--- /dev/null
+From 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 23 Mar 2021 16:19:35 +0300
+Subject: ovl: fix missing revert_creds() on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream.
+
+Smatch complains about missing that the ovl_override_creds() doesn't
+have a matching revert_creds() if the dentry is disconnected. Fix this
+by moving the ovl_override_creds() until after the disconnected check.
+
+Fixes: aa3ff3c152ff ("ovl: copy up of disconnected dentries")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/copy_up.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -852,7 +852,7 @@ static int ovl_copy_up_one(struct dentry
+ int ovl_copy_up_flags(struct dentry *dentry, int flags)
+ {
+ int err = 0;
+- const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
++ const struct cred *old_cred;
+ bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);
+
+ /*
+@@ -863,6 +863,7 @@ int ovl_copy_up_flags(struct dentry *den
+ if (WARN_ON(disconnected && d_is_dir(dentry)))
+ return -EIO;
+
++ old_cred = ovl_override_creds(dentry->d_sb);
+ while (!err) {
+ struct dentry *next;
+ struct dentry *parent = NULL;
--- /dev/null
+From 0d95f41ebde40d552bb4fea64b1d618607915fd6 Mon Sep 17 00:00:00 2001
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Date: Thu, 8 Apr 2021 10:28:03 -0700
+Subject: Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
+
+From: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+
+commit 0d95f41ebde40d552bb4fea64b1d618607915fd6 upstream.
+
+Adding the destroy_workqueue call in i3c_master_register introduced below
+kernel warning because it makes duplicate destroy_workqueue calls when
+i3c_master_register fails after allocating the workqueue. The workqueue will
+be destroyed by i3c_masterdev_release which is called by put_device at the
+end of the i3c_master_register function eventually in failure cases so the
+workqueue doesn't need to be destroyed in i3c_master_register.
+
+[ 6.972952] WARNING: CPU: 1 PID: 1 at lib/list_debug.c:48 __list_del_entry_valid+0x9c/0xf4
+[ 6.982205] list_del corruption, 8fe03c08->prev is LIST_POISON2 (00000122)
+[ 6.989910] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.10.23-c12838a-dirty-31dc772 #1
+[ 7.000295] Hardware name: Generic DT based system
+[ 7.005638] Backtrace:
+[ 7.008369] [<809133f0>] (dump_backtrace) from [<80913644>] (show_stack+0x20/0x24)
+[ 7.016819] r7:00000030 r6:60000013 r5:00000000 r4:813b5d40
+[ 7.023137] [<80913624>] (show_stack) from [<8091e1a0>] (dump_stack+0x9c/0xb0)
+[ 7.031201] [<8091e104>] (dump_stack) from [<8011fa30>] (__warn+0xf8/0x154)
+[ 7.038972] r7:00000030 r6:00000009 r5:804fa1c8 r4:80b6eca4
+[ 7.045289] [<8011f938>] (__warn) from [<80913d14>] (warn_slowpath_fmt+0x8c/0xc0)
+[ 7.053641] r7:00000030 r6:80b6eca4 r5:80b6ed74 r4:818cc000
+[ 7.059960] [<80913c8c>] (warn_slowpath_fmt) from [<804fa1c8>] (__list_del_entry_valid+0x9c/0xf4)
+[ 7.069866] r9:96becf8c r8:818cc000 r7:8fe03c10 r6:8fe03c00 r5:8fe03ba0 r4:ff7ead4c
+[ 7.078513] [<804fa12c>] (__list_del_entry_valid) from [<8013f0b4>] (destroy_workqueue+0x1c4/0x23c)
+[ 7.088615] [<8013eef0>] (destroy_workqueue) from [<806aa124>] (i3c_masterdev_release+0x40/0xb0)
+[ 7.098421] r7:00000000 r6:81a43b80 r5:8fe65360 r4:8fe65048
