--- /dev/null
+From a34ae6c0660d3b96b0055f68ef74dc9478852245 Mon Sep 17 00:00:00 2001
+From: Takashi Iwai <tiwai@suse.de>
+Date: Tue, 10 May 2022 12:36:26 +0200
+Subject: ALSA: wavefront: Proper check of get_user() error
+
+From: Takashi Iwai <tiwai@suse.de>
+
+commit a34ae6c0660d3b96b0055f68ef74dc9478852245 upstream.
+
+The antient ISA wavefront driver reads its sample patch data (uploaded
+over an ioctl) via __get_user() with no good reason; likely just for
+some performance optimizations in the past. Let's change this to the
+standard get_user() and the error check for handling the fault case
+properly.
+
+Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20220510103626.16635-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ sound/isa/wavefront/wavefront_synth.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/sound/isa/wavefront/wavefront_synth.c
++++ b/sound/isa/wavefront/wavefront_synth.c
+@@ -1088,7 +1088,8 @@ wavefront_send_sample (snd_wavefront_t *
+
+ if (dataptr < data_end) {
+
+- __get_user (sample_short, dataptr);
++ if (get_user(sample_short, dataptr))
++ return -EFAULT;
+ dataptr += skip;
+
+ if (data_is_unsigned) { /* GUS ? */
mmc-core-specify-timeouts-for-bkops-and-cache_flush-for-emmc.patch
mmc-block-use-generic_cmd6_time-when-modifying-inand_cmd38_arg_ext_csd.patch
mmc-core-default-to-generic_cmd6_time-as-timeout-in-__mmc_switch.patch
+sunrpc-clean-up-scheduling-of-autoclose.patch
+sunrpc-prevent-immediate-close-reconnect.patch
+sunrpc-don-t-call-connect-more-than-once-on-a-tcp-socket.patch
+sunrpc-ensure-we-flush-any-closed-sockets-before-xs_xprt_free.patch
+alsa-wavefront-proper-check-of-get_user-error.patch
--- /dev/null
+From foo@baz Thu May 19 04:26:41 PM CEST 2022
+From: Meena Shanmugam <meenashanmugam@google.com>
+Date: Wed, 18 May 2022 18:40:08 +0000
+Subject: SUNRPC: Clean up scheduling of autoclose
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, trond.myklebust@hammerspace.com, Anna Schumaker <Anna.Schumaker@Netapp.com>, Meena Shanmugam <meenashanmugam@google.com>
+Message-ID: <20220518184011.789699-2-meenashanmugam@google.com>
+
+From: Meena Shanmugam <meenashanmugam@google.com>
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit e26d9972720e2484f44cdd94ca4e31cc372ed2ed upstream.
+
+Consolidate duplicated code in xprt_force_disconnect() and
+xprt_conditional_disconnect().
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Meena Shanmugam <meenashanmugam@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xprt.c | 26 +++++++++++++++-----------
+ 1 file changed, 15 insertions(+), 11 deletions(-)
+
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -717,21 +717,29 @@ void xprt_disconnect_done(struct rpc_xpr
+ EXPORT_SYMBOL_GPL(xprt_disconnect_done);
+
+ /**
+- * xprt_force_disconnect - force a transport to disconnect
++ * xprt_schedule_autoclose_locked - Try to schedule an autoclose RPC call
+ * @xprt: transport to disconnect
+- *
+ */
+-void xprt_force_disconnect(struct rpc_xprt *xprt)
++static void xprt_schedule_autoclose_locked(struct rpc_xprt *xprt)
+ {
+- /* Don't race with the test_bit() in xprt_clear_locked() */
+- spin_lock(&xprt->transport_lock);
+ set_bit(XPRT_CLOSE_WAIT, &xprt->state);
+- /* Try to schedule an autoclose RPC call */
+ if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
+ queue_work(xprtiod_workqueue, &xprt->task_cleanup);
+ else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
+ rpc_wake_up_queued_task_set_status(&xprt->pending,
+ xprt->snd_task, -ENOTCONN);
++}
++
++/**
++ * xprt_force_disconnect - force a transport to disconnect
