From: Greg Kroah-Hartman Date: Wed, 12 May 2021 11:01:57 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v5.4.119~35 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f45129713a020bc2eafbd436a5de9979100d888f;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: ovl-fix-missing-revert_creds-on-error-path.patch revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch --- diff --git a/queue-5.4/ovl-fix-missing-revert_creds-on-error-path.patch b/queue-5.4/ovl-fix-missing-revert_creds-on-error-path.patch new file mode 100644 index 00000000000..4fe58bce28b --- /dev/null +++ b/queue-5.4/ovl-fix-missing-revert_creds-on-error-path.patch @@ -0,0 +1,40 @@ +From 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 23 Mar 2021 16:19:35 +0300 +Subject: ovl: fix missing revert_creds() on error path + +From: Dan Carpenter + +commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream. + +Smatch complains about missing that the ovl_override_creds() doesn't +have a matching revert_creds() if the dentry is disconnected. Fix this +by moving the ovl_override_creds() until after the disconnected check. + +Fixes: aa3ff3c152ff ("ovl: copy up of disconnected dentries") +Signed-off-by: Dan Carpenter +Signed-off-by: Miklos Szeredi +Signed-off-by: Greg Kroah-Hartman +--- + fs/overlayfs/copy_up.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/overlayfs/copy_up.c ++++ b/fs/overlayfs/copy_up.c +@@ -852,7 +852,7 @@ static int ovl_copy_up_one(struct dentry + int ovl_copy_up_flags(struct dentry *dentry, int flags) + { + int err = 0; +- const struct cred *old_cred = ovl_override_creds(dentry->d_sb); ++ const struct cred *old_cred; + bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED); + + /* +@@ -863,6 +863,7 @@ int ovl_copy_up_flags(struct dentry *den + if (WARN_ON(disconnected && d_is_dir(dentry))) + return -EIO; + ++ old_cred = ovl_override_creds(dentry->d_sb); + while (!err) { + struct dentry *next; + struct dentry *parent = NULL; diff --git a/queue-5.4/revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch b/queue-5.4/revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch new file mode 100644 index 00000000000..0f7ad192ef7 --- /dev/null +++ b/queue-5.4/revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch @@ -0,0 +1,110 @@ +From 0d95f41ebde40d552bb4fea64b1d618607915fd6 Mon Sep 17 00:00:00 2001 +From: Jae Hyun Yoo +Date: Thu, 8 Apr 2021 10:28:03 -0700 +Subject: Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register" + +From: Jae Hyun Yoo + +commit 0d95f41ebde40d552bb4fea64b1d618607915fd6 upstream. + +Adding the destroy_workqueue call in i3c_master_register introduced below +kernel warning because it makes duplicate destroy_workqueue calls when +i3c_master_register fails after allocating the workqueue. The workqueue will +be destroyed by i3c_masterdev_release which is called by put_device at the +end of the i3c_master_register function eventually in failure cases so the +workqueue doesn't need to be destroyed in i3c_master_register. + +[ 6.972952] WARNING: CPU: 1 PID: 1 at lib/list_debug.c:48 __list_del_entry_valid+0x9c/0xf4 +[ 6.982205] list_del corruption, 8fe03c08->prev is LIST_POISON2 (00000122) +[ 6.989910] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 5.10.23-c12838a-dirty-31dc772 #1 +[ 7.000295] Hardware name: Generic DT based system +[ 7.005638] Backtrace: +[ 7.008369] [<809133f0>] (dump_backtrace) from [<80913644>] (show_stack+0x20/0x24) +[ 7.016819] r7:00000030 r6:60000013 r5:00000000 r4:813b5d40 +[ 7.023137] [<80913624>] (show_stack) from [<8091e1a0>] (dump_stack+0x9c/0xb0) +[ 7.031201] [<8091e104>] (dump_stack) from [<8011fa30>] (__warn+0xf8/0x154) +[ 7.038972] r7:00000030 r6:00000009 r5:804fa1c8 r4:80b6eca4 +[ 7.045289] [<8011f938>] (__warn) from [<80913d14>] (warn_slowpath_fmt+0x8c/0xc0) +[ 7.053641] r7:00000030 r6:80b6eca4 