From: Sasha Levin Date: Wed, 29 Jul 2026 21:28:38 +0000 (-0400) Subject: Drop firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch from... X-Git-Tag: v5.10.262~10 X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=0ad7bf2371cdb41d91d965b3bbf57cea7eb849f8;p=thirdparty%2Fkernel%2Fstable-queue.git Drop firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch from 6.1 and 6.6 Signed-off-by: Sasha Levin --- diff --git a/queue-6.1/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch b/queue-6.1/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch deleted file mode 100644 index ec07abaf59..0000000000 --- a/queue-6.1/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c Mon Sep 17 00:00:00 2001 -From: Tze Yee Ng -Date: Wed, 24 Jun 2026 03:06:35 -0700 -Subject: firmware: stratix10-svc: fix memory leaks and list corruption bugs - -From: Tze Yee Ng - -commit 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c upstream. - -Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error -path. Switch pmem allocation from devm_kzalloc() to kzalloc() with -explicit kfree() in the free path to match its list-managed lifetime. -Remove the erroneous list_del(&svc_data_mem) which corrupted the list head -on failed lookups. - -Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") -Cc: stable@vger.kernel.org # 5.0+ -Signed-off-by: Tze Yee Ng -Signed-off-by: Dinh Nguyen -Signed-off-by: Greg Kroah-Hartman ---- - drivers/firmware/stratix10-svc.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - ---- a/drivers/firmware/stratix10-svc.c -+++ b/drivers/firmware/stratix10-svc.c -@@ -1065,14 +1065,16 @@ void *stratix10_svc_allocate_memory(stru - struct gen_pool *genpool = chan->ctrl->genpool; - size_t s = roundup(size, 1 << genpool->min_alloc_order); - -- pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL); -+ pmem = kzalloc_obj(*pmem); - if (!pmem) - return ERR_PTR(-ENOMEM); - - guard(mutex)(&svc_mem_lock); - va = gen_pool_alloc(genpool, s); -- if (!va) -+ if (!va) { -+ kfree(pmem); - return ERR_PTR(-ENOMEM); -+ } - - memset((void *)va, 0, s); - pa = gen_pool_virt_to_phys(genpool, va); -@@ -1098,6 +1100,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate - void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr) - { - struct stratix10_svc_data_mem *pmem; -+ - guard(mutex)(&svc_mem_lock); - - list_for_each_entry(pmem, &svc_data_mem, node) -@@ -1106,10 +1109,9 @@ void stratix10_svc_free_memory(struct st - (unsigned long)kaddr, pmem->size); - pmem->vaddr = NULL; - list_del(&pmem->node); -+ kfree(pmem); - return; - } -- -- list_del(&svc_data_mem); - } - EXPORT_SYMBOL_GPL(stratix10_svc_free_memory); - diff --git a/queue-6.1/series b/queue-6.1/series index a7664cffa3..e2e0c4a7b5 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -231,7 +231,6 @@ exec-fix-unsigned-loop-counter-wrap-in-transfer_args_to_stack.patch binfmt_misc-set-have_execfd-only-once-the-interpreter-is-opened.patch platform-loongarch-laptop-explicitly-reset-bl_powered-state-when-suspend.patch cdrom-fix-stack-out-of-bounds-read-in-cdromvolctrl.patch -firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch x86-boot-compressed-disable-jump-tables.patch comedi-comedi_parport-deal-with-premature-interrupt.patch serial-sc16is7xx-implement-gpio-get_direction-callback.patch diff --git a/queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch b/queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch deleted file mode 100644 index 2218ff48ac..0000000000 --- a/queue-6.6/firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c Mon Sep 17 00:00:00 2001 -From: Tze Yee Ng -Date: Wed, 24 Jun 2026 03:06:35 -0700 -Subject: firmware: stratix10-svc: fix memory leaks and list corruption bugs - -From: Tze Yee Ng - -commit 9119ceb76e987c2ec2b549ea100e3268ce3a1c7c upstream. - -Fix a memory leak when gen_pool_alloc() fails by freeing pmem on the error -path. Switch pmem allocation from devm_kzalloc() to kzalloc() with -explicit kfree() in the free path to match its list-managed lifetime. -Remove the erroneous list_del(&svc_data_mem) which corrupted the list head -on failed lookups. - -Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver") -Cc: stable@vger.kernel.org # 5.0+ -Signed-off-by: Tze Yee Ng -Signed-off-by: Dinh Nguyen -Signed-off-by: Greg Kroah-Hartman ---- - drivers/firmware/stratix10-svc.c | 10 ++++++---- - 1 file changed, 6 insertions(+), 4 deletions(-) - ---- a/drivers/firmware/stratix10-svc.c -+++ b/drivers/firmware/stratix10-svc.c -@@ -1083,14 +1083,16 @@ void *stratix10_svc_allocate_memory(stru - struct gen_pool *genpool = chan->ctrl->genpool; - size_t s = roundup(size, 1 << genpool->min_alloc_order); - -- pmem = devm_kzalloc(chan->ctrl->dev, sizeof(*pmem), GFP_KERNEL); -+ pmem = kzalloc_obj(*pmem); - if (!pmem) - return ERR_PTR(-ENOMEM); - - guard(mutex)(&svc_mem_lock); - va = gen_pool_alloc(genpool, s); -- if (!va) -+ if (!va) { -+ kfree(pmem); - return ERR_PTR(-ENOMEM); -+ } - - memset((void *)va, 0, s); - pa = gen_pool_virt_to_phys(genpool, va); -@@ -1116,6 +1118,7 @@ EXPORT_SYMBOL_GPL(stratix10_svc_allocate - void stratix10_svc_free_memory(struct stratix10_svc_chan *chan, void *kaddr) - { - struct stratix10_svc_data_mem *pmem; -+ - guard(mutex)(&svc_mem_lock); - - list_for_each_entry(pmem, &svc_data_mem, node) -@@ -1124,10 +1127,9 @@ void stratix10_svc_free_memory(struct st - (unsigned long)kaddr, pmem->size); - pmem->vaddr = NULL; - list_del(&pmem->node); -+ kfree(pmem); - return; - } -- -- list_del(&svc_data_mem); - } - EXPORT_SYMBOL_GPL(stratix10_svc_free_memory); - diff --git a/queue-6.6/series b/queue-6.6/series index 1d4acc3665..0b64a711e3 100644 --- a/queue-6.6/series +++ b/queue-6.6/series @@ -283,7 +283,6 @@ binfmt_misc-set-have_execfd-only-once-the-interpreter-is-opened.patch platform-loongarch-laptop-explicitly-reset-bl_powered-state-when-suspend.patch loongarch-fix-oops-during-single-step-debugging.patch cdrom-fix-stack-out-of-bounds-read-in-cdromvolctrl.patch -firmware-stratix10-svc-fix-memory-leaks-and-list-corruption-bugs.patch x86-boot-compressed-disable-jump-tables.patch comedi-comedi_parport-deal-with-premature-interrupt.patch serial-sc16is7xx-implement-gpio-get_direction-callback.patch