A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 20:33:58 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "Merge android11-5.4.161+ (5d7a491) into msm-5.4"

Browse source
This commit is contained in:
qctecmdr 2022-03-09 20:19:56 -08:00 • committed by Gerrit - the friendly Code Review server
commit c33437e770
21 changed files with 2010 additions and 2010 deletions
Download patch file Download diff file Expand all files Collapse all files

2
android/GKI_VERSION
View file

@ -1 +1 @@
LTS_5.4.161_b9d179c605d3
LTS_5.4.161_5d7a491ae4a7

3714
android/abi_gki_aarch64.xml
View file

File diff suppressed because it is too large Load diff

5
android/abi_gki_aarch64_db845c
View file

@ -583,6 +583,7 @@
__kfifo_alloc
__kfifo_free
kmalloc_order_trace
ktime_get_with_offset
__local_bh_enable_ip
memmove
param_ops_ulong
@ -590,6 +591,7 @@
__rcu_read_lock
__rcu_read_unlock
regulatory_hint
rfc1042_header
skb_copy
skb_realloc_headroom
strlcat
@ -660,6 +662,7 @@
phy_pm_runtime_get_sync
phy_pm_runtime_put_sync
platform_get_irq_byname_optional
pm_runtime_barrier
system_freezable_wq
usb_add_gadget_udc
usb_decode_ctrl
@ -733,7 +736,6 @@
generic_file_read_iter
generic_file_splice_read
generic_read_dir
generic_shutdown_super
__get_free_pages
get_zeroed_page
iget5_locked
@ -745,6 +747,7 @@
kernel_read
kernel_write
kern_path
kill_anon_super
kobject_create_and_add
kobject_put
lockref_get

1
arch/arm64/configs/gki_defconfig
View file

@ -317,6 +317,7 @@ CONFIG_SERIAL_8250=y
# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
CONFIG_SERIAL_8250_CONSOLE=y
# CONFIG_SERIAL_8250_EXAR is not set
CONFIG_SERIAL_8250_RUNTIME_UARTS=0
CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_AMBA_PL011=y
CONFIG_SERIAL_AMBA_PL011_CONSOLE=y

1
arch/x86/configs/gki_defconfig
View file

@ -290,6 +290,7 @@ CONFIG_INPUT_UINPUT=y
CONFIG_SERIAL_8250=y
# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
CONFIG_SERIAL_8250_CONSOLE=y
CONFIG_SERIAL_8250_RUNTIME_UARTS=0
CONFIG_SERIAL_OF_PLATFORM=y
CONFIG_SERIAL_DEV_BUS=y
CONFIG_HW_RANDOM=y

2
arch/x86/include/asm/setup.h
View file

@ -4,7 +4,7 @@
#include <uapi/asm/setup.h>
#define COMMAND_LINE_SIZE 2048
#define COMMAND_LINE_SIZE 4096
#include <linux/linkage.h>
#include <asm/page_types.h>

2
drivers/android/binder_alloc.c
View file

@ -662,7 +662,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc,
BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size);
if (buffer->async_transaction) {
alloc->free_async_space += size + sizeof(struct binder_buffer);
alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_free_buf size %zd async free %zd\n",

