4.9-stable patches

added patches:
	xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-4.9/series b/queue-4.9/series
index c14b1fa5f8ca73fbe4c18dae2d8122bde363c250..ea9ba195ae4cb4bb7144f195289f7c064718dc30 100644 (file)
--- a/queue-4.9/series
+++ b/queue-4.9/series
@@ -27,3 +27,4 @@ lan78xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
 sr9700-use-skb_cow_head-to-deal-with-cloned-skbs.patch
 smsc75xx-use-skb_cow_head-to-deal-with-cloned-skbs.patch
 cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skbs.patch
+xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-4.9/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch b/queue-4.9/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
new file mode 100644 (file)
index 0000000..1d98daa
--- /dev/null
+++ b/queue-4.9/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
@@ -0,0 +1,39 @@
+From ben.hutchings@codethink.co.uk  Thu Jan 11 18:12:08 2018
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Thu, 11 Jan 2018 17:01:36 +0000
+Subject: xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
+Message-ID: <20180111170136.abfqwdgvgapfiumn@xylophone.i.decadent.org.uk>
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+This is a stable-only fix for the backport of commit 5d9b70f7d52e
+("xhci: Don't add a virt_dev to the devs array before it's fully
+allocated").
+
+In branches that predate commit c5628a2af83a ("xhci: remove endpoint
+ring cache") there is an additional failure path in
+xhci_alloc_virt_device() where ring cache allocation fails, in
+which case we need to free the ring allocated for endpoint 0.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Mathias Nyman <mathias.nyman@intel.com>
+---
+This is build-tested only.
+
+Ben.
+
+ drivers/usb/host/xhci-mem.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1086,7 +1086,8 @@ int xhci_alloc_virt_device(struct xhci_h
+ 
+       return 1;
+ fail:
+-
++      if (dev->eps[0].ring)
++              xhci_ring_free(xhci, dev->eps[0].ring);
+       if (dev->in_ctx)
+               xhci_free_container_ctx(xhci, dev->in_ctx);
+       if (dev->out_ctx)