From: Greg Kroah-Hartman Date: Mon, 3 Dec 2018 11:24:52 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v4.19.7~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=13c4c5bf81cb538776fcc46acaab268b4bc5871a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch dmaengine-at_hdmac-fix-module-unloading.patch --- diff --git a/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch b/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch new file mode 100644 index 00000000000..d54f59f9fcc --- /dev/null +++ b/queue-4.9/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch @@ -0,0 +1,57 @@ +From 98f5f932254b88ce828bc8e4d1642d14e5854caa Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 27 Nov 2018 17:06:34 +0100 +Subject: dmaengine: at_hdmac: fix memory leak in at_dma_xlate() + +From: Richard Genoud + +commit 98f5f932254b88ce828bc8e4d1642d14e5854caa upstream. + +The leak was found when opening/closing a serial port a great number of +time, increasing kmalloc-32 in slabinfo. + +Each time the port was opened, dma_request_slave_channel() was called. +Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and +never freed. (Well, it was free at module unload, but that's not what we +want). +So, here, kzalloc is more suited for the job since it has to be freed in +atc_free_chan_resources(). + +Cc: stable@vger.kernel.org +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Reported-by: Mario Forner +Suggested-by: Alexandre Belloni +Acked-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Signed-off-by: Richard Genoud +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1774,6 +1774,12 @@ static void atc_free_chan_resources(stru + atchan->descs_allocated = 0; + atchan->status = 0; + ++ /* ++ * Free atslave allocated in at_dma_xlate() ++ */ ++ kfree(chan->private); ++ chan->private = NULL; ++ + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } + +@@ -1808,7 +1814,7 @@ static struct dma_chan *at_dma_xlate(str + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); + +- atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL); ++ atslave = kzalloc(sizeof(*atslave), GFP_KERNEL); + if (!atslave) + return NULL; + diff --git a/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch b/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch new file mode 100644 index 00000000000..ba6b8135f9c --- /dev/null +++ b/queue-4.9/dmaengine-at_hdmac-fix-module-unloading.patch @@ -0,0 +1,37 @@ +From 77e75fda94d2ebb86aa9d35fb1860f6395bf95de Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 27 Nov 2018 17:06:35 +0100 +Subject: dmaengine: at_hdmac: fix module unloading + +From: Richard Genoud + +commit 77e75fda94d2ebb86aa9d35fb1860f6395bf95de upstream. + +of_dma_controller_free() was not called on module onloading. +This lead to a soft lockup: +watchdog: BUG: soft lockup - CPU#0 stuck for 23s! +Modules linked in: at_hdmac [last unloaded: at_hdmac] +when of_dma_request_slave_channel() tried to call ofdma->of_dma_xlate(). + +Cc: stable@vger.kernel.org +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Acked-by: Ludovic Desroches +Signed-off-by: Richard Genoud +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -2145,6 +2145,8 @@ static int at_dma_remove(struct platform + struct resource *io; + + at_dma_off(atdma); ++ if (pdev->dev.of_node) ++ of_dma_controller_free(pdev->dev.of_node); + dma_async_device_unregister(&atdma->dma_common); + + dma_pool_destroy(atdma->memset_pool); diff --git a/queue-4.9/series b/queue-4.9/series index 0bfcdf4014b..46539d877ca 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -44,3 +44,5 @@ function_graph-have-profiler-use-curr_ret_stack-and-not-depth.patch function_graph-move-return-callback-before-update-of-curr_ret_stack.patch function_graph-reverse-the-order-of-pushing-the-ret_stack-and-the-callback.patch ext2-fix-potential-use-after-free.patch +dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch +dmaengine-at_hdmac-fix-module-unloading.patch