++ * @xprt: transport to disconnect
++ *
++ */
++void xprt_force_disconnect(struct rpc_xprt *xprt)
++{
++ /* Don't race with the test_bit() in xprt_clear_locked() */
++ spin_lock(&xprt->transport_lock);
++ xprt_schedule_autoclose_locked(xprt);
+ spin_unlock(&xprt->transport_lock);
+ }
+ EXPORT_SYMBOL_GPL(xprt_force_disconnect);
+@@ -771,11 +779,7 @@ void xprt_conditional_disconnect(struct
+ goto out;
+ if (test_bit(XPRT_CLOSING, &xprt->state))
+ goto out;
+- set_bit(XPRT_CLOSE_WAIT, &xprt->state);
+- /* Try to schedule an autoclose RPC call */
+- if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
+- queue_work(xprtiod_workqueue, &xprt->task_cleanup);
+- xprt_wake_pending_tasks(xprt, -EAGAIN);
++ xprt_schedule_autoclose_locked(xprt);
+ out:
+ spin_unlock(&xprt->transport_lock);
+ }
--- /dev/null
+From foo@baz Thu May 19 04:26:41 PM CEST 2022
+From: Meena Shanmugam <meenashanmugam@google.com>
+Date: Wed, 18 May 2022 18:40:10 +0000
+Subject: SUNRPC: Don't call connect() more than once on a TCP socket
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, trond.myklebust@hammerspace.com, Enrico Scholz <enrico.scholz@sigma-chemnitz.de>, Meena Shanmugam <meenashanmugam@google.com>
+Message-ID: <20220518184011.789699-4-meenashanmugam@google.com>
+
+From: Meena Shanmugam <meenashanmugam@google.com>
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 89f42494f92f448747bd8a7ab1ae8b5d5520577d upstream.
+
+Avoid socket state races due to repeated calls to ->connect() using the
+same socket. If connect() returns 0 due to the connection having
+completed, but we are in fact in a closing state, then we may leave the
+XPRT_CONNECTING flag set on the transport.
+
+Reported-by: Enrico Scholz <enrico.scholz@sigma-chemnitz.de>
+Fixes: 3be232f11a3c ("SUNRPC: Prevent immediate close+reconnect")
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+[meenashanmugam: Fix merge conflict in xs_tcp_setup_socket]
+Signed-off-by: Meena Shanmugam <meenashanmugam@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ Added fallthrough which I missed in 5.10 patch.
+
+ include/linux/sunrpc/xprtsock.h | 1 +
+ net/sunrpc/xprtsock.c | 22 ++++++++++++----------
+ 2 files changed, 13 insertions(+), 10 deletions(-)
+
+--- a/include/linux/sunrpc/xprtsock.h
++++ b/include/linux/sunrpc/xprtsock.h
+@@ -90,6 +90,7 @@ struct sock_xprt {
+ #define XPRT_SOCK_WAKE_WRITE (5)
+ #define XPRT_SOCK_WAKE_PENDING (6)
+ #define XPRT_SOCK_WAKE_DISCONNECT (7)
++#define XPRT_SOCK_CONNECT_SENT (8)
+
+ #endif /* __KERNEL__ */
+
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2384,10 +2384,14 @@ static void xs_tcp_setup_socket(struct w
+ struct rpc_xprt *xprt = &transport->xprt;
+ int status = -EIO;
+
+- if (!sock) {
+- sock = xs_create_sock(xprt, transport,
+- xs_addr(xprt)->sa_family, SOCK_STREAM,
+- IPPROTO_TCP, true);
++ if (xprt_connected(xprt))
++ goto out;
++ if (test_and_clear_bit(XPRT_SOCK_CONNECT_SENT,
++ &transport->sock_state) ||
++ !sock) {
++ xs_reset_transport(transport);
++ sock = xs_create_sock(xprt, transport, xs_addr(xprt)->sa_family,
++ SOCK_STREAM, IPPROTO_TCP, true);
+ if (IS_ERR(sock)) {
+ status = PTR_ERR(sock);
+ goto out;
+@@ -2418,6 +2422,8 @@ static void xs_tcp_setup_socket(struct w
+ break;
+ case 0:
+ case -EINPROGRESS:
++ set_bit(XPRT_SOCK_CONNECT_SENT, &transport->sock_state);
++ fallthrough;
+ case -EALREADY:
+ xprt_unlock_connect(xprt, transport);
+ return;
+@@ -2469,13 +2475,9 @@ static void xs_connect(struct rpc_xprt *
+
+ WARN_ON_ONCE(!xprt_lock_connect(xprt, task, transport));
+
+- if (transport->sock != NULL && !xprt_connecting(xprt)) {