177
drivers/tee/tee_shm.c
View file

@ -1,26 +1,18 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2015-2016, Linaro Limited
* Copyright (c) 2015-2017, 2019-2021 Linaro Limited
*/
#include <linux/anon_inodes.h>
#include <linux/device.h>
#include <linux/dma-buf.h>
#include <linux/fdtable.h>
#include <linux/idr.h>
#include <linux/mm.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/tee_drv.h>
#include "tee_private.h"
static void tee_shm_release(struct tee_shm *shm)
static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
{
struct tee_device *teedev = shm->teedev;
mutex_lock(&teedev->mutex);
idr_remove(&teedev->idr, shm->id);
if (shm->ctx)
list_del(&shm->link);
mutex_unlock(&teedev->mutex);
if (shm->flags & TEE_SHM_POOL) {
struct tee_shm_pool_mgr *poolm;
@ -52,51 +44,6 @@ static void tee_shm_release(struct tee_shm *shm)
tee_device_put(teedev);
}
static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
*attach, enum dma_data_direction dir)
{
return NULL;
}
static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
struct sg_table *table,
enum dma_data_direction dir)
{
}
static void tee_shm_op_release(struct dma_buf *dmabuf)
{
struct tee_shm *shm = dmabuf->priv;
tee_shm_release(shm);
}
static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum)
{
return NULL;
}
static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
{
struct tee_shm *shm = dmabuf->priv;
size_t size = vma->vm_end - vma->vm_start;
/* Refuse sharing shared memory provided by application */
if (shm->flags & TEE_SHM_REGISTER)
return -EINVAL;
return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
size, vma->vm_page_prot);
}
static const struct dma_buf_ops tee_shm_dma_buf_ops = {
.map_dma_buf = tee_shm_op_map_dma_buf,
.unmap_dma_buf = tee_shm_op_unmap_dma_buf,
.release = tee_shm_op_release,
.map = tee_shm_op_map,
.mmap = tee_shm_op_mmap,
};
static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
struct tee_device *teedev,
size_t size, u32 flags)
@ -137,6 +84,7 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
goto err_dev_put;
}
refcount_set(&shm->refcount, 1);
shm->flags = flags | TEE_SHM_POOL;
shm->teedev = teedev;
shm->ctx = ctx;
@ -159,21 +107,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
goto err_pool_free;
}
if (flags & TEE_SHM_DMA_BUF) {
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
exp_info.ops = &tee_shm_dma_buf_ops;
exp_info.size = shm->size;
exp_info.flags = O_RDWR;
exp_info.priv = shm;
shm->dmabuf = dma_buf_export(&exp_info);
if (IS_ERR(shm->dmabuf)) {
ret = ERR_CAST(shm->dmabuf);
goto err_rem;
}
}
if (ctx) {
teedev_ctx_get(ctx);
mutex_lock(&teedev->mutex);
@ -182,10 +115,6 @@ static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
}
return shm;
err_rem:
mutex_lock(&teedev->mutex);
idr_remove(&teedev->idr, shm->id);
mutex_unlock(&teedev->mutex);
err_pool_free:
poolm->ops->free(poolm, shm);
err_kfree:
@ -268,6 +197,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
goto err;
}
refcount_set(&shm->refcount, 1);
shm->flags = flags | TEE_SHM_REGISTER;
shm->teedev = teedev;
shm->ctx = ctx;
@ -309,22 +239,6 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
goto err;
}
if (flags & TEE_SHM_DMA_BUF) {
DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
exp_info.ops = &tee_shm_dma_buf_ops;
exp_info.size = shm->size;
exp_info.flags = O_RDWR;
