--- /dev/null
+From c1bf2e6338e18baec5128b3577d125ba39dd3572 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 16 Jun 2020 14:09:21 +0200
+Subject: ALSA: usb-audio: Fix potential use-after-free of streams
+
+From: Takashi Iwai <tiwai@suse.de>
+
+[ Upstream commit ff58bbc7b9704a5869204176f804eff57307fef0 ]
+
+With the recent full-duplex support of implicit feedback streams, an
+endpoint can be still running after closing the capture stream as long
+as the playback stream with the sync-endpoint is running. In such a
+state, the URBs are still be handled and they may call retire_data_urb
+callback, which tries to transfer the data from the PCM buffer. Since
+the PCM stream gets closed, this may lead to use-after-free.
+
+This patch adds the proper clearance of the callback at stopping the
+capture stream for addressing the possible UAF above.
+
+Fixes: 10ce77e4817f ("ALSA: usb-audio: Add duplex sound support for USB devices using implicit feedback")
+Link: https://lore.kernel.org/r/20200616120921.12249-1-tiwai@suse.de
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/usb/pcm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 6c391e5fad2a7..c36e6c97d09ae 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -1778,6 +1778,7 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream
+ return 0;
+ case SNDRV_PCM_TRIGGER_STOP:
+ stop_endpoints(subs, false);
++ subs->data_endpoint->retire_data_urb = NULL;
+ subs->running = 0;
+ return 0;
+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
+--
+2.25.1
+
--- /dev/null
+From 8e95f3061d4571b4a733b7aeba3bd9b5a0f37153 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 25 Jun 2020 17:03:10 -0400
+Subject: btrfs: fix a block group ref counter leak after failure to remove
+ block group
+
+[ Upstream commit 9fecd13202f520f3f25d5b1c313adb740fe19773 ]
+
+When removing a block group, if we fail to delete the block group's item
+from the extent tree, we jump to the 'out' label and end up decrementing
+the block group's reference count once only (by 1), resulting in a counter
+leak because the block group at that point was already removed from the
+block group cache rbtree - so we have to decrement the reference count
+twice, once for the rbtree and once for our lookup at the start of the
+function.
+
+There is a second bug where if removing the free space tree entries (the
+call to remove_block_group_free_space()) fails we end up jumping to the
+'out_put_group' label but end up decrementing the reference count only
+once, when we should have done it twice, since we have already removed
+the block group from the block group cache rbtree. This happens because
+the reference count decrement for the rbtree reference happens after
+attempting to remove the free space tree entries, which is far away from
+the place where we remove the block group from the rbtree.
+
+To make things less error prone, decrement the reference count for the
+rbtree immediately after removing the block group from it. This also
+eleminates the need for two different exit labels on error, renaming
+'out_put_label' to just 'out' and removing the old 'out'.
+
+Fixes: f6033c5e333238 ("btrfs: fix block group leak when removing fails")
+CC: stable@vger.kernel.org # 4.4+
+Reviewed-by: Nikolay Borisov <nborisov@suse.com>
+Reviewed-by: Anand Jain <anand.jain@oracle.com>
+Signed-off-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/block-group.c | 19 +++++++++----------
+ 1 file changed, 9 insertions(+), 10 deletions(-)
+
+diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c
+index c2dd94e1b274c..42d69e77f89d9 100644
+--- a/fs/btrfs/block-group.c
++++ b/fs/btrfs/block-group.c
+@@ -910,7 +910,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ path = btrfs_alloc_path();
+ if (!path) {
+ ret = -ENOMEM;
+- goto out_put_group;
++ goto out;
+ }
+
+ /*
+@@ -948,7 +948,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ ret = btrfs_orphan_add(trans, BTRFS_I(inode));
+ if (ret) {
+ btrfs_add_delayed_iput(inode);
+- goto out_put_group;
++ goto out;
+ }
+ clear_nlink(inode);
+ /* One for the block groups ref */
+@@ -971,13 +971,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1);
+ if (ret < 0)
+- goto out_put_group;
++ goto out;
+ if (ret > 0)
+ btrfs_release_path(path);
+ if (ret == 0) {
+ ret = btrfs_del_item(trans, tree_root, path);
+ if (ret)
+- goto out_put_group;
++ goto out;
+ btrfs_release_path(path);
+ }
+
+@@ -986,6 +986,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ &fs_info->block_group_cache_tree);
+ RB_CLEAR_NODE(&block_group->cache_node);
+
++ /* Once for the block groups rbtree */
++ btrfs_put_block_group(block_group);
++
+ if (fs_info->first_logical_byte == block_group->key.objectid)
+ fs_info->first_logical_byte = (u64)-1;
+ spin_unlock(&fs_info->block_group_cache_lock);
+@@ -1094,10 +1097,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+
+ ret = remove_block_group_free_space(trans, block_group);
+ if (ret)
+- goto out_put_group;
+-
+- /* Once for the block groups rbtree */
