4.9-stable patches

added patches:
	pci-hotplug-acpi-fix-context-refcounting-in-acpiphp_grab_context.patch

diff --git a/queue-4.9/pci-hotplug-acpi-fix-context-refcounting-in-acpiphp_grab_context.patch b/queue-4.9/pci-hotplug-acpi-fix-context-refcounting-in-acpiphp_grab_context.patch
new file mode 100644 (file)
index 0000000..c2b7656
--- /dev/null
+++ b/queue-4.9/pci-hotplug-acpi-fix-context-refcounting-in-acpiphp_grab_context.patch
@@ -0,0 +1,51 @@
+From dae68d7fd4930315389117e9da35b763f12238f9 Mon Sep 17 00:00:00 2001
+From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
+Date: Fri, 26 Jun 2020 19:42:34 +0200
+Subject: PCI: hotplug: ACPI: Fix context refcounting in acpiphp_grab_context()
+
+From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+
+commit dae68d7fd4930315389117e9da35b763f12238f9 upstream.
+
+If context is not NULL in acpiphp_grab_context(), but the
+is_going_away flag is set for the device's parent, the reference
+counter of the context needs to be decremented before returning
+NULL or the context will never be freed, so make that happen.
+
+Fixes: edf5bf34d408 ("ACPI / dock: Use callback pointers from devices' ACPI hotplug contexts")
+Reported-by: Vasily Averin <vvs@virtuozzo.com>
+Cc: 3.15+ <stable@vger.kernel.org> # 3.15+
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/hotplug/acpiphp_glue.c |   14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+--- a/drivers/pci/hotplug/acpiphp_glue.c
++++ b/drivers/pci/hotplug/acpiphp_glue.c
+@@ -136,13 +136,21 @@ static struct acpiphp_context *acpiphp_g
+       struct acpiphp_context *context;
+ 
+       acpi_lock_hp_context();
++
+       context = acpiphp_get_context(adev);
+-      if (!context || context->func.parent->is_going_away) {
+-              acpi_unlock_hp_context();
+-              return NULL;
++      if (!context)
++              goto unlock;
++
++      if (context->func.parent->is_going_away) {
++              acpiphp_put_context(context);
++              context = NULL;
++              goto unlock;
+       }
++
+       get_bridge(context->func.parent);
+       acpiphp_put_context(context);
++
++unlock:
+       acpi_unlock_hp_context();
+       return context;
+ }

diff --git a/queue-4.9/series b/queue-4.9/series
index fc691de97253ffa18cadcd906f3995eec86ecb3c..44450fe69158c037b756ed4d200c3a0a8bec07e9 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -167,3 +167,4 @@ arm-8992-1-fix-unwind_frame-for-clang-built-kernels.patch
 xen-balloon-fix-accounting-in-alloc_xenballooned_pages-error-path.patch
 xen-balloon-make-the-balloon-wait-interruptible.patch
 smb3-warn-on-confusing-error-scenario-with-sec-krb5.patch
+pci-hotplug-acpi-fix-context-refcounting-in-acpiphp_grab_context.patch