Xie He
1aff51292e
drivers/net/wan: lapb: Corrected the usage of skb_cow ...
[ Upstream commit 8754e1379e7089516a449821f88e1fe1ebbae5e1 ]
This patch fixed 2 issues with the usage of skb_cow in LAPB drivers
"lapbether" and "hdlc_x25":
1) After skb_cow fails, kfree_skb should be called to drop a reference
to the skb. But in both drivers, kfree_skb is not called.
2) skb_cow should be called before skb_push so that is can ensure the
safety of skb_push. But in "lapbether", it is incorrectly called after
skb_push.
More details about these 2 issues:
1) The behavior of calling kfree_skb on failure is also the behavior of
netif_rx, which is called by this function with "return netif_rx(skb);".
So this function should follow this behavior, too.
2) In "lapbether", skb_cow is called after skb_push. This results in 2
logical issues:
a) skb_push is not protected by skb_cow;
b) An extra headroom of 1 byte is ensured after skb_push. This extra
headroom has no use in this function. It also has no use in the
upper-layer function that this function passes the skb to
(x25_lapb_receive_frame in net/x25/x25_dev.c).
So logically skb_cow should instead be called before skb_push.
Cc: Eric Dumazet <edumazet@google.com>
Cc: Martin Schiller <ms@dev.tdt.de>
Signed-off-by: Xie He <xie.he.0141@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-08-05 09:59:51 +02:00
ACPI: video: Use native backlight on Acer TravelMate 5735Z
2020-07-22 09:33:00 +02:00
binder: Don't use mmput() from shrinker function.
2020-07-29 10:18:41 +02:00
ata/libata: Fix usage of page address by page_address in ata_scsi_mode_select_xlat function
2020-06-30 15:37:03 -04:00
PM: wakeup: Show statistics for deleted wakeup sources again
2020-07-31 18:39:32 +02:00
Revert "zram: convert remaining CLASS_ATTR() to CLASS_ATTR_RO()"
2020-07-22 09:33:12 +02:00
Bluetooth: hci_bcm: fix freeing not-requested IRQ
2020-06-22 09:31:18 +02:00
bus: ti-sysc: Do not disable on suspend for no-idle
2020-07-22 09:33:01 +02:00
/dev/mem: Add missing memory barriers for devmem_inode
2020-07-29 10:18:43 +02:00
clk: qcom: gcc: Add missing UFS clocks for SM8150
2020-07-22 09:33:07 +02:00
arm64: arch_timer: Disable the compat vdso for cores affected by ARM64_WORKAROUND_1418040
2020-07-22 09:32:51 +02:00
cpufreq: Fix up cpufreq_boost_set_sw()
2020-06-17 16:40:33 +02:00
cpuidle: Fix three reference count leaks
2020-06-22 09:31:10 +02:00
crypto: ccp - Release all allocated memory if sha type is invalid
2020-08-05 09:59:40 +02:00
device-dax: don't leak kernel memory to user space after unloading kmem
2020-05-27 17:46:48 +02:00
dmaengine: ioat setting ioat timeout as module parameter
2020-07-29 10:18:37 +02:00
dmabuf: use spinlock to access dmabuf->name
2020-07-29 10:18:29 +02:00
EDAC/amd64: Read back the scrub rate PCI register on F15h
2020-07-09 09:37:49 +02:00
extcon: adc-jack: Fix an error handling path in 'adc_jack_probe()'
2020-06-24 17:50:36 +02:00
drivers/firmware/psci: Fix memory leakage in alloc_init_cpu_groups()
2020-07-29 10:18:28 +02:00
fpga: dfl: fix bug in port reset handshake
2020-07-29 10:18:31 +02:00
gnss: sirf: fix error return code in sirf_probe()
2020-06-22 09:31:20 +02:00
gpio: arizona: put pm_runtime in case of failure
2020-07-29 10:18:26 +02:00
drm: hold gem reference until object is no longer accessed
2020-08-05 09:59:44 +02:00
HID: apple: Disable Fn-key key-re-mapping on clone keyboards
2020-07-29 10:18:36 +02:00
Drivers: hv: vmbus: Always handle the VMBus messages on CPU0
2020-06-22 09:31:00 +02:00
hwmon: (scmi) Fix potential buffer overflow in scmi_hwmon_probe()
2020-07-29 10:18:39 +02:00
intel_th: Fix a NULL dereference when hub driver is not loaded
2020-07-22 09:33:15 +02:00
Revert "i2c: cadence: Fix the hold bit setting"
2020-08-05 09:59:50 +02:00
iio: adc: ad7780: Fix a resource handling path in 'ad7780_probe()'
2020-07-22 09:33:02 +02:00
IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE
2020-08-05 09:59:42 +02:00
Input: elan_i2c - only increment wakeup count on touch
2020-07-29 10:18:38 +02:00
irqdomain/treewide: Keep firmware node unconditionally allocated