+[ 7.104740] [<806aa0e4>] (i3c_masterdev_release) from [<805f3f04>] (device_release+0x40/0xb0)
+[ 7.114254] r5:00000000 r4:8fe65048
+[ 7.118245] [<805f3ec4>] (device_release) from [<808fe754>] (kobject_put+0xc8/0x204)
+[ 7.126885] r5:813978dc r4:8fe65048
+[ 7.130877] [<808fe68c>] (kobject_put) from [<805f5fbc>] (put_device+0x20/0x24)
+[ 7.139037] r7:8fe65358 r6:8fe65368 r5:8fe65358 r4:8fe65048
+[ 7.145355] [<805f5f9c>] (put_device) from [<806abac4>] (i3c_master_register+0x338/0xb00)
+[ 7.154487] [<806ab78c>] (i3c_master_register) from [<806ae084>] (dw_i3c_probe+0x224/0x24c)
+[ 7.163811] r10:00000000 r9:8fe7a100 r8:00000032 r7:819fa810 r6:819fa800 r5:8fe65040
+[ 7.172547] r4:00000000
+[ 7.175376] [<806ade60>] (dw_i3c_probe) from [<805fdc14>] (platform_drv_probe+0x44/0x80)
+[ 7.184409] r9:813a25c0 r8:00000000 r7:815ec114 r6:00000000 r5:813a25c0 r4:819fa810
+[ 7.193053] [<805fdbd0>] (platform_drv_probe) from [<805fb83c>] (really_probe+0x108/0x50c)
+[ 7.202275] r5:815ec004 r4:819fa810
+[ 7.206265] [<805fb734>] (really_probe) from [<805fc180>] (driver_probe_device+0xb4/0x190)
+[ 7.215492] r10:813dc000 r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa810 r5:00000000
+[ 7.224228] r4:813a25c0
+[ 7.227055] [<805fc0cc>] (driver_probe_device) from [<805fc5cc>] (device_driver_attach+0xb8/0xc0)
+[ 7.236959] r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa854 r4:819fa810
+[ 7.244439] [<805fc514>] (device_driver_attach) from [<805fc65c>] (__driver_attach+0x88/0x16c)
+[ 7.254051] r7:00000000 r6:819fa810 r5:00000000 r4:813a25c0
+[ 7.260369] [<805fc5d4>] (__driver_attach) from [<805f954c>] (bus_for_each_dev+0x88/0xc8)
+[ 7.269489] r7:00000000 r6:818cc000 r5:805fc5d4 r4:813a25c0
+[ 7.275806] [<805f94c4>] (bus_for_each_dev) from [<805fc76c>] (driver_attach+0x2c/0x30)
+[ 7.284739] r7:81397c98 r6:00000000 r5:8fe7db80 r4:813a25c0
+[ 7.291057] [<805fc740>] (driver_attach) from [<805f9eec>] (bus_add_driver+0x120/0x200)
+[ 7.299984] [<805f9dcc>] (bus_add_driver) from [<805fce44>] (driver_register+0x98/0x128)
+[ 7.309005] r7:80c4383c r6:00000000 r5:00000000 r4:813a25c0
+[ 7.315323] [<805fcdac>] (driver_register) from [<805fedb4>] (__platform_driver_register+0x50/0x58)
+[ 7.325410] r5:818cc000 r4:81397c98
+[ 7.329404] [<805fed64>] (__platform_driver_register) from [<80c23398>] (dw_i3c_driver_init+0x24/0x28)
+[ 7.339790] r5:818cc000 r4:80c23374
+[ 7.343784] [<80c23374>] (dw_i3c_driver_init) from [<80c01300>] (do_one_initcall+0xac/0x1d0)
+[ 7.353206] [<80c01254>] (do_one_initcall) from [<80c01630>] (kernel_init_freeable+0x1a8/0x204)
+[ 7.362916] r8:000000d9 r7:80c4383c r6:00000007 r5:819ca2c0 r4:80c67680
+[ 7.370398] [<80c01488>] (kernel_init_freeable) from [<8091eb18>] (kernel_init+0x18/0x12c)
+[ 7.379616] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8091eb00
+[ 7.388343] r4:00000000
+[ 7.391170] [<8091eb00>] (kernel_init) from [<80100148>] (ret_from_fork+0x14/0x2c)
+[ 7.399607] Exception stack(0x818cdfb0 to 0x818cdff8)
+[ 7.405243] dfa0: 00000000 00000000 00000000 00000000
+[ 7.414371] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+[ 7.423499] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
+[ 7.430879] r5:8091eb00 r4:00000000
+
+This reverts commit 59165d16c699182b86b5c65181013f1fd88feb62.
