Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8fb59f2b authored by shaohanlin's avatar shaohanlin
Browse files

Merge SPL 2021-06-05 into mp 

* origin/8901-fp3-q-mp-release-spl-202106:
  netfilter: nf_conntrack_h323: lost .data_len definition for Q.931/ipv6
  HID: make arrays usage and value to be the same
  futex: Handle faults correctly for PI futexes
  crypto: Fix possible stack out of bound error
Change-Id: I1c25831e10390264c60984c1f6399c10fc5185ec
parents 2742fa12 65e3629b

drivers/crypto/msm/qce50.c

+5 −0
Original line number Diff line number Diff line
@@ -850,6 +850,11 @@ static int _ce_setup_cipher(struct qce_device *pce_dev, struct qce_req *creq, 
	switch (creq->alg) {

	case CIPHER_ALG_DES:

		if (creq->mode !=  QCE_MODE_ECB) {

			if (ivsize > MAX_IV_LENGTH) {

				pr_err("%s: error: Invalid length parameter\n",

					 __func__);

				return -EINVAL;

			}

			_byte_stream_to_net_words(enciv32, creq->iv, ivsize);

			pce = cmdlistinfo->encr_cntr_iv;

			pce->data = enciv32[0];

drivers/hid/hid-core.c

+3 −3
Original line number Diff line number Diff line
@@ -91,7 +91,7 @@ EXPORT_SYMBOL_GPL(hid_register_report); 
 * Register a new field for this report.

 */



static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values)

static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages)

{

	struct hid_field *field;
@@ -102,7 +102,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned 


	field = kzalloc((sizeof(struct hid_field) +

			 usages * sizeof(struct hid_usage) +

			 values * sizeof(unsigned)), GFP_KERNEL);

			 usages * sizeof(unsigned)), GFP_KERNEL);

	if (!field)

		return NULL;
@@ -281,7 +281,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign 
	usages = max_t(unsigned, parser->local.usage_index,

				 parser->global.report_count);



	field = hid_register_field(report, usages, parser->global.report_count);

	field = hid_register_field(report, usages);

	if (!field)

		return 0;

kernel/futex.c

+2 −18
Original line number Diff line number Diff line
@@ -988,7 +988,8 @@ void exit_pi_state_list(struct task_struct *curr) 
 *	FUTEX_OWNER_DIED bit. See [4]

 *

 * [10] There is no transient state which leaves owner and user space

 *	TID out of sync.

 *	TID out of sync. Except one error case where the kernel is denied

 *	write access to the user address, see fixup_pi_state_owner().

 */



/*
@@ -2653,13 +2654,6 @@ static int futex_lock_pi(u32 __user *uaddr, unsigned int flags, 
	if (res)

		ret = (res < 0) ? res : 0;



	/*

	 * If fixup_owner() faulted and was unable to handle the fault, unlock

	 * it and return the fault to userspace.

	 */

	if (ret && (rt_mutex_owner(&q.pi_state->pi_mutex) == current))

		rt_mutex_unlock(&q.pi_state->pi_mutex);



	/* Unqueue and drop the lock */

	unqueue_me_pi(&q);
@@ -2964,8 +2958,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, 
		if (q.pi_state && (q.pi_state->owner != current)) {

			spin_lock(q.lock_ptr);

			ret = fixup_pi_state_owner(uaddr2, &q, current);

			if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current)

				rt_mutex_unlock(&q.pi_state->pi_mutex);

			/*

			 * Drop the reference to the pi state which

			 * the requeue_pi() code acquired for us.
@@ -3002,14 +2994,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, 
		if (res)

			ret = (res < 0) ? res : 0;



		/*

		 * If fixup_pi_state_owner() faulted and was unable to handle

		 * the fault, unlock the rt_mutex and return the fault to

		 * userspace.

		 */

		if (ret && rt_mutex_owner(pi_mutex) == current)

			rt_mutex_unlock(pi_mutex);



		/* Unqueue and drop the lock. */

		unqueue_me_pi(&q);

	}

net/netfilter/nf_conntrack_h323_main.c

+1 −0
Original line number Diff line number Diff line
@@ -1225,6 +1225,7 @@ static struct nf_conntrack_helper nf_conntrack_helper_q931[] __read_mostly = { 
	{

		.name			= "Q.931",

		.me			= THIS_MODULE,

		.data_len		= sizeof(struct nf_ct_h323_master),

		.tuple.src.l3num	= AF_INET6,

		.tuple.src.u.tcp.port	= cpu_to_be16(Q931_PORT),

		.tuple.dst.protonum	= IPPROTO_TCP,