Patches contributed by University of Minnesota

<<Prev 1 2 3 4 5[6]7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Next>>

commit 90a239ee25fa3a483facec3de7c144361a3d3a51
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Sat Jun 13 23:11:48 2020 -0500

    RDMA/rvt: Fix potential memory leak caused by rvt_alloc_rq
    
    In case of failure of alloc_ud_wq_attr(), the memory allocated by
    rvt_alloc_rq() is not freed. Fix it by calling rvt_free_rq() using the
    existing clean-up code.
    
    Fixes: d310c4bf8aea ("IB/{rdmavt, hfi1, qib}: Remove AH refcount for UD QPs")
    Link: https://lore.kernel.org/r/20200614041148.131983-1-pakki001@umn.edu
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Acked-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>

diff --git a/drivers/infiniband/sw/rdmavt/qp.c b/drivers/infiniband/sw/rdmavt/qp.c
index 511b72809e14..7db35dd6ad74 100644
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -1204,7 +1204,7 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
 		err = alloc_ud_wq_attr(qp, rdi->dparms.node);
 		if (err) {
 			ret = (ERR_PTR(err));
-			goto bail_driver_priv;
+			goto bail_rq_rvt;
 		}
 
 		if (init_attr->create_flags & IB_QP_CREATE_NETDEV_USE)
@@ -1314,9 +1314,11 @@ struct ib_qp *rvt_create_qp(struct ib_pd *ibpd,
 	rvt_free_qpn(&rdi->qp_dev->qpn_table, qp->ibqp.qp_num);
 
 bail_rq_wq:
-	rvt_free_rq(&qp->r_rq);
 	free_ud_wq_attr(qp);
 
+bail_rq_rvt:
+	rvt_free_rq(&qp->r_rq);
+
 bail_driver_priv:
 	rdi->driver_f.qp_priv_free(rdi, qp);

commit 17ed808ad243192fb923e4e653c1338d3ba06207
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Thu May 28 15:22:37 2020 -0500

    EDAC: Fix reference count leaks
    
    When kobject_init_and_add() returns an error, it should be handled
    because kobject_init_and_add() takes a reference even when it fails. If
    this function returns an error, kobject_put() must be called to properly
    clean up the memory associated with the object.
    
    Therefore, replace calling kfree() and call kobject_put() and add a
    missing kobject_put() in the edac_device_register_sysfs_main_kobj()
    error path.
    
     [ bp: Massage and merge into a single patch. ]
    
    Fixes: b2ed215a3338 ("Kobject: change drivers/edac to use kobject_init_and_add")
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Signed-off-by: Borislav Petkov <bp@suse.de>
    Link: https://lkml.kernel.org/r/20200528202238.18078-1-wu000273@umn.edu
    Link: https://lkml.kernel.org/r/20200528203526.20908-1-wu000273@umn.edu

diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 0e7ea3591b78..5e7593753799 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -275,6 +275,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 
 	/* Error exit stack */
 err_kobj_reg:
+	kobject_put(&edac_dev->kobj);
 	module_put(edac_dev->owner);
 
 err_out:
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index 72c9eb9fdffb..53042af7262e 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -386,7 +386,7 @@ static int edac_pci_main_kobj_setup(void)
 
 	/* Error unwind statck */
 kobject_init_and_add_fail:
-	kfree(edac_pci_top_main_kobj);
+	kobject_put(edac_pci_top_main_kobj);
 
 kzalloc_fail:
 	module_put(THIS_MODULE);

commit deca195383a6085be62cb453079e03e04d618d6e
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Sat Jun 13 15:44:19 2020 -0500

    ASoC: tegra: Fix reference count leaks.
    
    Calling pm_runtime_get_sync increments the counter even in case of
    failure, causing incorrect ref count if pm_runtime_put is not called in
    error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
    
