From: Greg Kroah-Hartman Date: Sun, 10 Jan 2021 13:13:45 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.251~37 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=03f35b23f861334c8a9ac002fda2f750c9e515de;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch --- diff --git a/queue-5.4/bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch b/queue-5.4/bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch new file mode 100644 index 00000000000..800ac388d44 --- /dev/null +++ b/queue-5.4/bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch @@ -0,0 +1,65 @@ +From 5c3b5796866f85354a5ce76a28f8ffba0dcefc7e Mon Sep 17 00:00:00 2001 +From: Hans de Goede +Date: Sun, 22 Nov 2020 13:17:25 +0100 +Subject: Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close + +From: Hans de Goede + +commit 5c3b5796866f85354a5ce76a28f8ffba0dcefc7e upstream. + +There have been multiple revisions of the patch fix the h5->rx_skb +leak. Accidentally the first revision (which is buggy) and v5 have +both been merged: + +v1 commit 70f259a3f427 ("Bluetooth: hci_h5: close serdev device and free +hu in h5_close"); +v5 commit 855af2d74c87 ("Bluetooth: hci_h5: fix memory leak in h5_close") + +The correct v5 makes changes slightly higher up in the h5_close() +function, which allowed both versions to get merged without conflict. + +The changes from v1 unconditionally frees the h5 data struct, this +is wrong because in the serdev enumeration case the memory is +allocated in h5_serdev_probe() like this: + + h5 = devm_kzalloc(dev, sizeof(*h5), GFP_KERNEL); + +So its lifetime is tied to the lifetime of the driver being bound +to the serdev and it is automatically freed when the driver gets +unbound. In the serdev case the same h5 struct is re-used over +h5_close() and h5_open() calls and thus MUST not be free-ed in +h5_close(). + +The serdev_device_close() added to h5_close() is incorrect in the +same way, serdev_device_close() is called on driver unbound too and +also MUST no be called from h5_close(). + +This reverts the changes made by merging v1 of the patch, so that +just the changes of the correct v5 remain. + +Cc: Anant Thazhemadam +Signed-off-by: Hans de Goede +Signed-off-by: Marcel Holtmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/bluetooth/hci_h5.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -250,12 +250,8 @@ static int h5_close(struct hci_uart *hu) + if (h5->vnd && h5->vnd->close) + h5->vnd->close(h5); + +- if (hu->serdev) +- serdev_device_close(hu->serdev); +- +- kfree_skb(h5->rx_skb); +- kfree(h5); +- h5 = NULL; ++ if (!hu->serdev) ++ kfree(h5); + + return 0; + } diff --git a/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch b/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch index fa5b789b3a9..c515b7643e5 100644 --- a/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch +++ b/queue-5.4/net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch @@ -25,7 +25,7 @@ Signed-off-by: Greg Kroah-Hartman --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c -@@ -1612,7 +1612,7 @@ static void taprio_destroy(struct Qdisc +@@ -1626,7 +1626,7 @@ static void taprio_destroy(struct Qdisc taprio_disable_offload(dev, q, NULL); if (q->qdiscs) { diff --git a/queue-5.4/series b/queue-5.4/series index 8f9e0fa163c..8ae3b1ab884 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -44,3 +44,4 @@ vhost_net-fix-ubuf-refcount-incorrectly-when-sendmsg-fails.patch ionic-account-for-vlan-tag-len-in-rx-buffer-len.patch net-sched-sch_taprio-ensure-to-reset-destroy-all-child-qdiscs.patch kbuild-don-t-hardcode-depmod-path.patch +bluetooth-revert-hci_h5-close-serdev-device-and-free-hu-in-h5_close.patch