exp_info.priv = shm;
shm->dmabuf = dma_buf_export(&exp_info);
if (IS_ERR(shm->dmabuf)) {
ret = ERR_CAST(shm->dmabuf);
teedev->desc->ops->shm_unregister(ctx, shm);
goto err;
}
}
mutex_lock(&teedev->mutex);
list_add_tail(&shm->link, &ctx->list_shm);
mutex_unlock(&teedev->mutex);
@ -352,6 +266,35 @@ err:
}
EXPORT_SYMBOL_GPL(tee_shm_register);
static int tee_shm_fop_release(struct inode *inode, struct file *filp)
{
tee_shm_put(filp->private_data);
return 0;
}
static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma)
{
struct tee_shm *shm = filp->private_data;
size_t size = vma->vm_end - vma->vm_start;
/* Refuse sharing shared memory provided by application */
if (shm->flags & TEE_SHM_USER_MAPPED)
return -EINVAL;
/* check for overflowing the buffer's size */
if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
return -EINVAL;
return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
size, vma->vm_page_prot);
}
static const struct file_operations tee_shm_fops = {
.owner = THIS_MODULE,
.release = tee_shm_fop_release,
.mmap = tee_shm_fop_mmap,
};
/**
* tee_shm_get_fd() - Increase reference count and return file descriptor
* @shm: Shared memory handle
@ -364,10 +307,11 @@ int tee_shm_get_fd(struct tee_shm *shm)
if (!(shm->flags & TEE_SHM_DMA_BUF))
return -EINVAL;
get_dma_buf(shm->dmabuf);
fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
/* matched by tee_shm_put() in tee_shm_op_release() */
refcount_inc(&shm->refcount);
fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
if (fd < 0)
dma_buf_put(shm->dmabuf);
tee_shm_put(shm);
return fd;
}
@ -377,17 +321,7 @@ int tee_shm_get_fd(struct tee_shm *shm)
*/
void tee_shm_free(struct tee_shm *shm)
{
/*
* dma_buf_put() decreases the dmabuf reference counter and will
* call tee_shm_release() when the last reference is gone.
*
* In the case of driver private memory we call tee_shm_release
* directly instead as it doesn't have a reference counter.
*/
if (shm->flags & TEE_SHM_DMA_BUF)
dma_buf_put(shm->dmabuf);
else
tee_shm_release(shm);
tee_shm_put(shm);
}
EXPORT_SYMBOL_GPL(tee_shm_free);
@ -494,10 +428,15 @@ struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
teedev = ctx->teedev;
mutex_lock(&teedev->mutex);
shm = idr_find(&teedev->idr, id);
/*
* If the tee_shm was found in the IDR it must have a refcount
* larger than 0 due to the guarantee in tee_shm_put() below. So
* it's safe to use refcount_inc().
*/
if (!shm || shm->ctx != ctx)
shm = ERR_PTR(-EINVAL);
else if (shm->flags & TEE_SHM_DMA_BUF)
get_dma_buf(shm->dmabuf);
else
refcount_inc(&shm->refcount);
mutex_unlock(&teedev->mutex);
return shm;
}
@ -509,7 +448,25 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
*/
void tee_shm_put(struct tee_shm *shm)
{
if (shm->flags & TEE_SHM_DMA_BUF)
dma_buf_put(shm->dmabuf);
struct tee_device *teedev = shm->teedev;
bool do_release = false;
mutex_lock(&teedev->mutex);
if (refcount_dec_and_test(&shm->refcount)) {
/*
* refcount has reached 0, we must now remove it from the
* IDR before releasing the mutex. This will guarantee that
* the refcount_inc() in tee_shm_get_from_id() never starts
* from 0.
*/
idr_remove(&teedev->idr, shm->id);
if (shm->ctx)
list_del(&shm->link);
do_release = true;
}
mutex_unlock(&teedev->mutex);
if (do_release)
tee_shm_release(teedev, shm);
}
EXPORT_SYMBOL_GPL(tee_shm_put);

