A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge tag 'LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

Browse source 
"LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0"

* tag 'LA.UM.9.14.r1-24900-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  qcedev: fix UAF in qcedev_smmu
  msm: cvp: OOB write fix due to integer underflow
  msm: eva: Adding kref count for cvp_get_inst_from_id
  msm: kgsl: Fix error handling during drawctxt switch
  msm_ipa: EoGRE Multi tunnel support
  usb: dwc3: Fix dwc3 version and revisions in remote wakeup path
  usb: gadget: f_cdev: Add remote wakeup capability from notify_serial_state
  power: reset: qcom-dload-mode: nodump mode error handling
  firmware: qcom_scm: Add a call for getting dload mode
  msm: kgsl: Fix error handling during drawctxt switch
  power: reset: qcom-dload-mode: support for nodump mode
  defconfig: sdxlemur: Enable nodump support for sdxlemur
  PCI: Disable L0s support for SDX65 with QPS615 on CPE platform
  msm: adsprpc: use-after-free (UAF) in global maps
  UPSTREAM: xhci: prepare for operation without shared HCD
  rpmsg: glink: Get reference of channel objects in rx path
  msm_ipa: Tunnel Config structure changes
  soc: qcom: mdt_loader: add bound checks for headers
  BACKPORT: media: venus: hfi: add checks in capabilities from firmware

Change-Id: Idae516c9223cb306b362ad22f031735cd856d59f
This commit is contained in:
Michael Bestas 2024-08-05 21:53:23 +03:00
commit ea1c711e8f
No known key found for this signature in database
GPG key ID: CC95044519BE6669
21 changed files with 387 additions and 220 deletions
Download patch file Download diff file Expand all files Collapse all files

6
drivers/crypto/msm/qcedev_smmu.c
View file

@ -350,8 +350,12 @@ int qcedev_check_and_map_buffer(void *handle,
return 0;
unmap:
if (!found)
if (!found) {
qcedev_unmap_buffer(handle, mem_client, binfo);
mutex_lock(&qce_hndl->registeredbufs.lock);
list_del(&binfo->list);
mutex_unlock(&qce_hndl->registeredbufs.lock);
}
error:
kfree(binfo);