kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers
History
Hans de Goede faa613d033 Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close 
commit 5c3b579686 upstream.

There have been multiple revisions of the patch fix the h5->rx_skb
leak. Accidentally the first revision (which is buggy) and v5 have
both been merged:

v1 commit 70f259a3f4 ("Bluetooth: hci_h5: close serdev device and free
hu in h5_close");
v5 commit 855af2d74c ("Bluetooth: hci_h5: fix memory leak in h5_close")

The correct v5 makes changes slightly higher up in the h5_close()
function, which allowed both versions to get merged without conflict.

The changes from v1 unconditionally frees the h5 data struct, this
is wrong because in the serdev enumeration case the memory is
allocated in h5_serdev_probe() like this:

        h5 = devm_kzalloc(dev, sizeof(*h5), GFP_KERNEL);

So its lifetime is tied to the lifetime of the driver being bound
to the serdev and it is automatically freed when the driver gets
unbound. In the serdev case the same h5 struct is re-used over
h5_close() and h5_open() calls and thus MUST not be free-ed in
h5_close().

The serdev_device_close() added to h5_close() is incorrect in the
same way, serdev_device_close() is called on driver unbound too and
also MUST no be called from h5_close().

This reverts the changes made by merging v1 of the patch, so that
just the changes of the correct v5 remain.

