From: Greg Kroah-Hartman Date: Mon, 3 Dec 2018 11:20:29 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v4.19.7~20 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8391272fe77c686333815c061e903aac61fe9aa2;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch dmaengine-at_hdmac-fix-module-unloading.patch --- diff --git a/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch b/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch new file mode 100644 index 00000000000..23fef51c921 --- /dev/null +++ b/queue-3.18/dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch @@ -0,0 +1,57 @@ +From 98f5f932254b88ce828bc8e4d1642d14e5854caa Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 27 Nov 2018 17:06:34 +0100 +Subject: dmaengine: at_hdmac: fix memory leak in at_dma_xlate() + +From: Richard Genoud + +commit 98f5f932254b88ce828bc8e4d1642d14e5854caa upstream. + +The leak was found when opening/closing a serial port a great number of +time, increasing kmalloc-32 in slabinfo. + +Each time the port was opened, dma_request_slave_channel() was called. +Then, in at_dma_xlate(), atslave was allocated with devm_kzalloc() and +never freed. (Well, it was free at module unload, but that's not what we +want). +So, here, kzalloc is more suited for the job since it has to be freed in +atc_free_chan_resources(). + +Cc: stable@vger.kernel.org +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Reported-by: Mario Forner +Suggested-by: Alexandre Belloni +Acked-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Signed-off-by: Richard Genoud +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1232,6 +1232,12 @@ static void atc_free_chan_resources(stru + atchan->status = 0; + atchan->remain_desc = 0; + ++ /* ++ * Free atslave allocated in at_dma_xlate() ++ */ ++ kfree(chan->private); ++ chan->private = NULL; ++ + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } + +@@ -1266,7 +1272,7 @@ static struct dma_chan *at_dma_xlate(str + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); + +- atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL); ++ atslave = kzalloc(sizeof(*atslave), GFP_KERNEL); + if (!atslave) + return NULL; + diff --git a/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch b/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch new file mode 100644 index 00000000000..27f892cb751 --- /dev/null +++ b/queue-3.18/dmaengine-at_hdmac-fix-module-unloading.patch @@ -0,0 +1,37 @@ +From 77e75fda94d2ebb86aa9d35fb1860f6395bf95de Mon Sep 17 00:00:00 2001 +From: Richard Genoud +Date: Tue, 27 Nov 2018 17:06:35 +0100 +Subject: dmaengine: at_hdmac: fix module unloading + +From: Richard Genoud + +commit 77e75fda94d2ebb86aa9d35fb1860f6395bf95de upstream. + +of_dma_controller_free() was not called on module onloading. +This lead to a soft lockup: +watchdog: BUG: soft lockup - CPU#0 stuck for 23s! +Modules linked in: at_hdmac [last unloaded: at_hdmac] +when of_dma_request_slave_channel() tried to call ofdma->of_dma_xlate(). + +Cc: stable@vger.kernel.org +Fixes: bbe89c8e3d59 ("at_hdmac: move to generic DMA binding") +Acked-by: Ludovic Desroches +Signed-off-by: Richard Genoud +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/dma/at_hdmac.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1565,6 +1565,8 @@ static int at_dma_remove(struct platform + struct resource *io; + + at_dma_off(atdma); ++ if (pdev->dev.of_node) ++ of_dma_controller_free(pdev->dev.of_node); + dma_async_device_unregister(&atdma->dma_common); + + dma_pool_destroy(atdma->dma_desc_pool); diff --git a/queue-3.18/series b/queue-3.18/series index eda3d47005d..0e6c843198e 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -6,3 +6,5 @@ alsa-wss-fix-invalid-snd_free_pages-at-error-path.patch alsa-ac97-fix-incorrect-bit-shift-at-ac97-spsa-control-write.patch alsa-sparc-fix-invalid-snd_free_pages-at-error-path.patch ext2-fix-potential-use-after-free.patch +dmaengine-at_hdmac-fix-memory-leak-in-at_dma_xlate.patch +dmaengine-at_hdmac-fix-module-unloading.patch