r5:80b6ed74 r4:818cc000 +[ 7.059960] [<80913c8c>] (warn_slowpath_fmt) from [<804fa1c8>] (__list_del_entry_valid+0x9c/0xf4) +[ 7.069866] r9:96becf8c r8:818cc000 r7:8fe03c10 r6:8fe03c00 r5:8fe03ba0 r4:ff7ead4c +[ 7.078513] [<804fa12c>] (__list_del_entry_valid) from [<8013f0b4>] (destroy_workqueue+0x1c4/0x23c) +[ 7.088615] [<8013eef0>] (destroy_workqueue) from [<806aa124>] (i3c_masterdev_release+0x40/0xb0) +[ 7.098421] r7:00000000 r6:81a43b80 r5:8fe65360 r4:8fe65048 +[ 7.104740] [<806aa0e4>] (i3c_masterdev_release) from [<805f3f04>] (device_release+0x40/0xb0) +[ 7.114254] r5:00000000 r4:8fe65048 +[ 7.118245] [<805f3ec4>] (device_release) from [<808fe754>] (kobject_put+0xc8/0x204) +[ 7.126885] r5:813978dc r4:8fe65048 +[ 7.130877] [<808fe68c>] (kobject_put) from [<805f5fbc>] (put_device+0x20/0x24) +[ 7.139037] r7:8fe65358 r6:8fe65368 r5:8fe65358 r4:8fe65048 +[ 7.145355] [<805f5f9c>] (put_device) from [<806abac4>] (i3c_master_register+0x338/0xb00) +[ 7.154487] [<806ab78c>] (i3c_master_register) from [<806ae084>] (dw_i3c_probe+0x224/0x24c) +[ 7.163811] r10:00000000 r9:8fe7a100 r8:00000032 r7:819fa810 r6:819fa800 r5:8fe65040 +[ 7.172547] r4:00000000 +[ 7.175376] [<806ade60>] (dw_i3c_probe) from [<805fdc14>] (platform_drv_probe+0x44/0x80) +[ 7.184409] r9:813a25c0 r8:00000000 r7:815ec114 r6:00000000 r5:813a25c0 r4:819fa810 +[ 7.193053] [<805fdbd0>] (platform_drv_probe) from [<805fb83c>] (really_probe+0x108/0x50c) +[ 7.202275] r5:815ec004 r4:819fa810 +[ 7.206265] [<805fb734>] (really_probe) from [<805fc180>] (driver_probe_device+0xb4/0x190) +[ 7.215492] r10:813dc000 r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa810 r5:00000000 +[ 7.224228] r4:813a25c0 +[ 7.227055] [<805fc0cc>] (driver_probe_device) from [<805fc5cc>] (device_driver_attach+0xb8/0xc0) +[ 7.236959] r9:80c4385c r8:000000d9 r7:813a25c0 r6:819fa854 r4:819fa810 +[ 7.244439] [<805fc514>] (device_driver_attach) from [<805fc65c>] (__driver_attach+0x88/0x16c) +[ 7.254051] r7:00000000 r6:819fa810 r5:00000000 r4:813a25c0 +[ 7.260369] [<805fc5d4>] (__driver_attach) from [<805f954c>] (bus_for_each_dev+0x88/0xc8) +[ 7.269489] r7:00000000 r6:818cc000 r5:805fc5d4 r4:813a25c0 +[ 7.275806] [<805f94c4>] (bus_for_each_dev) from [<805fc76c>] (driver_attach+0x2c/0x30) +[ 7.284739] r7:81397c98 r6:00000000 r5:8fe7db80 r4:813a25c0 +[ 7.291057] [<805fc740>] (driver_attach) from [<805f9eec>] (bus_add_driver+0x120/0x200) +[ 7.299984] [<805f9dcc>] (bus_add_driver) from [<805fce44>] (driver_register+0x98/0x128) +[ 7.309005] r7:80c4383c r6:00000000 r5:00000000 r4:813a25c0 +[ 7.315323] [<805fcdac>] (driver_register) from [<805fedb4>] (__platform_driver_register+0x50/0x58) +[ 7.325410] r5:818cc000 r4:81397c98 +[ 7.329404] [<805fed64>] (__platform_driver_register) from [<80c23398>] (dw_i3c_driver_init+0x24/0x28) +[ 7.339790] r5:818cc000 r4:80c23374 +[ 7.343784] [<80c23374>] (dw_i3c_driver_init) from [<80c01300>] (do_one_initcall+0xac/0x1d0) +[ 7.353206] [<80c01254>] (do_one_initcall) from [<80c01630>] (kernel_init_freeable+0x1a8/0x204) +[ 7.362916] r8:000000d9 r7:80c4383c r6:00000007 r5:819ca2c0 r4:80c67680 +[ 7.370398] [<80c01488>] (kernel_init_freeable) from [<8091eb18>] (kernel_init+0x18/0x12c) +[ 7.379616] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8091eb00 +[ 7.388343] r4:00000000 +[ 7.391170] [<8091eb00>] (kernel_init) from [<80100148>] (ret_from_fork+0x14/0x2c) +[ 7.399607] Exception stack(0x818cdfb0 to 0x818cdff8) +[ 7.405243] dfa0: 00000000 00000000 00000000 00000000 +[ 7.414371] dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 +[ 7.423499] dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 +[ 7.430879] r5:8091eb00 r4:00000000 + +This reverts commit 59165d16c699182b86b5c65181013f1fd88feb62. + +Fixes: 59165d16c699 ("i3c master: fix missing destroy_workqueue() on error in i3c_master_register") +Signed-off-by: Jae Hyun Yoo +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20210408172803.24599-1-jae.hyun.yoo@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i3c/master.