3
drivers/usb/gadget/composite.c
View file

@ -2004,6 +2004,9 @@ unknown:
if (w_index != 0x5 || (w_value >> 8))
break;
interface = w_value & 0xFF;
if (interface >= MAX_CONFIG_INTERFACES ||
!os_desc_cfg->interface[interface])
break;
buf[6] = w_index;
count = count_ext_prop(os_desc_cfg,
interface);

9
drivers/usb/gadget/function/rndis.c
View file

@ -637,14 +637,17 @@ static int rndis_set_response(struct rndis_params *params,
rndis_set_cmplt_type *resp;
rndis_resp_t *r;
BufLength = le32_to_cpu(buf->InformationBufferLength);
BufOffset = le32_to_cpu(buf->InformationBufferOffset);
if ((BufLength > RNDIS_MAX_TOTAL_SIZE) ||
(BufOffset + 8 >= RNDIS_MAX_TOTAL_SIZE))
return -EINVAL;
r = rndis_add_response(params, sizeof(rndis_set_cmplt_type));
if (!r)
return -ENOMEM;
resp = (rndis_set_cmplt_type *)r->buf;
BufLength = le32_to_cpu(buf->InformationBufferLength);
BufOffset = le32_to_cpu(buf->InformationBufferOffset);
#ifdef VERBOSE_DEBUG
pr_debug("%s: Length: %d\n", __func__, BufLength);
pr_debug("%s: Offset: %d\n", __func__, BufOffset);

5
fs/f2fs/data.c
View file

@ -2581,6 +2581,11 @@ bool f2fs_should_update_outplace(struct inode *inode, struct f2fs_io_info *fio)
{
struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
/* The below cases were checked when setting it. */
if (f2fs_is_pinned_file(inode))
return false;
if (fio && is_sbi_flag_set(sbi, SBI_NEED_FSCK))
return true;
if (f2fs_lfs_mode(sbi))
return true;
if (S_ISDIR(inode->i_mode))

10
fs/f2fs/file.c
View file

@ -3235,17 +3235,17 @@ static int f2fs_ioc_set_pin_file(struct file *filp, unsigned long arg)
inode_lock(inode);
if (f2fs_should_update_outplace(inode, NULL)) {
ret = -EINVAL;
goto out;
}
if (!pin) {
clear_inode_flag(inode, FI_PIN_FILE);
f2fs_i_gc_failures_write(inode, 0);
goto done;
}
if (f2fs_should_update_outplace(inode, NULL)) {
ret = -EINVAL;
goto out;
}
if (f2fs_pin_file_control(inode, false)) {
ret = -EAGAIN;
goto out;