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
    Link: https://lore.kernel.org/r/20200613204422.24484-1-wu000273@umn.edu
    Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index 635eacbd28d4..156e3b9d613c 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -643,8 +643,10 @@ static int tegra30_ahub_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put(dev);
 		return ret;
+	}
 	ret = regcache_sync(ahub->regmap_ahub);
 	ret |= regcache_sync(ahub->regmap_apbif);
 	pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index d59882ec48f1..db5a8587bfa4 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -567,8 +567,10 @@ static int tegra30_i2s_resume(struct device *dev)
 	int ret;
 
 	ret = pm_runtime_get_sync(dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put(dev);
 		return ret;
+	}
 	ret = regcache_sync(i2s->regmap);
 	pm_runtime_put(dev);

commit 58d0c864e1a759a15c9df78f50ea5a5c32b3989e
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Fri Jun 12 15:27:55 2020 -0500

    rocker: fix incorrect error handling in dma_rings_init
    
    In rocker_dma_rings_init, the goto blocks in case of errors
    caused by the functions rocker_dma_cmd_ring_waits_alloc() and
    rocker_dma_ring_create() are incorrect. The patch fixes the
    order consistent with cleanup in rocker_dma_rings_fini().
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c
index 7585cd2270ba..fc99e7118e49 100644
--- a/drivers/net/ethernet/rocker/rocker_main.c
+++ b/drivers/net/ethernet/rocker/rocker_main.c
@@ -647,10 +647,10 @@ static int rocker_dma_rings_init(struct rocker *rocker)
 err_dma_event_ring_bufs_alloc:
 	rocker_dma_ring_destroy(rocker, &rocker->event_ring);
 err_dma_event_ring_create:
+	rocker_dma_cmd_ring_waits_free(rocker);
+err_dma_cmd_ring_waits_alloc:
 	rocker_dma_ring_bufs_free(rocker, &rocker->cmd_ring,
 				  PCI_DMA_BIDIRECTIONAL);
-err_dma_cmd_ring_waits_alloc:
-	rocker_dma_cmd_ring_waits_free(rocker);
 err_dma_cmd_ring_bufs_alloc:
 	rocker_dma_ring_destroy(rocker, &rocker->cmd_ring);
 	return err;

commit a6379f0ad6375a707e915518ecd5c2270afcd395
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Fri Jun 12 15:01:54 2020 -0500

    test_objagg: Fix potential memory leak in error handling
    
    In case of failure of check_expect_hints_stats(), the resources
    allocated by objagg_hints_get should be freed. The patch fixes
    this issue.
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/lib/test_objagg.c b/lib/test_objagg.c
index 72c1abfa154d..da137939a410 100644
--- a/lib/test_objagg.c
+++ b/lib/test_objagg.c
@@ -979,10 +979,10 @@ static int test_hints_case(const struct hints_case *hints_case)
 err_world2_obj_get:
 	for (i--; i >= 0; i--)
 		world_obj_put(&world2, objagg, hints_case->key_ids[i]);
-	objagg_hints_put(hints);
-	objagg_destroy(objagg2);
 	i = hints_case->key_ids_count;
+	objagg_destroy(objagg2);
 err_check_expect_hints_stats:
+	objagg_hints_put(hints);
 err_hints_get:
 err_check_expect_stats:
 err_world_obj_get:

commit 6b9fbb073636906eee9fe4d4c05a4f445b9e2a23
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Sat Jun 13 22:33:43 2020 -0500

    ASoC: img-parallel-out: Fix a reference count leak
    
    pm_runtime_get_sync() increments the runtime PM usage counter even
    when it returns an error code, causing incorrect ref count if
    pm_runtime_put_noidle() is not called in error handling paths.
    Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
    
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Link: https://lore.kernel.org/r/20200614033344.1814-1-wu000273@umn.edu
    Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/img/img-parallel-out.c b/sound/soc/img/img-parallel-out.c
index 5ddbe3a31c2e..4da49a42e854 100644
--- a/sound/soc/img/img-parallel-out.c
+++ b/sound/soc/img/img-parallel-out.c
@@ -163,8 +163,10 @@ static int img_prl_out_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 	}
 
 	ret = pm_runtime_get_sync(prl->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(prl->dev);
 		return ret;
+	}
 
 	reg = img_prl_out_readl(prl, IMG_PRL_OUT_CTL);
 	reg = (reg & ~IMG_PRL_OUT_CTL_EDGE_MASK) | control_set;

commit c4c59b95b7f7d4cef5071b151be2dadb33f3287b
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Sat Jun 13 22:37:48 2020 -0500

    ASoC: img: Fix a reference count leak in img_i2s_in_set_fmt
    
    pm_runtime_get_sync() increments the runtime PM usage counter even
    when it returns an error code, causing incorrect ref count if
    pm_runtime_put_noidle() is not called in error handling paths.
    Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
    
