aboutsummaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)Author
2019-12-03net: can: xilinx_can: Fix usage of skb memorySrinivas Neeli
commit d52eabb7d794515ec1d7473e5405ab8d0d2b6976 from https://github.com/Xilinx/linux-xlnx.git As per linux can framework, driver not allowed to touch the skb memory after can_put_echo_skb() call. This patch fixes the same. https://www.spinics.net/lists/linux-can/msg02199.html Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Meng Li <Meng.Li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-03net: can: xilinx: Avoid printing bus clock not found in case of deferVenkatesh Yadav Abbarapu
commit 7b1b5c5f94e0b1465408a01d5fd5dda7d52bbbde from https://github.com/Xilinx/linux-xlnx.git Avoid printing "bus clock not found" error message in the case of defer. Signed-off-by: Venkatesh Yadav Abbarapu <venkatesh.abbarapu@xilinx.com> Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Meng Li <Meng.Li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-03net: can: xilinx_can: Fix the data phase btr1 calculationSrinivas Neeli
commit fc03fa30d1ce26498a88d648863c094a43afcfc4 from https://github.com/Xilinx/linux-xlnx.git While calculating bitrate for the data phase, the driver is using phase segment 1 of the arbitration phase instead of the data phase. Signed-off-by: Srinivas Neeli <srinivas.neeli@xilinx.com> Acked-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Meng Li <Meng.Li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-03net: can: xilinx_can: Fix FSR register FL and RI mask values for canfd 2.0Appana Durga Kedareswara rao
commit 180d843c11156fdc789d3704aae1cc2319b28d00 from https://github.com/Xilinx/linux-xlnx.git For CANFD 2.0 IP configuration existing driver is using incorrect mask values for FSR register FL and RI fields. Signed-off-by: Appana Durga Kedareswara rao <appana.durga.rao@xilinx.com> Acked-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com> Signed-off-by: Michal Simek <michal.simek@xilinx.com> Signed-off-by: Meng Li <Meng.Li@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-03Merge branch 'v5.2/standard/base' into v5.2/standard/xlnx-socBruce Ashfield
2019-12-03yaffs: add strict check when call yaffs_internal_read_superQuanyang Wang
When kernel booting, mount_block_root will be called to judge the filesystem type of root device. Then .mount function in file_system_type structure will do the check operation. But yaffs filesystem has a relaxed examination because as a filesystem for NAND Flash, it doesn't examinate whether the root device is the MTD NAND device. This results that yaffs filesystem will do mount operation even though the root device is a MMC card with a btrfs filesystem, and will crash kernel after mounting failed. The crash log is as below: md: Waiting for all devices to be available before autodetect md: If you don't use raid, use raid=noautodetect md: Autodetecting RAID arrays. md: autorun ... md: ... autorun DONE. yaffs: dev is 187695107 name is "mmcblk0p3" rw yaffs: passed flags "" yaffs: dev is 187695107 name is "mmcblk0p3" rw yaffs: passed flags "" ------------[ cut here ]------------ kernel BUG at fs/yaffs2/yaffs_getblockinfo.h:30! Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 3 PID: 1 Comm: swapper/0 Not tainted 5.2.24-yocto-standard+ #250 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) pstate: 80000005 (Nzcv daif -PAN -UAO) pc : yaffs_rd_chunk_tags_nand+0xf0/0x110 lr : yaffs_rd_chunk_tags_nand+0x108/0x110 sp : ffffff801003b770 x29: ffffff801003b770 x28: ffffffc876fe8000 x27: 00000000000c0000 x26: 0000000000000000 x25: 00000000ffffffe1 x24: 0000000000010000 x23: 0000000000000000 x22: ffffff8011228000 x21: 000000000000005f x20: ffffff801003b890 x19: ffffffc876fe8000 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffffff80112285c8 x14: ffffff801137d228 x13: ffffff801137ce74 x12: ffffff8011246000 x11: 0000000000000000 x10: ffffff801137c000 x9 : 0000000000000000 x8 : 0000000000000007 x7 : 000000000000015c x6 : ffffff801137c490 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 00000000ffffffff x2 : 50c80792e0663400 x1 : 0000000000000000 x0 : 0000000000000037 Call trace: yaffs_rd_chunk_tags_nand+0xf0/0x110 yaffs_summary_read+0x10c/0x2e0 yaffs2_scan_backwards+0x28c/0xf58 yaffs_guts_initialise+0x71c/0x7a0 yaffs_internal_read_super.isra.20+0x4ec/0x838 yaffs2_internal_read_super_mtd+0x2c/0x48 mount_bdev+0x1a4/0x1e0 