From: Greg Kroah-Hartman Date: Fri, 26 Oct 2012 23:13:37 +0000 (-0700) Subject: 3.0-stable patches X-Git-Tag: v3.0.49~1 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=179c607421ab8c39664ff1db0342bba5a5608b98;p=thirdparty%2Fkernel%2Fstable-queue.git 3.0-stable patches added patches: usb-mos7840-fix-port-device-leak-in-error-path.patch usb-mos7840-fix-urb-leak-at-release.patch usb-mos7840-remove-invalid-disconnect-handling.patch usb-mos7840-remove-null-urb-submission.patch usb-serial-fix-memory-leak-in-sierra_release.patch usb-sierra-fix-memory-leak-in-attach-error-path.patch usb-sierra-fix-memory-leak-in-probe-error-path.patch --- diff --git a/queue-3.0/series b/queue-3.0/series index 94df6dc5f07..9c43004cae7 100644 --- a/queue-3.0/series +++ b/queue-3.0/series @@ -15,3 +15,10 @@ usb-hub-send-clear_tt_buffer_complete-events-when-canceling-tt-clear-work.patch usb-whiteheat-fix-memory-leak-in-error-path.patch usb-opticon-fix-dma-from-stack.patch usb-opticon-fix-memory-leak-in-error-path.patch +usb-serial-fix-memory-leak-in-sierra_release.patch +usb-sierra-fix-memory-leak-in-attach-error-path.patch +usb-sierra-fix-memory-leak-in-probe-error-path.patch +usb-mos7840-fix-urb-leak-at-release.patch +usb-mos7840-fix-port-device-leak-in-error-path.patch +usb-mos7840-remove-null-urb-submission.patch +usb-mos7840-remove-invalid-disconnect-handling.patch diff --git a/queue-3.0/usb-mos7840-fix-port-device-leak-in-error-path.patch b/queue-3.0/usb-mos7840-fix-port-device-leak-in-error-path.patch new file mode 100644 index 00000000000..6db29fbbeb5 --- /dev/null +++ b/queue-3.0/usb-mos7840-fix-port-device-leak-in-error-path.patch @@ -0,0 +1,30 @@ +From 3eb55cc4ed88eee3b5230f66abcdbd2a91639eda Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 13:35:10 +0200 +Subject: USB: mos7840: fix port-device leak in error path + +From: Johan Hovold + +commit 3eb55cc4ed88eee3b5230f66abcdbd2a91639eda upstream. + +The driver set the usb-serial port pointers to NULL on errors in attach, +effectively preventing usb-serial core from decrementing the port ref +counters and releasing the port devices and associated data. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -2595,7 +2595,6 @@ error: + kfree(mos7840_port->ctrl_buf); + usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port); +- serial->port[i] = NULL; + } + return status; + } diff --git a/queue-3.0/usb-mos7840-fix-urb-leak-at-release.patch b/queue-3.0/usb-mos7840-fix-urb-leak-at-release.patch new file mode 100644 index 00000000000..e80c4c119e1 --- /dev/null +++ b/queue-3.0/usb-mos7840-fix-urb-leak-at-release.patch @@ -0,0 +1,28 @@ +From 65a4cdbb170e4ec1a7fa0e94936d47e24a17b0e8 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 13:35:09 +0200 +Subject: USB: mos7840: fix urb leak at release + +From: Johan Hovold + +commit 65a4cdbb170e4ec1a7fa0e94936d47e24a17b0e8 upstream. + +Make sure control urb is freed at release. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -2662,6 +2662,7 @@ static void mos7840_release(struct usb_s + mos7840_port = mos7840_get_port_private(serial->port[i]); + dbg("mos7840_port %d = %p", i, mos7840_port); + if (mos7840_port) { ++ usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port->ctrl_buf); + kfree(mos7840_port->dr); + kfree(mos7840_port); diff --git a/queue-3.0/usb-mos7840-remove-invalid-disconnect-handling.patch b/queue-3.0/usb-mos7840-remove-invalid-disconnect-handling.patch new file mode 100644 index 00000000000..45b0484d542 --- /dev/null +++ b/queue-3.0/usb-mos7840-remove-invalid-disconnect-handling.patch @@ -0,0 +1,58 @@ +From e681b66f2e19fadbe8a7e2a17900978cb6bc921f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 18:56:33 +0200 +Subject: USB: mos7840: remove invalid disconnect handling + +From: Johan Hovold + +commit e681b66f2e19fadbe8a7e2a17900978cb6bc921f upstream. + +Remove private zombie flag used to signal disconnect and to prevent +control urb from being submitted from interrupt urb completion handler. + +The control urb will not be re-submitted as both the control urb and the +interrupt urb is killed on disconnect. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 13 +------------ + 1 file changed, 1 insertion(+), 12 deletions(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -239,7 +239,6 @@ struct moschip_port { + __u8 shadowMCR; /* last MCR value received */ + char open; + char open_ports; +- char zombie; + wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */ + wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */ + int delta_msr_cond; +@@ -642,14 +641,7 @@ static void mos7840_interrupt_callback(s + wreg = MODEM_STATUS_REGISTER; + break; + } +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) { +- rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); +- } else { +- spin_unlock(&mos7840_port->pool_lock); +- return; +- } +- spin_unlock(&mos7840_port->pool_lock); ++ rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); + } + } + } +@@ -2612,9 +2604,6 @@ static void mos7840_disconnect(struct us + mos7840_port = mos7840_get_port_private(serial->port[i]); + dbg ("mos7840_port %d = %p", i, mos7840_port); + if (mos7840_port) { +- spin_lock_irqsave(&mos7840_port->pool_lock, flags); +- mos7840_port->zombie = 1; +- spin_unlock_irqrestore(&mos7840_port->pool_lock, flags); + usb_kill_urb(mos7840_port->control_urb); + } + } diff --git a/queue-3.0/usb-mos7840-remove-null-urb-submission.patch b/queue-3.0/usb-mos7840-remove-null-urb-submission.patch new file mode 100644 index 00000000000..c88aca56b7d --- /dev/null +++ b/queue-3.0/usb-mos7840-remove-null-urb-submission.patch @@ -0,0 +1,65 @@ +From 28c3ae9a8cf45f439c9a0779ebd0256e2ae72813 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 18:56:32 +0200 +Subject: USB: mos7840: remove NULL-urb submission + +From: Johan Hovold + +commit 28c3ae9a8cf45f439c9a0779ebd0256e2ae72813 upstream. + +The private int_urb is never allocated so the submission from the +control completion handler will always fail. Remove this odd piece of +broken code. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/mos7840.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -235,7 +235,6 @@ struct moschip_port { + int port_num; /*Actual port number in the device(1,2,etc) */ + struct urb *write_urb; /* write URB for this port */ + struct urb *read_urb; /* read URB for this port */ +- struct urb *int_urb; + __u8 shadowLCR; /* last LCR value received */ + __u8 shadowMCR; /* last MCR value received */ + char open; +@@ -505,7 +504,6 @@ static void mos7840_control_callback(str + unsigned char *data; + struct moschip_port *mos7840_port; + __u8 regval = 0x0; +- int result = 0; + int status = urb->status; + + mos7840_port = urb->context; +@@ -524,7 +522,7 @@ static void mos7840_control_callback(str + default: + dbg("%s - nonzero urb status received: %d", __func__, + status); +- goto exit; ++ return; + } + + dbg("%s urb buffer size is %d", __func__, urb->actual_length); +@@ -537,17 +535,6 @@ static void mos7840_control_callback(str + mos7840_handle_new_msr(mos7840_port, regval); + else if (mos7840_port->MsrLsr == 1) + mos7840_handle_new_lsr(mos7840_port, regval); +- +-exit: +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) +- result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC); +- spin_unlock(&mos7840_port->pool_lock); +- if (result) { +- dev_err(&urb->dev->dev, +- "%s - Error %d submitting interrupt urb\n", +- __func__, result); +- } + } + + static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, diff --git a/queue-3.0/usb-serial-fix-memory-leak-in-sierra_release.patch b/queue-3.0/usb-serial-fix-memory-leak-in-sierra_release.patch new file mode 100644 index 00000000000..6512ea6ee8b --- /dev/null +++ b/queue-3.0/usb-serial-fix-memory-leak-in-sierra_release.patch @@ -0,0 +1,30 @@ +From f7bc5051667b74c3861f79eed98c60d5c3b883f7 Mon Sep 17 00:00:00 2001 +From: Lennart Sorensen +Date: Wed, 24 Oct 2012 10:23:09 -0400 +Subject: USB: serial: Fix memory leak in sierra_release() + +From: Lennart Sorensen + +commit f7bc5051667b74c3861f79eed98c60d5c3b883f7 upstream. + +I found a memory leak in sierra_release() (well sierra_probe() I guess) +that looses 8 bytes each time the driver releases a device. + +Signed-off-by: Len Sorensen +Acked-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -993,6 +993,7 @@ static void sierra_release(struct usb_se + continue; + kfree(portdata); + } ++ kfree(serial->private); + } + + #ifdef CONFIG_PM diff --git a/queue-3.0/usb-sierra-fix-memory-leak-in-attach-error-path.patch b/queue-3.0/usb-sierra-fix-memory-leak-in-attach-error-path.patch new file mode 100644 index 00000000000..d0ff187ecd1 --- /dev/null +++ b/queue-3.0/usb-sierra-fix-memory-leak-in-attach-error-path.patch @@ -0,0 +1,43 @@ +From 7e41f9bcdd2e813ea2a3c40db291d87ea06b559f Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 10:29:17 +0200 +Subject: USB: sierra: fix memory leak in attach error path + +From: Johan Hovold + +commit 7e41f9bcdd2e813ea2a3c40db291d87ea06b559f upstream. + +Make sure port private data is deallocated on errors in attach. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -937,7 +937,7 @@ static int sierra_startup(struct usb_ser + dev_dbg(&port->dev, "%s: kmalloc for " + "sierra_port_private (%d) failed!\n", + __func__, i); +- return -ENOMEM; ++ goto err; + } + spin_lock_init(&portdata->lock); + init_usb_anchor(&portdata->active); +@@ -974,6 +974,13 @@ static int sierra_startup(struct usb_ser + } + + return 0; ++err: ++ for (--i; i >= 0; --i) { ++ portdata = usb_get_serial_port_data(serial->port[i]); ++ kfree(portdata); ++ } ++ ++ return -ENOMEM; + } + + static void sierra_release(struct usb_serial *serial) diff --git a/queue-3.0/usb-sierra-fix-memory-leak-in-probe-error-path.patch b/queue-3.0/usb-sierra-fix-memory-leak-in-probe-error-path.patch new file mode 100644 index 00000000000..fa1f009fd01 --- /dev/null +++ b/queue-3.0/usb-sierra-fix-memory-leak-in-probe-error-path.patch @@ -0,0 +1,72 @@ +From 084817d79399ab5ccab2f90a148b0369912a8369 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Thu, 25 Oct 2012 10:29:18 +0200 +Subject: USB: sierra: fix memory leak in probe error path + +From: Johan Hovold + +commit 084817d79399ab5ccab2f90a148b0369912a8369 upstream. + +Move interface data allocation to attach so that it is deallocated on +errors in usb-serial probe. + +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/serial/sierra.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -171,7 +171,6 @@ static int sierra_probe(struct usb_seria + { + int result = 0; + struct usb_device *udev; +- struct sierra_intf_private *data; + u8 ifnum; + + udev = serial->dev; +@@ -199,11 +198,6 @@ static int sierra_probe(struct usb_seria + return -ENODEV; + } + +- data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- spin_lock_init(&data->susp_lock); +- + return result; + } + +@@ -915,6 +909,7 @@ static void sierra_dtr_rts(struct usb_se + static int sierra_startup(struct usb_serial *serial) + { + struct usb_serial_port *port; ++ struct sierra_intf_private *intfdata; + struct sierra_port_private *portdata; + struct sierra_iface_info *himemoryp = NULL; + int i; +@@ -922,6 +917,14 @@ static int sierra_startup(struct usb_ser + + dev_dbg(&serial->dev->dev, "%s\n", __func__); + ++ intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL); ++ if (!intfdata) ++ return -ENOMEM; ++ ++ spin_lock_init(&intfdata->susp_lock); ++ ++ usb_set_serial_data(serial, intfdata); ++ + /* Set Device mode to D0 */ + sierra_set_power_state(serial->dev, 0x0000); + +@@ -979,6 +982,7 @@ err: + portdata = usb_get_serial_port_data(serial->port[i]); + kfree(portdata); + } ++ kfree(intfdata); + + return -ENOMEM; + }