Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-12-03 17:41:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

HSI changes for the v4.12 series

Browse Source 
* double free fix in ssi-protocol
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAlkG7+0ACgkQ2O7X88g7
 +prDRA//dlNgAkwSyiRtX/DiBWPdIyMIvS7rJZzAr5WQaFLMP0EFhYUJ7YTona+c
 FV/yhXImYR+Uggl+I10rHgSnmejsV6Lp9wDauT1B5tdHR7CtlAxICiucxmtZ5Vmx
 +4lzM8Ftekd0hDSHCJYCJHkjIzPf0V6RhjuPEknBu+8JmpElXgOlhpahi6dHQdKk
 MR7GG9o8YKhATYb81wj+cH05J9zPkDJ+fGB82YCDj2+G+OhL2taMSQ8VHbZ7MRUv
 5/NaCwGNybGcdztXSXjYqEKYqm84M80DPi+QxWBab8/Z+0JlTgcJHPbOP2YLq3A5
 BcqEcMTQP3W0RZCHdhFxQhjC3X6LLD6T8FkSenox4Ck0YF+5Kbpb9vLEoKGqekiW
 WyDoEezk3kNz/LphYRYG2bxV3NG9ypYIH8feM9cHKPe5qs3pXh4jo1iTfePuYf0H
 HHEteKvHTYFTDo6tm1s30wOAKHWQK7yf/MSekVOaHhdReUxnhk+S2HDdQprSh5l6
 UuA1zSWGJ0qScb+NR0rB0hwJ8wbXUCujMIZjw5I/NrGcGmQ9IwlDpm1f0tciaYYn
 ptU+i3vldm9IPBYTANoXnaaKbasW/ShnqEbiWauUvmr73KpxPUrjhDHnDfENtrBa
 5xnFViHKALHeBGw1i66exGXy2O97xW6Jua1Chf0hmFIbkf7cl9g=
 =zFRo
 -----END PGP SIGNATURE-----

Merge tag 'hsi-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi

Pull HSI fix from Sebastian Reichel:
 "Fix double free fix in ssi-protocol"

* tag 'hsi-for-4.12' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi:
  HSI: ssi_protocol: double free in ssip_pn_xmit()
This commit is contained in:
Linus Torvalds 2017-05-01 13:04:39 -07:00
commit 5c6ba7d532
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/hsi/clients/ssi_protocol.c
View File

@ -980,7 +980,7 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev)
goto drop;
/* Pad to 32-bits - FIXME: Revisit*/
if ((skb->len & 3) && skb_pad(skb, 4 - (skb->len & 3)))
goto drop;
goto inc_dropped;
/*
* Modem sends Phonet messages over SSI with its own endianess...
@ -1032,8 +1032,9 @@ static int ssip_pn_xmit(struct sk_buff *skb, struct net_device *dev)
drop2:
hsi_free_msg(msg);
drop:
dev->stats.tx_dropped++;
dev_kfree_skb(skb);
inc_dropped:
dev->stats.tx_dropped++;
return 0;
}