yaffs2_mount+0x44/0x58 legacy_get_tree+0x34/0x60 vfs_get_tree+0x34/0x120 do_mount+0x708/0x980 ksys_mount+0x9c/0x110 mount_block_root+0x128/0x29c mount_root+0x148/0x17c prepare_namespace+0x178/0x1c0 kernel_init_freeable+0x370/0x390 kernel_init+0x18/0x110 ret_from_fork+0x10/0x1c Code: d65f03c0 f00069c0 b9440400 37f00060 (d4210000) ---[ end trace 68aa0995bdf59f76 ]--- BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:34 in_atomic(): 1, irqs_disabled(): 128, pid: 1, name: swapper/0 Preemption disabled at: [<ffffff80100a4598>] debug_exception_enter+0x30/0x40 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G D 5.2.24-yocto-standard+ #250 Hardware name: ZynqMP ZCU102 Rev1.0 (DT) Call trace: dump_backtrace+0x0/0x148 show_stack+0x24/0x30 dump_stack+0x98/0xbc ___might_sleep+0x130/0x188 __might_sleep+0x58/0x90 exit_signals+0x44/0x258 do_exit+0xb4/0xa38 die+0x1bc/0x1e0 bug_handler+0x48/0x98 call_break_hook+0x7c/0xa8 brk_handler+0x28/0x68 do_debug_exception+0xc4/0x188 el1_dbg+0x18/0x8c yaffs_rd_chunk_tags_nand+0xf0/0x110 yaffs_summary_read+0x10c/0x2e0 yaffs2_scan_backwards+0x28c/0xf58 yaffs_guts_initialise+0x71c/0x7a0 yaffs_internal_read_super.isra.20+0x4ec/0x838 yaffs2_internal_read_super_mtd+0x2c/0x48 mount_bdev+0x1a4/0x1e0 yaffs2_mount+0x44/0x58 legacy_get_tree+0x34/0x60 vfs_get_tree+0x34/0x120 do_mount+0x708/0x980 ksys_mount+0x9c/0x110 mount_block_root+0x128/0x29c mount_root+0x148/0x17c prepare_namespace+0x178/0x1c0 kernel_init_freeable+0x370/0x390 kernel_init+0x18/0x110 ret_from_fork+0x10/0x1c note: swapper/0[1] exited with preempt_count 1 Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x0002,20002004 Memory Limit: none ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- Use yaffs_get_mtd_device to add strict check. Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-03yaffs: repair yaffs_get_mtd_deviceQuanyang Wang
The function yaffs_get_mtd_device use wrong function to retrieve mtd_info structure (using yaffs_get_mtd_device itself will cause dead loop). Use get_mtd_device to do this. Signed-off-by: Quanyang Wang <quanyang.wang@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
2019-12-02Merge branch 'v5.2/standard/base' into v5.2/standard/xlnx-socBruce Ashfield
2019-12-02Merge tag 'v5.2.25' into v5.2/standard/baseBruce Ashfield
This is the 5.2.25 stable release # gpg: Signature made Mon 02 Dec 2019 05:06:15 PM EST # gpg: using RSA key EBCE84042C07D1D6 # gpg: Can't check signature: No public key
2019-12-02Linux 5.2.25v5.2.25Paul Gortmaker
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggleNavid Emamdoost
commit 6f3ef5c25cc762687a7341c18cbea5af54461407 upstream. In the implementation of i2400m_op_rfkill_sw_toggle() the allocated buffer for cmd should be released before returning. The documentation for i2400m_msg_to_dev() says when it returns the buffer can be reused. Meaning cmd should be released in either case. Move kfree(cmd) before return to be reached by all execution paths. Fixes: 2507e6ab7a9a ("wimax: i2400: fix memory leak") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02wimax: i2400: fix memory leakNavid Emamdoost
commit 2507e6ab7a9a440773be476141a255934468c5ef upstream. In i2400m_op_rfkill_sw_toggle cmd buffer should be released along with skb response. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02iio: imu: adis16400: fix memory leakNavid Emamdoost
commit 9c0530e898f384c5d279bfcebd8bb17af1105873 upstream. In adis_update_scan_mode_burst, if adis->buffer allocation fails release the adis->xfer. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02spi: lpspi: fix memory leak in fsl_lpspi_probeNavid Emamdoost
commit 057b8945f78f76d0b04eeb5c27cd9225e5e7ad86 upstream. In fsl_lpspi_probe an SPI controller is allocated either via spi_alloc_slave or spi_alloc_master. In all but one error cases this controller is put by going to error handling code. This commit fixes the case when pm_runtime_get_sync fails and it should go to the error handling path. Fixes: 944c01a889d9 ("spi: lpspi: enable runtime pm for lpspi") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Link: https://lore.kernel.org/r/20190930034602.1467-1-navid.emamdoost@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02scsi: bfa: release allocated memory in case of errorNavid Emamdoost
