Pull char/misc driver fixes from Greg KH: "Here are five small bugfixes for reported issues with 4.12-rc1 and earlier kernels. Nothing huge here, just a lp, mem, vpd, and uio driver fix, along with a Kconfig fixup for one of the misc drivers. All of these have been in linux-next with no reported issues" * tag 'char-misc-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: firmware: Google VPD: Fix memory allocation error handling drivers: char: mem: Check for address space wraparound with mmap() uio: fix incorrect memory leak cleanup misc: pci_endpoint_test: select CRC32 char: lp: fix possible integer overflow in lp_setup()
Unified · Split
| @@ -859,7 +859,11 @@ static int __init lp_setup (char *str) · 858 unmodified lines | ||
| 859 | 859 | } else if (!strcmp(str, "auto")) { |
| 860 | 860 | parport_nr[0] = LP_PARPORT_AUTO; |
| 861 | 861 | } else if (!strcmp(str, "none")) { |
| 862 | − parport_nr[parport_ptr++] = LP_PARPORT_NONE; | |
| 862 | + if (parport_ptr < LP_NO) | |
| 863 | + parport_nr[parport_ptr++] = LP_PARPORT_NONE; | |
| 864 | + else | |
| 865 | + printk(KERN_INFO "lp: too many ports, %s ignored.\n", | |
| 866 | + str); | |
| 863 | 867 | } else if (!strcmp(str, "reset")) { |
| 864 | 868 | reset = 1; |
| 865 | 869 | } |
| @@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = { · 339 unmodified lines | ||
| 340 | 340 | static int mmap_mem(struct file *file, struct vm_area_struct *vma) |
| 341 | 341 | { |
| 342 | 342 | size_t size = vma->vm_end - vma->vm_start; |
| 343 | + phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; | |
| 344 | + | |
| 345 | + /* It's illegal to wrap around the end of the physical address space. */ | |
| 346 | + if (offset + (phys_addr_t)size < offset) | |
| 347 | + return -EINVAL; | |
| 343 | 348 | |
| 344 | 349 | if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size)) |
| 345 | 350 | return -EINVAL; |
| @@ -116,9 +116,13 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len, · 115 unmodified lines | ||
| 116 | 116 | return VPD_OK; |
| 117 | 117 | |
| 118 | 118 | info = kzalloc(sizeof(*info), GFP_KERNEL); |
| 119 | − info->key = kzalloc(key_len + 1, GFP_KERNEL); | |
| 120 | − if (!info->key) | |
| 119 | + if (!info) | |
| 121 | 120 | return -ENOMEM; |
| 121 | + info->key = kzalloc(key_len + 1, GFP_KERNEL); | |
| 122 | + if (!info->key) { | |
| 123 | + ret = -ENOMEM; | |
| 124 | + goto free_info; | |
| 125 | + } | |
| 122 | 126 | |
| 123 | 127 | memcpy(info->key, key, key_len); |
| 124 | 128 | |
| @@ -135,12 +139,17 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len, · 10 unmodified lines | ||
| 135 | 139 | list_add_tail(&info->list, &sec->attribs); |
| 136 | 140 | |
| 137 | 141 | ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr); |
| 138 | − if (ret) { | |
| 139 | − kfree(info->key); | |
| 140 | − return ret; | |
| 141 | − } | |
| 142 | + if (ret) | |
| 143 | + goto free_info_key; | |
| 142 | 144 | |
| 143 | 145 | return 0; |
| 146 | + | |
| 147 | +free_info_key: | |
| 148 | + kfree(info->key); | |
| 149 | +free_info: | |
| 150 | + kfree(info); | |
| 151 | + | |
| 152 | + return ret; | |
| 144 | 153 | } |
| 145 | 154 | |
| 146 | 155 | static void vpd_section_attrib_destroy(struct vpd_section *sec) |
| @@ -492,6 +492,7 @@ config ASPEED_LPC_CTRL · 491 unmodified lines | ||
| 492 | 492 | |
| 493 | 493 | config PCI_ENDPOINT_TEST |
| 494 | 494 | depends on PCI |
| 495 | + select CRC32 | |
| 495 | 496 | tristate "PCI Endpoint Test driver" |
| 496 | 497 | ---help--- |
| 497 | 498 | Enable this configuration option to enable the host side test driver |
| @@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) · 278 unmodified lines | ||
| 279 | 279 | map = kzalloc(sizeof(*map), GFP_KERNEL); |
| 280 | 280 | if (!map) { |
| 281 | 281 | ret = -ENOMEM; |
| 282 | − goto err_map_kobj; | |
| 282 | + goto err_map; | |
| 283 | 283 | } |
| 284 | 284 | kobject_init(&map->kobj, &map_attr_type); |
| 285 | 285 | map->mem = mem; |
| @@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) · 3 unmodified lines | ||
| 289 | 289 | goto err_map_kobj; |
| 290 | 290 | ret = kobject_uevent(&map->kobj, KOBJ_ADD); |
| 291 | 291 | if (ret) |
| 292 | − goto err_map; | |
| 292 | + goto err_map_kobj; | |
| 293 | 293 | } |
| 294 | 294 | |
| 295 | 295 | for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) { |
| @@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) · 12 unmodified lines | ||
| 308 | 308 | portio = kzalloc(sizeof(*portio), GFP_KERNEL); |
| 309 | 309 | if (!portio) { |
| 310 | 310 | ret = -ENOMEM; |
| 311 | − goto err_portio_kobj; | |
| 311 | + goto err_portio; | |
| 312 | 312 | } |
| 313 | 313 | kobject_init(&portio->kobj, &portio_attr_type); |
| 314 | 314 | portio->port = port; |
| @@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev) · 4 unmodified lines | ||
| 319 | 319 | goto err_portio_kobj; |
| 320 | 320 | ret = kobject_uevent(&portio->kobj, KOBJ_ADD); |
| 321 | 321 | if (ret) |
| 322 | − goto err_portio; | |
| 322 | + goto err_portio_kobj; | |
| 323 | 323 | } |
| 324 | 324 | |
| 325 | 325 | return 0; |