--- /dev/null
+From dec9b2f1e0455a151a7293c367da22ab973f713e Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 2 Sep 2022 16:59:15 +0200
+Subject: debugfs: add debugfs_lookup_and_remove()
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit dec9b2f1e0455a151a7293c367da22ab973f713e upstream.
+
+There is a very common pattern of using
+debugfs_remove(debufs_lookup(..)) which results in a dentry leak of the
+dentry that was looked up. Instead of having to open-code the correct
+pattern of calling dput() on the dentry, create
+debugfs_lookup_and_remove() to handle this pattern automatically and
+properly without any memory leaks.
+
+Cc: stable <stable@kernel.org>
+Reported-by: Kuyo Chang <kuyo.chang@mediatek.com>
+Tested-by: Kuyo Chang <kuyo.chang@mediatek.com>
+Link: https://lore.kernel.org/r/YxIaQ8cSinDR881k@kroah.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/debugfs/inode.c | 22 ++++++++++++++++++++++
+ include/linux/debugfs.h | 6 ++++++
+ 2 files changed, 28 insertions(+)
+
+--- a/fs/debugfs/inode.c
++++ b/fs/debugfs/inode.c
+@@ -745,6 +745,28 @@ void debugfs_remove(struct dentry *dentr
+ EXPORT_SYMBOL_GPL(debugfs_remove);
+
+ /**
++ * debugfs_lookup_and_remove - lookup a directory or file and recursively remove it
++ * @name: a pointer to a string containing the name of the item to look up.
++ * @parent: a pointer to the parent dentry of the item.
++ *
++ * This is the equlivant of doing something like
++ * debugfs_remove(debugfs_lookup(..)) but with the proper reference counting
++ * handled for the directory being looked up.
++ */
++void debugfs_lookup_and_remove(const char *name, struct dentry *parent)
++{
++ struct dentry *dentry;
++
++ dentry = debugfs_lookup(name, parent);
++ if (!dentry)
++ return;
++
++ debugfs_remove(dentry);
++ dput(dentry);
++}
++EXPORT_SYMBOL_GPL(debugfs_lookup_and_remove);
++
++/**
+ * debugfs_rename - rename a file/directory in the debugfs filesystem
+ * @old_dir: a pointer to the parent dentry for the renamed object. This
+ * should be a directory dentry.
+--- a/include/linux/debugfs.h
++++ b/include/linux/debugfs.h
+@@ -91,6 +91,8 @@ struct dentry *debugfs_create_automount(
+ void debugfs_remove(struct dentry *dentry);
+ #define debugfs_remove_recursive debugfs_remove
+
++void debugfs_lookup_and_remove(const char *name, struct dentry *parent);
++
+ const struct file_operations *debugfs_real_fops(const struct file *filp);
+
+ int debugfs_file_get(struct dentry *dentry);
+@@ -225,6 +227,10 @@ static inline void debugfs_remove(struct
+ static inline void debugfs_remove_recursive(struct dentry *dentry)
+ { }
+
++static inline void debugfs_lookup_and_remove(const char *name,
++ struct dentry *parent)
++{ }
++
+ const struct file_operations *debugfs_real_fops(const struct file *filp);
+
+ static inline int debugfs_file_get(struct dentry *dentry)
--- /dev/null
+From 5666a274a6d54372d6b79b1f78682a9d827e679e Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Thu, 1 Sep 2022 18:37:34 +0200
+Subject: driver core: fix driver_set_override() issue with empty strings
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit 5666a274a6d54372d6b79b1f78682a9d827e679e upstream.
+
+Python likes to send an empty string for some sysfs files, including the
+driver_override field. When commit 23d99baf9d72 ("PCI: Use
+driver_set_override() instead of open-coding") moved the PCI core to use
+the driver core function instead of hand-rolling their own handler, this
+showed up as a regression from some userspace tools, like DPDK.
+
+Fix this up by actually looking at the length of the string first
+instead of trusting that userspace got it correct.
+
+Fixes: 23d99baf9d72 ("PCI: Use driver_set_override() instead of open-coding")
+Cc: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Cc: "Rafael J. Wysocki" <rafael@kernel.org>
+Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
+Cc: stable <stable@kernel.org>
+Reported-by: Stephen Hemminger <stephen@networkplumber.org>
+Tested-by: Huisong Li <lihuisong@huawei.com>
+Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
+Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
+Link: https://lore.kernel.org/r/20220901163734.3583106-1-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/base/driver.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/base/driver.c
++++ b/drivers/base/driver.c
+@@ -63,6 +63,12 @@ int driver_set_override(struct device *d
+ if (len >= (PAGE_SIZE - 1))
+ return -EINVAL;
+
++ /*
++ * Compute the real length of the string in case userspace sends us a
++ * bunch of \0 characters like python likes to do.
