Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea83e4a9 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 4.9.65 into android-4.9 



Changes in 4.9.65
	tcp_nv: fix division by zero in tcpnv_acked()
	net: vrf: correct FRA_L3MDEV encode type
	tcp: do not mangle skb->cb[] in tcp_make_synack()
	netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed
	bonding: discard lowest hash bit for 802.3ad layer3+4
	net: cdc_ether: fix divide by 0 on bad descriptors
	net: qmi_wwan: fix divide by 0 on bad descriptors
	qmi_wwan: Add missing skb_reset_mac_header-call
	net: usb: asix: fill null-ptr-deref in asix_suspend
	vlan: fix a use-after-free in vlan_device_event()
	af_netlink: ensure that NLMSG_DONE never fails in dumps
	sctp: do not peel off an assoc from one netns to another one
	fealnx: Fix building error on MIPS
	net/sctp: Always set scope_id in sctp_inet6_skb_msgname
	crypto: dh - fix memleak in setkey
	crypto: dh - Fix double free of ctx->p
	ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
	serial: omap: Fix EFR write on RTS deassertion
	serial: 8250_fintek: Fix finding base_port with activated SuperIO
	dmaengine: dmatest: warn user when dma test times out
	ocfs2: fix cluster hang after a node dies
	ocfs2: should wait dio before inode lock in ocfs2_setattr()
	ipmi: fix unsigned long underflow
	mm/page_alloc.c: broken deferred calculation
	coda: fix 'kernel memory exposure attempt' in fsync
	mm/pagewalk.c: report holes in hugetlb ranges
	Linux 4.9.65

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parents fbb7468c 133e6ccf

Makefile

+1 −1
Original line number Diff line number Diff line 
VERSION = 4

PATCHLEVEL = 9

SUBLEVEL = 64

SUBLEVEL = 65

EXTRAVERSION =

NAME = Roaring Lionus

crypto/dh.c

+15 −19
Original line number Diff line number Diff line
@@ -21,19 +21,12 @@ struct dh_ctx { 
	MPI xa;

};



static inline void dh_clear_params(struct dh_ctx *ctx)

static void dh_clear_ctx(struct dh_ctx *ctx)

{

	mpi_free(ctx->p);

	mpi_free(ctx->g);

	ctx->p = NULL;

	ctx->g = NULL;

}



static void dh_free_ctx(struct dh_ctx *ctx)

{

	dh_clear_params(ctx);

	mpi_free(ctx->xa);

	ctx->xa = NULL;

	memset(ctx, 0, sizeof(*ctx));

}



/*
@@ -71,10 +64,8 @@ static int dh_set_params(struct dh_ctx *ctx, struct dh *params) 
		return -EINVAL;



	ctx->g = mpi_read_raw_data(params->g, params->g_size);

	if (!ctx->g) {

		mpi_free(ctx->p);

	if (!ctx->g)

		return -EINVAL;

	}



	return 0;

}
@@ -84,19 +75,24 @@ static int dh_set_secret(struct crypto_kpp *tfm, void *buf, unsigned int len) 
	struct dh_ctx *ctx = dh_get_ctx(tfm);

	struct dh params;



	/* Free the old MPI key if any */

	dh_clear_ctx(ctx);



	if (crypto_dh_decode_key(buf, len, &params) < 0)

		return -EINVAL;

		goto err_clear_ctx;



	if (dh_set_params(ctx, &params) < 0)

		return -EINVAL;

		goto err_clear_ctx;



	ctx->xa = mpi_read_raw_data(params.key, params.key_size);

	if (!ctx->xa) {

		dh_clear_params(ctx);

		return -EINVAL;

	}

	if (!ctx->xa)

		goto err_clear_ctx;



	return 0;



err_clear_ctx:

	dh_clear_ctx(ctx);

	return -EINVAL;

}



static int dh_compute_value(struct kpp_request *req)
@@ -154,7 +150,7 @@ static void dh_exit_tfm(struct crypto_kpp *tfm) 
{

	struct dh_ctx *ctx = dh_get_ctx(tfm);



	dh_free_ctx(ctx);

	dh_clear_ctx(ctx);

}



static struct kpp_alg dh = {

drivers/char/ipmi/ipmi_msghandler.c

+6 −4
Original line number Diff line number Diff line
@@ -4029,7 +4029,8 @@ smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg, 
}



static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent,

			      struct list_head *timeouts, long timeout_period,

			      struct list_head *timeouts,

			      unsigned long timeout_period,

			      int slot, unsigned long *flags,

			      unsigned int *waiting_msgs)

{
@@ -4042,8 +4043,8 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent, 
	if (!ent->inuse)

		return;



	if (timeout_period < ent->timeout) {

		ent->timeout -= timeout_period;

	if (ent->timeout > 0) {

		(*waiting_msgs)++;

		return;

	}
@@ -4109,7 +4110,8 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent, 
	}

}



static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period)

static unsigned int ipmi_timeout_handler(ipmi_smi_t intf,

					 unsigned long timeout_period)

{

	struct list_head     timeouts;

	struct ipmi_recv_msg *msg, *msg2;

drivers/dma/dmatest.c

+1 −0
Original line number Diff line number Diff line
@@ -666,6 +666,7 @@ static int dmatest_func(void *data) 
			 * free it this time?" dancing.  For now, just

			 * leave it dangling.

			 */

			WARN(1, "dmatest: Kernel stack may be corrupted!!\n");

			dmaengine_unmap_put(um);

			result("test timed out", total_tests, src_off, dst_off,

			       len, 0);

drivers/net/bonding/bond_main.c

+1 −1
Original line number Diff line number Diff line
@@ -3217,7 +3217,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb) 
	hash ^= (hash >> 16);

	hash ^= (hash >> 8);



	return hash;

	return hash >> 1;

}



/*-------------------------- Device entry points ----------------------------*/