4.4-stable patches

added patches:
	xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-4.4/series b/queue-4.4/series
index 16fa0412d1070e8762fc69245047c2b07a809eb1..7324608636a6f8717b2b431ec05ea8ac325dc3d4 100644 (file)
--- a/queue-4.4/series
+++ b/queue-4.4/series
@@ -42,3 +42,4 @@ cx82310_eth-use-skb_cow_head-to-deal-with-cloned-skbs.patch
 x86-mm-pat-dev-mem-remove-superfluous-error-message.patch
 hwrng-core-sleep-interruptible-in-read.patch
 sysrq-fix-warning-in-sysrq-generated-crash.patch
+xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch

diff --git a/queue-4.4/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch b/queue-4.4/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
new file mode 100644 (file)
index 0000000..cc67906
--- /dev/null
+++ b/queue-4.4/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
@@ -0,0 +1,39 @@
+From ben.hutchings@codethink.co.uk  Thu Jan 11 18:12:08 2018
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Date: Thu, 11 Jan 2018 17:01:36 +0000
+Subject: xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
+Message-ID: <20180111170136.abfqwdgvgapfiumn@xylophone.i.decadent.org.uk>
+
+From: Ben Hutchings <ben.hutchings@codethink.co.uk>
+
+This is a stable-only fix for the backport of commit 5d9b70f7d52e
+("xhci: Don't add a virt_dev to the devs array before it's fully
+allocated").
+
+In branches that predate commit c5628a2af83a ("xhci: remove endpoint
+ring cache") there is an additional failure path in
+xhci_alloc_virt_device() where ring cache allocation fails, in
+which case we need to free the ring allocated for endpoint 0.
+
+Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
+Cc: Mathias Nyman <mathias.nyman@intel.com>
+---
+This is build-tested only.
+
+Ben.
+
+ drivers/usb/host/xhci-mem.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/host/xhci-mem.c
++++ b/drivers/usb/host/xhci-mem.c
+@@ -1071,7 +1071,8 @@ int xhci_alloc_virt_device(struct xhci_h
+ 
+       return 1;
+ fail:
+-
++      if (dev->eps[0].ring)
++              xhci_ring_free(xhci, dev->eps[0].ring);
+       if (dev->in_ctx)
+               xhci_free_container_ctx(xhci, dev->in_ctx);
+       if (dev->out_ctx)