++ */
++ len = strlen(s);
++
+ if (!len) {
+ /* Empty string passed - clear override */
+ device_lock(dev);
--- /dev/null
+From cbfac7fa491651c57926c99edeb7495c6c1aeac2 Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 2 Sep 2022 15:01:05 +0200
+Subject: drm/amd/display: fix memory leak when using debugfs_lookup()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit cbfac7fa491651c57926c99edeb7495c6c1aeac2 upstream.
+
+When calling debugfs_lookup() the result must have dput() called on it,
+otherwise the memory will leak over time. Fix this up by properly
+calling dput().
+
+Cc: Harry Wentland <harry.wentland@amd.com>
+Cc: Leo Li <sunpeng.li@amd.com>
+Cc: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Cc: Alex Deucher <alexander.deucher@amd.com>
+Cc: "Christian König" <christian.koenig@amd.com>
+Cc: "Pan, Xinhui" <Xinhui.Pan@amd.com>
+Cc: David Airlie <airlied@linux.ie>
+Cc: Daniel Vetter <daniel@ffwll.ch>
+Cc: Wayne Lin <Wayne.Lin@amd.com>
+Cc: hersen wu <hersenxs.wu@amd.com>
+Cc: Wenjing Liu <wenjing.liu@amd.com>
+Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
+Cc: Thelford Williams <tdwilliamsiv@gmail.com>
+Cc: Fangzhi Zuo <Jerry.Zuo@amd.com>
+Cc: Yongzhi Liu <lyz_cs@pku.edu.cn>
+Cc: Mikita Lipski <mikita.lipski@amd.com>
+Cc: Jiapeng Chong <jiapeng.chong@linux.alibaba.com>
+Cc: Bhanuprakash Modem <bhanuprakash.modem@intel.com>
+Cc: Sean Paul <seanpaul@chromium.org>
+Cc: amd-gfx@lists.freedesktop.org
+Cc: dri-devel@lists.freedesktop.org
+Cc: stable@vger.kernel.org
+Reviewed-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Rodrigo Siqueira <Rodrigo.Siqueira@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c
+@@ -3188,7 +3188,7 @@ void crtc_debugfs_init(struct drm_crtc *
+ &crc_win_y_end_fops);
+ debugfs_create_file_unsafe("crc_win_update", 0644, dir, crtc,
+ &crc_win_update_fops);
+-
++ dput(dir);
+ }
+ #endif
+ /*
--- /dev/null
+From c2e406596571659451f4b95e37ddfd5a8ef1d0dc Mon Sep 17 00:00:00 2001
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Date: Fri, 2 Sep 2022 14:31:07 +0200
+Subject: sched/debug: fix dentry leak in update_sched_domain_debugfs
+
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+commit c2e406596571659451f4b95e37ddfd5a8ef1d0dc upstream.
+
+Kuyo reports that the pattern of using debugfs_remove(debugfs_lookup())
+leaks a dentry and with a hotplug stress test, the machine eventually
+runs out of memory.
+
+Fix this up by using the newly created debugfs_lookup_and_remove() call
+instead which properly handles the dentry reference counting logic.
+
+Cc: Major Chen <major.chen@samsung.com>
+Cc: stable <stable@kernel.org>
+Cc: Ingo Molnar <mingo@redhat.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Juri Lelli <juri.lelli@redhat.com>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Ben Segall <bsegall@google.com>
+Cc: Mel Gorman <mgorman@suse.de>
+Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
+Cc: Valentin Schneider <vschneid@redhat.com>
+Cc: Matthias Brugger <matthias.bgg@gmail.com>
+Reported-by: Kuyo Chang <kuyo.chang@mediatek.com>
+Tested-by: Kuyo Chang <kuyo.chang@mediatek.com>
+Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Link: https://lore.kernel.org/r/20220902123107.109274-2-gregkh@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/sched/debug.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/kernel/sched/debug.c
++++ b/kernel/sched/debug.c
+@@ -416,7 +416,7 @@ void update_sched_domain_debugfs(void)
+ char buf[32];
+
+ snprintf(buf, sizeof(buf), "cpu%d", cpu);
+- debugfs_remove(debugfs_lookup(buf, sd_dentry));
++ debugfs_lookup_and_remove(buf, sd_dentry);
+ d_cpu = debugfs_create_dir(buf, sd_dentry);
+
+ i = 0;
vfio-type1-unpin-zero-pages.patch
kprobes-prohibit-probes-in-gate-area.patch
perf-risc-v-fix-access-beyond-allocated-array.patch
+debugfs-add-debugfs_lookup_and_remove.patch
+sched-debug-fix-dentry-leak-in-update_sched_domain_debugfs.patch
+drm-amd-display-fix-memory-leak-when-using-debugfs_lookup.patch
+driver-core-fix-driver_set_override-issue-with-empty-strings.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