commit 0e62395da2bd5166d7c9e14cbc7503b256a34cb0 upstream. In bfad_im_get_stats if bfa_port_get_stats fails, allocated memory needs to be released. Link: https://lore.kernel.org/r/20190910234417.22151-1-navid.emamdoost@gmail.com Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02RDMA/hfi1: Prevent memory leak in sdma_initNavid Emamdoost
commit 34b3be18a04ecdc610aae4c48e5d1b799d8689f6 upstream. In sdma_init if rhashtable_init fails the allocated memory for tmp_sdma_rht should be released. Fixes: 5a52a7acf7e2 ("IB/hfi1: NULL pointer dereference when freeing rhashtable") Link: https://lore.kernel.org/r/20190925144543.10141-1-navid.emamdoost@gmail.com Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02ath9k: release allocated buffer if timed outNavid Emamdoost
commit 728c1e2a05e4b5fc52fab3421dce772a806612a2 upstream. In ath9k_wmi_cmd, the allocated network buffer needs to be released if timeout happens. Otherwise memory will be leaked. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02ath10k: fix memory leakNavid Emamdoost
commit b8d17e7d93d2beb89e4f34c59996376b8b544792 upstream. In ath10k_usb_hif_tx_sg the allocated urb should be released if usb_submit_urb fails. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attachNavid Emamdoost
commit fc739a058d99c9297ef6bfd923b809d85855b9a9 upstream. In fastrpc_dma_buf_attach if dma_get_sgtable fails the allocated memory for a should be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Link: https://lore.kernel.org/r/20190925152742.16258-1-navid.emamdoost@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02spi: gpio: prevent memory leak in spi_gpio_probeNavid Emamdoost
commit d3b0ffa1d75d5305ebe34735598993afbb8a869d upstream. In spi_gpio_probe an SPI master is allocated via spi_alloc_master, but this controller should be released if devm_add_action_or_reset fails, otherwise memory leaks. In order to avoid leak spi_contriller_put must be called in case of failure for devm_add_action_or_reset. Fixes: 8b797490b4db ("spi: gpio: Make sure spi_master_put() is called in every error path") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Link: https://lore.kernel.org/r/20190930205241.5483-1-navid.emamdoost@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02rsi: release skb if rsi_prepare_beacon failsNavid Emamdoost
commit d563131ef23cbc756026f839a82598c8445bc45f upstream. In rsi_send_beacon, if rsi_prepare_beacon fails the allocated skb should be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02RDMA: Fix goto target to release the allocated memoryNavid Emamdoost
commit 4a9d46a9fe14401f21df69cea97c62396d5fb053 upstream. In bnxt_re_create_srq(), when ib_copy_to_udata() fails allocated memory should be released by goto fail. Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") Link: https://lore.kernel.org/r/20190910222120.16517-1-navid.emamdoost@gmail.com Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Jason Gunthorpe <jgg@mellanox.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02tracing: Have error path in predicate_parse() free its allocated memoryNavid Emamdoost
commit 96c5c6e6a5b6db592acae039fed54b5c8844cd35 upstream. In predicate_parse, there is an error path that is not going to out_free instead it returns directly which leads to a memory leak. Link: http://lkml.kernel.org/r/20190920225800.3870-1-navid.emamdoost@gmail.com Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02drm/amd/display: prevent memory leakNavid Emamdoost
commit 104c307147ad379617472dd91a5bcb368d72bd6d upstream. In dcn*_create_resource_pool the allocated memory should be released if construct pool fails. Reviewed-by: Harry Wentland <harry.wentland@amd.com> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_bufNavid Emamdoost
commit db8fd2cde93227e566a412cf53173ffa227998bc upstream. In mwifiex_pcie_alloc_cmdrsp_buf, a new skb is allocated which should be released if mwifiex_map_pci_memory() fails. The release is added. Fixes: fc3314609047 ("mwifiex: use pci_alloc/free_consistent APIs for PCIe") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Acked-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02vcs: prevent write access to vcsu devicesNicolas Pitre