++ if (transport->sock != NULL) {
+ dprintk("RPC: xs_connect delayed xprt %p for %lu "
+- "seconds\n",
+- xprt, xprt->reestablish_timeout / HZ);
+-
+- /* Start by resetting any existing state */
+- xs_reset_transport(transport);
++ "seconds\n", xprt, xprt->reestablish_timeout / HZ);
+
+ delay = xprt_reconnect_delay(xprt);
+ xprt_reconnect_backoff(xprt, XS_TCP_INIT_REEST_TO);
--- /dev/null
+From foo@baz Thu May 19 04:26:41 PM CEST 2022
+From: Meena Shanmugam <meenashanmugam@google.com>
+Date: Wed, 18 May 2022 18:40:11 +0000
+Subject: SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, trond.myklebust@hammerspace.com, Felix Fu <foyjog@gmail.com>, Al Viro <viro@zeniv.linux.org.uk>, Meena Shanmugam <meenashanmugam@google.com>
+Message-ID: <20220518184011.789699-5-meenashanmugam@google.com>
+
+From: Meena Shanmugam <meenashanmugam@google.com>
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit f00432063db1a0db484e85193eccc6845435b80e upstream.
+
+We must ensure that all sockets are closed before we call xprt_free()
+and release the reference to the net namespace. The problem is that
+calling fput() will defer closing the socket until delayed_fput() gets
+called.
+Let's fix the situation by allowing rpciod and the transport teardown
+code (which runs on the system wq) to call __fput_sync(), and directly
+close the socket.
+
+Reported-by: Felix Fu <foyjog@gmail.com>
+Acked-by: Al Viro <viro@zeniv.linux.org.uk>
+Fixes: a73881c96d73 ("SUNRPC: Fix an Oops in udp_poll()")
+Cc: stable@vger.kernel.org # 5.1.x: 3be232f11a3c: SUNRPC: Prevent immediate close+reconnect
+Cc: stable@vger.kernel.org # 5.1.x: 89f42494f92f: SUNRPC: Don't call connect() more than once on a TCP socket
+Cc: stable@vger.kernel.org # 5.1.x
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+[meenashanmugam: Fix merge conflict in xprt_connect]
+Signed-off-by: Meena Shanmugam <meenashanmugam@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/file_table.c | 1 +
+ net/sunrpc/xprt.c | 5 +----
+ net/sunrpc/xprtsock.c | 16 +++++++++++++---
+ 3 files changed, 15 insertions(+), 7 deletions(-)
+
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -375,6 +375,7 @@ void __fput_sync(struct file *file)
+ }
+
+ EXPORT_SYMBOL(fput);
++EXPORT_SYMBOL(__fput_sync);
+
+ void __init files_init(void)
+ {
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -868,10 +868,7 @@ void xprt_connect(struct rpc_task *task)
+ if (!xprt_lock_write(xprt, task))
+ return;
+
+- if (test_and_clear_bit(XPRT_CLOSE_WAIT, &xprt->state))
+- xprt->ops->close(xprt);
+-
+- if (!xprt_connected(xprt)) {
++ if (!xprt_connected(xprt) && !test_bit(XPRT_CLOSE_WAIT, &xprt->state)) {
+ task->tk_rqstp->rq_connect_cookie = xprt->connect_cookie;
+ rpc_sleep_on_timeout(&xprt->pending, task, NULL,
+ xprt_request_timeout(task->tk_rqstp));
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -989,7 +989,7 @@ static int xs_local_send_request(struct
+
+ /* Close the stream if the previous transmission was incomplete */
+ if (xs_send_request_was_aborted(transport, req)) {
+- xs_close(xprt);
++ xprt_force_disconnect(xprt);
+ return -ENOTCONN;
+ }
+
+@@ -1027,7 +1027,7 @@ static int xs_local_send_request(struct
+ -status);
+ /* fall through */
+ case -EPIPE:
+- xs_close(xprt);
++ xprt_force_disconnect(xprt);
+ status = -ENOTCONN;
+ }
+
+@@ -1303,6 +1303,16 @@ static void xs_reset_transport(struct so
+
+ if (sk == NULL)
+ return;
++ /*
++ * Make sure we're calling this in a context from which it is safe
++ * to call __fput_sync(). In practice that means rpciod and the
++ * system workqueue.