Cc: Anant Thazhemadam <anant.thazhemadam@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2021-01-12 20:18:16 +01:00
..
accessibility speakup: fix uninitialized flush_lock 2020-12-30 11:53:44 +01:00
acpi ACPI: PNP: compare the string length in the matching_id() 2020-12-30 11:54:06 +01:00
amba ARM: tegra: Replace zero-length array with flexible-array 2020-06-15 23:08:28 -05:00
android binder: add flag to clear buffer on txn complete 2020-12-30 11:54:09 +01:00
ata libata-5.10-2020-10-30 2020-10-30 14:51:01 -07:00
atm atm: idt77252: call pci_disable_device() on error path 2021-01-12 20:18:09 +01:00
auxdisplay A trivial patch for auxdisplay: 2020-09-05 14:22:46 -07:00
base driver: core: Fix list corruption after device_del() 2020-12-30 11:54:26 +01:00
bcma bcma: use semicolons rather than commas to separate statements 2020-10-01 16:23:50 +03:00
block null_blk: Fail zone append to conventional zones 2020-12-30 11:54:29 +01:00
bluetooth Bluetooth: revert: hci_h5: close serdev device and free hu in h5_close 2021-01-12 20:18:16 +01:00
bus bus: fsl-mc: fix error return code in fsl_mc_object_allocate() 2020-12-30 11:53:46 +01:00
cdrom gdrom: use bdev_check_media_change 2020-09-10 09:32:31 -06:00
char um: random: Register random as hwrng-core device 2021-01-06 14:56:55 +01:00
clk clk: tegra: Do not return 0 on failure 2020-12-30 11:54:26 +01:00
clocksource clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI 2020-12-30 11:53:37 +01:00
connector connector: simplify the return expression of cn_add_callback() 2020-09-21 13:48:29 -07:00
counter counter: microchip-tcb-capture: Fix CMR value check 2020-12-30 11:54:26 +01:00
cpufreq cpufreq: intel_pstate: Use most recent guaranteed performance values 2020-12-30 11:54:10 +01:00
cpuidle cpuidle: tegra: Annotate tegra_pm_set_cpu_in_lp2() with RCU_NONIDLE 2020-11-16 13:24:32 +01:00
crypto crypto: atmel-i2c - select CONFIG_BITREVERSE 2020-12-30 11:53:50 +01:00
dax device-dax: Fix range release 2021-01-06 14:56:56 +01:00
dca dca: Use PTR_ERR_OR_ZERO() to simplify code 2020-05-15 16:25:20 +02:00
devfreq PM / devfreq: tegra30: Improve initial hardware resetting 2020-09-29 17:50:10 +09:00
dio maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault 2020-06-17 10:57:41 -07:00
dma dmaengine: ti: k3-udma: Correct normal channel offset when uchan_cnt is not 0 2020-12-30 11:53:51 +01:00
dma-buf dma-buf/dma-resv: Respect num_fences when initializing the shared fence list. 2020-12-30 11:54:26 +01:00
edac EDAC/amd64: Fix PCI component registration 2020-12-30 11:54:11 +01:00
eisa treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
extcon extcon: max77693: Fix modalias string 2020-12-30 11:53:49 +01:00
firewire firewire-ohci: use dma_alloc_pages 2020-09-25 06:20:48 +02:00
firmware mm/gup: prevent gup_fast from racing with COW during fork 2020-12-30 11:53:54 +01:00
fpga fpga: Specify HAS_IOMEM dependency for FPGA_DFL 2020-12-01 18:46:24 +01:00
fsi fsi: Aspeed: Add mutex to protect HW access 2020-12-30 11:53:46 +01:00
gnss treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
gpio gpiolib: irq hooks: fix recursion in gpiochip_irq_unmask 2020-12-30 11:53:51 +01:00
gpu drm/i915/tgl: Fix Combo PHY DPLL fractional divider for 38.4MHz ref clock 2021-01-09 13:46:23 +01:00
greybus drivers/greybus: Use kobj_to_dev() 2020-09-04 18:06:01 +02:00
hid HID: i2c-hid: add Vero K147 to descriptor override 2020-12-26 16:02:43 +01:00
hsi HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() 2020-12-30 11:53:24 +01:00
hv hyperv-fixes for 5.10-rc5 2020-11-16 15:02:33 -08:00
hwmon hwmon: (ina3221) Fix PM usage counter unbalance in ina3221_write_enable 2020-12-30 11:53:31 +01:00
hwspinlock hwspinlock: qcom: Allow mmio usage in addition to syscon 2020-07-13 22:29:28 -07:00
hwtracing coresight: remove broken __exit annotations 2020-12-30 11:53:44 +01:00
i2c Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" 2020-12-30 11:52:57 +01:00
