From: Greg Kroah-Hartman Date: Mon, 23 Nov 2020 08:46:39 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.4.246~21 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ee966d784a840398f9910a48c2303b09b4008f9a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: alsa-ctl-fix-error-path-at-adding-user-defined-element-set.patch alsa-mixart-fix-mutex-deadlock.patch efivarfs-fix-memory-leak-in-efivarfs_create.patch tty-serial-imx-keep-console-clocks-always-on.patch --- diff --git a/queue-4.9/alsa-ctl-fix-error-path-at-adding-user-defined-element-set.patch b/queue-4.9/alsa-ctl-fix-error-path-at-adding-user-defined-element-set.patch new file mode 100644 index 00000000000..9621bac49af --- /dev/null +++ b/queue-4.9/alsa-ctl-fix-error-path-at-adding-user-defined-element-set.patch @@ -0,0 +1,40 @@ +From 95a793c3bc75cf888e0e641d656e7d080f487d8b Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Fri, 13 Nov 2020 18:20:43 +0900 +Subject: ALSA: ctl: fix error path at adding user-defined element set + +From: Takashi Sakamoto + +commit 95a793c3bc75cf888e0e641d656e7d080f487d8b upstream. + +When processing request to add/replace user-defined element set, check +of given element identifier and decision of numeric identifier is done +in "__snd_ctl_add_replace()" helper function. When the result of check +is wrong, the helper function returns error code. The error code shall +be returned to userspace application. + +Current implementation includes bug to return zero to userspace application +regardless of the result. This commit fixes the bug. + +Cc: +Fixes: e1a7bfe38079 ("ALSA: control: Fix race between adding and removing a user element") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20201113092043.16148-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/core/control.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1381,7 +1381,7 @@ static int snd_ctl_elem_add(struct snd_c + + unlock: + up_write(&card->controls_rwsem); +- return 0; ++ return err; + } + + static int snd_ctl_elem_add_user(struct snd_ctl_file *file, diff --git a/queue-4.9/alsa-mixart-fix-mutex-deadlock.patch b/queue-4.9/alsa-mixart-fix-mutex-deadlock.patch new file mode 100644 index 00000000000..cf745b9a3a5 --- /dev/null +++ b/queue-4.9/alsa-mixart-fix-mutex-deadlock.patch @@ -0,0 +1,56 @@ +From d21b96c8ed2aea7e6b7bf4735e1d2503cfbf4072 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 19 Nov 2020 13:14:40 +0100 +Subject: ALSA: mixart: Fix mutex deadlock + +From: Takashi Iwai + +commit d21b96c8ed2aea7e6b7bf4735e1d2503cfbf4072 upstream. + +The code change for switching to non-atomic mode brought the +unexpected mutex deadlock in get_msg(). It converted the spinlock +with the existing mutex, but there were calls with the already holding +the mutex. Since the only place that needs the extra lock is the code +path from snd_mixart_send_msg(), remove the mutex lock in get_msg() +and apply in the caller side for fixing the mutex deadlock. + +Fixes: 8d3a8b5cb57d ("ALSA: mixart: Use nonatomic PCM ops") +Reported-by: Dan Carpenter +Cc: +Link: https://lore.kernel.org/r/20201119121440.18945-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/pci/mixart/mixart_core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +--- a/sound/pci/mixart/mixart_core.c ++++ b/sound/pci/mixart/mixart_core.c +@@ -83,7 +83,6 @@ static int get_msg(struct mixart_mgr *mg + unsigned int i; + #endif + +- mutex_lock(&mgr->msg_lock); + err = 0; + + /* copy message descriptor from miXart to driver */ +@@ -132,8 +131,6 @@ static int get_msg(struct mixart_mgr *mg + writel_be(headptr, MIXART_MEM(mgr, MSG_OUTBOUND_FREE_HEAD)); + + _clean_exit: +- mutex_unlock(&mgr->msg_lock); +- + return err; + } + +@@ -271,7 +268,9 @@ int snd_mixart_send_msg(struct mixart_mg + resp.data = resp_data; + resp.size = max_resp_size; + ++ mutex_lock(&mgr->msg_lock); + err = get_msg(mgr, &resp, msg_frame); ++ mutex_unlock(&mgr->msg_lock); + + if( request->message_id != resp.message_id ) + dev_err(&mgr->pci->dev, "RESPONSE ERROR!\n"); diff --git a/queue-4.9/efivarfs-fix-memory-leak-in-efivarfs_create.patch b/queue-4.9/efivarfs-fix-memory-leak-in-efivarfs_create.patch new file mode 100644 index 00000000000..df04f894a3d --- /dev/null +++ b/queue-4.9/efivarfs-fix-memory-leak-in-efivarfs_create.patch @@ -0,0 +1,49 @@ +From fe5186cf12e30facfe261e9be6c7904a170bd822 Mon Sep 17 00:00:00 2001 +From: Vamshi K Sthambamkadi +Date: Fri, 23 Oct 2020 17:24:39 +0530 +Subject: efivarfs: fix memory leak in efivarfs_create() + +From: Vamshi K Sthambamkadi + +commit fe5186cf12e30facfe261e9be6c7904a170bd822 upstream. + +kmemleak report: + unreferenced object 0xffff9b8915fcb000 (size 4096): + comm "efivarfs.sh", pid 2360, jiffies 4294920096 (age 48.264s) + hex dump (first 32 bytes): + 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -............... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000cc4d897c>] kmem_cache_alloc_trace+0x155/0x4b0 + [<000000007d1dfa72>] efivarfs_create+0x6e/0x1a0 + [<00000000e6ee18fc>] path_openat+0xe4b/0x1120 + [<000000000ad0414f>] do_filp_open+0x91/0x100 + [<00000000ce93a198>] do_sys_openat2+0x20c/0x2d0 + [<000000002a91be6d>] do_sys_open+0x46/0x80 + [<000000000a854999>] __x64_sys_openat+0x20/0x30 + [<00000000c50d89c9>] do_syscall_64+0x38/0x90 + [<00000000cecd6b5f>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +In efivarfs_create(), inode->i_private is setup with efivar_entry +object which is never freed. + +Cc: +Signed-off-by: Vamshi K Sthambamkadi +Link: https://lore.kernel.org/r/20201023115429.GA2479@cosmos +Signed-off-by: Ard Biesheuvel +Signed-off-by: Greg Kroah-Hartman + +--- + fs/efivarfs/super.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/efivarfs/super.c ++++ b/fs/efivarfs/super.c +@@ -23,6 +23,7 @@ LIST_HEAD(efivarfs_list); + static void efivarfs_evict_inode(struct inode *inode) + { + clear_inode(inode); ++ kfree(inode->i_private); + } + + static const struct super_operations efivarfs_ops = { diff --git a/queue-4.9/series b/queue-4.9/series index 1e04a9f0274..092eec9eb72 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -32,3 +32,7 @@ regulator-ti-abb-fix-array-out-of-bound-read-access-.patch xfs-revert-xfs-fix-rmap-key-and-record-comparison-fu.patch libfs-fix-error-cast-of-negative-value-in-simple_att.patch powerpc-uaccess-flush-fix-missing-includes-in-kup-radix.h.patch +alsa-ctl-fix-error-path-at-adding-user-defined-element-set.patch +alsa-mixart-fix-mutex-deadlock.patch +tty-serial-imx-keep-console-clocks-always-on.patch +efivarfs-fix-memory-leak-in-efivarfs_create.patch diff --git a/queue-4.9/tty-serial-imx-keep-console-clocks-always-on.patch b/queue-4.9/tty-serial-imx-keep-console-clocks-always-on.patch new file mode 100644 index 00000000000..6564d92fd1c --- /dev/null +++ b/queue-4.9/tty-serial-imx-keep-console-clocks-always-on.patch @@ -0,0 +1,91 @@ +From e67c139c488e84e7eae6c333231e791f0e89b3fb Mon Sep 17 00:00:00 2001 +From: Fugang Duan +Date: Wed, 11 Nov 2020 10:51:36 +0800 +Subject: tty: serial: imx: keep console clocks always on +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Fugang Duan + +commit e67c139c488e84e7eae6c333231e791f0e89b3fb upstream. + +For below code, there has chance to cause deadlock in SMP system: +Thread 1: +clk_enable_lock(); +pr_info("debug message"); +clk_enable_unlock(); + +Thread 2: +imx_uart_console_write() + clk_enable() + clk_enable_lock(); + +Thread 1: +Acuired clk enable_lock -> printk -> console_trylock_spinning +Thread 2: +console_unlock() -> imx_uart_console_write -> clk_disable -> Acquite clk enable_lock + +So the patch is to keep console port clocks always on like +other console drivers. + +Fixes: 1cf93e0d5488 ("serial: imx: remove the uart_console() check") +Acked-by: Uwe Kleine-König +Signed-off-by: Fugang Duan +Link: https://lore.kernel.org/r/20201111025136.29818-1-fugang.duan@nxp.com +Cc: stable +[fix up build warning - gregkh] +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/imx.c | 20 +++----------------- + 1 file changed, 3 insertions(+), 17 deletions(-) + +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -1787,16 +1787,6 @@ imx_console_write(struct console *co, co + unsigned int ucr1; + unsigned long flags = 0; + int locked = 1; +- int retval; +- +- retval = clk_enable(sport->clk_per); +- if (retval) +- return; +- retval = clk_enable(sport->clk_ipg); +- if (retval) { +- clk_disable(sport->clk_per); +- return; +- } + + if (sport->port.sysrq) + locked = 0; +@@ -1832,9 +1822,6 @@ imx_console_write(struct console *co, co + + if (locked) + spin_unlock_irqrestore(&sport->port.lock, flags); +- +- clk_disable(sport->clk_ipg); +- clk_disable(sport->clk_per); + } + + /* +@@ -1935,15 +1922,14 @@ imx_console_setup(struct console *co, ch + + retval = uart_set_options(&sport->port, co, baud, parity, bits, flow); + +- clk_disable(sport->clk_ipg); + if (retval) { +- clk_unprepare(sport->clk_ipg); ++ clk_disable_unprepare(sport->clk_ipg); + goto error_console; + } + +- retval = clk_prepare(sport->clk_per); ++ retval = clk_prepare_enable(sport->clk_per); + if (retval) +- clk_unprepare(sport->clk_ipg); ++ clk_disable_unprepare(sport->clk_ipg); + + error_console: + return retval;