4.14-stable patches

added patches:
	usbip-vudc-synchronize-sysfs-code-paths.patch

diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..59936a1
--- /dev/null
+++ b/queue-4.14/series
@@ -0,0 +1 @@
+usbip-vudc-synchronize-sysfs-code-paths.patch

diff --git a/queue-4.14/usbip-vudc-synchronize-sysfs-code-paths.patch b/queue-4.14/usbip-vudc-synchronize-sysfs-code-paths.patch
new file mode 100644 (file)
index 0000000..07fb9cb
--- /dev/null
+++ b/queue-4.14/usbip-vudc-synchronize-sysfs-code-paths.patch
@@ -0,0 +1,72 @@
+From bd8b82042269a95db48074b8bb400678dbac1815 Mon Sep 17 00:00:00 2001
+From: Shuah Khan <skhan@linuxfoundation.org>
+Date: Mon, 29 Mar 2021 19:36:50 -0600
+Subject: usbip: vudc synchronize sysfs code paths
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+commit bd8b82042269a95db48074b8bb400678dbac1815 upstream.
+
+Fuzzing uncovered race condition between sysfs code paths in usbip
+drivers. Device connect/disconnect code paths initiated through
+sysfs interface are prone to races if disconnect happens during
+connect and vice versa.
+
+Use sysfs_lock to protect sysfs paths in vudc.
+
+Cc: stable@vger.kernel.org
+Reported-and-tested-by: syzbot+a93fba6d384346a761e3@syzkaller.appspotmail.com
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/caabcf3fc87bdae970509b5ff32d05bb7ce2fb15.1616807117.git.skhan@linuxfoundation.org
+Signed-off-by: Tom Seewald <tseewald@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/usbip/vudc_dev.c   |    1 +
+ drivers/usb/usbip/vudc_sysfs.c |    5 +++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/usb/usbip/vudc_dev.c
++++ b/drivers/usb/usbip/vudc_dev.c
+@@ -586,6 +586,7 @@ static int init_vudc_hw(struct vudc *udc
+       init_waitqueue_head(&udc->tx_waitq);
+ 
+       spin_lock_init(&ud->lock);
++      mutex_init(&ud->sysfs_lock);
+       ud->status = SDEV_ST_AVAILABLE;
+       ud->side = USBIP_VUDC;
+ 
+--- a/drivers/usb/usbip/vudc_sysfs.c
++++ b/drivers/usb/usbip/vudc_sysfs.c
+@@ -125,6 +125,7 @@ static ssize_t store_sockfd(struct devic
+               dev_err(dev, "no device");
+               return -ENODEV;
+       }
++      mutex_lock(&udc->ud.sysfs_lock);
+       spin_lock_irqsave(&udc->lock, flags);
+       /* Don't export what we don't have */
+       if (!udc->driver || !udc->pullup) {
+@@ -200,6 +201,8 @@ static ssize_t store_sockfd(struct devic
+ 
+               wake_up_process(udc->ud.tcp_rx);
+               wake_up_process(udc->ud.tcp_tx);
++
++              mutex_unlock(&udc->ud.sysfs_lock);
+               return count;
+ 
+       } else {
+@@ -220,6 +223,7 @@ static ssize_t store_sockfd(struct devic
+       }
+ 
+       spin_unlock_irqrestore(&udc->lock, flags);
++      mutex_unlock(&udc->ud.sysfs_lock);
+ 
+       return count;
+ 
+@@ -229,6 +233,7 @@ unlock_ud:
+       spin_unlock_irq(&udc->ud.lock);
+ unlock:
+       spin_unlock_irqrestore(&udc->lock, flags);
++      mutex_unlock(&udc->ud.sysfs_lock);
+ 
+       return ret;
+ }