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Link: https://lore.kernel.org/r/20200614033749.2975-1-wu000273@umn.edu
    Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c
index e30b66b94bf6..0843235d73c9 100644
--- a/sound/soc/img/img-i2s-in.c
+++ b/sound/soc/img/img-i2s-in.c
@@ -343,8 +343,10 @@ static int img_i2s_in_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
 	chan_control_mask = IMG_I2S_IN_CH_CTL_CLK_TRANS_MASK;
 
 	ret = pm_runtime_get_sync(i2s->dev);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_noidle(i2s->dev);
 		return ret;
+	}
 
 	for (i = 0; i < i2s->active_channels; i++)
 		img_i2s_in_ch_disable(i2s, i);

commit 4ddf4739be6e375116c375f0a68bf3893ffcee21
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Thu May 28 13:38:04 2020 -0500

    efi/esrt: Fix reference count leak in esre_create_sysfs_entry.
    
    kobject_init_and_add() takes reference even when it fails.
    If this function returns an error, kobject_put() must be called to
    properly clean up the memory associated with the object. Previous
    commit "b8eb718348b8" fixed a similar problem.
    
    Fixes: 0bb549052d33 ("efi: Add esrt support")
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Link: https://lore.kernel.org/r/20200528183804.4497-1-wu000273@umn.edu
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c
index e3d692696583..d5915272141f 100644
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -181,7 +181,7 @@ static int esre_create_sysfs_entry(void *esre, int entry_num)
 		rc = kobject_init_and_add(&entry->kobj, &esre1_ktype, NULL,
 					  "entry%d", entry_num);
 		if (rc) {
-			kfree(entry);
+			kobject_put(&entry->kobj);
 			return rc;
 		}
 	}

commit 0267ffce562c8bbf9b57ebe0e38445ad04972890
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Thu May 28 15:13:53 2020 -0500

    scsi: iscsi: Fix reference count leak in iscsi_boot_create_kobj
    
    kobject_init_and_add() takes reference even when it fails. If this
    function returns an error, kobject_put() must be called to properly
    clean up the memory associated with the object.
    
    Link: https://lore.kernel.org/r/20200528201353.14849-1-wu000273@umn.edu
    Reviewed-by: Lee Duncan <lduncan@suse.com>
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/iscsi_boot_sysfs.c b/drivers/scsi/iscsi_boot_sysfs.c
index e4857b728033..a64abe38db2d 100644
--- a/drivers/scsi/iscsi_boot_sysfs.c
+++ b/drivers/scsi/iscsi_boot_sysfs.c
@@ -352,7 +352,7 @@ iscsi_boot_create_kobj(struct iscsi_boot_kset *boot_kset,
 	boot_kobj->kobj.kset = boot_kset->kset;
 	if (kobject_init_and_add(&boot_kobj->kobj, &iscsi_boot_ktype,
 				 NULL, name, index)) {
-		kfree(boot_kobj);
+		kobject_put(&boot_kobj->kobj);
 		return NULL;
 	}
 	boot_kobj->data = data;

commit aa8ba13cae3134b8ef1c1b6879f66372531da738
Author: Qiushi Wu <wu000273@umn.edu>
Date:   Wed May 27 21:01:09 2020 -0500

    vfio/mdev: Fix reference count leak in add_mdev_supported_type
    
    kobject_init_and_add() takes reference even when it fails.
    If this function returns an error, kobject_put() must be called to
    properly clean up the memory associated with the object. Thus,
    replace kfree() by kobject_put() to fix this issue. Previous
    commit "b8eb718348b8" fixed a similar problem.
    
    Fixes: 7b96953bc640 ("vfio: Mediated device Core driver")
    Signed-off-by: Qiushi Wu <wu000273@umn.edu>
    Reviewed-by: Cornelia Huck <cohuck@redhat.com>
    Reviewed-by: Kirti Wankhede <kwankhede@nvidia.com>
    Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

diff --git a/drivers/vfio/mdev/mdev_sysfs.c b/drivers/vfio/mdev/mdev_sysfs.c
index 8ad14e5c02bf..917fd84c1c6f 100644
--- a/drivers/vfio/mdev/mdev_sysfs.c
+++ b/drivers/vfio/mdev/mdev_sysfs.c
@@ -110,7 +110,7 @@ static struct mdev_type *add_mdev_supported_type(struct mdev_parent *parent,
 				   "%s-%s", dev_driver_string(parent->dev),
 				   group->name);
 	if (ret) {
-		kfree(type);
+		kobject_put(&type->kobj);
 		return ERR_PTR(ret);
 	}

<<Prev 1 2 3 4 5[6]7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Next>>