On July 1, 2018 3:51:18 PM GMT+02:00, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
>
>The patch below does not apply to the 4.17-stable tree.
>If someone wants it applied there, or to any other stable or longterm
>tree, then please email the backport, including the original git commit
>id to <stable@xxxxxxxxxxxxxxx>.
I think it might be enough to also backport 8e03477cb709 ("i2c: core: smbus: fix a potential missing-check bug")?
I have not tested if that is enough though (and am not in a position to easily do so)...
Cheers,
Peter
>thanks,
>
>greg k-h
>
>------------------ original commit in Linus's tree ------------------
>
>From 9aa613674f89d01248ae2e4afe691b515ff8fbb6 Mon Sep 17 00:00:00 2001
>From: Peter Rosin <peda@xxxxxxxxxx>
>Date: Wed, 20 Jun 2018 11:43:23 +0200
>Subject: [PATCH] i2c: smbus: kill memory leak on emulated and failed
>DMA SMBus
> xfers
>
>If DMA safe memory was allocated, but the subsequent I2C transfer
>fails the memory is leaked. Plug this leak.
>
>Fixes: 8a77821e74d6 ("i2c: smbus: use DMA safe buffers for emulated
>SMBus transactions")
>Signed-off-by: Peter Rosin <peda@xxxxxxxxxx>
>Signed-off-by: Wolfram Sang <wsa@xxxxxxxxxxxxx>
>Cc: stable@xxxxxxxxxx
>
>diff --git a/drivers/i2c/i2c-core-smbus.c
>b/drivers/i2c/i2c-core-smbus.c
>index f3f683041e7f..51970bae3c4a 100644
>--- a/drivers/i2c/i2c-core-smbus.c
>+++ b/drivers/i2c/i2c-core-smbus.c
>@@ -465,15 +465,18 @@ static s32 i2c_smbus_xfer_emulated(struct
>i2c_adapter *adapter, u16 addr,
>
> status = i2c_transfer(adapter, msg, num);
> if (status < 0)
>- return status;
>- if (status != num)
>- return -EIO;
>+ goto cleanup;
>+ if (status != num) {
>+ status = -EIO;
>+ goto cleanup;
>+ }
>+ status = 0;
>
> /* Check PEC if last message is a read */
> if (i && (msg[num-1].flags & I2C_M_RD)) {
> status = i2c_smbus_check_pec(partial_pec, &msg[num-1]);
> if (status < 0)
>- return status;
>+ goto cleanup;
> }
>
> if (read_write == I2C_SMBUS_READ)
>@@ -499,12 +502,13 @@ static s32 i2c_smbus_xfer_emulated(struct
>i2c_adapter *adapter, u16 addr,
> break;
> }
>
>+cleanup:
> if (msg[0].flags & I2C_M_DMA_SAFE)
> kfree(msg[0].buf);
> if (msg[1].flags & I2C_M_DMA_SAFE)
> kfree(msg[1].buf);
>
>- return 0;
>+ return status;
> }
>
> /**
