5.15-stable patches

added patches:
	usb-cdc-wdm-close-race-between-read-and-workqueue.patch

diff --git a/queue-5.15/series b/queue-5.15/series
index 1c2e6e381a35268a932a880a5302b502c742df15..2e748f18ad5bd1d37d158bcf6e2786a870ca2689 100644 (file)
--- a/queue-5.15/series
+++ b/queue-5.15/series
@@ -575,3 +575,4 @@ mmc-core-initialize-mmc_blk_ioc_data.patch
 mmc-core-avoid-negative-index-with-array-access.patch
 net-ll_temac-platform_get_resource-replaced-by-wrong-function.patch
 drm-i915-gt-reset-queue_priority_hint-on-parking.patch
+usb-cdc-wdm-close-race-between-read-and-workqueue.patch

diff --git a/queue-5.15/usb-cdc-wdm-close-race-between-read-and-workqueue.patch b/queue-5.15/usb-cdc-wdm-close-race-between-read-and-workqueue.patch
new file mode 100644 (file)
index 0000000..8108b8b
--- /dev/null
+++ b/queue-5.15/usb-cdc-wdm-close-race-between-read-and-workqueue.patch
@@ -0,0 +1,47 @@
+From 339f83612f3a569b194680768b22bf113c26a29d Mon Sep 17 00:00:00 2001
+From: Oliver Neukum <oneukum@suse.com>
+Date: Thu, 14 Mar 2024 12:50:48 +0100
+Subject: usb: cdc-wdm: close race between read and workqueue
+
+From: Oliver Neukum <oneukum@suse.com>
+
+commit 339f83612f3a569b194680768b22bf113c26a29d upstream.
+
+wdm_read() cannot race with itself. However, in
+service_outstanding_interrupt() it can race with the
+workqueue, which can be triggered by error handling.
+
+Hence we need to make sure that the WDM_RESPONDING
+flag is not just only set but tested.
+
+Fixes: afba937e540c9 ("USB: CDC WDM driver")
+Cc: stable <stable@kernel.org>
+Signed-off-by: Oliver Neukum <oneukum@suse.com>
+Link: https://lore.kernel.org/r/20240314115132.3907-1-oneukum@suse.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/class/cdc-wdm.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -485,6 +485,7 @@ out_free_mem:
+ static int service_outstanding_interrupt(struct wdm_device *desc)
+ {
+       int rv = 0;
++      int used;
+ 
+       /* submit read urb only if the device is waiting for it */
+       if (!desc->resp_count || !--desc->resp_count)
+@@ -499,7 +500,10 @@ static int service_outstanding_interrupt
+               goto out;
+       }
+ 
+-      set_bit(WDM_RESPONDING, &desc->flags);
++      used = test_and_set_bit(WDM_RESPONDING, &desc->flags);
++      if (used)
++              goto out;
++
+       spin_unlock_irq(&desc->iuspin);
+       rv = usb_submit_urb(desc->response, GFP_KERNEL);
+       spin_lock_irq(&desc->iuspin);