Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 58b36178 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman
Browse files

Merge 5.4.179 into android11-5.4-lts 



Changes in 5.4.179
	moxart: fix potential use-after-free on remove path
	tipc: improve size validations for received domain records
	Linux 5.4.179

Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I60ec5a742e23ee96257003c3a736267a3c473b64
parents 88fc697a 52871671

Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0

VERSION = 5

PATCHLEVEL = 4

SUBLEVEL = 178

SUBLEVEL = 179

EXTRAVERSION =

NAME = Kleptomaniac Octopus

drivers/mmc/host/moxart-mmc.c

+1 −1
Original line number Diff line number Diff line
@@ -696,12 +696,12 @@ static int moxart_remove(struct platform_device *pdev) 
		if (!IS_ERR(host->dma_chan_rx))

			dma_release_channel(host->dma_chan_rx);

		mmc_remove_host(mmc);

		mmc_free_host(mmc);



		writel(0, host->base + REG_INTERRUPT_MASK);

		writel(0, host->base + REG_POWER_CONTROL);

		writel(readl(host->base + REG_CLOCK_CONTROL) | CLK_OFF,

		       host->base + REG_CLOCK_CONTROL);

		mmc_free_host(mmc);

	}

	return 0;

}

net/tipc/link.c

+7 −3
Original line number Diff line number Diff line
@@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, 
	u16 peers_tol = msg_link_tolerance(hdr);

	u16 peers_prio = msg_linkprio(hdr);

	u16 rcv_nxt = l->rcv_nxt;

	u16 dlen = msg_data_sz(hdr);

	u32 dlen = msg_data_sz(hdr), glen = 0;

	int mtyp = msg_type(hdr);

	bool reply = msg_probe(hdr);

	u16 glen = 0;

	void *data;

	char *if_name;

	int rc = 0;



	trace_tipc_proto_rcv(skb, false, l->name);



	if (dlen > U16_MAX)

		goto exit;



	if (tipc_link_is_blocked(l) || !xmitq)

		goto exit;
@@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb, 
			if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))

				ga = NULL;

		}



		if(glen > dlen)

			break;

		tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,

			     &l->mon_state, l->bearer_id);

net/tipc/monitor.c

+2 −0
Original line number Diff line number Diff line
@@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr, 
	state->probing = false;



	/* Sanity check received domain record */

	if (new_member_cnt > MAX_MON_DOMAIN)

		return;

	if (dlen < dom_rec_len(arrv_dom, 0))

		return;

	if (dlen != dom_rec_len(arrv_dom, new_member_cnt))