+- btrfs_put_block_group(block_group);
++ goto out;
+
+ ret = btrfs_search_slot(trans, root, &key, path, -1, 1);
+ if (ret > 0)
+@@ -1120,10 +1120,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
+ free_extent_map(em);
+ }
+
+-out_put_group:
++out:
+ /* Once for the lookup reference */
+ btrfs_put_block_group(block_group);
+-out:
+ if (remove_rsv)
+ btrfs_delayed_refs_rsv_release(fs_info, 1);
+ btrfs_free_path(path);
+--
+2.25.1
+
--- /dev/null
+From f6973b21c0dfcb866fde04cbcbe101cc05a25623 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Sat, 6 Jun 2020 23:44:24 -0400
+Subject: fix a braino in "sparc32: fix register window handling in
+ genregs32_[gs]et()"
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+[ Upstream commit 9d964e1b82d8182184153b70174f445ea616f053 ]
+
+lost npc in PTRACE_SETREGSET, breaking PTRACE_SETREGS as well
+
+Fixes: cf51e129b968 "sparc32: fix register window handling in genregs32_[gs]et()"
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/sparc/kernel/ptrace_32.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c
+index 60f7205ebe40d..646dd58169ecb 100644
+--- a/arch/sparc/kernel/ptrace_32.c
++++ b/arch/sparc/kernel/ptrace_32.c
+@@ -168,12 +168,17 @@ static int genregs32_set(struct task_struct *target,
+ if (ret || !count)
+ return ret;
+ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
+- ®s->y,
++ ®s->npc,
+ 34 * sizeof(u32), 35 * sizeof(u32));
+ if (ret || !count)
+ return ret;
++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf,
++ ®s->y,
++ 35 * sizeof(u32), 36 * sizeof(u32));
++ if (ret || !count)
++ return ret;
+ return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf,
+- 35 * sizeof(u32), 38 * sizeof(u32));
++ 36 * sizeof(u32), 38 * sizeof(u32));
+ }
+
+ static int fpregs32_get(struct task_struct *target,
+--
+2.25.1
+
--- /dev/null
+From f0eda8fe1c0dff23b29473cbf73cb527a24acc3b Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 9 Jun 2020 22:11:54 +0200
+Subject: net: sched: export __netdev_watchdog_up()
+
+From: Valentin Longchamp <valentin@longchamp.me>
+
+[ Upstream commit 1a3db27ad9a72d033235b9673653962c02e3486e ]
+
+Since the quiesce/activate rework, __netdev_watchdog_up() is directly
+called in the ucc_geth driver.
+
+Unfortunately, this function is not available for modules and thus
+ucc_geth cannot be built as a module anymore. Fix it by exporting
+__netdev_watchdog_up().
+
+Since the commit introducing the regression was backported to stable
+branches, this one should ideally be as well.
+
+Fixes: 79dde73cf9bc ("net/ethernet/freescale: rework quiesce/activate for ucc_geth")
+Signed-off-by: Valentin Longchamp <valentin@longchamp.me>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/sched/sch_generic.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
+index 7c3c5fdb82a96..896c9037155a5 100644
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -469,6 +469,7 @@ void __netdev_watchdog_up(struct net_device *dev)
+ dev_hold(dev);
+ }
+ }
++EXPORT_SYMBOL_GPL(__netdev_watchdog_up);
+
+ static void dev_watchdog_up(struct net_device *dev)
+ {
+--
+2.25.1
+
--- /dev/null
+From 6c80bcc1e3f2f72ac0597c3132c8b8d3087ab6c1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Apr 2020 13:31:58 +0200
+Subject: Revert "i2c: tegra: Fix suspending in active runtime PM state"
+
+From: Thierry Reding <treding@nvidia.com>
+
+[ Upstream commit 78ad73421831247e46c31899a7bead02740e4bef ]
+
+This reverts commit 9f42de8d4ec2304f10bbc51dc0484f3503d61196.
+
+It's not safe to use pm_runtime_force_{suspend,resume}(), especially
+during the noirq phase of suspend. See also the guidance provided in
+commit 1e2ef05bb8cf ("PM: Limit race conditions between runtime PM
+and system sleep (v2)").
+
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/i2c/busses/i2c-tegra.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c
+index dbc43cfec19d4..331f7cca9babe 100644
+--- a/drivers/i2c/busses/i2c-tegra.c
++++ b/drivers/i2c/busses/i2c-tegra.c
+@@ -1719,14 +1719,9 @@ static int tegra_i2c_remove(struct platform_device *pdev)
+ static int __maybe_unused tegra_i2c_suspend(struct device *dev)
+ {
+ struct tegra_i2c_dev *i2c_dev = dev_get_drvdata(dev);
+- int err;
+
+ i2c_mark_adapter_suspended(&i2c_dev->adapter);
+
+- err = pm_runtime_force_suspend(dev);
+- if (err < 0)
+- return err;
+-
+ return 0;
+ }
+
+@@ -1747,10 +1742,6 @@ static int __maybe_unused tegra_i2c_resume(struct device *dev)
+ if (err)
+ return err;
+
+- err = pm_runtime_force_resume(dev);
+- if (err < 0)
+- return err;
+-
+ i2c_mark_adapter_resumed(&i2c_dev->adapter);
+
+ return 0;
+--
+2.25.1
+
block-bio-integrity-don-t-free-buf-if-bio_integrity_add_page-failed.patch
+revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch
+btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch
+net-sched-export-__netdev_watchdog_up.patch
+fix-a-braino-in-sparc32-fix-register-window-handling.patch
+alsa-usb-audio-fix-potential-use-after-free-of-strea.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
