Char/Misc fixes for 4.15-rc8
Here are two bugfixes for some driver bugs for 4.15-rc8 The first is a bluetooth security bug that has been ignored by the Bluetooth developers for months for no obvious reason at all, so I've taken it through my tree. The second is a simple double-free bug in the mux subsystem. Both have been in linux-next for a while with no reported issues. Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> -----BEGIN PGP SIGNATURE----- iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCWlppww8cZ3JlZ0Brcm9h aC5jb20ACgkQMUfUDdst+ylnwgCeOrW4MKzAG9nc+ZWKRw5CeWVqx9AAoLyQeiF6 KyLdQ6C2GiSRHtz7memv =Zbvd -----END PGP SIGNATURE----- Merge tag 'char-misc-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc fixes from Greg KH: "Here are two bugfixes for some driver bugs for 4.15-rc8 The first is a bluetooth security bug that has been ignored by the Bluetooth developers for months for no obvious reason at all, so I've taken it through my tree. The second is a simple double-free bug in the mux subsystem. Both have been in linux-next for a while with no reported issues" * tag 'char-misc-4.15-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: mux: core: fix double get_device() Bluetooth: Prevent stack info leak from the EFS element.
This commit is contained in:
commit
9e8f8f1ef4
|
@ -413,6 +413,7 @@ static int of_dev_node_match(struct device *dev, const void *data)
|
|||
return dev->of_node == data;
|
||||
}
|
||||
|
||||
/* Note this function returns a reference to the mux_chip dev. */
|
||||
static struct mux_chip *of_find_mux_chip_by_node(struct device_node *np)
|
||||
{
|
||||
struct device *dev;
|
||||
|
@ -466,6 +467,7 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
|
|||
(!args.args_count && (mux_chip->controllers > 1))) {
|
||||
dev_err(dev, "%pOF: wrong #mux-control-cells for %pOF\n",
|
||||
np, args.np);
|
||||
put_device(&mux_chip->dev);
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
|
||||
|
@ -476,10 +478,10 @@ struct mux_control *mux_control_get(struct device *dev, const char *mux_name)
|
|||
if (controller >= mux_chip->controllers) {
|
||||
dev_err(dev, "%pOF: bad mux controller %u specified in %pOF\n",
|
||||
np, controller, args.np);
|
||||
put_device(&mux_chip->dev);
|
||||
return ERR_PTR(-EINVAL);
|
||||
}
|
||||
|
||||
get_device(&mux_chip->dev);
|
||||
return &mux_chip->mux[controller];
|
||||
}
|
||||
EXPORT_SYMBOL_GPL(mux_control_get);
|
||||
|
|
|
@ -3363,9 +3363,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data
|
|||
break;
|
||||
|
||||
case L2CAP_CONF_EFS:
|
||||
if (olen == sizeof(efs)) {
|
||||
remote_efs = 1;
|
||||
if (olen == sizeof(efs))
|
||||
memcpy(&efs, (void *) val, olen);
|
||||
}
|
||||
break;
|
||||
|
||||
case L2CAP_CONF_EWS:
|
||||
|
@ -3584,7 +3585,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
|
|||
break;
|
||||
|
||||
case L2CAP_CONF_EFS:
|
||||
if (olen == sizeof(efs))
|
||||
if (olen == sizeof(efs)) {
|
||||
memcpy(&efs, (void *)val, olen);
|
||||
|
||||
if (chan->local_stype != L2CAP_SERV_NOTRAFIC &&
|
||||
|
@ -3594,6 +3595,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len,
|
|||
|
||||
l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs),
|
||||
(unsigned long) &efs, endptr - ptr);
|
||||
}
|
||||
break;
|
||||
|
||||
case L2CAP_CONF_FCS:
|
||||
|
|
Loading…
Reference in New Issue