A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'ASB-2024-09-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

Browse source 
https://source.android.com/docs/security/bulletin/2024-09-01
CVE-2024-36972

* tag 'ASB-2024-09-05_11-5.4' of https://android.googlesource.com/kernel/common: (59 commits)
  ANDROID: delete tool added by mistake
  ANDROID: fix ENOMEM check of binder_proc_ext
  ANDROID: binder: fix KMI issues due to frozen notification
  BACKPORT: FROMGIT: binder: frozen notification binder_features flag
  BACKPORT: FROMGIT: binder: frozen notification
  BACKPORT: selftests/binderfs: add test for feature files
  UPSTREAM: docs: binderfs: add section about feature files
  BACKPORT: binderfs: add support for feature files
  FROMLIST: binder: fix memory leaks of spam and pending work
  FROMGIT: Binder: add TF_UPDATE_TXN to replace outdated txn
  BACKPORT: binder: tell userspace to dump current backtrace when detected oneway spamming
  UPSTREAM: net: sched: sch_multiq: fix possible OOB write in multiq_tune()
  FROMLIST: binder: fix UAF caused by offsets overwrite
  Revert "net: mac802154: Fix racy device stats updates by DEV_STATS_INC() and DEV_STATS_ADD()"
  Linux 5.4.281
  tap: add missing verification for short frame
  tun: add missing verification for short frame
  filelock: Fix fcntl/close race recovery compat path
  ALSA: hda/realtek: Enable headset mic on Positivo SU C1400
  jfs: don't walk off the end of ealist
  ...

 Conflicts:
	drivers/android/binder.c
	include/uapi/linux/android/binder.h

Change-Id: I0cdb84a8241c0abaf6e5fad140ed19480655d53c
This commit is contained in:
Michael Bestas 2024-10-01 11:09:58 +03:00 • committed by Alexander Winkowski
commit 123d88374f
No known key found for this signature in database
GPG key ID: 72762A66704CDE44
50 changed files with 705 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

8
net/wireless/scan.c
View file

@ -2212,10 +2212,14 @@ int cfg80211_wext_siwscan(struct net_device *dev,
wiphy = &rdev->wiphy;
/* Determine number of channels, needed to allocate creq */
if (wreq && wreq->num_channels)
if (wreq && wreq->num_channels) {
/* Passed from userspace so should be checked */
if (unlikely(wreq->num_channels > IW_MAX_FREQUENCIES))
return -EINVAL;
n_channels = wreq->num_channels;
else
} else {
n_channels = ieee80211_get_num_supported_channels(wiphy);
}
creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
n_channels * sizeof(void *),