This is the 4.9.130 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAluvTugACgkQONu9yGCS aT7VlA/9EmN7I6hHlA0CiHZF8UI86zHMXmHNTF8gF/X5mQs1vcKGtSJMnsCjTzki l/dPU22eci+xdHwHkuKb7ZkDilu8dMNW8nTkqSoXBfGUviomgTyCgP68vOO5UIDM 8m+wGsAuvuPBQccTd6XdpSRJdz7TSO41t3d/F3IH4KCPWWOp4O8WLYkbUdmXX+Ys qyPBfP+qtfkgBwexpMBqdzzGgdh3JszBYmWV9EUo9hPVcylcWjUlGwK2sIVB9gDH CiMHV2TYVv3jI7km9+R2tqY+kWfBWqaLTxRGuYlvFR8smMaWUiRhrWN9ce0BRYzO dVqgGp/CJsgb/zhAxNQ0PfQ20FtSiM+mSZ2F4DDOjFt0GE0QkcxvN/jaJsfqy/K4 5nteK4yU3X5CpBeVurjaSSMNI1Q3P9aIWTf+FgatUGBWGhxvTKsSxzfSnBAZdV8X r1ahCmutf0fjT1IuIDj+6/GrqhucugbsWo6y49bxjlrShsOsbdMVKgzLTzjPwEf/ gDBHoenEnz1NuzWCbZTm2g0GxrVAIvNVzyzlQDjeQe/2t5EN1ymJY4RT9fbfN8Lc zOGmlR7qjkvtcjvXVsNtaqsE+bnBRyeLMYhlHN55X8q9dBVltVvNxLtyvbCRar8G ptx56z+/jNPk4iFf3AhDzp4UbNfz0C0TO+eL1F6UAGpVYlYQu+k= =eQ3Q -----END PGP SIGNATURE----- Merge 4.9.130 into android-4.9 Changes in 4.9.130 NFC: Fix possible memory corruption when handling SHDLC I-Frame commands NFC: Fix the number of pipes ASoC: cs4265: fix MMTLR Data switch control ALSA: bebob: fix memory leak for M-Audio FW1814 and ProjectMix I/O at error path ALSA: bebob: use address returned by kmalloc() instead of kernel stack for streaming DMA mapping ALSA: emu10k1: fix possible info leak to userspace on SNDRV_EMU10K1_IOCTL_INFO ALSA: firewire-digi00x: fix memory leak of private data ALSA: firewire-tascam: fix memory leak of private data ALSA: fireworks: fix memory leak of response buffer at error path ALSA: oxfw: fix memory leak for model-dependent data at error path ALSA: oxfw: fix memory leak of discovered stream formats at error path ALSA: oxfw: fix memory leak of private data platform/x86: alienware-wmi: Correct a memory leak xen/netfront: don't bug in case of too many frags xen/x86/vpmu: Zero struct pt_regs before calling into sample handling code Revert "PCI: Add ACS quirk for Intel 300 series" ring-buffer: Allow for rescheduling when removing pages mm: shmem.c: Correctly annotate new inodes for lockdep gso_segment: Reset skb->mac_len after modifying network header ipv6: fix possible use-after-free in ip6_xmit() net/appletalk: fix minor pointer leak to userspace in SIOCFINDIPDDPRT net: hp100: fix always-true check for link up state udp4: fix IP_CMSG_CHECKSUM for connected sockets neighbour: confirm neigh entries when ARP packet is received scsi: target: iscsi: Use hex2bin instead of a re-implementation ocfs2: fix ocfs2 read block panic drm/nouveau/drm/nouveau: Fix bogus drm_kms_helper_poll_enable() placement drm/nouveau/drm/nouveau: Use pm_runtime_get_noresume() in connector_detect() drm/nouveau/drm/nouveau: Prevent handling ACPI HPD events too early drm/vc4: Fix the "no scaling" case on multi-planar YUV formats tty: vt_ioctl: fix potential Spectre v1 ext4: check to make sure the rename(2)'s destination is not freed ext4: avoid divide by zero fault when deleting corrupted inline directories ext4: recalucate superblock checksum after updating free blocks/inodes ext4: fix online resize's handling of a too-small final block group ext4: fix online resizing for bigalloc file systems with a 1k block size ext4: don't mark mmp buffer head dirty ext4: show test_dummy_encryption mount option in /proc/mounts sched/fair: Fix vruntime_normalized() for remote non-migration wakeup HID: sony: Update device ids HID: sony: Support DS4 dongle PCI: aardvark: Size bridges before resources allocation vmw_balloon: include asm/io.h iw_cxgb4: only allow 1 flush on user qps Linux 4.9.130 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
This commit is contained in:
commit
1c7637ca0b
42 changed files with 225 additions and 123 deletions
2
Makefile
2
Makefile
|
|
@ -1,6 +1,6 @@
|
|||
VERSION = 4
|
||||
PATCHLEVEL = 9
|
||||
SUBLEVEL = 129
|
||||
SUBLEVEL = 130
|
||||
EXTRAVERSION =
|
||||
NAME = Roaring Lionus
|
||||
|
||||
|
|
|
|||
|
|
@ -477,7 +477,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs,
|
|||
irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
|
||||
{
|
||||
int err, ret = IRQ_NONE;
|
||||
struct pt_regs regs;
|
||||
struct pt_regs regs = {0};
|
||||
const struct xen_pmu_data *xenpmu_data = get_xenpmu_data();
|
||||
uint8_t xenpmu_flags = get_xenpmu_flags();
|
||||
|
||||
|
|
|
|||
|
|
@ -271,12 +271,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
|
|||
nv_connector->edid = NULL;
|
||||
}
|
||||
|
||||
/* Outputs are only polled while runtime active, so acquiring a
|
||||
* runtime PM ref here is unnecessary (and would deadlock upon
|
||||
* runtime suspend because it waits for polling to finish).
|
||||
/* Outputs are only polled while runtime active, so resuming the
|
||||
* device here is unnecessary (and would deadlock upon runtime suspend
|
||||
* because it waits for polling to finish). We do however, want to
|
||||
* prevent the autosuspend timer from elapsing during this operation
|
||||
* if possible.
|
||||
*/
|
||||
if (!drm_kms_helper_is_poll_worker()) {
|
||||
ret = pm_runtime_get_sync(connector->dev->dev);
|
||||
if (drm_kms_helper_is_poll_worker()) {
|
||||
pm_runtime_get_noresume(dev->dev);
|
||||
} else {
|
||||
ret = pm_runtime_get_sync(dev->dev);
|
||||
if (ret < 0 && ret != -EACCES)
|
||||
return conn_status;
|
||||
}
|
||||
|
|
@ -354,10 +358,8 @@ detect_analog:
|
|||
|
||||
out:
|
||||
|
||||
if (!drm_kms_helper_is_poll_worker()) {
|
||||
pm_runtime_mark_last_busy(connector->dev->dev);
|
||||
pm_runtime_put_autosuspend(connector->dev->dev);
|
||||
}
|
||||
pm_runtime_mark_last_busy(dev->dev);
|
||||
pm_runtime_put_autosuspend(dev->dev);
|
||||
|
||||
return conn_status;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -367,8 +367,6 @@ nouveau_display_hpd_work(struct work_struct *work)
|
|||
pm_runtime_get_sync(drm->dev->dev);
|
||||
|
||||
drm_helper_hpd_irq_event(drm->dev);
|
||||
/* enable polling for external displays */
|
||||
drm_kms_helper_poll_enable(drm->dev);
|
||||
|
||||
pm_runtime_mark_last_busy(drm->dev->dev);
|
||||
pm_runtime_put_sync(drm->dev->dev);
|
||||
|
|
@ -391,15 +389,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
|
|||
{
|
||||
struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
|
||||
struct acpi_bus_event *info = data;
|
||||
int ret;
|
||||
|
||||
if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
|
||||
if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
|
||||
/*
|
||||
* This may be the only indication we receive of a
|
||||
* connector hotplug on a runtime suspended GPU,
|
||||
* schedule hpd_work to check.
