[Linux-stable-mirror] [PATCH stable 3.18-4.9] xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
This is a stable-only fix for the backport of commit 5d9b70f7d52e ("xhci: Don't add a virt_dev to the devs array before it's fully allocated").
In branches that predate commit c5628a2af83a ("xhci: remove endpoint ring cache") there is an additional failure path in xhci_alloc_virt_device() where ring cache allocation fails, in which case we need to free the ring allocated for endpoint 0.
Signed-off-by: Ben Hutchings ben.hutchings@codethink.co.uk --- This is build-tested only.
Ben.
drivers/usb/host/xhci-mem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c index f7481c4e2bc9..d9363713b7f1 100644 --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1071,7 +1071,8 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
return 1; fail: - + if (dev->eps[0].ring) + xhci_ring_free(xhci, dev->eps[0].ring); if (dev->in_ctx) xhci_free_container_ctx(xhci, dev->in_ctx); if (dev->out_ctx)
On Thu, Jan 11, 2018 at 05:01:36PM +0000, Ben Hutchings wrote:
This is a stable-only fix for the backport of commit 5d9b70f7d52e ("xhci: Don't add a virt_dev to the devs array before it's fully allocated").
In branches that predate commit c5628a2af83a ("xhci: remove endpoint ring cache") there is an additional failure path in xhci_alloc_virt_device() where ring cache allocation fails, in which case we need to free the ring allocated for endpoint 0.
Signed-off-by: Ben Hutchings ben.hutchings@codethink.co.uk
This is build-tested only.
Looks good to me, thanks for this!
Mathias, yell if you think it's wrong :)
greg k-h
This is a note to let you know that I've just added the patch titled
xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch and it can be found in the queue-4.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From ben.hutchings@codethink.co.uk Thu Jan 11 18:12:08 2018
From: Ben Hutchings ben.hutchings@codethink.co.uk Date: Thu, 11 Jan 2018 17:01:36 +0000 Subject: xhci: Fix ring leak in failure path of xhci_alloc_virt_device() Message-ID: 20180111170136.abfqwdgvgapfiumn@xylophone.i.decadent.org.uk
From: Ben Hutchings ben.hutchings@codethink.co.uk
This is a stable-only fix for the backport of commit 5d9b70f7d52e ("xhci: Don't add a virt_dev to the devs array before it's fully allocated").
In branches that predate commit c5628a2af83a ("xhci: remove endpoint ring cache") there is an additional failure path in xhci_alloc_virt_device() where ring cache allocation fails, in which case we need to free the ring allocated for endpoint 0.
Signed-off-by: Ben Hutchings ben.hutchings@codethink.co.uk Cc: Mathias Nyman mathias.nyman@intel.com --- This is build-tested only.
Ben.
drivers/usb/host/xhci-mem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1071,7 +1071,8 @@ int xhci_alloc_virt_device(struct xhci_h
return 1; fail: - + if (dev->eps[0].ring) + xhci_ring_free(xhci, dev->eps[0].ring); if (dev->in_ctx) xhci_free_container_ctx(xhci, dev->in_ctx); if (dev->out_ctx)
Patches currently in stable-queue which might be from ben.hutchings@codethink.co.uk are
queue-4.4/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
This is a note to let you know that I've just added the patch titled
xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...
The filename of the patch is: xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch and it can be found in the queue-4.9 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.
From ben.hutchings@codethink.co.uk Thu Jan 11 18:12:08 2018
From: Ben Hutchings ben.hutchings@codethink.co.uk Date: Thu, 11 Jan 2018 17:01:36 +0000 Subject: xhci: Fix ring leak in failure path of xhci_alloc_virt_device() Message-ID: 20180111170136.abfqwdgvgapfiumn@xylophone.i.decadent.org.uk
From: Ben Hutchings ben.hutchings@codethink.co.uk
This is a stable-only fix for the backport of commit 5d9b70f7d52e ("xhci: Don't add a virt_dev to the devs array before it's fully allocated").
In branches that predate commit c5628a2af83a ("xhci: remove endpoint ring cache") there is an additional failure path in xhci_alloc_virt_device() where ring cache allocation fails, in which case we need to free the ring allocated for endpoint 0.
Signed-off-by: Ben Hutchings ben.hutchings@codethink.co.uk Cc: Mathias Nyman mathias.nyman@intel.com --- This is build-tested only.
Ben.
drivers/usb/host/xhci-mem.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -1086,7 +1086,8 @@ int xhci_alloc_virt_device(struct xhci_h
return 1; fail: - + if (dev->eps[0].ring) + xhci_ring_free(xhci, dev->eps[0].ring); if (dev->in_ctx) xhci_free_container_ctx(xhci, dev->in_ctx); if (dev->out_ctx)
Patches currently in stable-queue which might be from ben.hutchings@codethink.co.uk are
queue-4.9/xhci-fix-ring-leak-in-failure-path-of-xhci_alloc_virt_device.patch
linux-stable-mirror@lists.linaro.org
-
Ben Hutchings -
Greg KH -
gregkh＠linuxfoundation.org