From 18cae8b20072ae96e24cbd063fb79639ed91a5e4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 8 Feb 2021 11:25:31 +0100 Subject: [PATCH] 4.4-stable patches added patches: cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch mac80211-fix-station-rate-table-updates-on-assoc.patch usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch --- ...lid-when-revalidating-a-dentry-fails.patch | 74 +++++++++++++++++++ ...ration-of-the-same-kretprobe-earlier.patch | 52 +++++++++++++ ...-station-rate-table-updates-on-assoc.patch | 51 +++++++++++++ queue-4.4/series | 6 ++ ...nt-direction-check-in-ep_from_windex.patch | 74 +++++++++++++++++++ ...legacy-fix-an-error-code-in-eth_bind.patch | 35 +++++++++ ...et_interface-if-there-s-a-single-alt.patch | 51 +++++++++++++ 7 files changed, 343 insertions(+) create mode 100644 queue-4.4/cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch create mode 100644 queue-4.4/kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch create mode 100644 queue-4.4/mac80211-fix-station-rate-table-updates-on-assoc.patch create mode 100644 queue-4.4/usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch create mode 100644 queue-4.4/usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch create mode 100644 queue-4.4/usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch diff --git a/queue-4.4/cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch b/queue-4.4/cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch new file mode 100644 index 00000000000..a8d40937db0 --- /dev/null +++ b/queue-4.4/cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch @@ -0,0 +1,74 @@ +From 21b200d091826a83aafc95d847139b2b0582f6d1 Mon Sep 17 00:00:00 2001 +From: Aurelien Aptel +Date: Fri, 5 Feb 2021 15:42:48 +0100 +Subject: cifs: report error instead of invalid when revalidating a dentry fails + +From: Aurelien Aptel + +commit 21b200d091826a83aafc95d847139b2b0582f6d1 upstream. + +Assuming +- //HOST/a is mounted on /mnt +- //HOST/b is mounted on /mnt/b + +On a slow connection, running 'df' and killing it while it's +processing /mnt/b can make cifs_get_inode_info() returns -ERESTARTSYS. + +This triggers the following chain of events: +=> the dentry revalidation fail +=> dentry is put and released +=> superblock associated with the dentry is put +=> /mnt/b is unmounted + +This patch makes cifs_d_revalidate() return the error instead of 0 +(invalid) when cifs_revalidate_dentry() fails, except for ENOENT (file +deleted) and ESTALE (file recreated). + +Signed-off-by: Aurelien Aptel +Suggested-by: Shyam Prasad N +Reviewed-by: Shyam Prasad N +CC: stable@vger.kernel.org +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman +--- + fs/cifs/dir.c | 22 ++++++++++++++++++++-- + 1 file changed, 20 insertions(+), 2 deletions(-) + +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -831,6 +831,7 @@ static int + cifs_d_revalidate(struct dentry *direntry, unsigned int flags) + { + struct inode *inode; ++ int rc; + + if (flags & LOOKUP_RCU) + return -ECHILD; +@@ -840,8 +841,25 @@ cifs_d_revalidate(struct dentry *direntr + if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode))) + CIFS_I(inode)->time = 0; /* force reval */ + +- if (cifs_revalidate_dentry(direntry)) +- return 0; ++ rc = cifs_revalidate_dentry(direntry); ++ if (rc) { ++ cifs_dbg(FYI, "cifs_revalidate_dentry failed with rc=%d", rc); ++ switch (rc) { ++ case -ENOENT: ++ case -ESTALE: ++ /* ++ * Those errors mean the dentry is invalid ++ * (file was deleted or recreated) ++ */ ++ return 0; ++ default: ++ /* ++ * Otherwise some unexpected error happened ++ * report it as-is to VFS