commit 0c9acb1af77a3cb8707e43f45b72c95266903cee upstream. Commit d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") guarded against using devices containing attributes as this is not yet implemented. It however failed to guard against writes to any devices as this is also unimplemented. Reported-by: Or Cohen <orcohen@paloaltonetworks.com> Signed-off-by: Nicolas Pitre <npitre@baylibre.com> Cc: <stable@vger.kernel.org> # v4.19+ Cc: Jiri Slaby <jslaby@suse.com> Fixes: d21b0be246bf ("vt: introduce unicode mode for /dev/vcs") Link: https://lore.kernel.org/r/nycvar.YSQ.7.76.1911051030580.30289@knanqh.ubzr Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02KVM: PPC: Book3S HV: Flush link stack on guest exit to host kernelMichael Ellerman
commit af2e8c68b9c5403f77096969c516f742f5bb29e0 upstream. On some systems that are vulnerable to Spectre v2, it is up to software to flush the link stack (return address stack), in order to protect against Spectre-RSB. When exiting from a guest we do some house keeping and then potentially exit to C code which is several stack frames deep in the host kernel. We will then execute a series of returns without preceeding calls, opening up the possiblity that the guest could have poisoned the link stack, and direct speculative execution of the host to a gadget of some sort. To prevent this we add a flush of the link stack on exit from a guest. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02powerpc/book3s64: Fix link stack flush on context switchMichael Ellerman
commit 39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad upstream. In commit ee13cb249fab ("powerpc/64s: Add support for software count cache flush"), I added support for software to flush the count cache (indirect branch cache) on context switch if firmware told us that was the required mitigation for Spectre v2. As part of that code we also added a software flush of the link stack (return address stack), which protects against Spectre-RSB between user processes. That is all correct for CPUs that activate that mitigation, which is currently Power9 Nimbus DD2.3. What I got wrong is that on older CPUs, where firmware has disabled the count cache, we also need to flush the link stack on context switch. To fix it we create a new feature bit which is not set by firmware, which tells us we need to flush the link stack. We set that when firmware tells us that either of the existing Spectre v2 mitigations are enabled. Then we adjust the patching code so that if we see that feature bit we enable the link stack flush. If we're also told to flush the count cache in software then we fall through and do that also. On the older CPUs we don't need to do do the software count cache flush, firmware has disabled it, so in that case we patch in an early return after the link stack flush. The naming of some of the functions is awkward after this patch, because they're called "count cache" but they also do link stack. But we'll fix that up in a later commit to ease backporting. This is the fix for CVE-2019-18660. Reported-by: Anthony Steinhauser <asteinhauser@google.com> Fixes: ee13cb249fab ("powerpc/64s: Add support for software count cache flush") Cc: stable@vger.kernel.org # v4.4+ Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02powerpc/64s: support nospectre_v2 cmdline optionChristopher M. Riedl
commit d8f0e0b073e1ec52a05f0c2a56318b47387d2f10 upstream. Add support for disabling the kernel implemented spectre v2 mitigation (count cache flush on context switch) via the nospectre_v2 and mitigations=off cmdline options. Suggested-by: Michael Ellerman <mpe@ellerman.id.au> Signed-off-by: Christopher M. Riedl <cmr@informatik.wtf> Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20190524024647.381-1-cmr@informatik.wtf Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02crypto: user - fix memory leak in crypto_reportstatNavid Emamdoost
commit c03b04dcdba1da39903e23cc4d072abf8f68f2dd upstream. In crypto_reportstat, a new skb is created by nlmsg_new(). This skb is leaked if crypto_reportstat_alg() fails. Required release for skb is added. Fixes: cac5818c25d0 ("crypto: user - Implement a generic crypto statistics") Cc: <stable@vger.kernel.org> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02crypto: user - fix memory leak in crypto_reportNavid Emamdoost
commit ffdde5932042600c6807d46c1550b28b0db6a3bc upstream. In crypto_report, a new skb is created via nlmsg_new(). This skb should be released if crypto_report_alg() fails. Fixes: a38f7907b926 ("crypto: Add userspace configuration API") Cc: <stable@vger.kernel.org> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02can: gs_usb: gs_can_open(): prevent memory leakNavid Emamdoost