|
||||
*/
|
||||
schedule_work(&drm->hpd_work);
|
||||
ret = pm_runtime_get(drm->dev->dev);
|
||||
if (ret == 1 || ret == -EACCES) {
|
||||
/* If the GPU is already awake, or in a state
|
||||
* where we can't wake it up, it can handle
|
||||
* it's own hotplug events.
|
||||
*/
|
||||
pm_runtime_put_autosuspend(drm->dev->dev);
|
||||
} else if (ret == 0) {
|
||||
/* This may be the only indication we receive
|
||||
* of a connector hotplug on a runtime
|
||||
* suspended GPU, schedule hpd_work to check.
|
||||
*/
|
||||
NV_DEBUG(drm, "ACPI requested connector reprobe\n");
|
||||
schedule_work(&drm->hpd_work);
|
||||
pm_runtime_put_noidle(drm->dev->dev);
|
||||
} else {
|
||||
NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
|
||||
ret);
|
||||
}
|
||||
|
||||
/* acpi-video should not generate keypresses for this */
|
||||
return NOTIFY_BAD;
|
||||
|
|
@ -422,6 +434,11 @@ nouveau_display_init(struct drm_device *dev)
|
|||
if (ret)
|
||||
return ret;
|
||||
|
||||
/* enable connector detection and polling for connectors without HPD
|
||||
* support
|
||||
*/
|
||||
drm_kms_helper_poll_enable(dev);
|
||||
|
||||
/* enable hotplug interrupts */
|
||||
list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
|
||||
struct nouveau_connector *conn = nouveau_connector(connector);
|
||||
|
|
|
|||
|
|
@ -327,6 +327,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
|
|||
vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
|
||||
vc4_state->crtc_h);
|
||||
|
||||
vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
|
||||
vc4_state->y_scaling[0] == VC4_SCALING_NONE);
|
||||
|
||||
if (num_planes > 1) {
|
||||
vc4_state->is_yuv = true;
|
||||
|
||||
|
|
@ -342,24 +345,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
|
|||
vc4_get_scaling_mode(vc4_state->src_h[1],
|
||||
vc4_state->crtc_h);
|
||||
|
||||
/* YUV conversion requires that scaling be enabled,
|
||||
* even on a plane that's otherwise 1:1. Choose TPZ
|
||||
* for simplicity.
|
||||
/* YUV conversion requires that horizontal scaling be enabled,
|
||||
* even on a plane that's otherwise 1:1. Looks like only PPF
|
||||
* works in that case, so let's pick that one.
|
||||
*/
|
||||
if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
|
||||
vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
|
||||
if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
|
||||
vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
|
||||
if (vc4_state->is_unity)
|
||||
vc4_state->x_scaling[0] = VC4_SCALING_PPF;
|
||||
} else {
|
||||
vc4_state->x_scaling[1] = VC4_SCALING_NONE;
|
||||
vc4_state->y_scaling[1] = VC4_SCALING_NONE;
|
||||
}
|
||||
|
||||
vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
|
||||
vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
|
||||
vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
|
||||
vc4_state->y_scaling[1] == VC4_SCALING_NONE);
|
||||
|
||||
/* No configuring scaling on the cursor plane, since it gets
|
||||
non-vblank-synced updates, and scaling requires requires
|
||||
LBM changes which have to be vblank-synced.