layer ++ */ ++ return rc; ++ } ++ } + else { + /* + * If the inode wasn't known to be a dfs entry when diff --git a/queue-4.4/kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch b/queue-4.4/kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch new file mode 100644 index 00000000000..f27d001c6d2 --- /dev/null +++ b/queue-4.4/kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch @@ -0,0 +1,52 @@ +From 0188b87899ffc4a1d36a0badbe77d56c92fd91dc Mon Sep 17 00:00:00 2001 +From: Wang ShaoBo +Date: Thu, 28 Jan 2021 20:44:27 +0800 +Subject: kretprobe: Avoid re-registration of the same kretprobe earlier + +From: Wang ShaoBo + +commit 0188b87899ffc4a1d36a0badbe77d56c92fd91dc upstream. + +Our system encountered a re-init error when re-registering same kretprobe, +where the kretprobe_instance in rp->free_instances is illegally accessed +after re-init. + +Implementation to avoid re-registration has been introduced for kprobe +before, but lags for register_kretprobe(). We must check if kprobe has +been re-registered before re-initializing kretprobe, otherwise it will +destroy the data struct of kretprobe registered, which can lead to memory +leak, system crash, also some unexpected behaviors. + +We use check_kprobe_rereg() to check if kprobe has been re-registered +before running register_kretprobe()'s body, for giving a warning message +and terminate registration process. + +Link: https://lkml.kernel.org/r/20210128124427.2031088-1-bobo.shaobowang@huawei.com + +Cc: stable@vger.kernel.org +Fixes: 1f0ab40976460 ("kprobes: Prevent re-registration of the same kprobe") +[ The above commit should have been done for kretprobes too ] +Acked-by: Naveen N. Rao +Acked-by: Ananth N Mavinakayanahalli +Acked-by: Masami Hiramatsu +Signed-off-by: Wang ShaoBo +Signed-off-by: Cheng Jian +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Greg Kroah-Hartman +--- + kernel/kprobes.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -1884,6 +1884,10 @@ int register_kretprobe(struct kretprobe + int i; + void *addr; + ++ /* If only rp->kp.addr is specified, check reregistering kprobes */ ++ if (rp->kp.addr && check_kprobe_rereg(&rp->kp)) ++ return -EINVAL; ++ + if (kretprobe_blacklist_size) { + addr = kprobe_addr(&rp->kp); + if (IS_ERR(addr)) diff --git a/queue-4.4/mac80211-fix-station-rate-table-updates-on-assoc.patch b/queue-4.4/mac80211-fix-station-rate-table-updates-on-assoc.patch new file mode 100644 index 00000000000..ae89c42c044 --- /dev/null +++ b/queue-4.4/mac80211-fix-station-rate-table-updates-on-assoc.patch @@ -0,0 +1,51 @@ +From 18fe0fae61252b5ae6e26553e2676b5fac555951 Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Mon, 1 Feb 2021 09:33:24 +0100 +Subject: mac80211: fix station rate table updates on assoc + +From: Felix Fietkau + +commit 18fe0fae61252b5ae6e26553e2676b5fac555951 upstream. + +If the driver uses .sta_add, station entries are only uploaded after the sta +is in assoc state. Fix early station rate table updates by deferring them +until the sta has been uploaded. + +Cc: stable@vger.kernel.org +Signed-off-by: Felix Fietkau +Link: https://lore.kernel.org/r/20210201083324.3134-1-nbd@nbd.name +[use rcu_access_pointer() instead since we won't dereference here] +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + net/mac80211/driver-ops.c | 5 ++++- + net/mac80211/rate.c | 3 ++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/net/mac80211/driver-ops.c ++++ b/net/mac80211/driver-ops.c +@@ -128,8 +128,11 @@ int drv_sta_state(struct ieee80211_local + } else if (old_state == IEEE80211_STA_AUTH && + new_state == IEEE80211_STA_ASSOC) { + ret = drv_sta_add(local, sdata, &sta->sta); +- if (ret == 0) ++ if (ret == 0) { + sta->uploaded = true; ++ if (rcu_access_pointer(sta->sta.rates)) ++ drv_sta_rate_tbl_update(local, sdata, &sta->sta); ++ } + } else if (old_state == IEEE80211_STA_ASSOC && + new_state == IEEE80211_STA_AUTH) { + drv_sta_remove(local, sdata, &sta->sta); +--- a/net/mac80211/rate.c ++++ b/net/mac80211/rate.c +@@ -888,7 +888,8 @@ int rate_control_set_rates(struct ieee80 + if (old) + kfree_rcu(old, rcu_head); + +- drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta); ++ if (sta->uploaded) ++ drv_sta_rate_tbl_update(hw_to_local(hw), sta->sdata, pubsta); + + return 0; + } diff --git a/queue-4.4/series b/queue-4.4/series index dd9c7ab7dca..4ef35d1250a 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -20,3 +20,9 @@ input-i8042-unbreak-pegatron-c15b.patch net-lapb-copy-the-skb-before-sending-a-packet.patch elf-mips-build-fix.patch elfcore-fix-building-with-clang.patch +usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch +usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch +usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch +mac80211-fix-station-rate-table-updates-on-assoc.patch +kretprobe-avoid-re-registration-of-the-same-kretprobe-earlier.patch +cifs-report-error-instead-of-invalid-when-revalidating-a-dentry-fails.patch diff --git a/queue-4.4/usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch b/queue-4.4/usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch new file mode 100644 index 00000000000..6bbcd291019 --- /dev/null +++ b/queue-4.4/usb-dwc2-fix-endpoint-direction-check-in-ep_from_windex.patch @@ -0,0 +1,74 @@ +From f670e9f9c8cac716c3506c6bac9e997b27ad441a Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Wed, 27 Jan 2021 11:39:19 +0100 +Subject: usb: dwc2: Fix endpoint direction check in ep_from_windex + +From: Heiko Stuebner + +commit f670e9f9c8cac716c3506c6bac9e997b27ad441a upstream. + +dwc2_hsotg_process_req_status uses ep_from_windex() to retrieve +the endpoint for the index provided in the wIndex request param. + +In a test-case with a rndis gadget running and sending a malformed +packet to it like: + dev.ctrl_transfer( + 0x82, # bmRequestType + 0x00, # bRequest + 0x0000, # wValue + 0x0001, # wIndex + 0x00 # wLength + ) +it is possible to cause a crash: + +[ 217.533022] dwc2 ff300000.usb: dwc2_hsotg_process_req_status: USB_REQ_GET_STATUS +[ 217.559003] Unable to handle kernel read from unreadable memory at virtual address 0000000000000088 +... +[ 218.313189] Call trace: +[ 218.330217] ep_from_windex+0x3c/0x54 +[ 218.348565] usb_gadget_giveback_request+0x10/0x20 +[ 218.368056] dwc2_hsotg_complete_request+0x144/0x184 + +This happens because ep_from_windex wants to compare the endpoint +direction even if index_to_ep() didn't return an endpoint due to +the direction not matching. + +The fix is easy insofar that the actual direction check is already +happening when calling index_to_ep() which will return NULL if there +is no endpoint for the targeted direction, so the offending check +can go away completely. + +Fixes: c6f5c050e2a7 ("usb: dwc2: gadget: add bi-directional endpoint support") +Cc: stable@vger.kernel.org +Reported-by: Gerhard Klostermeier +Signed-off-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20210127103919.58215-1-heiko@sntech.de +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc2/gadget.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -871,7 +871,6 @@ static void dwc2_hsotg_complete_oursetup + static struct dwc2_hsotg_ep *ep_from_windex(struct dwc2_hsotg *hsotg, + u32 windex) + { +- struct dwc2_hsotg_ep *ep; + int dir = (windex & USB_DIR_IN) ? 1 : 0; + int idx = windex & 0x7F; + +@@ -881,12 +880,7 @@ static struct dwc2_hsotg_ep *ep_from_win + if (idx > hsotg->num_of_eps) + return NULL; + +- ep = index_to_ep(hsotg, idx, dir); +- +- if (idx && ep->dir_in != dir) +- return NULL; +- +- return ep; ++ return index_to_ep(hsotg, idx, dir); + } + + /** diff --git a/queue-4.4/usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch b/queue-4.4/usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch new file mode 100644 index 00000000000..3fc4c45508c --- /dev/null +++ b/queue-4.4/usb-gadget-legacy-fix-an-error-code-in-eth_bind.patch @@ -0,0 +1,35 @@ +From 3e1f4a2e1184ae6ad7f4caf682ced9554141a0f4 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 28 Jan 2021 12:33:42 +0300 +Subject: USB: gadget: legacy: fix an error code in eth_bind() + +From: Dan Carpenter + +commit 3e1f4a2e1184ae6ad7f4caf682ced9554141a0f4 upstream. + +This code should return -ENOMEM if the allocation fails but it currently +returns success. + +Fixes: 9b95236eebdb ("usb: gadget: ether: allocate and init otg descriptor by otg capabilities") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YBKE9rqVuJEOUWpW@mwanda +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/legacy/ether.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/gadget/legacy/ether.c ++++ b/drivers/usb/gadget/legacy/ether.c +@@ -407,8 +407,10 @@ static int eth_bind(struct usb_composite + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto fail1; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; diff --git a/queue-4.4/usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch b/queue-4.4/usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch new file mode 100644 index 00000000000..e33ab40b694 --- /dev/null +++ b/queue-4.4/usb-usblp-don-t-call-usb_set_interface-if-there-s-a-single-alt.patch @@ -0,0 +1,51 @@ +From d8c6edfa3f4ee0d45d7ce5ef18d1245b78774b9d Mon Sep 17 00:00:00 2001 +From: Jeremy Figgins +Date: Sat, 23 Jan 2021 18:21:36 -0600 +Subject: USB: usblp: don't call usb_set_interface if there's a single alt + +From: Jeremy Figgins + +commit d8c6edfa3f4ee0d45d7ce5ef18d1245b78774b9d upstream. + +Some devices, such as the Winbond Electronics Corp. Virtual Com Port +(Vendor=0416, ProdId=5011), lockup when usb_set_interface() or +usb_clear_halt() are called. This device has only a single +altsetting, so it should not be necessary to call usb_set_interface(). + +Acked-by: Pete Zaitcev +Signed-off-by: Jeremy Figgins +Link: https://lore.kernel.org/r/YAy9kJhM/rG8EQXC@watson +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/class/usblp.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +--- a/drivers/usb/class/usblp.c ++++ b/drivers/usb/class/usblp.c +@@ -1349,14 +1349,17 @@ static int usblp_set_protocol(struct usb + if (protocol < USBLP_FIRST_PROTOCOL || protocol > USBLP_LAST_PROTOCOL) + return -EINVAL; + +- alts = usblp->protocol[protocol].alt_setting; +- if (alts < 0) +- return -EINVAL; +- r = usb_set_interface(usblp->dev, usblp->ifnum, alts); +- if (r < 0) { +- printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n", +- alts, usblp->ifnum); +- return r; ++ /* Don't unnecessarily set the interface if there's a single alt. */ ++ if (usblp->intf->num_altsetting > 1) { ++ alts = usblp->protocol[protocol].alt_setting; ++ if (alts < 0) ++ return -EINVAL; ++ r = usb_set_interface(usblp->dev, usblp->ifnum, alts); ++ if (r < 0) { ++ printk(KERN_ERR "usblp: can't set desired altsetting %d on interface %d\n", ++ alts, usblp->ifnum); ++ return r; ++ } + } + + usblp->bidir = (usblp->protocol[protocol].epread != NULL); -- 2.47.2