commit fb5be6a7b4863ecc44963bb80ca614584b6c7817 upstream. In gs_can_open() if usb_submit_urb() fails the allocated urb should be released. Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices") Cc: linux-stable <stable@vger.kernel.org> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02rtlwifi: prevent memory leak in rtl_usb_probeNavid Emamdoost
commit 3f93616951138a598d930dcaec40f2bfd9ce43bb upstream. In rtl_usb_probe if allocation for usb_data fails the allocated hw should be released. In addition the allocated rtlpriv->usb_data should be released on error handling path. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02of: unittest: fix memory leak in unittest_data_addNavid Emamdoost
commit e13de8fe0d6a51341671bbe384826d527afe8d44 upstream. In unittest_data_add, a copy buffer is created via kmemdup. This buffer is leaked if of_fdt_unflatten_tree fails. The release for the unittest_data buffer is added. Fixes: b951f9dc7f25 ("Enabling OF selftest to run without machine's devicetree") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Frank Rowand <frowand.list@gmail.com> Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02virt: vbox: fix memory leak in hgcm_call_preprocess_linaddrNavid Emamdoost
commit e0b0cb9388642c104838fac100a4af32745621e2 upstream. In hgcm_call_preprocess_linaddr memory is allocated for bounce_buf but is not released if copy_form_user fails. In order to prevent memory leak in case of failure, the assignment to bounce_buf_ret is moved before the error check. This way the allocated bounce_buf will be released by the caller. Fixes: 579db9d45cb4 ("virt: Add vboxguest VMMDEV communication code") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20190930204223.3660-1-navid.emamdoost@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02iio: imu: adis16400: release allocated memory on failureNavid Emamdoost
commit ab612b1daf415b62c58e130cb3d0f30b255a14d0 upstream. In adis_update_scan_mode, if allocation for adis->buffer fails, previously allocated adis->xfer needs to be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Alexandru Ardelean <alexandru.ardelean@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ringNavid Emamdoost
commit d10dcb615c8e29d403a24d35f8310a7a53e3050c upstream. In mwifiex_pcie_init_evt_ring, a new skb is allocated which should be released if mwifiex_map_pci_memory() fails. The release for skb and card->evtbd_ring_vbase is added. Fixes: 0732484b47b5 ("mwifiex: separate ring initialization and ring creation routines") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Acked-by: Ganapathi Bhat <gbhat@marvell.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02nl80211: fix memory leak in nl80211_get_ftm_responder_statsNavid Emamdoost
commit 1399c59fa92984836db90538cf92397fe7caaa57 upstream. In nl80211_get_ftm_responder_stats, a new skb is created via nlmsg_new named msg. If nl80211hdr_put() fails, then msg should be released. The return statement should be replace by goto to error handling code. Fixes: 81e54d08d9d8 ("cfg80211: support FTM responder configuration/statistics") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Link: https://lore.kernel.org/r/20191004194220.19412-1-navid.emamdoost@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02net: qrtr: fix memort leak in qrtr_tun_write_iterNavid Emamdoost
commit a21b7f0cff1906a93a0130b74713b15a0b36481d upstream. In qrtr_tun_write_iter the allocated kbuf should be release in case of error or success return. v2 Update: Thanks to David Miller for pointing out the release on success path as well. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02iwlwifi: dbg_ini: fix memory leak in alloc_sgtableNavid Emamdoost
commit b4b814fec1a5a849383f7b3886b654a13abbda7d upstream. In alloc_sgtable if alloc_page fails, the alocated table should be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02ath9k_htc: release allocated buffer if timed outNavid Emamdoost
commit 853acf7caf10b828102d92d05b5c101666a6142b upstream. In htc_config_pipe_credits, htc_setup_complete, and htc_connect_service if time out happens, the allocated buffer needs to be released. Otherwise there will be memory leak. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02rtl8xxxu: prevent leaking urbNavid Emamdoost
commit a2cdd07488e666aa93a49a3fc9c9b1299e27ef3c upstream. In rtl8xxxu_submit_int_urb if usb_submit_urb fails the allocated urb should be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Reviewed-by: Chris Chiu <chiu@endlessm.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02ipmi: Fix memory leak in __ipmi_bmc_registerNavid Emamdoost