58
fs/incfs/vfs.c
View file

@ -319,6 +319,7 @@ static struct mount_info *get_mount_info(struct super_block *sb)
{
struct mount_info *result = sb->s_fs_info;
WARN_ON(!result);
return result;
}
@ -677,7 +678,7 @@ static int iterate_incfs_dir(struct file *file, struct dir_context *ctx)
struct mount_info *mi = get_mount_info(file_superblock(file));
bool root;
if (!dir || !mi) {
if (!dir) {
error = -EBADF;
goto out;
}
@ -1841,9 +1842,6 @@ static int dir_rename(struct inode *old_dir, struct dentry *old_dentry,
struct dentry *trap;
int error = 0;
if (!mi)
return -EBADF;
error = mutex_lock_interruptible(&mi->mi_dir_struct_mutex);
if (error)
return error;
@ -2091,9 +2089,6 @@ static ssize_t incfs_getxattr(struct dentry *d, const char *name,
char *stored_value;
size_t stored_size;
if (!mi)
return -EBADF;
if (di && di->backing_path.dentry)
return vfs_getxattr(di->backing_path.dentry, name, value, size);
@ -2130,9 +2125,6 @@ static ssize_t incfs_setxattr(struct dentry *d, const char *name,
void **stored_value;
size_t *stored_size;
if (!mi)
return -EBADF;
if (di && di->backing_path.dentry)
return vfs_setxattr(di->backing_path.dentry, name, value, size,
flags);
@ -2173,11 +2165,6 @@ static ssize_t incfs_listxattr(struct dentry *d, char *list, size_t size)
return vfs_listxattr(di->backing_path.dentry, list, size);
}
static int incfs_test_super(struct super_block *s, void *p)
{
return s->s_fs_info != NULL;
}
struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
const char *dev_name, void *data)
{
@ -2187,8 +2174,7 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
struct dentry *index_dir;
struct super_block *src_fs_sb = NULL;
struct inode *root_inode = NULL;
struct super_block *sb = sget(type, incfs_test_super, set_anon_super,
flags, NULL);
struct super_block *sb = sget(type, NULL, set_anon_super, flags, NULL);
int error = 0;
if (IS_ERR(sb))
@ -2229,18 +2215,13 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
src_fs_sb = backing_dir_path.dentry->d_sb;
sb->s_maxbytes = src_fs_sb->s_maxbytes;
if (!sb->s_fs_info) {
mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path);
mi = incfs_alloc_mount_info(sb, &options, &backing_dir_path);
if (IS_ERR_OR_NULL(mi)) {
error = PTR_ERR(mi);
pr_err("incfs: Error allocating mount info. %d\n", error);
mi = NULL;
goto err;
}
sb->s_fs_info = mi;
} else {
mi = sb->s_fs_info;
if (IS_ERR_OR_NULL(mi)) {
error = PTR_ERR(mi);
pr_err("incfs: Error allocating mount info. %d\n", error);
mi = NULL;
goto err;
}
index_dir = open_or_create_index_dir(backing_dir_path.dentry);
@ -2252,22 +2233,21 @@ struct dentry *incfs_mount_fs(struct file_system_type *type, int flags,
}
mi->mi_index_dir = index_dir;
sb->s_fs_info = mi;
root_inode = fetch_regular_inode(sb, backing_dir_path.dentry);
if (IS_ERR(root_inode)) {
error = PTR_ERR(root_inode);
goto err;
}
sb->s_root = d_make_root(root_inode);
if (!sb->s_root) {
sb->s_root = d_make_root(root_inode);
if (!sb->s_root) {
error = -ENOMEM;
goto err;
}
error = incfs_init_dentry(sb->s_root, &backing_dir_path);
if (error)
goto err;
error = -ENOMEM;
goto err;
}
error = incfs_init_dentry(sb->s_root, &backing_dir_path);
if (error)
goto err;
path_put(&backing_dir_path);
sb->s_flags |= SB_ACTIVE;
@ -2288,9 +2268,6 @@ static int incfs_remount_fs(struct super_block *sb, int *flags, char *data)
struct mount_info *mi = get_mount_info(sb);
int err = 0;
if (!mi)
return err;
sync_filesystem(sb);
err = parse_options(&options, (char *)data);
if (err)
@ -2318,9 +2295,6 @@ static int show_options(struct seq_file *m, struct dentry *root)
{
struct mount_info *mi = get_mount_info(root->d_sb);
if (!mi)
return -EBADF;
seq_printf(m, ",read_timeout_ms=%u", mi->mi_options.read_timeout_ms);
seq_printf(m, ",readahead=%u", mi->mi_options.readahead_pages);
if (mi->mi_options.read_log_pages != 0) {

3
fs/tracefs/inode.c
View file

@ -427,8 +427,7 @@ static struct dentry *__create_dir(const char *name, struct dentry *parent,
if (unlikely(!inode))
return failed_creating(dentry);
/* Do not set bits for OTH */
inode->i_mode = S_IFDIR | S_IRWXU | S_IRUSR| S_IRGRP | S_IXUSR | S_IXGRP;
inode->i_mode = S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO;
inode->i_op = ops;
inode->i_fop = &simple_dir_operations;

4
include/linux/tee_drv.h
View file

@ -178,7 +178,7 @@ void tee_device_unregister(struct tee_device *teedev);
* @offset: offset of buffer in user space
* @pages: locked pages from userspace
* @num_pages: number of locked pages
* @dmabuf: dmabuf used to for exporting to user space
* @refcount: reference counter
* @flags: defined by TEE_SHM_* in tee_drv.h
* @id: unique id of a shared memory object on this device
*
@ -195,7 +195,7 @@ struct tee_shm {
unsigned int offset;
struct page **pages;
size_t num_pages;
struct dma_buf *dmabuf;
refcount_t refcount;
u32 flags;
int id;
};

4
kernel/bpf/devmap.c
View file

@ -94,7 +94,7 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries,
int i;
struct hlist_head *hash;
hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node);
hash = bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node);
if (hash != NULL)
for (i = 0; i < entries; i++)
INIT_HLIST_HEAD(&hash[i]);
@ -159,7 +159,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr)
spin_lock_init(&dtab->index_lock);
} else {
dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries *
dtab->netdev_map = bpf_map_area_alloc((u64) dtab->map.max_entries *
sizeof(struct bpf_dtab_netdev *),
dtab->map.numa_node);
if (!dtab->netdev_map)

14
kernel/cgroup/cgroup-v1.c
View file

@ -552,6 +552,14 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of,
BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
/*
* Release agent gets called with all capabilities,
* require capabilities to set release agent.
*/
if ((of->file->f_cred->user_ns != &init_user_ns) ||
!capable(CAP_SYS_ADMIN))
return -EPERM;
cgrp = cgroup_kn_lock_live(of->kn, false);
if (!cgrp)
return -ENODEV;
@ -964,6 +972,12 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
/* Specifying two release agents is forbidden */
if (ctx->release_agent)
return cg_invalf(fc, "cgroup1: release_agent respecified");
/*
* Release agent gets called with all capabilities,
* require capabilities to set release agent.
*/
if ((fc->user_ns != &init_user_ns) || !capable(CAP_SYS_ADMIN))
return cg_invalf(fc, "cgroup1: Setting release_agent not allowed");
ctx->release_agent = param->string;
param->string = NULL;
break;

2
lib/iov_iter.c
View file

@ -398,6 +398,7 @@ static size_t copy_page_to_iter_pipe(struct page *page, size_t offset, size_t by
return 0;
pipe->nrbufs++;
buf->ops = &page_cache_pipe_buf_ops;
buf->flags = 0;
get_page(buf->page = page);
buf->offset = offset;
buf->len = bytes;
@ -524,6 +525,7 @@ static size_t push_pipe(struct iov_iter *i, size_t size,
break;
pipe->nrbufs++;
pipe->bufs[idx].ops = &default_pipe_buf_ops;
pipe->bufs[idx].flags = 0;
pipe->bufs[idx].page = page;
pipe->bufs[idx].offset = 0;
if (left <= PAGE_SIZE) {

2
net/core/sock_map.c
View file

@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr)
if (err)
goto free_stab;
stab->sks = bpf_map_area_alloc(stab->map.max_entries *
stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries *
sizeof(struct sock *),
stab->map.numa_node);
if (stab->sks)

10
net/tipc/link.c
View file

@ -1953,15 +1953,18 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
u16 peers_tol = msg_link_tolerance(hdr);
u16 peers_prio = msg_linkprio(hdr);
u16 rcv_nxt = l->rcv_nxt;
u16 dlen = msg_data_sz(hdr);
u32 dlen = msg_data_sz(hdr), glen = 0;
int mtyp = msg_type(hdr);
bool reply = msg_probe(hdr);
u16 glen = 0;
void *data;
char *if_name;
int rc = 0;
trace_tipc_proto_rcv(skb, false, l->name);
if (dlen > U16_MAX)
goto exit;
if (tipc_link_is_blocked(l) || !xmitq)
goto exit;
@ -2063,7 +2066,8 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
if (glen != tipc_gap_ack_blks_sz(ga->gack_cnt))
ga = NULL;
}
if(glen > dlen)
break;
tipc_mon_rcv(l->net, data + glen, dlen - glen, l->addr,
&l->mon_state, l->bearer_id);

2
net/tipc/monitor.c
View file

@ -457,6 +457,8 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
state->probing = false;
/* Sanity check received domain record */
if (new_member_cnt > MAX_MON_DOMAIN)
return;
if (dlen < dom_rec_len(arrv_dom, 0))
return;
if (dlen != dom_rec_len(arrv_dom, new_member_cnt))