From: Sasha Levin Date: Fri, 26 Jun 2020 18:07:35 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.7.7~61^2~8 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2bedf1bbe9d6282c89e1cbc86496f79d4094706a;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-usb-audio-fix-potential-use-after-free-of-strea.patch b/queue-5.4/alsa-usb-audio-fix-potential-use-after-free-of-strea.patch new file mode 100644 index 00000000000..23e0de95a87 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-fix-potential-use-after-free-of-strea.patch @@ -0,0 +1,42 @@ +From c1bf2e6338e18baec5128b3577d125ba39dd3572 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 14:09:21 +0200 +Subject: ALSA: usb-audio: Fix potential use-after-free of streams + +From: Takashi Iwai + +[ Upstream commit ff58bbc7b9704a5869204176f804eff57307fef0 ] + +With the recent full-duplex support of implicit feedback streams, an +endpoint can be still running after closing the capture stream as long +as the playback stream with the sync-endpoint is running. In such a +state, the URBs are still be handled and they may call retire_data_urb +callback, which tries to transfer the data from the PCM buffer. Since +the PCM stream gets closed, this may lead to use-after-free. + +This patch adds the proper clearance of the callback at stopping the +capture stream for addressing the possible UAF above. + +Fixes: 10ce77e4817f ("ALSA: usb-audio: Add duplex sound support for USB devices using implicit feedback") +Link: https://lore.kernel.org/r/20200616120921.12249-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/pcm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 6c391e5fad2a7..c36e6c97d09ae 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1778,6 +1778,7 @@ static int snd_usb_substream_capture_trigger(struct snd_pcm_substream *substream + return 0; + case SNDRV_PCM_TRIGGER_STOP: + stop_endpoints(subs, false); ++ subs->data_endpoint->retire_data_urb = NULL; + subs->running = 0; + return 0; + case SNDRV_PCM_TRIGGER_PAUSE_PUSH: +-- +2.25.1 + diff --git a/queue-5.4/btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch b/queue-5.4/btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch new file mode 100644 index 00000000000..eba92a67a21 --- /dev/null +++ b/queue-5.4/btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch @@ -0,0 +1,117 @@ +From 8e95f3061d4571b4a733b7aeba3bd9b5a0f37153 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 17:03:10 -0400 +Subject: btrfs: fix a block group ref counter leak after failure to remove + block group + +[ Upstream commit 9fecd13202f520f3f25d5b1c313adb740fe19773 ] + +When removing a block group, if we fail to delete the block group's item +from the extent tree, we jump to the 'out' label and end up decrementing +the block group's reference count once only (by 1), resulting in a counter +leak because the block group at that point was already removed from the +block group cache rbtree - so we have to decrement the reference count +twice, once for the rbtree and once for our lookup at the start of the +function. + +There is a second bug where if removing the free space tree entries (the +call to remove_block_group_free_space()) fails we end up jumping to the +'out_put_group' label but end up decrementing the reference count only +once, when we should have done it twice, since we have already removed +the block group from the block group cache rbtree. This happens because +the reference count decrement for the rbtree reference happens after +attempting to remove the free space tree entries, which is far away from +the place where we remove the block group from the rbtree. + +To make things less error prone, decrement the reference count for the +rbtree immediately after removing the block group from it. This also +eleminates the need for two different exit labels on error, renaming +'out_put_label' to just 'out' and removing the old 'out'. + +Fixes: f6033c5e333238 ("btrfs: fix block group leak when removing fails") +CC: stable@vger.kernel.org # 4.4+ +Reviewed-by: Nikolay Borisov +Reviewed-by: Anand Jain +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/block-group.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/fs/btrfs/block-group.c b/fs/btrfs/block-group.c +index c2dd94e1b274c..42d69e77f89d9 100644 +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -910,7 +910,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + path = btrfs_alloc_path(); + if (!path) { + ret = -ENOMEM; +- goto out_put_group; ++ goto out; + } + + /* +@@ -948,7 +948,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + ret = btrfs_orphan_add(trans, BTRFS_I(inode)); + if (ret) { + btrfs_add_delayed_iput(inode); +- goto out_put_group; ++ goto out; + } + clear_nlink(inode); + /* One for the block groups ref */ +@@ -971,13 +971,13 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + + ret = btrfs_search_slot(trans, tree_root, &key, path, -1, 1); + if (ret < 0) +- goto out_put_group; ++ goto out; + if (ret > 0) + btrfs_release_path(path); + if (ret == 0) { + ret = btrfs_del_item(trans, tree_root, path); + if (ret) +- goto out_put_group; ++ goto out; + btrfs_release_path(path); + } + +@@ -986,6 +986,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + &fs_info->block_group_cache_tree); + RB_CLEAR_NODE(&block_group->cache_node); + ++ /* Once for the block groups rbtree */ ++ btrfs_put_block_group(block_group); ++ + if (fs_info->first_logical_byte == block_group->key.objectid) + fs_info->first_logical_byte = (u64)-1; + spin_unlock(&fs_info->block_group_cache_lock); +@@ -1094,10 +1097,7 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + + ret = remove_block_group_free_space(trans, block_group); + if (ret) +- goto out_put_group; +- +- /* Once for the block groups rbtree */ +- btrfs_put_block_group(block_group); ++ goto out; + + ret = btrfs_search_slot(trans, root, &key, path, -1, 1); + if (ret > 0) +@@ -1120,10 +1120,9 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans, + free_extent_map(em); + } + +-out_put_group: ++out: + /* Once for the lookup reference */ + btrfs_put_block_group(block_group); +-out: + if (remove_rsv) + btrfs_delayed_refs_rsv_release(fs_info, 1); + btrfs_free_path(path); +-- +2.25.1 + diff --git a/queue-5.4/fix-a-braino-in-sparc32-fix-register-window-handling.patch b/queue-5.4/fix-a-braino-in-sparc32-fix-register-window-handling.patch new file mode 100644 index 00000000000..8932fef24b1 --- /dev/null +++ b/queue-5.4/fix-a-braino-in-sparc32-fix-register-window-handling.patch @@ -0,0 +1,46 @@ +From f6973b21c0dfcb866fde04cbcbe101cc05a25623 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Jun 2020 23:44:24 -0400 +Subject: fix a braino in "sparc32: fix register window handling in + genregs32_[gs]et()" + +From: Al Viro + +[ Upstream commit 9d964e1b82d8182184153b70174f445ea616f053 ] + +lost npc in PTRACE_SETREGSET, breaking PTRACE_SETREGS as well + +Fixes: cf51e129b968 "sparc32: fix register window handling in genregs32_[gs]et()" +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + arch/sparc/kernel/ptrace_32.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/sparc/kernel/ptrace_32.c b/arch/sparc/kernel/ptrace_32.c +index 60f7205ebe40d..646dd58169ecb 100644 +--- a/arch/sparc/kernel/ptrace_32.c ++++ b/arch/sparc/kernel/ptrace_32.c +@@ -168,12 +168,17 @@ static int genregs32_set(struct task_struct *target, + if (ret || !count) + return ret; + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- ®s->y, ++ ®s->npc, + 34 * sizeof(u32), 35 * sizeof(u32)); + if (ret || !count) + return ret; ++ ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ++ ®s->y, ++ 35 * sizeof(u32), 36 * sizeof(u32)); ++ if (ret || !count) ++ return ret; + return user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, +- 35 * sizeof(u32), 38 * sizeof(u32)); ++ 36 * sizeof(u32), 38 * sizeof(u32)); + } + + static int fpregs32_get(struct task_struct *target, +-- +2.25.1 + diff --git a/queue-5.4/net-sched-export-__netdev_watchdog_up.patch b/queue-5.4/net-sched-export-__netdev_watchdog_up.patch new file mode 100644 index 00000000000..b6c28bd6f2b --- /dev/null +++ b/queue-5.4/net-sched-export-__netdev_watchdog_up.patch @@ -0,0 +1,42 @@ +From f0eda8fe1c0dff23b29473cbf73cb527a24acc3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 22:11:54 +0200 +Subject: net: sched: export __netdev_watchdog_up() + +From: Valentin Longchamp + +[ Upstream commit 1a3db27ad9a72d033235b9673653962c02e3486e ] + +Since the quiesce/activate rework, __netdev_watchdog_up() is directly +called in the ucc_geth driver. + +Unfortunately, this function is not available for modules and thus +ucc_geth cannot be built as a module anymore. Fix it by exporting +__netdev_watchdog_up(). + +Since the commit introducing the regression was backported to stable +branches, this one should ideally be as well. + +Fixes: 79dde73cf9bc ("net/ethernet/freescale: rework quiesce/activate for ucc_geth") +Signed-off-by: Valentin Longchamp +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_generic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 7c3c5fdb82a96..896c9037155a5 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -469,6 +469,7 @@ void __netdev_watchdog_up(struct net_device *dev) + dev_hold(dev); + } + } ++EXPORT_SYMBOL_GPL(__netdev_watchdog_up); + + static void dev_watchdog_up(struct net_device *dev) + { +-- +2.25.1 + diff --git a/queue-5.4/revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch b/queue-5.4/revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch new file mode 100644 index 00000000000..7ee91e40637 --- /dev/null +++ b/queue-5.4/revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch @@ -0,0 +1,55 @@ +From 6c80bcc1e3f2f72ac0597c3132c8b8d3087ab6c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 13:31:58 +0200 +Subject: Revert "i2c: tegra: Fix suspending in active runtime PM state" + +From: Thierry Reding + +[ Upstream commit 78ad73421831247e46c31899a7bead02740e4bef ] + +This reverts commit 9f42de8d4ec2304f10bbc51dc0484f3503d61196. + +It's not safe to use pm_runtime_force_{suspend,resume}(), especially +during the noirq phase of suspend. See also the guidance provided in +commit 1e2ef05bb8cf ("PM: Limit race conditions between runtime PM +and system sleep (v2)"). + +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-tegra.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c +index dbc43cfec19d4..331f7cca9babe 100644 +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -1719,14 +1719,9 @@ static int tegra_i2c_remove(struct platform_device *pdev) + static int __maybe_unused tegra_i2c_suspend(struct device *dev) + { + struct tegra_i2c_dev *i2c_dev = dev_get_drvdata(dev); +- int err; + + i2c_mark_adapter_suspended(&i2c_dev->adapter); + +- err = pm_runtime_force_suspend(dev); +- if (err < 0) +- return err; +- + return 0; + } + +@@ -1747,10 +1742,6 @@ static int __maybe_unused tegra_i2c_resume(struct device *dev) + if (err) + return err; + +- err = pm_runtime_force_resume(dev); +- if (err < 0) +- return err; +- + i2c_mark_adapter_resumed(&i2c_dev->adapter); + + return 0; +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 1ab482d4a03..6c4aa8cfb80 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,6 @@ block-bio-integrity-don-t-free-buf-if-bio_integrity_add_page-failed.patch +revert-i2c-tegra-fix-suspending-in-active-runtime-pm.patch +btrfs-fix-a-block-group-ref-counter-leak-after-failu.patch +net-sched-export-__netdev_watchdog_up.patch +fix-a-braino-in-sparc32-fix-register-window-handling.patch +alsa-usb-audio-fix-potential-use-after-free-of-strea.patch