A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'ASB-2023-07-05_11-5.4' of https://android.googlesource.com/kernel/common into android13-5.4-lahaina

Browse source 
https://source.android.com/docs/security/bulletin/2023-07-01
CVE-2022-42703
CVE-2023-21255
CVE-2023-25012

* tag 'ASB-2023-07-05_11-5.4' of https://android.googlesource.com/kernel/common:
  UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb
  UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow
  UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition
  BACKPORT: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
  ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
  UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl()
  ANDROID: HID; Over-ride default maximum buffer size when using UHID
  Revert "ANDROID: AVB error handler to invalidate vbmeta partition."
  UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
  UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
  UPSTREAM: efi: rt-wrapper: Add missing include
  BACKPORT: arm64: efi: Execute runtime services from a dedicated stack

Change-Id: I1f90844654d86b0a8507de963cb574813fdbf99b
This commit is contained in:
Michael Bestas 2023-07-11 15:34:28 +03:00
commit 6e1a4f94cd
No known key found for this signature in database
GPG key ID: CC95044519BE6669
18 changed files with 100 additions and 275 deletions
Download patch file Download diff file Expand all files Collapse all files

13
drivers/mailbox/mailbox-test.c
View file

@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/mailbox_client.h>
#include <linux/module.h>
#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/platform_device.h>
#include <linux/poll.h>
@ -38,6 +39,7 @@ struct mbox_test_device {
char *signal;
char *message;
spinlock_t lock;
struct mutex mutex;
wait_queue_head_t waitq;
struct fasync_struct *async_queue;
struct dentry *root_debugfs_dir;
@ -95,6 +97,7 @@ static ssize_t mbox_test_message_write(struct file *filp,
size_t count, loff_t *ppos)
{
struct mbox_test_device *tdev = filp->private_data;
char *message;
void *data;
int ret;
@ -110,10 +113,13 @@ static ssize_t mbox_test_message_write(struct file *filp,
return -EINVAL;
}
tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
if (!tdev->message)
message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
if (!message)
return -ENOMEM;
mutex_lock(&tdev->mutex);
tdev->message = message;
ret = copy_from_user(tdev->message, userbuf, count);
if (ret) {
ret = -EFAULT;
@ -144,6 +150,8 @@ out:
kfree(tdev->message);
tdev->signal = NULL;
mutex_unlock(&tdev->mutex);
return ret < 0 ? ret : count;
}
@ -392,6 +400,7 @@ static int mbox_test_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, tdev);
spin_lock_init(&tdev->lock);
mutex_init(&tdev->mutex);
if (tdev->rx_channel) {
tdev->rx_buffer = devm_kzalloc(&pdev->dev,