Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9e8f8f1e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char/misc fixes from Greg KH:
 "Here are two bugfixes for some driver bugs for 4.15-rc8

  The first is a bluetooth security bug that has been ignored by the
  Bluetooth developers for months for no obvious reason at all, so I've
  taken it through my tree.

  The second is a simple double-free bug in the mux subsystem.

  Both have been in linux-next for a while with no reported issues"

* tag 'char-misc-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  mux: core: fix double get_device()
  Bluetooth: Prevent stack info leak from the EFS element.
parents 22079ee4 aa1f10e8

drivers/mux/core.c

+3 −1
Original line number Diff line number Diff line
@@ -413,6 +413,7 @@ static int of_dev_node_match(struct device *dev, const void *data) 
	return dev->of_node == data;

}



/* Note this function returns a reference to the mux_chip dev. */

static struct mux_chip *of_find_mux_chip_by_node(struct device_node *np)

{

	struct device *dev;
@@ -466,6 +467,7 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name) 
	    (!args.args_count && (mux_chip->controllers > 1))) {

		dev_err(dev, "%pOF: wrong #mux-control-cells for %pOF\n",

			np, args.np);

		put_device(&mux_chip->dev);

		return ERR_PTR(-EINVAL);

	}
@@ -476,10 +478,10 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name) 
	if (controller >= mux_chip->controllers) {

		dev_err(dev, "%pOF: bad mux controller %u specified in %pOF\n",

			np, controller, args.np);

		put_device(&mux_chip->dev);

		return ERR_PTR(-EINVAL);

	}



	get_device(&mux_chip->dev);

	return &mux_chip->mux[controller];

}

EXPORT_SYMBOL_GPL(mux_control_get);

net/bluetooth/l2cap_core.c

+11 −9
Original line number Diff line number Diff line
@@ -3363,9 +3363,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data 
			break;



		case L2CAP_CONF_EFS:

			if (olen == sizeof(efs)) {

				remote_efs = 1;

			if (olen == sizeof(efs))

				memcpy(&efs, (void *) val, olen);

			}

			break;



		case L2CAP_CONF_EWS:
@@ -3584,7 +3585,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 
			break;



		case L2CAP_CONF_EFS:

			if (olen == sizeof(efs))

			if (olen == sizeof(efs)) {

				memcpy(&efs, (void *)val, olen);



				if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
@@ -3594,6 +3595,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, 


				l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),

						   (unsigned long) &efs, endptr - ptr);

			}

			break;



		case L2CAP_CONF_FCS: