Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 0ac840a3 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'ASB-2023-09-05_11-5.4' of... 

Merge tag 'ASB-2023-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

https://source.android.com/docs/security/bulletin/2023-09-01

* tag 'ASB-2023-09-05_11-5.4' of https://android.googlesource.com/kernel/common:
  BACKPORT: net: nfc: Fix use-after-free caused by nfc_llcp_find_local
  UPSTREAM: media: usb: siano: Fix warning due to null work_func_t function pointer
  UPSTREAM: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
  ANDROID: ABI: Update allowed list for QCOM
  UPSTREAM: net: tap_open(): set sk_uid from current_fsuid()
  UPSTREAM: net: tun_chr_open(): set sk_uid from current_fsuid()
  UPSTREAM: net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free
  UPSTREAM: net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free
  UPSTREAM: net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free
  UPSTREAM: net/sched: cls_fw: Fix improper refcount update leads to use-after-free

Change-Id: Id067733b2597d8ef336d3b38f76669bd2d6726d7
parents cbe5f002 b91825e0

android/abi_gki_aarch64.xml

+2107 −2197

File changed.

Preview size limit exceeded, changes collapsed.

android/abi_gki_aarch64_qcom

+1 −0
Original line number Diff line number Diff line
@@ -2443,6 +2443,7 @@ 
  sysfs_create_group

  sysfs_create_groups

  sysfs_create_link

  sysfs_emit

  __sysfs_match_string

  sysfs_notify

  sysfs_remove_bin_file

drivers/media/usb/siano/smsusb.c

+2 −1
Original line number Diff line number Diff line
@@ -179,6 +179,7 @@ static void smsusb_stop_streaming(struct smsusb_device_t *dev) 


	for (i = 0; i < MAX_URBS; i++) {

		usb_kill_urb(&dev->surbs[i].urb);

		if (dev->surbs[i].wq.func)

			cancel_work_sync(&dev->surbs[i].wq);



		if (dev->surbs[i].cb) {

drivers/net/tap.c

+1 −1
Original line number Diff line number Diff line
@@ -525,7 +525,7 @@ static int tap_open(struct inode *inode, struct file *file) 
	q->sock.state = SS_CONNECTED;

	q->sock.file = file;

	q->sock.ops = &tap_socket_ops;

	sock_init_data_uid(&q->sock, &q->sk, inode->i_uid);

	sock_init_data_uid(&q->sock, &q->sk, current_fsuid());

	q->sk.sk_write_space = tap_sock_write_space;

	q->sk.sk_destruct = tap_sock_destruct;

	q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;

drivers/net/tun.c

+1 −1
Original line number Diff line number Diff line
@@ -3534,7 +3534,7 @@ static int tun_chr_open(struct inode *inode, struct file * file) 
	tfile->socket.file = file;

	tfile->socket.ops = &tun_socket_ops;



	sock_init_data_uid(&tfile->socket, &tfile->sk, inode->i_uid);

	sock_init_data_uid(&tfile->socket, &tfile->sk, current_fsuid());



	tfile->sk.sk_write_space = tun_sock_write_space;

	tfile->sk.sk_sndbuf = INT_MAX;