From: Greg Kroah-Hartman Date: Fri, 10 Mar 2023 12:00:07 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v6.1.17~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1f94903db8b6ab167fdbfd2b917b82e7c42da855;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: bluetooth-hci_sock-purge-socket-queues-in-the-destruct-callback.patch media-uvcvideo-fix-race-condition-with-usb_kill_urb.patch s390-maccess-add-no-dat-mode-to-kernel_write.patch s390-setup-init-jump-labels-before-command-line-parsing.patch --- diff --git a/queue-4.19/bluetooth-hci_sock-purge-socket-queues-in-the-destruct-callback.patch b/queue-4.19/bluetooth-hci_sock-purge-socket-queues-in-the-destruct-callback.patch new file mode 100644 index 00000000000..208bf27ae7e --- /dev/null +++ b/queue-4.19/bluetooth-hci_sock-purge-socket-queues-in-the-destruct-callback.patch @@ -0,0 +1,60 @@ +From 709fca500067524381e28a5f481882930eebac88 Mon Sep 17 00:00:00 2001 +From: Nguyen Dinh Phi +Date: Fri, 8 Oct 2021 03:04:24 +0800 +Subject: Bluetooth: hci_sock: purge socket queues in the destruct() callback + +From: Nguyen Dinh Phi + +commit 709fca500067524381e28a5f481882930eebac88 upstream. + +The receive path may take the socket right before hci_sock_release(), +but it may enqueue the packets to the socket queues after the call to +skb_queue_purge(), therefore the socket can be destroyed without clear +its queues completely. + +Moving these skb_queue_purge() to the hci_sock_destruct() will fix this +issue, because nothing is referencing the socket at this point. + +Signed-off-by: Nguyen Dinh Phi +Reported-by: syzbot+4c4ffd1e1094dae61035@syzkaller.appspotmail.com +Signed-off-by: Marcel Holtmann +Signed-off-by: Fedor Pchelkin +Signed-off-by: Greg Kroah-Hartman +--- + net/bluetooth/hci_sock.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -881,10 +881,6 @@ static int hci_sock_release(struct socke + } + + sock_orphan(sk); +- +- skb_queue_purge(&sk->sk_receive_queue); +- skb_queue_purge(&sk->sk_write_queue); +- + release_sock(sk); + sock_put(sk); + return 0; +@@ -1985,6 +1981,12 @@ done: + return err; + } + ++static void hci_sock_destruct(struct sock *sk) ++{ ++ skb_queue_purge(&sk->sk_receive_queue); ++ skb_queue_purge(&sk->sk_write_queue); ++} ++ + static const struct proto_ops hci_sock_ops = { + .family = PF_BLUETOOTH, + .owner = THIS_MODULE, +@@ -2035,6 +2037,7 @@ static int hci_sock_create(struct net *n + + sock->state = SS_UNCONNECTED; + sk->sk_state = BT_OPEN; ++ sk->sk_destruct = hci_sock_destruct; + + bt_sock_link(&hci_sk_list, sk); + return 0; diff --git a/queue-4.19/media-uvcvideo-fix-race-condition-with-usb_kill_urb.patch b/queue-4.19/media-uvcvideo-fix-race-condition-with-usb_kill_urb.patch new file mode 100644 index 00000000000..c33d5127d5f --- /dev/null +++ b/queue-4.19/media-uvcvideo-fix-race-condition-with-usb_kill_urb.patch @@ -0,0 +1,140 @@ +From 619d9b710cf06f7a00a17120ca92333684ac45a8 Mon Sep 17 00:00:00 2001 +From: Ricardo Ribalda +Date: Thu, 5 Jan 2023 15:31:29 +0100 +Subject: media: uvcvideo: Fix race condition with usb_kill_urb + +From: Ricardo Ribalda + +commit 619d9b710cf06f7a00a17120ca92333684ac45a8 upstream. + +usb_kill_urb warranties that all the handlers are finished when it +returns, but does not protect against threads that might be handling +asynchronously the urb. + +For UVC, the function uvc_ctrl_status_event_async() takes care of +control changes asynchronously. + +If the code is executed in the following order: + +CPU 0 CPU 1 +===== ===== +uvc_status_complete() + uvc_status_stop() +uvc_ctrl_status_event_work() + uvc_status_start() -> FAIL + +Then uvc_status_start will keep failing and this error will be shown: + +<4>[ 5.540139] URB 0000000000000000 submitted while active +drivers/usb/core/urb.c:378 usb_submit_urb+0x4c3/0x528 + +Let's improve the current situation, by not re-submiting the urb if +we are stopping the status event. Also process the queued work +(if any) during stop. + +CPU 0 CPU 1 +===== ===== +uvc_status_complete() + uvc_status_stop() + uvc_status_start() +uvc_ctrl_status_event_work() -> FAIL + +Hopefully, with the usb layer protection this should be enough to cover +all the cases. + +Cc: stable@vger.kernel.org +Fixes: e5225c820c05 ("media: uvcvideo: Send a control event when a Control Change interrupt arrives") +Reviewed-by: Yunke Cao +Signed-off-by: Ricardo Ribalda +Reviewed-by: Laurent Pinchart +Signed-off-by: Laurent Pinchart +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/usb/uvc/uvc_ctrl.c | 5 +++++ + drivers/media/usb/uvc/uvc_status.c | 37 +++++++++++++++++++++++++++++++++++++ + drivers/media/usb/uvc/uvcvideo.h | 1 + + 3 files changed, 43 insertions(+) + +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -11,6 +11,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -1318,6 +1319,10 @@ static void uvc_ctrl_status_event_work(s + + mutex_unlock(&chain->ctrl_mutex); + ++ /* The barrier is needed to synchronize with uvc_status_stop(). */ ++ if (smp_load_acquire(&dev->flush_status)) ++ return; ++ + /* Resubmit the URB. */ + w->urb->interval = dev->int_ep->desc.bInterval; + ret = usb_submit_urb(w->urb, GFP_KERNEL); +--- a/drivers/media/usb/uvc/uvc_status.c ++++ b/drivers/media/usb/uvc/uvc_status.c +@@ -11,6 +11,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -314,5 +315,41 @@ int uvc_status_start(struct uvc_device * + + void uvc_status_stop(struct uvc_device *dev) + { ++ struct uvc_ctrl_work *w = &dev->async_ctrl; ++ ++ /* ++ * Prevent the asynchronous control handler from requeing the URB. The ++ * barrier is needed so the flush_status change is visible to other ++ * CPUs running the asynchronous handler before usb_kill_urb() is ++ * called below. ++ */ ++ smp_store_release(&dev->flush_status, true); ++ ++ /* ++ * Cancel any pending asynchronous work. If any status event was queued, ++ * process it synchronously. ++ */ ++ if (cancel_work_sync(&w->work)) ++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data); ++ ++ /* Kill the urb. */ + usb_kill_urb(dev->int_urb); ++ ++ /* ++ * The URB completion handler may have queued asynchronous work. This ++ * won't resubmit the URB as flush_status is set, but it needs to be ++ * cancelled before returning or it could then race with a future ++ * uvc_status_start() call. ++ */ ++ if (cancel_work_sync(&w->work)) ++ uvc_ctrl_status_event(w->chain, w->ctrl, w->data); ++ ++ /* ++ * From this point, there are no events on the queue and the status URB ++ * is dead. No events will be queued until uvc_status_start() is called. ++ * The barrier is needed to make sure that flush_status is visible to ++ * uvc_ctrl_status_event_work() when uvc_status_start() will be called ++ * again. ++ */ ++ smp_store_release(&dev->flush_status, false); + } +--- a/drivers/media/usb/uvc/uvcvideo.h ++++ b/drivers/media/usb/uvc/uvcvideo.h +@@ -603,6 +603,7 @@ struct uvc_device { + /* Status Interrupt Endpoint */ + struct usb_host_endpoint *int_ep; + struct urb *int_urb; ++ bool flush_status; + u8 *status; + struct input_dev *input; + char input_phys[64]; diff --git a/queue-4.19/s390-maccess-add-no-dat-mode-to-kernel_write.patch b/queue-4.19/s390-maccess-add-no-dat-mode-to-kernel_write.patch new file mode 100644 index 00000000000..4b80daa5bb9 --- /dev/null +++ b/queue-4.19/s390-maccess-add-no-dat-mode-to-kernel_write.patch @@ -0,0 +1,48 @@ +From d6df52e9996dcc2062c3d9c9123288468bb95b52 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Wed, 24 Jun 2020 17:39:14 +0200 +Subject: s390/maccess: add no DAT mode to kernel_write + +From: Vasily Gorbik + +commit d6df52e9996dcc2062c3d9c9123288468bb95b52 upstream. + +To be able to patch kernel code before paging is initialized do plain +memcpy if DAT is off. This is required to enable early jump label +initialization. + +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/mm/maccess.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/arch/s390/mm/maccess.c ++++ b/arch/s390/mm/maccess.c +@@ -58,13 +58,19 @@ static notrace long s390_kernel_write_od + */ + void notrace s390_kernel_write(void *dst, const void *src, size_t size) + { ++ unsigned long flags; + long copied; + +- while (size) { +- copied = s390_kernel_write_odd(dst, src, size); +- dst += copied; +- src += copied; +- size -= copied; ++ flags = arch_local_save_flags(); ++ if (!(flags & PSW_MASK_DAT)) { ++ memcpy(dst, src, size); ++ } else { ++ while (size) { ++ copied = s390_kernel_write_odd(dst, src, size); ++ dst += copied; ++ src += copied; ++ size -= copied; ++ } + } + } + diff --git a/queue-4.19/s390-setup-init-jump-labels-before-command-line-parsing.patch b/queue-4.19/s390-setup-init-jump-labels-before-command-line-parsing.patch new file mode 100644 index 00000000000..980833ec37d --- /dev/null +++ b/queue-4.19/s390-setup-init-jump-labels-before-command-line-parsing.patch @@ -0,0 +1,41 @@ +From 95e61b1b5d6394b53d147c0fcbe2ae70fbe09446 Mon Sep 17 00:00:00 2001 +From: Vasily Gorbik +Date: Thu, 18 Jun 2020 17:17:19 +0200 +Subject: s390/setup: init jump labels before command line parsing + +From: Vasily Gorbik + +commit 95e61b1b5d6394b53d147c0fcbe2ae70fbe09446 upstream. + +Command line parameters might set static keys. This is true for s390 at +least since commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 +and init_on_free=1 boot options"). To avoid the following WARN: + +static_key_enable_cpuslocked(): static key 'init_on_alloc+0x0/0x40' used +before call to jump_label_init() + +call jump_label_init() just before parse_early_param(). +jump_label_init() is safe to call multiple times (x86 does that), doesn't +do any memory allocations and hence should be safe to call that early. + +Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") +Cc: # 5.3: d6df52e9996d: s390/maccess: add no DAT mode to kernel_write +Cc: # 5.3 +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/setup.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -909,6 +909,7 @@ void __init setup_arch(char **cmdline_p) + if (IS_ENABLED(CONFIG_EXPOLINE_AUTO)) + nospec_auto_detect(); + ++ jump_label_init(); + parse_early_param(); + #ifdef CONFIG_CRASH_DUMP + /* Deactivate elfcorehdr= kernel parameter */