++ */
++ if (!(current->flags & PF_WQ_WORKER)) {
++ WARN_ON_ONCE(1);
++ set_bit(XPRT_CLOSE_WAIT, &xprt->state);
++ return;
++ }
+
+ if (atomic_read(&transport->xprt.swapper))
+ sk_clear_memalloc(sk);
+@@ -1326,7 +1336,7 @@ static void xs_reset_transport(struct so
+ mutex_unlock(&transport->recv_mutex);
+
+ trace_rpc_socket_close(xprt, sock);
+- fput(filp);
++ __fput_sync(filp);
+
+ xprt_disconnect_done(xprt);
+ }
--- /dev/null
+From foo@baz Thu May 19 04:26:41 PM CEST 2022
+From: Meena Shanmugam <meenashanmugam@google.com>
+Date: Wed, 18 May 2022 18:40:09 +0000
+Subject: SUNRPC: Prevent immediate close+reconnect
+To: stable@vger.kernel.org
+Cc: gregkh@linuxfoundation.org, trond.myklebust@hammerspace.com, Meena Shanmugam <meenashanmugam@google.com>
+Message-ID: <20220518184011.789699-3-meenashanmugam@google.com>
+
+From: Meena Shanmugam <meenashanmugam@google.com>
+
+From: Trond Myklebust <trond.myklebust@hammerspace.com>
+
+commit 3be232f11a3cc9b0ef0795e39fa11bdb8e422a06 upstream.
+
+If we have already set up the socket and are waiting for it to connect,
+then don't immediately close and retry.
+
+Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
+Signed-off-by: Meena Shanmugam <meenashanmugam@google.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sunrpc/xprt.c | 3 ++-
+ net/sunrpc/xprtsock.c | 2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/xprt.c
++++ b/net/sunrpc/xprt.c
+@@ -722,7 +722,8 @@ EXPORT_SYMBOL_GPL(xprt_disconnect_done);
+ */
+ static void xprt_schedule_autoclose_locked(struct rpc_xprt *xprt)
+ {
+- set_bit(XPRT_CLOSE_WAIT, &xprt->state);
++ if (test_and_set_bit(XPRT_CLOSE_WAIT, &xprt->state))
++ return;
+ if (test_and_set_bit(XPRT_LOCKED, &xprt->state) == 0)
+ queue_work(xprtiod_workqueue, &xprt->task_cleanup);
+ else if (xprt->snd_task && !test_bit(XPRT_SND_IS_COOKIE, &xprt->state))
+--- a/net/sunrpc/xprtsock.c
++++ b/net/sunrpc/xprtsock.c
+@@ -2469,7 +2469,7 @@ static void xs_connect(struct rpc_xprt *
+
+ WARN_ON_ONCE(!xprt_lock_connect(xprt, task, transport));
+
+- if (transport->sock != NULL) {
++ if (transport->sock != NULL && !xprt_connecting(xprt)) {
+ dprintk("RPC: xs_connect delayed xprt %p for %lu "
+ "seconds\n",
+ xprt, xprt->reestablish_timeout / HZ);
projects / thirdparty / kernel / stable-queue.git / commitdiff
