Commit da940012 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'char-misc-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 

Pull char/misc driver fixes from Greg KH:
 "Here are some small char/misc driver fixes for 5.4-rc3.

  Nothing huge here. Some binder driver fixes (although it is still
  being discussed if these all fix the reported issues or not, so more
  might be coming later), some mei device ids and fixes, and a google
  firmware driver bugfix that fixes a regression, as well as some other
  tiny fixes.

  All have been in linux-next with no reported issues"

* tag 'char-misc-5.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  firmware: google: increment VPD key_len properly
  w1: ds250x: Fix build error without CRC16
  virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
  binder: Fix comment headers on binder_alloc_prepare_to_free()
  binder: prevent UAF read in print_binder_transaction_log_entry()
  misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach
  mei: avoid FW version request on Ibex Peak and earlier
  mei: me: add comet point (lake) LP device ids
parents 9cbc6348 442f1e74

drivers/android/binder.c

+3 −1
Original line number Diff line number Diff line
@@ -57,6 +57,7 @@ 
#include <linux/sched/signal.h>

#include <linux/sched/mm.h>

#include <linux/seq_file.h>

#include <linux/string.h>

#include <linux/uaccess.h>

#include <linux/pid_namespace.h>

#include <linux/security.h>
@@ -66,6 +67,7 @@ 
#include <linux/task_work.h>



#include <uapi/linux/android/binder.h>

#include <uapi/linux/android/binderfs.h>



#include <asm/cacheflush.h>
@@ -2876,7 +2878,7 @@ static void binder_transaction(struct binder_proc *proc, 
	e->target_handle = tr->target.handle;

	e->data_size = tr->data_size;

	e->offsets_size = tr->offsets_size;

	e->context_name = proc->context->name;

	strscpy(e->context_name, proc->context->name, BINDERFS_MAX_NAME);



	if (reply) {

		binder_inner_proc_lock(proc);

drivers/android/binder_alloc.c

+1 −1
Original line number Diff line number Diff line
@@ -156,7 +156,7 @@ static struct binder_buffer *binder_alloc_prepare_to_free_locked( 
}



/**

 * binder_alloc_buffer_lookup() - get buffer given user ptr

 * binder_alloc_prepare_to_free() - get buffer given user ptr

 * @alloc:	binder_alloc for this proc

 * @user_ptr:	User pointer to buffer data

 *

drivers/android/binder_internal.h

+1 −1
Original line number Diff line number Diff line
@@ -130,7 +130,7 @@ struct binder_transaction_log_entry { 
	int return_error_line;

	uint32_t return_error;

	uint32_t return_error_param;

	const char *context_name;

	char context_name[BINDERFS_MAX_NAME + 1];

};



struct binder_transaction_log {

drivers/firmware/google/vpd_decode.c

+1 −1
Original line number Diff line number Diff line
@@ -52,7 +52,7 @@ static int vpd_decode_entry(const u32 max_len, const u8 *input_buf, 
	if (max_len - consumed < *entry_len)

		return VPD_FAIL;



	consumed += decoded_len;

	consumed += *entry_len;

	*_consumed = consumed;

	return VPD_OK;

}

drivers/misc/fastrpc.c

+1 −0
Original line number Diff line number Diff line
@@ -527,6 +527,7 @@ static int fastrpc_dma_buf_attach(struct dma_buf *dmabuf, 
			      FASTRPC_PHYS(buffer->phys), buffer->size);

	if (ret < 0) {

		dev_err(buffer->dev, "failed to get scatterlist from DMA API\n");

		kfree(a);

		return -EINVAL;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE