4.19-stable patches

added patches:
	comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch

diff --git a/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch b/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch
new file mode 100644 (file)
index 0000000..163f064
--- /dev/null
+++ b/queue-4.19/comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch
@@ -0,0 +1,123 @@
+From f53641a6e849034a44bf80f50245a75d7a376025 Mon Sep 17 00:00:00 2001
+From: Ian Abbott <abbotti@mev.co.uk>
+Date: Wed, 14 Feb 2024 10:07:25 +0000
+Subject: comedi: comedi_test: Prevent timers rescheduling during deletion
+
+From: Ian Abbott <abbotti@mev.co.uk>
+
+commit f53641a6e849034a44bf80f50245a75d7a376025 upstream.
+
+The comedi_test devices have a couple of timers (ai_timer and ao_timer)
+that can be started to simulate hardware interrupts.  Their expiry
+functions normally reschedule the timer.  The driver code calls either
+del_timer_sync() or del_timer() to delete the timers from the queue, but
+does not currently prevent the timers from rescheduling themselves so
+synchronized deletion may be ineffective.
+
+Add a couple of boolean members (one for each timer: ai_timer_enable and
+ao_timer_enable) to the device private data structure to indicate
+whether the timers are allowed to reschedule themselves.  Set the member
+to true when adding the timer to the queue, and to false when deleting
+the timer from the queue in the waveform_ai_cancel() and
+waveform_ao_cancel() functions.
+
+The del_timer_sync() function is also called from the waveform_detach()
+function, but the timer enable members will already be set to false when
+that function is called, so no change is needed there.
+
+Fixes: 403fe7f34e33 ("staging: comedi: comedi_test: fix timer race conditions")
+Cc: stable@vger.kernel.org # 4.4+
+Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
+Link: https://lore.kernel.org/r/20240214100747.16203-1-abbotti@mev.co.uk
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/staging/comedi/drivers/comedi_test.c |   30 +++++++++++++++++++++++----
+ 1 file changed, 26 insertions(+), 4 deletions(-)
+
+--- a/drivers/staging/comedi/drivers/comedi_test.c
++++ b/drivers/staging/comedi/drivers/comedi_test.c
+@@ -87,6 +87,8 @@ struct waveform_private {
+       struct comedi_device *dev;      /* parent comedi device */
+       u64 ao_last_scan_time;          /* time of previous AO scan in usec */
+       unsigned int ao_scan_period;    /* AO scan period in usec */
++      bool ai_timer_enable:1;         /* should AI timer be running? */
++      bool ao_timer_enable:1;         /* should AO timer be running? */
+       unsigned short ao_loopbacks[N_CHANS];
+ };
+ 
+@@ -236,8 +238,12 @@ static void waveform_ai_timer(struct tim
+                       time_increment = devpriv->ai_convert_time - now;
+               else
+                       time_increment = 1;
+-              mod_timer(&devpriv->ai_timer,
+-                        jiffies + usecs_to_jiffies(time_increment));
++              spin_lock(&dev->spinlock);
++              if (devpriv->ai_timer_enable) {
++                      mod_timer(&devpriv->ai_timer,
++                                jiffies + usecs_to_jiffies(time_increment));
++              }
++              spin_unlock(&dev->spinlock);
+       }
+ 
+ overrun:
+@@ -393,9 +399,12 @@ static int waveform_ai_cmd(struct comedi
+        * Seem to need an extra jiffy here, otherwise timer expires slightly
+        * early!
+        */
++      spin_lock_bh(&dev->spinlock);
++      devpriv->ai_timer_enable = true;
+       devpriv->ai_timer.expires =
+               jiffies + usecs_to_jiffies(devpriv->ai_convert_period) + 1;
+       add_timer(&devpriv->ai_timer);
++      spin_unlock_bh(&dev->spinlock);
+       return 0;
+ }
+ 
+@@ -404,6 +413,9 @@ static int waveform_ai_cancel(struct com
+ {
+       struct waveform_private *devpriv = dev->private;
+ 
++      spin_lock_bh(&dev->spinlock);
++      devpriv->ai_timer_enable = false;
++      spin_unlock_bh(&dev->spinlock);
+       if (in_softirq()) {
+               /* Assume we were called from the timer routine itself. */
+               del_timer(&devpriv->ai_timer);
+@@ -495,8 +507,12 @@ static void waveform_ao_timer(struct tim
+               unsigned int time_inc = devpriv->ao_last_scan_time +
+                                       devpriv->ao_scan_period - now;
+ 
+-              mod_timer(&devpriv->ao_timer,
+-                        jiffies + usecs_to_jiffies(time_inc));
++              spin_lock(&dev->spinlock);
++              if (devpriv->ao_timer_enable) {
++                      mod_timer(&devpriv->ao_timer,
++                                jiffies + usecs_to_jiffies(time_inc));
++              }
++              spin_unlock(&dev->spinlock);
+       }
+ 
+ underrun:
+@@ -517,9 +533,12 @@ static int waveform_ao_inttrig_start(str
+       async->inttrig = NULL;
+ 
+       devpriv->ao_last_scan_time = ktime_to_us(ktime_get());
++      spin_lock_bh(&dev->spinlock);
++      devpriv->ao_timer_enable = true;
+       devpriv->ao_timer.expires =
+               jiffies + usecs_to_jiffies(devpriv->ao_scan_period);
+       add_timer(&devpriv->ao_timer);
++      spin_unlock_bh(&dev->spinlock);
+ 
+       return 1;
+ }
+@@ -604,6 +623,9 @@ static int waveform_ao_cancel(struct com
+       struct waveform_private *devpriv = dev->private;
+ 
+       s->async->inttrig = NULL;
++      spin_lock_bh(&dev->spinlock);
++      devpriv->ao_timer_enable = false;
++      spin_unlock_bh(&dev->spinlock);
+       if (in_softirq()) {
+               /* Assume we were called from the timer routine itself. */
+               del_timer(&devpriv->ao_timer);

diff --git a/queue-4.19/series b/queue-4.19/series
index 1451d833d775fb7012674405b61e96ca04556a3e..4d142f70c607e05731dacaf22f170c04fcafbe4a 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -131,3 +131,4 @@ scsi-bfa-fix-function-pointer-type-mismatch-for-hcb_.patch
 net-sunrpc-fix-an-off-by-one-in-rpc_sockaddr2uaddr.patch
 nfs-fix-an-off-by-one-in-root_nfs_cat.patch
 clk-qcom-gdsc-add-support-to-update-gdsc-transition-.patch
+comedi-comedi_test-prevent-timers-rescheduling-during-deletion.patch