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/drivers/i3c/master.c ++++ b/drivers/i3c/master.c +@@ -2492,7 +2492,7 @@ int i3c_master_register(struct i3c_maste + + ret = i3c_master_bus_init(master); + if (ret) +- goto err_destroy_wq; ++ goto err_put_dev; + + ret = device_add(&master->dev); + if (ret) +@@ -2523,9 +2523,6 @@ err_del_dev: + err_cleanup_bus: + i3c_master_bus_cleanup(master); + +-err_destroy_wq: +- destroy_workqueue(master->wq); +- + err_put_dev: + put_device(&master->dev); + diff --git a/queue-5.4/series b/queue-5.4/series index 244b3a3c275..f8299d3547c 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -62,3 +62,6 @@ kvm-s390-split-kvm_s390_real_to_abs.patch kvm-s390-extend-kvm_s390_shadow_fault-to-return-entry-pointer.patch kvm-nvmx-truncate-bits-63-32-of-vmcs-field-on-nested-check-in-64-bit.patch kvm-stop-looking-for-coalesced-mmio-zones-if-the-bus-is-destroyed.patch +revert-i3c-master-fix-missing-destroy_workqueue-on-error-in-i3c_master_register.patch +ovl-fix-missing-revert_creds-on-error-path.patch +usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch diff --git a/queue-5.4/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch b/queue-5.4/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch new file mode 100644 index 00000000000..337bcb63629 --- /dev/null +++ b/queue-5.4/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch @@ -0,0 +1,83 @@ +From 50a318cc9b54a36f00beadf77e578a50f3620477 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Tue, 23 Mar 2021 17:36:24 +0200 +Subject: usb: gadget: pch_udc: Revert d3cb25a12138 completely + +From: Andy Shevchenko + +commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream. + +The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") +obviously was not thought through and had made the situation even worse +than it was before. Two changes after almost reverted it. but a few +leftovers have been left as it. With this revert d3cb25a12138 completely. + +While at it, narrow down the scope of unlocked section to prevent +potential race when prot_stall is assigned. + +Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc") +Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock") +Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock") +Cc: Iago Abal +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/gadget/udc/pch_udc.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +--- a/drivers/usb/gadget/udc/pch_udc.c ++++ b/drivers/usb/gadget/udc/pch_udc.c +@@ -600,18 +600,22 @@ static void pch_udc_reconnect(struct pch + static inline void pch_udc_vbus_session(struct pch_udc_dev *dev, + int is_active) + { ++ unsigned long iflags; ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_active) { + pch_udc_reconnect(dev); + dev->vbus_session = 1; + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + dev->vbus_session = 0; + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + } + + /** +@@ -1168,20 +1172,25 @@ static int pch_udc_pcd_selfpowered(struc + static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on) + { + struct pch_udc_dev *dev; ++ unsigned long iflags; + + if (!gadget) + return -EINVAL; ++ + dev = container_of(gadget, struct pch_udc_dev, gadget); ++ ++ spin_lock_irqsave(&dev->lock, iflags); + if (is_on) { + pch_udc_reconnect(dev); + } else { + if (dev->driver && dev->driver->disconnect) { +- spin_lock(&dev->lock); ++ spin_unlock_irqrestore(&dev->lock, iflags); + dev->driver->disconnect(&dev->gadget); +- spin_unlock(&dev->lock); ++ spin_lock_irqsave(&dev->lock, iflags); + } + pch_udc_set_disconnect(dev); + } ++ spin_unlock_irqrestore(&dev->lock, iflags); + + return 0; + }