From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:50553 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752934AbbFCCuA (ORCPT ); Tue, 2 Jun 2015 22:50:00 -0400 Subject: Patch "tty/n_gsm.c: fix a memory leak when gsmtty is removed" has been added to the 3.14-stable tree To: xinhuix.pan@intel.com, gregkh@linuxfoundation.org, jslaby@suse.cz Cc: , From: Date: Wed, 03 Jun 2015 11:49:25 +0900 Message-ID: <143329976548222@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled tty/n_gsm.c: fix a memory leak when gsmtty is removed to the 3.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tty-n_gsm.c-fix-a-memory-leak-when-gsmtty-is-removed.patch and it can be found in the queue-3.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 8f9cfeed3eae86c70d3b04445a6f2036b27b6304 Mon Sep 17 00:00:00 2001 From: Pan Xinhui Date: Sat, 28 Mar 2015 10:42:56 +0800 Subject: tty/n_gsm.c: fix a memory leak when gsmtty is removed From: Pan Xinhui commit 8f9cfeed3eae86c70d3b04445a6f2036b27b6304 upstream. when gsmtty_remove put dlci, it will cause memory leak if dlci->port's refcount is zero. So we do the cleanup work in .cleanup callback instead. dlci will be last put in two call chains. 1) gsmld_close -> gsm_cleanup_mux -> gsm_dlci_release -> dlci_put 2) gsmld_remove -> dlci_put so there is a race. the memory leak depends on the race. In call chain 2. we hit the memory leak. below comment tells. release_tty -> tty_driver_remove_tty -> gsmtty_remove -> dlci_put -> tty_port_destructor (WARN_ON(port->itty) and return directly) | tty->port->itty = NULL; | tty_kref_put ---> release_one_tty -> gsmtty_cleanup (added by our patch) So our patch fix the memory leak by doing the cleanup work after tty core did. Signed-off-by: Pan Xinhui Fixes: dfabf7ffa30585 Acked-by: Jiri Slaby Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_gsm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -3166,7 +3166,7 @@ static int gsmtty_break_ctl(struct tty_s return gsmtty_modem_update(dlci, encode); } -static void gsmtty_remove(struct tty_driver *driver, struct tty_struct *tty) +static void gsmtty_cleanup(struct tty_struct *tty) { struct gsm_dlci *dlci = tty->driver_data; struct gsm_mux *gsm = dlci->gsm; @@ -3174,7 +3174,6 @@ static void gsmtty_remove(struct tty_dri dlci_put(dlci); dlci_put(gsm->dlci[0]); mux_put(gsm); - driver->ttys[tty->index] = NULL; } /* Virtual ttys for the demux */ @@ -3195,7 +3194,7 @@ static const struct tty_operations gsmtt .tiocmget = gsmtty_tiocmget, .tiocmset = gsmtty_tiocmset, .break_ctl = gsmtty_break_ctl, - .remove = gsmtty_remove, + .cleanup = gsmtty_cleanup, }; Patches currently in stable-queue which might be from xinhuix.pan@intel.com are queue-3.14/tty-n_gsm.c-fix-a-memory-leak-when-gsmtty-is-removed.patch