releases/4.19.27/mmc-cqhci-fix-a-tiny-potential-memory-leak-on-error-condition.patch

   1 From d07e9fadf3a6b466ca3ae90fa4859089ff20530f Mon Sep 17 00:00:00 2001
   2 From: Alamy Liu <alamy.liu@gmail.com>
   3 Date: Mon, 25 Feb 2019 11:22:14 -0800
   4 Subject: mmc: cqhci: Fix a tiny potential memory leak on error condition
   5
   6 From: Alamy Liu <alamy.liu@gmail.com>
   7
   8 commit d07e9fadf3a6b466ca3ae90fa4859089ff20530f upstream.
   9
  10 Free up the allocated memory in the case of error return
  11
  12 The value of mmc_host->cqe_enabled stays 'false'. Thus, cqhci_disable
  13 (mmc_cqe_ops->cqe_disable) won't be called to free the memory.  Also,
  14 cqhci_disable() seems to be designed to disable and free all resources, not
  15 suitable to handle this corner case.
  16
  17 Fixes: a4080225f51d ("mmc: cqhci: support for command queue enabled host")
  18 Signed-off-by: Alamy Liu <alamy.liu@gmail.com>
  19 Acked-by: Adrian Hunter <adrian.hunter@intel.com>
  20 Cc: stable@vger.kernel.org
  21 Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  23
  24 ---
  25  drivers/mmc/host/cqhci.c |   11 ++++++++++-
  26  1 file changed, 10 insertions(+), 1 deletion(-)
  27
  28 --- a/drivers/mmc/host/cqhci.c
  29 +++ b/drivers/mmc/host/cqhci.c
  30 @@ -217,12 +217,21 @@ static int cqhci_host_alloc_tdl(struct c
  31                                                  cq_host->desc_size,
  32                                                  &cq_host->desc_dma_base,
  33                                                  GFP_KERNEL);
  34 +       if (!cq_host->desc_base)
  35 +               return -ENOMEM;
  36 +
  37         cq_host->trans_desc_base = dmam_alloc_coherent(mmc_dev(cq_host->mmc),
  38                                               cq_host->data_size,
  39                                               &cq_host->trans_desc_dma_base,
  40                                               GFP_KERNEL);
  41 -       if (!cq_host->desc_base || !cq_host->trans_desc_base)
  42 +       if (!cq_host->trans_desc_base) {
  43 +               dmam_free_coherent(mmc_dev(cq_host->mmc), cq_host->desc_size,
  44 +                                  cq_host->desc_base,
  45 +                                  cq_host->desc_dma_base);
  46 +               cq_host->desc_base = NULL;
  47 +               cq_host->desc_dma_base = 0;
  48                 return -ENOMEM;
  49 +       }
  50
  51         pr_debug("%s: cqhci: desc-base: 0x%p trans-base: 0x%p\n desc_dma 0x%llx trans_dma: 0x%llx\n",
  52                  mmc_hostname(cq_host->mmc), cq_host->desc_base, cq_host->trans_desc_base,