3.18-stable patches

added patches:
	dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
	dmaengine-at_hdmac-fix-module-unloading.patch

diff --git a/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch b/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
new file mode 100644 (file)
index 0000000..23fef51
--- /dev/null
+++ b/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
@@ -0,0 +1,57 @@
+From 98f5f932254b88ce828bc8e4d1642d14e5854caa Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 27 Nov 2018 17:06:34 +0100
+Subject: dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit 98f5f932254b88ce828bc8e4d1642d14e5854caa upstream.
+
+The leak was found when opening/closing a serial port a great number of
+time, increasing kmalloc-32 in slabinfo.
+
+Each time the port was opened, dma_request_slave_channel() was called.
+Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and
+never freed. (Well, it was free at module unload, but that's not what we
+want).
+So, here, kzalloc is more suited for the job since it has to be freed in
+atc_free_chan_resources().
+
+Cc: stable@vger.kernel.org
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Reported-by: Mario Forner <m.forner@be4energy.com>
+Suggested-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c |    8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1232,6 +1232,12 @@ static void atc_free_chan_resources(stru
+       atchan->status = 0;
+       atchan->remain_desc = 0;
+ 
++      /*
++       * Free atslave allocated in at_dma_xlate()
++       */
++      kfree(chan->private);
++      chan->private = NULL;
++
+       dev_vdbg(chan2dev(chan), "free_chan_resources: done\n");
+ }
+ 
+@@ -1266,7 +1272,7 @@ static struct dma_chan *at_dma_xlate(str
+       dma_cap_zero(mask);
+       dma_cap_set(DMA_SLAVE, mask);
+ 
+-      atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL);
++      atslave = kzalloc(sizeof(*atslave), GFP_KERNEL);
+       if (!atslave)
+               return NULL;
+ 

diff --git a/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch b/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch
new file mode 100644 (file)
index 0000000..27f892c
--- /dev/null
+++ b/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch
@@ -0,0 +1,37 @@
+From 77e75fda94d2ebb86aa9d35fb1860f6395bf95de Mon Sep 17 00:00:00 2001
+From: Richard Genoud <richard.genoud@gmail.com>
+Date: Tue, 27 Nov 2018 17:06:35 +0100
+Subject: dmaengine: at_hdmac: fix module unloading
+
+From: Richard Genoud <richard.genoud@gmail.com>
+
+commit 77e75fda94d2ebb86aa9d35fb1860f6395bf95de upstream.
+
+of_dma_controller_free() was not called on module onloading.
+This lead to a soft lockup:
+watchdog: BUG: soft lockup - CPU#0 stuck for 23s!
+Modules linked in: at_hdmac [last unloaded: at_hdmac]
+when of_dma_request_slave_channel() tried to call ofdma->of_dma_xlate().
+
+Cc: stable@vger.kernel.org
+Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding")
+Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
+Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
+Signed-off-by: Vinod Koul <vkoul@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/at_hdmac.c |    2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -1565,6 +1565,8 @@ static int at_dma_remove(struct platform
+       struct resource         *io;
+ 
+       at_dma_off(atdma);
++      if (pdev->dev.of_node)
++              of_dma_controller_free(pdev->dev.of_node);
+       dma_async_device_unregister(&atdma->dma_common);
+ 
+       dma_pool_destroy(atdma->dma_desc_pool);

diff --git a/queue-3.18/series b/queue-3.18/series
index eda3d47005dbe02af1d18f432cdf3c203be03d24..0e6c843198e042ee2b8e14a4baa045d0440dbc21 100644 (file)
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -6,3 +6,5 @@ alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch
 alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch
 alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch
 ext2-fix-potential-use-after-free.patch
+dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch
+dmaengine-at_hdmac-fix-module-unloading.patch