2020-07-29 10:18:28 +02:00
ipack: tpci200: fix error return code in tpci200_register()
2020-05-27 17:46:47 +02:00
irqchip/gic: Atomically update affinity
2020-07-09 09:37:56 +02:00
drivers/macintosh: Fix memleak in windfarm_pm112 driver
2020-06-22 09:31:22 +02:00
mailbox: zynqmp-ipi: Fix NULL vs IS_ERR() check in zynqmp_ipi_mbox_probe()
2020-06-24 17:50:36 +02:00
dm integrity: fix integrity recalculation that is improperly skipped
2020-07-29 10:18:45 +02:00
media: rc: prevent memory leak in cx23888_ir_probe
2020-08-05 09:59:40 +02:00
scsi: mptscsih: Fix read sense data size
2020-07-16 08:16:36 +02:00
mfd: stmfx: Disable IRQ in suspend to avoid spurious interrupt
2020-06-24 17:50:33 +02:00
misc: atmel-ssc: lock with mutex instead of spinlock
2020-07-22 09:33:15 +02:00
mmc: sdhci-of-aspeed: Fix clock divider calculation
2020-07-29 10:18:44 +02:00
mtd: rawnand: oxnas: Release all devices in the _remove() path
2020-07-22 09:33:07 +02:00
drivers/net/wan: lapb: Corrected the usage of skb_cow
2020-08-05 09:59:51 +02:00
nfc: s3fwrn5: add missing release on skb in s3fwrn5_recv_frame
2020-08-05 09:59:50 +02:00
NTB: perf: Fix race condition when run with ntb_test
2020-06-24 17:50:41 +02:00
nvme-tcp: fix possible hang waiting for icresp response
2020-08-05 09:59:45 +02:00
nvmem: qfprom: remove incorrect write support
2020-06-10 20:24:57 +02:00
of: of_mdio: Correct loop scanning logic
2020-07-22 09:32:55 +02:00
PCI/ASPM: Disable ASPM on ASMedia ASM1083/1085 PCIe-to-PCI bridge
2020-08-05 09:59:41 +02:00
drivers/perf: Prevent forced unbinding of PMU drivers
2020-07-29 10:18:40 +02:00
phy: sun4i-usb: fix dereference of pointer phy0 before it is null checked
2020-07-22 09:33:01 +02:00
pinctrl: amd: fix npins for uart0 in kerncz_groups
2020-07-29 10:18:26 +02:00
platform/x86: asus-wmi: allow BAT1 battery name
2020-07-29 10:18:39 +02:00
power: supply: smb347-charger: IRQSTAT_D is volatile
2020-06-24 17:50:25 +02:00
pwm: jz4740: Fix build failure
2020-07-16 08:16:48 +02:00
rapidio: fix an error in get_user_pages_fast() error handling
2020-05-27 17:46:48 +02:00
regualtor: pfuze100: correct sw1a/sw2 on pfuze3000
2020-06-30 15:36:54 -04:00
remoteproc: qcom_q6v5_mss: map/unmap mpss segments before/after use
2020-06-24 17:50:13 +02:00
rtc: rv3028: Add missed check for devm_regmap_init_i2c()
2020-06-24 17:50:36 +02:00
s390/qeth: fix error handling for isolation mode cmds
2020-06-30 15:36:57 -04:00
scsi: core: Run queue in case of I/O resource contention failure
2020-08-05 09:59:50 +02:00
slimbus: core: Fix mismatch in of_node_get/put
2020-07-22 09:33:08 +02:00
soc: qcom: rpmh: Dirt can only make you dirtier, not cleaner
2020-07-29 10:18:25 +02:00
soundwire: intel: fix memory leak with devm_kasprintf
2020-07-22 09:33:00 +02:00
spi: mediatek: use correct SPI_CFG2_REG MACRO
2020-07-29 10:18:37 +02:00
staging: comedi: addi_apci_1564: check INSN_CONFIG_DIGITAL_TRIG shift
2020-07-29 10:18:42 +02:00
scsi: target: tcmu: Fix a use after free in tcmu_check_expired_queue_cmd()
2020-06-24 17:50:34 +02:00
thermal/drivers/cpufreq_cooling: Fix wrong frequency converted from power
2020-07-22 09:33:16 +02:00
vt: Reject zero-sized screen buffer size.
2020-07-29 10:18:43 +02:00
uio_pdrv_genirq: fix use without device tree and no interrupt
2020-07-22 09:33:13 +02:00
usb: xhci: Fix ASM2142/ASM3142 DMA addressing
2020-07-29 10:18:41 +02:00
vfio/mdev: Fix reference count leak in add_mdev_supported_type
2020-06-24 17:50:36 +02:00
vhost/scsi: fix up req type endian-ness
2020-08-05 09:59:42 +02:00
fbdev: Detect integer underflow at "struct fbcon_ops"->clear_margins.
2020-07-29 10:18:43 +02:00
virt: vbox: Fix guest capabilities mask check
2020-07-22 09:33:11 +02:00
virtio_balloon: fix up endian-ness for free cmd id
2020-08-05 09:59:43 +02:00
w1: omap-hdq: cleanup to add missing newline for some dev_dbg
2020-06-22 09:31:26 +02:00
watchdog: da9062: No need to ping manually before setting timeout
2020-06-24 17:50:32 +02:00
xen/pvcalls-back: test for errors when calling backend_connect()
2020-06-17 16:40:38 +02:00
1aff51292e