commit 4aa7afb0ee20a97fbf0c5bab3df028d5fb85fdab upstream. In the impelementation of __ipmi_bmc_register() the allocated memory for bmc should be released in case ida_simple_get() fails. Fixes: 68e7e50f195f ("ipmi: Don't use BMC product/dev ids in the BMC name") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Message-Id: <20191021200649.1511-1-navid.emamdoost@gmail.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02media: vivid: Fix wrong locking that causes race conditions on streaming stopAlexander Popov
commit 6dcd5d7a7a29c1e4b8016a06aed78cd650cd8c27 upstream. There is the same incorrect approach to locking implemented in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(). These functions are called during streaming stopping with vivid_dev.mutex locked. And they all do the same mistake while stopping their kthreads, which need to lock this mutex as well. See the example from vivid_stop_generating_vid_cap(): /* shutdown control thread */ vivid_grab_controls(dev, false); mutex_unlock(&dev->mutex); kthread_stop(dev->kthread_vid_cap); dev->kthread_vid_cap = NULL; mutex_lock(&dev->mutex); But when this mutex is unlocked, another vb2_fop_read() can lock it instead of vivid_thread_vid_cap() and manipulate the buffer queue. That causes a use-after-free access later. To fix those issues let's: 1. avoid unlocking the mutex in vivid_stop_generating_vid_cap(), vivid_stop_generating_vid_out() and sdr_cap_stop_streaming(); 2. use mutex_trylock() with schedule_timeout_uninterruptible() in the loops of the vivid kthread handlers. Signed-off-by: Alexander Popov <alex.popov@linux.com> Acked-by: Linus Torvalds <torvalds@linux-foundation.org> Tested-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Cc: <stable@vger.kernel.org> # for v3.18 and up Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02media: rcar_drif: fix a memory disclosureKangjie Lu
commit d39083234c60519724c6ed59509a2129fd2aed41 upstream. "f->fmt.sdr.reserved" is uninitialized. As other peer drivers like msi2500 and airspy do, the fix initializes it to avoid memory disclosures. Signed-off-by: Kangjie Lu <kjlu@umn.edu> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02media: usb: fix memory leak in af9005_identify_stateNavid Emamdoost
commit 2289adbfa559050d2a38bcd9caac1c18b800e928 upstream. In af9005_identify_state when returning -EIO the allocated buffer should be released. Replace the "return -EIO" with assignment into ret and move deb_info() under a check. Fixes: af4e067e1dcf ("V4L/DVB (5625): Add support for the AF9005 demodulator from Afatech") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl> Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cqNavid Emamdoost
commit c8c2a057fdc7de1cd16f4baa51425b932a42eb39 upstream. In mlx5_fpga_conn_create_cq if mlx5_vector2eqn fails the allocated memory should be released. Fixes: 537a50574175 ("net/mlx5: FPGA, Add high-speed connection routines") Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Saeed Mahameed <saeedm@mellanox.com> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-12-02crypto: ccp - Release all allocated memory if sha type is invalidNavid Emamdoost
commit 128c66429247add5128c03dc1e144ca56f05a4e2 upstream. Release all allocated memory if sha type is invalid: In ccp_run_sha_cmd, if the type of sha is invalid, the allocated hmac_buf should be released. v2: fix the goto. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Acked-by: Gary R Hook <gary.hook@amd.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
2019-11-27Merge branch 'v5.2/standard/base' into v5.2/standard/xlnx-socBruce Ashfield
2019-11-27Revert "platform/x86: wmi: Destroy on cleanup rather than unregister"Yongxin Liu
This reverts commit 7b11e8989618581bc0226ad313264cdc05d48d86. Consider the following hardware setting. |-PNP0C14:00 | |-- device #1 |-PNP0C14:01 | |-- device #2 When unloading wmi driver module, device #2 will be first unregistered. But device_destroy() using MKDEV(0, 0) will locate PNP0C14:00 first and unregister it. This is incorrect. Should use device_unregister() to unregister the real parent device. Signed-off-by: Yongxin Liu <yongxin.liu@windriver.com> Signed-off-by: Bruce Ashfield <bruce.ashfield@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-05-28 16:15:47 +0000