Contents of /trunk/kernel-alx/patches-5.4/0278-5.4.179-all-fixes.patch
Parent Directory | Revision Log
Revision 3635 -
(show annotations)
(download)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 2329 byte(s)
Mon Oct 24 12:34:12 2022 UTC (23 months ago) by niro
File size: 2329 byte(s)
-sync kernel patches
1 | diff --git a/Makefile b/Makefile |
2 | index 6d33284664fef..5688e17a44363 100644 |
3 | --- a/Makefile |
4 | +++ b/Makefile |
5 | @@ -1,7 +1,7 @@ |
6 | # SPDX-License-Identifier: GPL-2.0 |
7 | VERSION = 5 |
8 | PATCHLEVEL = 4 |
9 | -SUBLEVEL = 178 |
10 | +SUBLEVEL = 179 |
11 | EXTRAVERSION = |
12 | NAME = Kleptomaniac Octopus |
13 | |
14 | diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c |
15 | index 5553a5643f405..5c81dc7371db7 100644 |
16 | --- a/drivers/mmc/host/moxart-mmc.c |
17 | +++ b/drivers/mmc/host/moxart-mmc.c |
18 | @@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev) |
19 | if (!IS_ERR(host->dma_chan_rx)) |
20 | dma_release_channel(host->dma_chan_rx); |
21 | mmc_remove_host(mmc); |
22 | - mmc_free_host(mmc); |
23 | |
24 | writel(0, host->base + REG_INTERRUPT_MASK); |
25 | writel(0, host->base + REG_POWER_CONTROL); |
26 | writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF, |
27 | host->base + REG_CLOCK_CONTROL); |
28 | + mmc_free_host(mmc); |
29 | } |
30 | return 0; |
31 | } |
32 | diff --git a/net/tipc/link.c b/net/tipc/link.c |
33 | index f25010261a9e0..8f2ee71c63c6d 100644 |
34 | --- a/net/tipc/link.c |
35 | +++ b/net/tipc/link.c |
36 | @@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, |
37 | u16 peers_tol = msg_link_tolerance(hdr); |
38 | u16 peers_prio = msg_linkprio(hdr); |
39 | u16 rcv_nxt = l->rcv_nxt; |
40 | - u16 dlen = msg_data_sz(hdr); |
41 | + u32 dlen = msg_data_sz(hdr), glen = 0; |
42 | int mtyp = msg_type(hdr); |
43 | bool reply = msg_probe(hdr); |
44 | - u16 glen = 0; |
45 | void *data; |
46 | char *if_name; |
47 | int rc = 0; |
48 | |
49 | trace_tipc_proto_rcv(skb, false, l->name); |
50 | + |
51 | + if (dlen > U16_MAX) |
52 | + goto exit; |
53 | + |
54 | if (tipc_link_is_blocked(l) || !xmitq) |
55 | goto exit; |
56 | |
57 | @@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, |
58 | if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt)) |
59 | ga = NULL; |
60 | } |
61 | - |
62 | + if(glen > dlen) |
63 | + break; |
64 | tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr, |
65 | &l->mon_state, l->bearer_id); |
66 | |
67 | diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c |
68 | index 58708b4c7719f..e7155a7743001 100644 |
69 | --- a/net/tipc/monitor.c |
70 | +++ b/net/tipc/monitor.c |
71 | @@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, |
72 | state->probing = false; |
73 | |
74 | /* Sanity check received domain record */ |
75 | + if (new_member_cnt > MAX_MON_DOMAIN) |
76 | + return; |
77 | if (dlen < dom_rec_len(arrv_dom, 0)) |
78 | return; |
79 | if (dlen != dom_rec_len(arrv_dom, new_member_cnt)) |