+
+Fixes: 59165d16c699 ("i3c master: fix missing destroy_workqueue() on error in i3c_master_register")
+Signed-off-by: Jae Hyun Yoo <jae.hyun.yoo@linux.intel.com>
+Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Link: https://lore.kernel.org/r/20210408172803.24599-1-jae.hyun.yoo@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/i3c/master.c | 5 +----
+ 1 file changed, 1 insertion(+), 4 deletions(-)
+
+--- a/drivers/i3c/master.c
++++ b/drivers/i3c/master.c
+@@ -2492,7 +2492,7 @@ int i3c_master_register(struct i3c_maste
+
+ ret = i3c_master_bus_init(master);
+ if (ret)
+- goto err_destroy_wq;
++ goto err_put_dev;
+
+ ret = device_add(&master->dev);
+ if (ret)
+@@ -2523,9 +2523,6 @@ err_del_dev:
+ err_cleanup_bus:
+ i3c_master_bus_cleanup(master);
+
+-err_destroy_wq:
+- destroy_workqueue(master->wq);
+-
+ err_put_dev:
+ put_device(&master->dev);
+
--- /dev/null
+From 50a318cc9b54a36f00beadf77e578a50f3620477 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 23 Mar 2021 17:36:24 +0200
+Subject: usb: gadget: pch_udc: Revert d3cb25a12138 completely
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream.
+
+The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
+obviously was not thought through and had made the situation even worse
+than it was before. Two changes after almost reverted it. but a few
+leftovers have been left as it. With this revert d3cb25a12138 completely.
+
+While at it, narrow down the scope of unlocked section to prevent
+potential race when prot_stall is assigned.
+
+Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
+Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock")
+Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock")
+Cc: Iago Abal <mail@iagoabal.eu>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c | 17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -600,18 +600,22 @@ static void pch_udc_reconnect(struct pch
+ static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
+ int is_active)
+ {
++ unsigned long iflags;
++
++ spin_lock_irqsave(&dev->lock, iflags);
+ if (is_active) {
+ pch_udc_reconnect(dev);
+ dev->vbus_session = 1;
+ } else {
+ if (dev->driver && dev->driver->disconnect) {
+- spin_lock(&dev->lock);
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ dev->driver->disconnect(&dev->gadget);
+- spin_unlock(&dev->lock);
++ spin_lock_irqsave(&dev->lock, iflags);
+ }
+ pch_udc_set_disconnect(dev);
+ dev->vbus_session = 0;
+ }
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ }
+
+ /**
+@@ -1168,20 +1172,25 @@ static int pch_udc_pcd_selfpowered(struc
+ static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
+ {
+ struct pch_udc_dev *dev;
++ unsigned long iflags;
+
+ if (!gadget)
+ return -EINVAL;
++
+ dev = container_of(gadget, struct pch_udc_dev, gadget);
++
++ spin_lock_irqsave(&dev->lock, iflags);
+ if (is_on) {
+ pch_udc_reconnect(dev);
+ } else {
+ if (dev->driver && dev->driver->disconnect) {
+- spin_lock(&dev->lock);
++ spin_unlock_irqrestore(&dev->lock, iflags);
+ dev->driver->disconnect(&dev->gadget);
+- spin_unlock(&dev->lock);
++ spin_lock_irqsave(&dev->lock, iflags);
+ }
+ pch_udc_set_disconnect(dev);
+ }
++ spin_unlock_irqrestore(&dev->lock, iflags);
+
+ return 0;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