|
||||
|
|
@ -614,7 +610,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
|
|||
vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
|
||||
}
|
||||
|
||||
if (!vc4_state->is_unity) {
|
||||
if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
|
||||
vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
|
||||
vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
|
||||
vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
|
||||
/* LBM Base Address. */
|
||||
if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
|
||||
vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
|
||||
|
|
|
|||
|
|
@ -2059,6 +2059,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
|
|||
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
|
||||
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
|
||||
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) },
|
||||
|
|
|
|||
|
|
@ -927,6 +927,8 @@
|
|||
#define USB_DEVICE_ID_SONY_PS3_BDREMOTE 0x0306
|
||||
#define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268
|
||||
#define USB_DEVICE_ID_SONY_PS4_CONTROLLER 0x05c4
|
||||
#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2 0x09cc
|
||||
#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE 0x0ba0
|
||||
#define USB_DEVICE_ID_SONY_MOTION_CONTROLLER 0x03d5
|
||||
#define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER 0x042f
|
||||
#define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER 0x0002
|
||||
|
|
|
|||
|
|
@ -2581,6 +2581,12 @@ static const struct hid_device_id sony_devices[] = {
|
|||
.driver_data = DUALSHOCK4_CONTROLLER_USB },
|
||||
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
|
||||
.driver_data = DUALSHOCK4_CONTROLLER_BT },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
|
||||
.driver_data = DUALSHOCK4_CONTROLLER_USB },
|
||||
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
|
||||
.driver_data = DUALSHOCK4_CONTROLLER_BT },
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE),
|
||||
.driver_data = DUALSHOCK4_CONTROLLER_USB },
|
||||
/* Nyko Core Controller for PS3 */
|
||||
{ HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER),
|
||||
.driver_data = SIXAXIS_CONTROLLER_USB | SINO_LITE_CONTROLLER },
|
||||
|
|
|
|||
|
|
@ -1258,6 +1258,12 @@ static void flush_qp(struct c4iw_qp *qhp)
|
|||
|
||||
t4_set_wq_in_error(&qhp->wq);
|
||||
if (qhp->ibqp.uobject) {
|
||||
|
||||
/* for user qps, qhp->wq.flushed is protected by qhp->mutex */
|
||||
if (qhp->wq.flushed)
|
||||
return;
|
||||
|
||||
qhp->wq.flushed = 1;
|
||||
t4_set_cq_in_error(&rchp->cq);
|
||||
spin_lock_irqsave(&rchp->comp_handler_lock, flag);
|
||||
(*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
|
||||
|
|
|
|||
|
|
@ -45,6 +45,7 @@
|
|||
#include <linux/seq_file.h>
|
||||
#include <linux/vmw_vmci_defs.h>
|
||||
#include <linux/vmw_vmci_api.h>
|
||||
#include <linux/io.h>
|
||||
#include <asm/hypervisor.h>
|
||||
|
||||
MODULE_AUTHOR("VMware, Inc.");
|
||||
|
|
|
|||
|
|
@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
|
|||
case SIOCFINDIPDDPRT:
|
||||
spin_lock_bh(&ipddp_route_lock);
|
||||
rp = __ipddp_find_route(&rcp);
|
||||
if (rp)
|
||||
memcpy(&rcp2, rp, sizeof(rcp2));
|
||||
if (rp) {
|
||||
memset(&rcp2, 0, sizeof(rcp2));
|
||||
rcp2.ip = rp->ip;
|
||||
rcp2.at = rp->at;
|
||||
rcp2.flags = rp->flags;
|
||||
}
|
||||
spin_unlock_bh(&ipddp_route_lock);
|
||||
|
||||
if (rp) {
|
||||
|
|
|
|||
|
|
@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
|
|||
/* Wait for link to drop */
|
||||
time = jiffies + (HZ / 10);
|
||||
do {
|
||||
if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
|
||||
