Merge "net: Fix double free and memory corruption in get_net_ns_by_id()" (cba461bf) · Commits · e / devices / android_kernel_sony_msm8998

drivers/block/loop.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -1569,9 +1569,8 @@ out:
		return err;
		}

		static void lo_release(struct gendisk *disk, fmode_t mode)
		static void __lo_release(struct loop_device *lo)
		{
		struct loop_device *lo = disk->private_data;
		int err;

		if (atomic_dec_return(&lo->lo_refcnt))
		@@ -1597,6 +1596,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode)
		mutex_unlock(&lo->lo_ctl_mutex);
		}

		static void lo_release(struct gendisk *disk, fmode_t mode)
		{
		mutex_lock(&loop_index_mutex);
		__lo_release(disk->private_data);
		mutex_unlock(&loop_index_mutex);
		}

		static const struct block_device_operations lo_fops = {
		.owner = THIS_MODULE,
		.open = lo_open,

+10 −7

Original line number	Diff line number	Diff line
		@@ -231,13 +231,17 @@ static void parse_hid_report_descriptor(struct gtco device, char report,

		/* Walk this report and pull out the info we need */
		while (i < length) {
		prefix = report[i];

		/* Skip over prefix */
		i++;
		prefix = report[i++];

		/* Determine data size and save the data in the proper variable */
		size = PREF_SIZE(prefix);
		size = (1U << PREF_SIZE(prefix)) >> 1;
		if (i + size > length) {
		dev_err(ddev,
		"Not enough data (need %d, have %d)\n",
		i + size, length);
		break;
		}

		switch (size) {
		case 1:
		data = report[i];
		@@ -245,8 +249,7 @@ static void parse_hid_report_descriptor(struct gtco device, char report,
		case 2:
		data16 = get_unaligned_le16(&report[i]);
		break;
		case 3:
		size = 4;
		case 4:
		data32 = get_unaligned_le32(&report[i]);
		break;
		}

+1 −1

Original line number	Diff line number	Diff line
		@@ -261,7 +261,7 @@ struct net get_net_ns_by_id(struct net net, int id)
		spin_lock_irqsave(&net->nsid_lock, flags);
		peer = idr_find(&net->netns_ids, id);
		if (peer)
		get_net(peer);
		peer = maybe_get_net(peer);
		spin_unlock_irqrestore(&net->nsid_lock, flags);
		rcu_read_unlock();