android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

This is the 5.4.179 stable release

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAmIGGXAACgkQONu9yGCS
 aT5rZg//XL05+Q2r/t8Hu6ZhQt8Y1D3NIoCZCJSI+Y3qPDej3G8/vdLIfNsjQ+q9
 52To0b7F16r3qY4eLv9kY1j9O1ZEIG99F2VnkMkM6sjCZCFEoGkUT9kIC/9FURqC
 qM6Cx5ZlhZ0CtyikWY3wmU2j/dmgv32URMB82MP8juq/Fm+Q0OW8XWrAbnottN5V
 3+cDFuvCBS57LNeprgC/t5DEc2r7JG6SrjuTlLzHscRp0ub6RGUfwPzgfZiJpGRz
 /f6HjcVPGOPsZC3FVoYq4t2qnaR5I9wPwmM5CrdLc244Bhh5qGporJR0ifSNK6Im
 wJ7uMnaxi1qhSmqte7cH72GJ3+EjJzU6ruEfHfz63XjbZ8YK2qMZSgclns9jwhBQ
 ICeLDY13wzYDoOUzmw2jjkPmO0Ilp9Lcx/j/PpxDXqlx0LJSxYLyzLJGm9F0GxkB
 8ay/HFE4QPJ3sgRJYXjdGTmmzGp0E28JnWim6HMW1ja5Y+lC8qRuGlInLaU9h84R
 nRmuEHON5L9jshgpoPO26KrmBD7bg+nq9WYpuXDKCUFdkS81z7u9BlFpkzfW5QTw
 9p7FPwX+yWxtv3ZUQ05144vVf9/oheh9zL3Wmm3AE0cp2hEv8F2zrTYNZxiu7y+Y
 qqkCVCAqoU43Sdxy+Tu6fgQuTInCsCtT5rQkmBIyZ77FQg2Zgi0=
 =nIXz
 -----END PGP SIGNATURE-----

Merge 5.4.179 into android11-5.4-lts

Changes in 5.4.179
	moxart: fix potential use-after-free on remove path
	tipc: improve size validations for received domain records
	Linux 5.4.179

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I60ec5a742e23ee96257003c3a736267a3c473b64
This commit is contained in:
Greg Kroah-Hartman 2022-02-11 09:16:55 +01:00
commit 58b361784b
4 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile
View File

@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 5
PATCHLEVEL = 4
SUBLEVEL = 178
SUBLEVEL = 179
EXTRAVERSION =
NAME = Kleptomaniac Octopus

2
drivers/mmc/host/moxart-mmc.c
View File

@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev)
if (!IS_ERR(host->dma_chan_rx))
dma_release_channel(host->dma_chan_rx);
mmc_remove_host(mmc);
mmc_free_host(mmc);
writel(0, host->base + REG_INTERRUPT_MASK);
writel(0, host->base + REG_POWER_CONTROL);
writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,
host->base + REG_CLOCK_CONTROL);
mmc_free_host(mmc);
}
return 0;
}

10
net/tipc/link.c
View File

@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
u16 peers_tol = msg_link_tolerance(hdr);
u16 peers_prio = msg_linkprio(hdr);
u16 rcv_nxt = l->rcv_nxt;
u16 dlen = msg_data_sz(hdr);
u32 dlen = msg_data_sz(hdr), glen = 0;
int mtyp = msg_type(hdr);
bool reply = msg_probe(hdr);
u16 glen = 0;
void *data;
char *if_name;
int rc = 0;
trace_tipc_proto_rcv(skb, false, l->name);
if (dlen > U16_MAX)
goto exit;
if (tipc_link_is_blocked(l) || !xmitq)
goto exit;
@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
ga = NULL;
}
if(glen > dlen)
break;
tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
&l->mon_state, l->bearer_id);

2
net/tipc/monitor.c
View File

@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
state->probing = false;
/* Sanity check received domain record */
if (new_member_cnt > MAX_MON_DOMAIN)
return;
if (dlen < dom_rec_len(arrv_dom, 0))
return;
if (dlen != dom_rec_len(arrv_dom, new_member_cnt))