i3c i3c master: fix missing destroy_workqueue() on error in i3c_master_register 2021-01-06 14:56:53 +01:00
ide scsi: ide: Mark power management requests with RQF_PM instead of RQF_PREEMPT 2021-01-12 20:18:15 +01:00
idle intel_idle: Build fix 2020-12-03 10:00:23 +01:00
iio iio:adc:ti-ads124s08: Fix alignment and data leak issues. 2020-12-30 11:54:25 +01:00
infiniband RDMA/siw,rxe: Make emulated devices virtual in the device tree 2021-01-09 13:46:24 +01:00
input Input: cyapa_gen6 - fix out-of-bounds stack access 2020-12-30 11:54:05 +01:00
interconnect interconnect: fix memory trashing in of_count_icc_providers() 2020-11-20 16:01:35 +02:00
iommu iommu/arm-smmu-qcom: Implement S2CR quirk 2020-12-30 11:54:15 +01:00
ipack treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
irqchip irqchip/qcom-pdc: Fix phantom irq when changing between rising/falling 2020-12-30 11:53:51 +01:00
isdn treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
leds leds: turris-omnia: check for LED_COLOR_ID_RGB instead LED_COLOR_ID_MULTI 2020-12-30 11:53:22 +01:00
lightnvm lightnvm: fix out-of-bounds write to array devices->info[] 2020-10-16 09:28:45 -06:00
macintosh macintosh/adb-iop: Send correct poll command 2020-12-30 11:53:39 +01:00
mailbox mailbox: arm_mhu_db: Fix mhu_db_shutdown by replacing kfree with devm_kfree 2020-12-30 11:53:28 +01:00
mcb drivers: mcb: use symbol namespaces 2019-11-03 19:54:53 +01:00
md dm verity: skip verity work if I/O error when system is shutting down 2021-01-06 14:56:56 +01:00
media media: gp8psk: initialize stats at power control logic 2021-01-06 14:56:52 +01:00
memory memory: renesas-rpc-if: Fix unbalanced pm_runtime_enable in rpcif_{enable,disable}_rpm 2020-12-30 11:54:27 +01:00
memstick memstick: r592: Fix error return in r592_probe() 2020-12-30 11:53:34 +01:00
message scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove() 2020-10-26 16:57:18 -04:00
mfd mfd: cpcap: Fix interrupt regression with regmap clear_ack 2020-12-30 11:53:16 +01:00
misc misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells() 2021-01-06 14:56:52 +01:00
mmc mmc: pxamci: Fix error return code in pxamci_probe 2020-12-30 11:53:20 +01:00
most drivers: most: add character device interface driver 2020-09-07 15:16:26 +02:00
mtd Revert "mtd: spinand: Fix OOB read" 2021-01-09 13:46:22 +01:00
mux treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
net stmmac: intel: Add PCI IDs for TGL-H platform 2021-01-12 20:18:14 +01:00
nfc nfc: s3fwrn5: Release the nfc firmware 2020-12-30 11:53:53 +01:00
ntb Bug fixes for v5.10 2020-10-25 11:12:31 -07:00
nubus nubus: Remove cast to void pointer 2019-10-21 09:08:15 +02:00
nvdimm libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels 2020-12-30 11:54:27 +01:00
nvme RDMA/core: remove use of dma_virt_ops 2021-01-09 13:46:24 +01:00
nvmem nvmem: core: fix possibly memleak when use nvmem_cell_info_to_nvmem_cell() 2020-09-27 14:25:48 +02:00
of of/address: Fix of_node memory leak in of_dma_is_coherent 2020-11-11 17:10:16 -06:00
opp opp: Call the missing clk_put() on error 2021-01-06 14:56:49 +01:00
oprofile module: Fix up module_notifier return values 2020-09-01 09:58:03 +02:00
parisc dma-mapping: split <linux/dma-mapping.h> 2020-10-06 07:07:03 +02:00
parport treewide: Use fallthrough pseudo-keyword 2020-08-23 17:36:59 -05:00
pci PCI: Fix pci_slot_release() NULL pointer dereference 2020-12-30 11:54:28 +01:00
pcmcia dma-mapping: remove DMA_MASK_NONE 2020-09-25 06:12:15 +02:00
perf perf: arm-cmn: Fix conversion specifiers for node type 2020-10-01 22:30:07 +01:00
phy drm/mediatek: avoid dereferencing a null hdmi_phy on an error message 2020-12-30 11:53:43 +01:00
pinctrl pinctrl: sunxi: Always call chained_irq_{enter, exit} in sunxi_pinctrl_irq_handler 2020-12-30 11:54:25 +01:00
platform platform/x86: intel-vbtn: Allow switch events on Acer Switch Alpha 12 2020-12-30 11:54:28 +01:00
pnp PNP: fix kernel-doc markups 2020-10-27 19:23:04 +01:00
power power: supply: bq24190_charger: fix reference leak 2020-12-30 11:53:25 +01:00
