryptodev(O)
+[10105.342468] CPU: 3 PID: 518 Comm: touch Tainted: G           O
+5.4.3 #1
+[10105.349517] Hardware name: HYPEX CPU (DT)
+[10105.353525] pstate: 40000005 (nZcv daif -PAN -UAO)
+[10105.358324] pc : atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34
+[10105.364596] lr : mutex_lock+0x1c/0x34
+[10105.368253] sp : ffff000075633aa0
+[10105.371563] x29: ffff000075633aa0 x28: 0000000000000001
+[10105.376874] x27: ffff000076fa80c8 x26: 0000000000000004
+[10105.382185] x25: 0000000000000030 x24: 0000000000000000
+[10105.387495] x23: 0000000000000000 x22: 0000000000000038
+[10105.392807] x21: 000000000000000c x20: ffff000076fa80c8
+[10105.398119] x19: ffff000076fa8000 x18: 0000000000000000
+[10105.403429] x17: 0000000000000000 x16: 0000000000000000
+[10105.408741] x15: 0000000000000000 x14: fefefefefefefeff
+[10105.414052] x13: 0000000000000000 x12: 0000000000000fe0
+[10105.419364] x11: 0000000000000fe0 x10: ffff000076709020
+[10105.424675] x9 : 0000000000000000 x8 : 00000000000000a0
+[10105.429986] x7 : ffff000076fa80f4 x6 : 0000000000000030
+[10105.435297] x5 : 0000000000000000 x4 : 0000000000000000
+[10105.440609] x3 : 0000000000000000 x2 : ffff00006f276040
+[10105.445920] x1 : ffff000075633ab8 x0 : 0000000000000030
+[10105.451232] Call trace:
+[10105.453676]  atomic64_try_cmpxchg_acquire.constprop.22+0x8/0x34
+[10105.459600]  ubifs_garbage_collect+0xb4/0x334
+[10105.463956]  ubifs_budget_space+0x398/0x458
+[10105.468139]  ubifs_create+0x50/0x180
+[10105.471712]  path_openat+0x6a0/0x9b0
+[10105.475284]  do_filp_open+0x34/0x7c
+[10105.478771]  do_sys_open+0x78/0xe4
+[10105.482170]  __arm64_sys_openat+0x1c/0x24
+[10105.486180]  el0_svc_handler+0x84/0xc8
+[10105.489928]  el0_svc+0x8/0xc
+[10105.492808] Code: 52800013 17fffffb d2800003 f9800011 (c85ffc05)
+[10105.498903] ---[ end trace 46b721d93267a586 ]---
+
+To reproduce the problem:
+
+1. Filesystem initially mounted read-only, free space fixup flag set.
+
+2. mount -o remount,rw <mountpoint>
+
+3. it takes some time (free space fixup running)
+    ... try to terminate running mount by CTRL-C
+    ... does not respond, only after free space fixup is complete
+    ... then "ubifs_remount_fs: cannot spawn "ubifs_bgt0_0", error -4"
+
+4. mount -o remount,rw <mountpoint>
+    ... now finished instantly (fixup already done).
+
+5. Create file or just unmount the filesystem and we get the oops.
+
+Cc: <stable@vger.kernel.org>
+Fixes: b50b9f408502 ("UBIFS: do not free write-buffers when in R/O mode")
+Signed-off-by: Petr Cvachoucek <cvachoucek@gmail.com>
+Signed-off-by: Richard Weinberger <richard@nod.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/ubifs/super.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/fs/ubifs/super.c
++++ b/fs/ubifs/super.c
+@@ -1730,7 +1730,6 @@ out:
+               kthread_stop(c->bgt);
+               c->bgt = NULL;
+       }
+-      free_wbufs(c);
+       kfree(c->write_reserve_buf);
+       c->write_reserve_buf = NULL;
+       vfree(c->ileb_buf);