if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
|
||||
break;
|
||||
if (!in_interrupt())
|
||||
schedule_timeout_interruptible(1);
|
||||
|
|
|
|||
|
|
@ -906,7 +906,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
|
|||
BUG_ON(pull_to <= skb_headlen(skb));
|
||||
__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
|
||||
}
|
||||
BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
|
||||
if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
|
||||
queue->rx.rsp_cons = ++cons;
|
||||
kfree_skb(nskb);
|
||||
return ~0U;
|
||||
}
|
||||
|
||||
skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
|
||||
skb_frag_page(nfrag),
|
||||
|
|
@ -1043,6 +1047,8 @@ err:
|
|||
skb->len += rx->status;
|
||||
|
||||
i = xennet_fill_frags(queue, skb, &tmpq);
|
||||
if (unlikely(i == ~0U))
|
||||
goto err;
|
||||
|
||||
if (rx->flags & XEN_NETRXF_csum_blank)
|
||||
skb->ip_summed = CHECKSUM_PARTIAL;
|
||||
|
|
|
|||
|
|
@ -976,6 +976,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
|
|||
return -ENOMEM;
|
||||
}
|
||||
|
||||
pci_bus_size_bridges(bus);
|
||||
pci_bus_assign_resources(bus);
|
||||
|
||||
list_for_each_entry(child, &bus->children, node)
|
||||
|
|
|
|||
|
|
@ -4236,11 +4236,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
|
|||
*
|
||||
* 0x9d10-0x9d1b PCI Express Root port #{1-12}
|
||||
*
|
||||
* The 300 series chipset suffers from the same bug so include those root
|
||||
* ports here as well.
|
||||
*
|
||||
* 0xa32c-0xa343 PCI Express Root port #{0-24}
|
||||
*
|
||||
* [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
|
||||
* [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
|
||||
* [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
|
||||
|
|
@ -4258,7 +4253,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
|
|||
case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
|
||||
case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
|
||||
case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
|
||||
case 0xa32c ... 0xa343: /* 300 series */
|
||||
return true;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -518,6 +518,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
|
|||
if (obj && obj->type == ACPI_TYPE_INTEGER)
|
||||
*out_data = (u32) obj->integer.value;
|
||||
}
|
||||
kfree(output.pointer);
|
||||
return status;
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -26,18 +26,6 @@
|
|||
#include "iscsi_target_nego.h"
|
||||
#include "iscsi_target_auth.h"
|
||||
|
||||
static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
|
||||
{
|
||||
int j = DIV_ROUND_UP(len, 2), rc;
|
||||
|
||||
rc = hex2bin(dst, src, j);
|
||||
if (rc < 0)
|
||||
pr_debug("CHAP string contains non hex digit symbols\n");
|
||||
|
||||
dst[j] = '\0';
|
||||
return j;
|
||||
}
|
||||
|
||||
static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
|
||||
{
|
||||
int i;
|
||||
|
|
@ -240,9 +228,16 @@ static int chap_server_compute_md5(
|
|||
pr_err("Could not find CHAP_R.\n");
|
||||
goto out;
|
||||
}
|
||||
if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
|
||||
pr_err("Malformed CHAP_R\n");
|
||||
goto out;
|
||||
}
|
||||
if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
|
||||
pr_err("Malformed CHAP_R\n");
|
||||
goto out;
|
||||
}
|
||||
|
||||
pr_debug("[server] Got CHAP_R=%s\n", chap_r);
|
||||
chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
|
||||
|
||||
tfm = crypto_alloc_shash("md5", 0, 0);
|
||||
if (IS_ERR(tfm)) {
|
||||
|
|
@ -341,9 +336,7 @@ static int chap_server_compute_md5(
|
|||
pr_err("Could not find CHAP_C.\n");
|
||||
goto out;
|
||||
}
|
||||
pr_debug("[server] Got CHAP_C=%s\n", challenge);
|
