4.19-stable patches

added patches:
	ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch

diff --git a/queue-4.19/ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch b/queue-4.19/ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch
new file mode 100644 (file)
index 0000000..b1f5bb6
--- /dev/null
+++ b/queue-4.19/ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch
@@ -0,0 +1,41 @@
+From 284b75a3d83c7631586d98f6dede1d90f128f0db Mon Sep 17 00:00:00 2001
+From: Zheng Qixing <zhengqixing@huawei.com>
+Date: Thu, 22 Aug 2024 11:30:50 +0800
+Subject: ata: libata: Fix memory leak for error path in ata_host_alloc()
+
+From: Zheng Qixing <zhengqixing@huawei.com>
+
+commit 284b75a3d83c7631586d98f6dede1d90f128f0db upstream.
+
+In ata_host_alloc(), if devres_alloc() fails to allocate the device host
+resource data pointer, the already allocated ata_host structure is not
+freed before returning from the function. This results in a potential
+memory leak.
+
+Call kfree(host) before jumping to the error handling path to ensure
+that the ata_host structure is properly freed if devres_alloc() fails.
+
+Fixes: 2623c7a5f279 ("libata: add refcounting to ata_host")
+Cc: stable@vger.kernel.org
+Signed-off-by: Zheng Qixing <zhengqixing@huawei.com>
+Reviewed-by: Yu Kuai <yukuai3@huawei.com>
+Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ata/libata-core.c |    4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -6221,8 +6221,10 @@ struct ata_host *ata_host_alloc(struct d
+       }
+ 
+       dr = devres_alloc(ata_devres_release, 0, GFP_KERNEL);
+-      if (!dr)
++      if (!dr) {
++              kfree(host);
+               goto err_out;
++      }
+ 
+       devres_add(dev, dr);
+       dev_set_drvdata(dev, host);

diff --git a/queue-4.19/series b/queue-4.19/series
index 3c97b40d9f32ff1cc06bf7cc136650a204032693..cac3fe4cffefa4cab4848f0caf13082be2446aad 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -17,3 +17,4 @@ alsa-usb-audio-sanity-checks-for-each-pipe-and-ep-types.patch
 alsa-usb-audio-fix-gpf-in-snd_usb_pipe_sanity_check.patch
 sch-netem-fix-use-after-free-in-netem_dequeue.patch
 alsa-hda-conexant-add-pincfg-quirk-to-enable-top-speakers-on-sirius-devices.patch
+ata-libata-fix-memory-leak-for-error-path-in-ata_host_alloc.patch