From: Greg Kroah-Hartman Date: Wed, 12 May 2021 11:01:41 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v5.4.119~36 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7e3e0c9b1b8e3d0038eeea3524a1f70f5bfc66d9;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: ovl-fix-missing-revert_creds-on-error-path.patch usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch --- diff --git a/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch b/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch new file mode 100644 index 00000000000..67fcd61acf4 --- /dev/null +++ b/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch @@ -0,0 +1,40 @@ +From 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 23 Mar 2021 16:19:35 +0300 +Subject: ovl: fix missing revert_creds() on error path + +From: Dan Carpenter + +commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream. + +Smatch complains about missing that the ovl_override_creds() doesn't +have a matching revert_creds() if the dentry is disconnected. Fix this +by moving the ovl_override_creds() until after the disconnected check. + +Fixes: aa3ff3c152ff ("ovl: copy up of disconnected dentries") +Signed-off-by: Dan Carpenter +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/copy_up.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -824,7 +824,7 @@ static int ovl_copy_up_one(struct dentry + int ovl_copy_up_flags(struct dentry *dentry, int flags) + { + int err = 0; +- const struct cred *old_cred = ovl_override_creds(dentry->d_sb); ++ const struct cred *old_cred; + bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED); + + /* +@@ -835,6 +835,7 @@ int ovl_copy_up_flags(struct dentry *den + if (WARN_ON(disconnected && d_is_dir(dentry))) + return -EIO; + ++ old_cred = ovl_override_creds(dentry->d_sb); + while (!err) { + struct dentry *next; + struct dentry *parent = NULL; diff --git a/queue-4.19/series b/queue-4.19/series index 813982d81fa..ebb64c73109 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -162,3 +162,5 @@ kvm-s390-fix-guarded-storage-control-register-handling.patch kvm-s390-vsie-fix-mvpg-handling-for-prefixing-and-mso.patch kvm-s390-split-kvm_s390_real_to_abs.patch kvm-s390-extend-kvm_s390_shadow_fault-to-return-entry-pointer.patch +ovl-fix-missing-revert_creds-on-error-path.patch +usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch diff --git a/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch b/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch new file mode 100644 index 00000000000..337bcb63629 --- /dev/null +++ b/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch @@ -0,0 +1,83 @@ +From 50a318cc9b54a36f00beadf77e578a50f3620477 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 23 Mar 2021 17:36:24 +0200 +Subject: usb: gadget: pch_udc: Revert d3cb25a12138 completely + +From: Andy Shevchenko + +commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream. + +The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") +obviously was not thought through and had made the situation even worse +than it was before. Two changes after almost reverted it. but a few +leftovers have been left as it. With this revert d3cb25a12138 completely. + +While at it, narrow down the scope of unlocked section to prevent +potential race when prot_stall is assigned. + +Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") +Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock") +Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock") +Cc: Iago Abal +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/pch_udc.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -600,18 +600,22 @@ static void pch_udc_reconnect(struct pch + static inline void pch_udc_vbus_session(struct pch_udc_dev *dev, + int is_active) + { ++ unsigned long iflags; ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_active) { + pch_udc_reconnect(dev); + dev->vbus_session = 1; + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + dev->vbus_session = 0; + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + } + + /** +@@ -1168,20 +1172,25 @@ static int pch_udc_pcd_selfpowered(struc + static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on) + { + struct pch_udc_dev *dev; ++ unsigned long iflags; + + if (!gadget) + return -EINVAL; ++ + dev = container_of(gadget, struct pch_udc_dev, gadget); ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_on) { + pch_udc_reconnect(dev); + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + + return 0; + }