Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0278-5.4.179-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0278-5.4.179-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (18 months, 1 week ago) by niro
    File size: 2329 byte(s) 
    -sync kernel patches
    1 diff --git a/Makefile b/Makefile
    2 index 6d33284664fef..5688e17a44363 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 178
    10 +SUBLEVEL = 179
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/drivers/mmc/host/moxart-mmc.c b/drivers/mmc/host/moxart-mmc.c
    15 index 5553a5643f405..5c81dc7371db7 100644
    16 --- a/drivers/mmc/host/moxart-mmc.c
    17 +++ b/drivers/mmc/host/moxart-mmc.c
    18 @@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)
    19 if (!IS_ERR(host->dma_chan_rx))
    20 dma_release_channel(host->dma_chan_rx);
    21 mmc_remove_host(mmc);
    22 - mmc_free_host(mmc);
    23
    24 writel(0, host->base + REG_INTERRUPT_MASK);
    25 writel(0, host->base + REG_POWER_CONTROL);
    26 writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
    27 host->base + REG_CLOCK_CONTROL);
    28 + mmc_free_host(mmc);
    29 }
    30 return 0;
    31 }
    32 diff --git a/net/tipc/link.c b/net/tipc/link.c
    33 index f25010261a9e0..8f2ee71c63c6d 100644
    34 --- a/net/tipc/link.c
    35 +++ b/net/tipc/link.c
    36 @@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
    37 u16 peers_tol = msg_link_tolerance(hdr);
    38 u16 peers_prio = msg_linkprio(hdr);
    39 u16 rcv_nxt = l->rcv_nxt;
    40 - u16 dlen = msg_data_sz(hdr);
    41 + u32 dlen = msg_data_sz(hdr), glen = 0;
    42 int mtyp = msg_type(hdr);
    43 bool reply = msg_probe(hdr);
    44 - u16 glen = 0;
    45 void *data;
    46 char *if_name;
    47 int rc = 0;
    48
    49 trace_tipc_proto_rcv(skb, false, l->name);
    50 +
    51 + if (dlen > U16_MAX)
    52 + goto exit;
    53 +
    54 if (tipc_link_is_blocked(l) || !xmitq)
    55 goto exit;
    56
    57 @@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
    58 if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
    59 ga = NULL;
    60 }
    61 -
    62 + if(glen > dlen)
    63 + break;
    64 tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
    65 &l->mon_state, l->bearer_id);
    66
    67 diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
    68 index 58708b4c7719f..e7155a7743001 100644
    69 --- a/net/tipc/monitor.c
    70 +++ b/net/tipc/monitor.c
    71 @@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
    72 state->probing = false;
    73
    74 /* Sanity check received domain record */
    75 + if (new_member_cnt > MAX_MON_DOMAIN)
    76 + return;
    77 if (dlen < dom_rec_len(arrv_dom, 0))
    78 return;
    79 if (dlen != dom_rec_len(arrv_dom, new_member_cnt))