4.19-stable patches

added patches:
	ovl-fix-missing-revert_creds-on-error-path.patch
	usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch

diff --git a/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch b/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch
new file mode 100644 (file)
index 0000000..67fcd61
--- /dev/null
+++ b/queue-4.19/ovl-fix-missing-revert_creds-on-error-path.patch
@@ -0,0 +1,40 @@
+From 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 23 Mar 2021 16:19:35 +0300
+Subject: ovl: fix missing revert_creds() on error path
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 7b279bbfd2b230c7a210ff8f405799c7e46bbf48 upstream.
+
+Smatch complains about missing that the ovl_override_creds() doesn't
+have a matching revert_creds() if the dentry is disconnected.  Fix this
+by moving the ovl_override_creds() until after the disconnected check.
+
+Fixes: aa3ff3c152ff ("ovl: copy up of disconnected dentries")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/overlayfs/copy_up.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -824,7 +824,7 @@ static int ovl_copy_up_one(struct dentry
+ int ovl_copy_up_flags(struct dentry *dentry, int flags)
+ {
+       int err = 0;
+-      const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
++      const struct cred *old_cred;
+       bool disconnected = (dentry->d_flags & DCACHE_DISCONNECTED);
+ 
+       /*
+@@ -835,6 +835,7 @@ int ovl_copy_up_flags(struct dentry *den
+       if (WARN_ON(disconnected && d_is_dir(dentry)))
+               return -EIO;
+ 
++      old_cred = ovl_override_creds(dentry->d_sb);
+       while (!err) {
+               struct dentry *next;
+               struct dentry *parent = NULL;

diff --git a/queue-4.19/series b/queue-4.19/series
index 813982d81fac23503f8b199b50e7a38f97204b29..ebb64c731091edc8ec270c647020bd034094b32b 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -162,3 +162,5 @@ kvm-s390-fix-guarded-storage-control-register-handling.patch
 kvm-s390-vsie-fix-mvpg-handling-for-prefixing-and-mso.patch
 kvm-s390-split-kvm_s390_real_to_abs.patch
 kvm-s390-extend-kvm_s390_shadow_fault-to-return-entry-pointer.patch
+ovl-fix-missing-revert_creds-on-error-path.patch
+usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch

diff --git a/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch b/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch
new file mode 100644 (file)
index 0000000..337bcb6
--- /dev/null
+++ b/queue-4.19/usb-gadget-pch_udc-revert-d3cb25a12138-completely.patch
@@ -0,0 +1,83 @@
+From 50a318cc9b54a36f00beadf77e578a50f3620477 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Tue, 23 Mar 2021 17:36:24 +0200
+Subject: usb: gadget: pch_udc: Revert d3cb25a12138 completely
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 50a318cc9b54a36f00beadf77e578a50f3620477 upstream.
+
+The commit d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
+obviously was not thought through and had made the situation even worse
+than it was before. Two changes after almost reverted it. but a few
+leftovers have been left as it. With this revert d3cb25a12138 completely.
+
+While at it, narrow down the scope of unlocked section to prevent
+potential race when prot_stall is assigned.
+
+Fixes: d3cb25a12138 ("usb: gadget: udc: fix spin_lock in pch_udc")
+Fixes: 9903b6bedd38 ("usb: gadget: pch-udc: fix lock")
+Fixes: 1d23d16a88e6 ("usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock")
+Cc: Iago Abal <mail@iagoabal.eu>
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Link: https://lore.kernel.org/r/20210323153626.54908-5-andriy.shevchenko@linux.intel.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/usb/gadget/udc/pch_udc.c |   17 +++++++++++++----
+ 1 file changed, 13 insertions(+), 4 deletions(-)
+
+--- a/drivers/usb/gadget/udc/pch_udc.c
++++ b/drivers/usb/gadget/udc/pch_udc.c
+@@ -600,18 +600,22 @@ static void pch_udc_reconnect(struct pch
+ static inline void pch_udc_vbus_session(struct pch_udc_dev *dev,
+                                         int is_active)
+ {
++      unsigned long           iflags;
++
++      spin_lock_irqsave(&dev->lock, iflags);
+       if (is_active) {
+               pch_udc_reconnect(dev);
+               dev->vbus_session = 1;
+       } else {
+               if (dev->driver && dev->driver->disconnect) {
+-                      spin_lock(&dev->lock);
++                      spin_unlock_irqrestore(&dev->lock, iflags);
+                       dev->driver->disconnect(&dev->gadget);
+-                      spin_unlock(&dev->lock);
++                      spin_lock_irqsave(&dev->lock, iflags);
+               }
+               pch_udc_set_disconnect(dev);
+               dev->vbus_session = 0;
+       }
++      spin_unlock_irqrestore(&dev->lock, iflags);
+ }
+ 
+ /**
+@@ -1168,20 +1172,25 @@ static int pch_udc_pcd_selfpowered(struc
+ static int pch_udc_pcd_pullup(struct usb_gadget *gadget, int is_on)
+ {
+       struct pch_udc_dev      *dev;
++      unsigned long           iflags;
+ 
+       if (!gadget)
+               return -EINVAL;
++
+       dev = container_of(gadget, struct pch_udc_dev, gadget);
++
++      spin_lock_irqsave(&dev->lock, iflags);
+       if (is_on) {
+               pch_udc_reconnect(dev);
+       } else {
+               if (dev->driver && dev->driver->disconnect) {
+-                      spin_lock(&dev->lock);
++                      spin_unlock_irqrestore(&dev->lock, iflags);
+                       dev->driver->disconnect(&dev->gadget);
+-                      spin_unlock(&dev->lock);
++                      spin_lock_irqsave(&dev->lock, iflags);
+               }
+               pch_udc_set_disconnect(dev);
+       }
++      spin_unlock_irqrestore(&dev->lock, iflags);
+ 
+       return 0;
+ }