powercap Merge branch 'turbostat' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux 2020-11-10 10:02:31 -08:00
pps treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
ps3 powerpc/ps3: use dma_mapping_error() 2020-12-30 11:53:53 +01:00
ptp ptp: clockmatrix: bug fix for idtcm_strverscmp 2020-11-25 17:24:49 -08:00
pwm pwm: sun4i: Remove erroneous else branch 2020-12-30 11:53:59 +01:00
rapidio rapidio: fix the missed put_device() for rio_mport_add_riodev 2020-10-16 11:11:22 -07:00
ras RAS/CEC: Convert to DEFINE_SHOW_ATTRIBUTE() 2020-09-25 19:05:31 +02:00
regulator regulator: axp20x: Fix DLDO2 voltage control register mask for AXP22x 2020-12-30 11:54:28 +01:00
remoteproc remoteproc: sysmon: Ensure remote notification ordering 2020-12-30 11:54:28 +01:00
reset ARM: SoC-related driver updates 2020-10-24 10:39:22 -07:00
rpmsg rpmsg updates for 5.10 2020-10-22 12:58:21 -07:00
rtc rtc: pcf2127: only use watchdog when explicitly available 2021-01-09 13:46:22 +01:00
s390 s390/dasd: fix list corruption of lcu list 2020-12-30 11:54:09 +01:00
sbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
scsi scsi: ufs: Clear UAC for FFU and RPMB LUNs 2021-01-12 20:18:16 +01:00
sfi treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
sh iomap: constify ioreadX() iomem argument (as in generic implementation) 2020-08-14 19:56:57 -07:00
siox siox: Use the correct style for SPDX License Identifier 2020-01-14 21:46:53 +01:00
slimbus slimbus: qcom: fix potential NULL dereference in qcom_slim_prg_slew() 2020-12-30 11:53:47 +01:00
soc soc: qcom: smp2p: Safely acquire spinlock without IRQs 2020-12-30 11:54:22 +01:00
soundwire soundwire: master: use pm_runtime_set_active() on add 2020-12-30 11:53:28 +01:00
spi spi: dw-bt1: Fix undefined devm_mux_control_get symbol 2021-01-06 14:56:49 +01:00
spmi spmi: pmic-arb: Set lockdep class for hierarchical irq domains 2020-02-10 13:16:04 +01:00
ssb ssb: Remove meaningless jump label to simplify the code 2020-09-21 16:01:35 +03:00
staging staging: comedi: mf6x4: Fix AI end-of-conversion detection 2020-12-30 11:54:10 +01:00
target SCSI fixes on 20201120 2020-11-20 16:24:28 -08:00
tc The main MIPS changes for 5.6: 2020-01-31 11:28:31 -08:00
tee ARM: SoC fixes for v5.10, part 3 2020-11-27 14:48:03 -08:00
thermal thermal/drivers/cpufreq_cooling: Update cpufreq_state only if state has changed 2020-12-30 11:54:29 +01:00
thunderbolt thunderbolt: Fix use-after-free in remove_unplugged_switch() 2020-11-19 17:44:10 +03:00
tty m68k: Fix WARNING splat in pmac_zilog driver 2020-12-30 11:54:11 +01:00
uio uio: Fix use-after-free in uio_unregister_device() 2020-11-09 18:54:30 +01:00
usb USB: serial: keyspan_pda: fix write unthrottling 2020-12-30 11:54:12 +01:00
vdpa vdpa/mlx5: Use write memory barrier after updating CQ index 2020-12-30 11:54:00 +01:00
vfio vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU 2020-12-30 11:54:03 +01:00
vhost vhost_net: fix ubuf refcount incorrectly when sendmsg fails 2021-01-12 20:18:13 +01:00
video fbcon: Disable accelerated scrolling 2021-01-06 14:56:51 +01:00
virt nitro_enclaves: Fixup type and simplify logic of the poll mask setup 2020-11-09 18:20:36 +01:00
virtio virtio_ring: Fix two use after free bugs 2020-12-30 11:54:00 +01:00
visorbus treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
vlynq treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 102 2019-05-24 17:39:00 +02:00
vme treewide: replace '---help---' in Kconfig files with 'help' 2020-06-14 01:57:21 +09:00
w1 w1: w1_therm: make w1_poll_completion static 2020-10-05 14:49:24 +02:00
watchdog watchdog: rti-wdt: fix reference leak in rti_wdt_probe 2021-01-06 14:56:54 +01:00
xen xenbus/xenbus_backend: Disallow pending watch messages 2020-12-30 11:54:27 +01:00
zorro zorro: Fix address space collision message with RAM expansion boards 2020-08-26 13:26:52 +02:00
Kconfig virtio: fixes, vdpa 2020-04-08 10:51:53 -07:00
Makefile vdpa: mlx5: fix vdpa/vhost dependencies 2020-12-02 04:09:56 -05:00