From: Greg Kroah-Hartman Date: Sun, 11 Aug 2019 15:03:56 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v5.2.9~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b90e21f87f028fb074ea3c797a25c165894ea720;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: sound-fix-a-memory-leak-bug.patch usb-iowarrior-fix-deadlock-on-disconnect.patch --- diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..318f70b27f7 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,10 @@ +iio-adc-max9611-fix-misuse-of-genmask-macro.patch +crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch +crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch +usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch +usb-iowarrior-fix-deadlock-on-disconnect.patch +sound-fix-a-memory-leak-bug.patch +mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch +mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch +loop-set-pf_memalloc_noio-for-the-worker-thread.patch +input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch diff --git a/queue-4.19/series b/queue-4.19/series new file mode 100644 index 00000000000..7bd979b1c9b --- /dev/null +++ b/queue-4.19/series @@ -0,0 +1,17 @@ +iio-cros_ec_accel_legacy-fix-incorrect-channel-setting.patch +iio-adc-max9611-fix-misuse-of-genmask-macro.patch +staging-gasket-apex-fix-copy-paste-typo.patch +staging-wilc1000-flush-the-workqueue-before-deinit-the-host.patch +staging-android-ion-bail-out-upon-sigkill-when-allocating-memory.patch +crypto-ccp-fix-oops-by-properly-managing-allocated-structures.patch +crypto-ccp-add-support-for-valid-authsize-values-less-than-16.patch +crypto-ccp-ignore-tag-length-when-decrypting-gcm-ciphertext.patch +usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch +usb-iowarrior-fix-deadlock-on-disconnect.patch +sound-fix-a-memory-leak-bug.patch +mmc-cavium-set-the-correct-dma-max-segment-size-for-mmc_host.patch +mmc-cavium-add-the-missing-dma-unmap-when-the-dma-has-finished.patch +loop-set-pf_memalloc_noio-for-the-worker-thread.patch +input-usbtouchscreen-initialize-pm-mutex-before-using-it.patch +input-elantech-enable-smbus-on-new-2018-systems.patch +input-synaptics-enable-rmi-mode-for-hp-spectre-x360.patch diff --git a/queue-4.4/series b/queue-4.4/series new file mode 100644 index 00000000000..5ce3b0269d4 --- /dev/null +++ b/queue-4.4/series @@ -0,0 +1,2 @@ +usb-iowarrior-fix-deadlock-on-disconnect.patch +sound-fix-a-memory-leak-bug.patch diff --git a/queue-4.4/sound-fix-a-memory-leak-bug.patch b/queue-4.4/sound-fix-a-memory-leak-bug.patch new file mode 100644 index 00000000000..bcc066b25cf --- /dev/null +++ b/queue-4.4/sound-fix-a-memory-leak-bug.patch @@ -0,0 +1,39 @@ +From c7cd7c748a3250ca33509f9235efab9c803aca09 Mon Sep 17 00:00:00 2001 +From: Wenwen Wang +Date: Thu, 8 Aug 2019 00:15:21 -0500 +Subject: sound: fix a memory leak bug + +From: Wenwen Wang + +commit c7cd7c748a3250ca33509f9235efab9c803aca09 upstream. + +In sound_insert_unit(), the controlling structure 's' is allocated through +kmalloc(). Then it is added to the sound driver list by invoking +__sound_insert_unit(). Later on, if __register_chrdev() fails, 's' is +removed from the list through __sound_remove_unit(). If 'index' is not less +than 0, -EBUSY is returned to indicate the error. However, 's' is not +deallocated on this execution path, leading to a memory leak bug. + +To fix the above issue, free 's' before -EBUSY is returned. + +Signed-off-by: Wenwen Wang +Cc: +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman + +--- + sound/sound_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/sound/sound_core.c ++++ b/sound/sound_core.c +@@ -287,7 +287,8 @@ retry: + goto retry; + } + spin_unlock(&sound_loader_lock); +- return -EBUSY; ++ r = -EBUSY; ++ goto fail; + } + } + diff --git a/queue-4.4/usb-iowarrior-fix-deadlock-on-disconnect.patch b/queue-4.4/usb-iowarrior-fix-deadlock-on-disconnect.patch new file mode 100644 index 00000000000..02376e987f1 --- /dev/null +++ b/queue-4.4/usb-iowarrior-fix-deadlock-on-disconnect.patch @@ -0,0 +1,50 @@ +From c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Thu, 8 Aug 2019 11:27:28 +0200 +Subject: usb: iowarrior: fix deadlock on disconnect + +From: Oliver Neukum + +commit c468a8aa790e0dfe0a7f8a39db282d39c2c00b46 upstream. + +We have to drop the mutex before we close() upon disconnect() +as close() needs the lock. This is safe to do by dropping the +mutex as intfdata is already set to NULL, so open() will fail. + +Fixes: 03f36e885fc26 ("USB: open disconnect race in iowarrior") +Reported-by: syzbot+a64a382964bf6c71a9c0@syzkaller.appspotmail.com +Cc: stable +Signed-off-by: Oliver Neukum +Link: https://lore.kernel.org/r/20190808092728.23417-1-oneukum@suse.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/usb/misc/iowarrior.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/usb/misc/iowarrior.c ++++ b/drivers/usb/misc/iowarrior.c +@@ -898,19 +898,20 @@ static void iowarrior_disconnect(struct + dev = usb_get_intfdata(interface); + mutex_lock(&iowarrior_open_disc_lock); + usb_set_intfdata(interface, NULL); ++ /* prevent device read, write and ioctl */ ++ dev->present = 0; + + minor = dev->minor; ++ mutex_unlock(&iowarrior_open_disc_lock); ++ /* give back our minor - this will call close() locks need to be dropped at this point*/ + +- /* give back our minor */ + usb_deregister_dev(interface, &iowarrior_class); + + mutex_lock(&dev->mutex); + + /* prevent device read, write and ioctl */ +- dev->present = 0; + + mutex_unlock(&dev->mutex); +- mutex_unlock(&iowarrior_open_disc_lock); + + if (dev->opened) { + /* There is a process that holds a filedescriptor to the device , diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..45875e6cd8c --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,3 @@ +usb-usbfs-fix-double-free-of-usb-memory-upon-submiturb-error.patch +usb-iowarrior-fix-deadlock-on-disconnect.patch +sound-fix-a-memory-leak-bug.patch