4.9-stable patches

added patches:
	dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
	dmaengine-at_hdmac-fix-module-unloading.patch

diff --git a/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch b/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
new file mode 100644 (file)
index 0000000..d54f59f
--- /dev/null
+++ b/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
@@ -0,0 +1,57 @@
+From 98f5f932254b88ce828bc8e4d1642d14e5854caa Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 27 Nov 2018 17:06:34 +0100
+Subject: dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit 98f5f932254b88ce828bc8e4d1642d14e5854caa upstream.
+
+The leak was found when opening/closing a serial port a great number of
+time, increasing kmalloc-32 in slabinfo.
+
+Each time the port was opened, dma_request_slave_channel() was called.
+Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and
+never freed. (Well, it was free at module unload, but that's not what we
+want).
+So, here, kzalloc is more suited for the job since it has to be freed in
+atc_free_chan_resources().
+
+Cc: stable@vger.kernel.org
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Reported-by: Mario Forner <m.forner@be4energy.com>
+Suggested-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1774,6 +1774,12 @@ static void atc_free_chan_resources(stru
+       atchan->descs_allocated = 0;
+       atchan->status = 0;
+ 
++      /*
++       * Free atslave allocated in at_dma_xlate()
++       */
++      kfree(chan->private);
++      chan->private = NULL;
++
+       dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
+ 
+@@ -1808,7 +1814,7 @@ static struct dma_chan *at_dma_xlate(str
+       dma_cap_zero(mask);
+       dma_cap_set(DMA_SLAVE, mask);
+ 
+-      atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
++      atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
+       if (!atslave)
+               return NULL;
+ 

diff --git a/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch b/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch
new file mode 100644 (file)
index 0000000..ba6b813
--- /dev/null
+++ b/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch
@@ -0,0 +1,37 @@
+From 77e75fda94d2ebb86aa9d35fb1860f6395bf95de Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 27 Nov 2018 17:06:35 +0100
+Subject: dmaengine: at_hdmac: fix module unloading
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit 77e75fda94d2ebb86aa9d35fb1860f6395bf95de upstream.
+
+of_dma_controller_free() was not called on module onloading.
+This lead to a soft lockup:
+watchdog: BUG: soft lockup - CPU#0 stuck for 23s!
+Modules linked in: at_hdmac [last unloaded: at_hdmac]
+when of_dma_request_slave_channel() tried to call ofdma->of_dma_xlate().
+
+Cc: stable@vger.kernel.org
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -2145,6 +2145,8 @@ static int at_dma_remove(struct platform
+       struct resource         *io;
+ 
+       at_dma_off(atdma);
++      if (pdev->dev.of_node)
++              of_dma_controller_free(pdev->dev.of_node);
+       dma_async_device_unregister(&atdma->dma_common);
+ 
+       dma_pool_destroy(atdma->memset_pool);

diff --git a/queue-4.9/series b/queue-4.9/series
index 0bfcdf4014bc1707c6451bfc6f32055e12a23ef3..46539d877caecaae5e27fb6901bc9e9f42a2d4d3 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -44,3 +44,5 @@ function_graph-have-profiler-use-curr_ret_stack-and-not-depth.patch
 function_graph-move-return-callback-before-update-of-curr_ret_stack.patch
 function_graph-reverse-the-order-of-pushing-the-ret_stack-and-the-callback.patch
 ext2-fix-potential-use-after-free.patch
+dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
+dmaengine-at_hdmac-fix-module-unloading.patch