5.4-stable patches

added patches:
	misc-pci_endpoint_test-free-irqs-before-removing-the-device.patch
	misc-pci_endpoint_test-re-init-completion-for-every-test.patch

diff --git a/queue-5.4/misc-pci_endpoint_test-free-irqs-before-removing-the-device.patch b/queue-5.4/misc-pci_endpoint_test-free-irqs-before-removing-the-device.patch
new file mode 100644 (file)
index 0000000..7eac1d7
--- /dev/null
+++ b/queue-5.4/misc-pci_endpoint_test-free-irqs-before-removing-the-device.patch
@@ -0,0 +1,50 @@
+From f61b7634a3249d12b9daa36ffbdb9965b6f24c6c Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Sat, 15 Apr 2023 11:35:39 +0900
+Subject: misc: pci_endpoint_test: Free IRQs before removing the device
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit f61b7634a3249d12b9daa36ffbdb9965b6f24c6c upstream.
+
+In pci_endpoint_test_remove(), freeing the IRQs after removing the device
+creates a small race window for IRQs to be received with the test device
+memory already released, causing the IRQ handler to access invalid memory,
+resulting in an oops.
+
+Free the device IRQs before removing the device to avoid this issue.
+
+Link: https://lore.kernel.org/r/20230415023542.77601-15-dlemoal@kernel.org
+Fixes: e03327122e2c ("pci_endpoint_test: Add 2 ioctl commands")
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/pci_endpoint_test.c |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -774,6 +774,9 @@ static void pci_endpoint_test_remove(str
+       if (id < 0)
+               return;
+ 
++      pci_endpoint_test_release_irq(test);
++      pci_endpoint_test_free_irq_vectors(test);
++
+       misc_deregister(&test->miscdev);
+       kfree(misc_device->name);
+       ida_simple_remove(&pci_endpoint_test_ida, id);
+@@ -782,9 +785,6 @@ static void pci_endpoint_test_remove(str
+                       pci_iounmap(pdev, test->bar[bar]);
+       }
+ 
+-      pci_endpoint_test_release_irq(test);
+-      pci_endpoint_test_free_irq_vectors(test);
+-
+       pci_release_regions(pdev);
+       pci_disable_device(pdev);
+ }

diff --git a/queue-5.4/misc-pci_endpoint_test-re-init-completion-for-every-test.patch b/queue-5.4/misc-pci_endpoint_test-re-init-completion-for-every-test.patch
new file mode 100644 (file)
index 0000000..62d3e03
--- /dev/null
+++ b/queue-5.4/misc-pci_endpoint_test-re-init-completion-for-every-test.patch
@@ -0,0 +1,44 @@
+From fb620ae73b70c2f57b9d3e911fc24c024ba2324f Mon Sep 17 00:00:00 2001
+From: Damien Le Moal <dlemoal@kernel.org>
+Date: Sat, 15 Apr 2023 11:35:40 +0900
+Subject: misc: pci_endpoint_test: Re-init completion for every test
+
+From: Damien Le Moal <dlemoal@kernel.org>
+
+commit fb620ae73b70c2f57b9d3e911fc24c024ba2324f upstream.
+
+The irq_raised completion used to detect the end of a test case is
+initialized when the test device is probed, but never reinitialized again
+before a test case. As a result, the irq_raised completion synchronization
+is effective only for the first ioctl test case executed. Any subsequent
+call to wait_for_completion() by another ioctl() call will immediately
+return, potentially too early, leading to false positive failures.
+
+Fix this by reinitializing the irq_raised completion before starting a new
+ioctl() test command.
+
+Link: https://lore.kernel.org/r/20230415023542.77601-16-dlemoal@kernel.org
+Fixes: 2c156ac71c6b ("misc: Add host side PCI driver for PCI test function device")
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
+Cc: stable@vger.kernel.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/pci_endpoint_test.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/misc/pci_endpoint_test.c
++++ b/drivers/misc/pci_endpoint_test.c
+@@ -590,6 +590,10 @@ static long pci_endpoint_test_ioctl(stru
+       struct pci_dev *pdev = test->pdev;
+ 
+       mutex_lock(&test->mutex);
++
++      reinit_completion(&test->irq_raised);
++      test->last_irq = -ENODATA;
++
+       switch (cmd) {
+       case PCITEST_BAR:
+               bar = arg;

diff --git a/queue-5.4/series b/queue-5.4/series
index ab2568d5e8aa6317aff5de4c9aedb83f22775da1..6ab3b073a2f91058a5b04f71202b624b8032ae0f 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -250,3 +250,5 @@ pci-rockchip-add-poll-and-timeout-to-wait-for-phy-plls-to-be-locked.patch
 pci-rockchip-fix-legacy-irq-generation-for-rk3399-pcie-endpoint-core.patch
 pci-rockchip-use-u32-variable-to-access-32-bit-registers.patch
 pci-rockchip-set-address-alignment-for-endpoint-mode.patch
+misc-pci_endpoint_test-free-irqs-before-removing-the-device.patch
+misc-pci_endpoint_test-re-init-completion-for-every-test.patch