From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Mon, 13 May 2024 13:42:23 +0000 (+0200)
Subject: 6.6-stable patches
X-Git-Tag: v4.19.314~47
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4918e678b78ad7b87345587b2bc2f16c1e824b7c;p=thirdparty%2Fkernel%2Fstable-queue.git

6.6-stable patches

added patches:
	mm-slab-make-__free-kfree-accept-error-pointers.patch
---

diff --git a/queue-6.6/mm-slab-make-__free-kfree-accept-error-pointers.patch b/queue-6.6/mm-slab-make-__free-kfree-accept-error-pointers.patch
new file mode 100644
index 00000000000..cd10afb4899
--- /dev/null
+++ b/queue-6.6/mm-slab-make-__free-kfree-accept-error-pointers.patch
@@ -0,0 +1,42 @@
+From cd7eb8f83fcf258f71e293f7fc52a70be8ed0128 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@linaro.org>
+Date: Sun, 28 Apr 2024 17:26:44 +0300
+Subject: mm/slab: make __free(kfree) accept error pointers
+
+From: Dan Carpenter <dan.carpenter@linaro.org>
+
+commit cd7eb8f83fcf258f71e293f7fc52a70be8ed0128 upstream.
+
+Currently, if an automatically freed allocation is an error pointer that
+will lead to a crash.  An example of this is in wm831x_gpio_dbg_show().
+
+   171	char *label __free(kfree) = gpiochip_dup_line_label(chip, i);
+   172	if (IS_ERR(label)) {
+   173		dev_err(wm831x->dev, "Failed to duplicate label\n");
+   174		continue;
+   175  }
+
+The auto clean up function should check for error pointers as well,
+otherwise we're going to keep hitting issues like this.
+
+Fixes: 54da6a092431 ("locking: Introduce __cleanup() based infrastructure")
+Cc: <stable@vger.kernel.org>
+Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
+Acked-by: David Rientjes <rientjes@google.com>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/slab.h |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/linux/slab.h
++++ b/include/linux/slab.h
+@@ -228,7 +228,7 @@ void kfree(const void *objp);
+ void kfree_sensitive(const void *objp);
+ size_t __ksize(const void *objp);
+ 
+-DEFINE_FREE(kfree, void *, if (_T) kfree(_T))
++DEFINE_FREE(kfree, void *, if (!IS_ERR_OR_NULL(_T)) kfree(_T))
+ 
+ /**
+  * ksize - Report actual allocation size of associated object
diff --git a/queue-6.6/series b/queue-6.6/series
index efba40ba05a..6e608862bb8 100644
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -241,3 +241,4 @@ firewire-ohci-fulfill-timestamp-for-some-local-asynchronous-transaction.patch
 btrfs-add-missing-mutex_unlock-in-btrfs_relocate_sys_chunks.patch
 btrfs-set-correct-ram_bytes-when-splitting-ordered-extent.patch
 maple_tree-fix-mas_empty_area_rev-null-pointer-dereference.patch
+mm-slab-make-__free-kfree-accept-error-pointers.patch