||||
challenge_len = chap_string_to_hex(challenge_binhex, challenge,
|
||||
strlen(challenge));
|
||||
challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
|
||||
if (!challenge_len) {
|
||||
pr_err("Unable to convert incoming challenge\n");
|
||||
goto out;
|
||||
|
|
@ -352,6 +345,11 @@ static int chap_server_compute_md5(
|
|||
pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
|
||||
goto out;
|
||||
}
|
||||
if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
|
||||
pr_err("Malformed CHAP_C\n");
|
||||
goto out;
|
||||
}
|
||||
pr_debug("[server] Got CHAP_C=%s\n", challenge);
|
||||
/*
|
||||
* During mutual authentication, the CHAP_C generated by the
|
||||
* initiator must not match the original CHAP_C generated by
|
||||
|
|
|
|||
|
|
@ -31,6 +31,8 @@
|
|||
#include <asm/io.h>
|
||||
#include <asm/uaccess.h>
|
||||
|
||||
#include <linux/nospec.h>
|
||||
|
||||
#include <linux/kbd_kern.h>
|
||||
#include <linux/vt_kern.h>
|
||||
#include <linux/kbd_diacr.h>
|
||||
|
|
@ -703,6 +705,8 @@ int vt_ioctl(struct tty_struct *tty,
|
|||
if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
|
||||
ret = -ENXIO;
|
||||
else {
|
||||
vsa.console = array_index_nospec(vsa.console,
|
||||
MAX_NR_CONSOLES + 1);
|
||||
vsa.console--;
|
||||
console_lock();
|
||||
ret = vc_allocate(vsa.console);
|
||||
|
|
|
|||
|
|
@ -74,7 +74,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
|
|||
else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
|
||||
error_msg = "rec_len is too small for name_len";
|
||||
else if (unlikely(((char *) de - buf) + rlen > size))
|
||||
error_msg = "directory entry across range";
|
||||
error_msg = "directory entry overrun";
|
||||
else if (unlikely(le32_to_cpu(de->inode) >
|
||||
le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
|
||||
error_msg = "inode out of bounds";
|
||||
|
|
@ -83,18 +83,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
|
|||
|
||||
if (filp)
|
||||
ext4_error_file(filp, function, line, bh->b_blocknr,
|
||||
"bad entry in directory: %s - offset=%u(%u), "
|
||||
"inode=%u, rec_len=%d, name_len=%d",
|
||||
error_msg, (unsigned) (offset % size),
|
||||
offset, le32_to_cpu(de->inode),
|
||||
rlen, de->name_len);
|
||||
"bad entry in directory: %s - offset=%u, "
|
||||
"inode=%u, rec_len=%d, name_len=%d, size=%d",
|
||||
error_msg, offset, le32_to_cpu(de->inode),
|
||||
rlen, de->name_len, size);
|
||||
else
|
||||
ext4_error_inode(dir, function, line, bh->b_blocknr,
|
||||
"bad entry in directory: %s - offset=%u(%u), "
|
||||
"inode=%u, rec_len=%d, name_len=%d",
|
||||
error_msg, (unsigned) (offset % size),
|
||||
offset, le32_to_cpu(de->inode),
|
||||
rlen, de->name_len);
|
||||
"bad entry in directory: %s - offset=%u, "
|
||||
"inode=%u, rec_len=%d, name_len=%d, size=%d",
|
||||
error_msg, offset, le32_to_cpu(de->inode),
|
||||
rlen, de->name_len, size);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1768,6 +1768,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
|
|||
{
|
||||
int err, inline_size;
|
||||
struct ext4_iloc iloc;
|
||||
size_t inline_len;
|
||||
void *inline_pos;
|
||||
unsigned int offset;
|
||||
struct ext4_dir_entry_2 *de;
|
||||
|
|
@ -1795,8 +1796,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
|
|||
goto out;
|
||||
}
|
||||
|
||||
inline_len = ext4_get_inline_size(dir);
|
||||
offset = EXT4_INLINE_DOTDOT_SIZE;
|
||||
while (offset < dir->i_size) {
|
||||
while (offset < inline_len) {
|
||||
de = ext4_get_inline_entry(dir, &iloc, offset,
|
||||
&inline_pos, &inline_size);
|
||||
if (ext4_check_dir_entry(dir, NULL, de,
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue