diff options
author | Zoltan Herpai <wigyori@uid0.hu> | 2016-11-06 11:13:37 +0100 |
---|---|---|
committer | GitHub <noreply@github.com> | 2016-11-06 11:13:37 +0100 |
commit | 9ce27c83ad3fe2fa5e6ba707dc6bc1182a0f32ed (patch) | |
tree | 87316c92634bbaa73948928ce290205a5076fd32 /target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch | |
parent | cabb0c506526fe468e4aa985086e50c440192122 (diff) | |
parent | 7862d74a17bb5a4a6d6b0d60d8cf33650b75c92a (diff) | |
download | master-187ad058-9ce27c83ad3fe2fa5e6ba707dc6bc1182a0f32ed.tar.gz master-187ad058-9ce27c83ad3fe2fa5e6ba707dc6bc1182a0f32ed.tar.bz2 master-187ad058-9ce27c83ad3fe2fa5e6ba707dc6bc1182a0f32ed.zip |
Merge pull request #156 from wigyori/dirtycow-fixes
CVE-2016-5195 (dirtycow) fixes for 3.18, 4.1, 4.4
Diffstat (limited to 'target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch')
-rw-r--r-- | target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch b/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch index 09cbe0c485..0b03963f0a 100644 --- a/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch +++ b/target/linux/generic/patches-3.18/190-cdc_ncm_add_support_for_moving_ndp_to_end_of_ncm_frame.patch @@ -61,7 +61,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> { const struct usb_cdc_union_desc *union_desc = NULL; struct cdc_ncm_ctx *ctx; -@@ -855,6 +857,17 @@ advance: +@@ -859,6 +861,17 @@ advance: /* finish setting up the device specific data */ cdc_ncm_setup(dev); @@ -79,7 +79,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> /* override ethtool_ops */ dev->net->ethtool_ops = &cdc_ncm_ethtool_ops; -@@ -954,8 +967,11 @@ static int cdc_ncm_bind(struct usbnet *d +@@ -958,8 +971,11 @@ static int cdc_ncm_bind(struct usbnet *d if (cdc_ncm_select_altsetting(intf) != CDC_NCM_COMM_ALTSETTING_NCM) return -ENODEV; @@ -93,7 +93,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> /* * We should get an event when network connection is "connected" or -@@ -986,6 +1002,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -990,6 +1006,14 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data; size_t ndpoffset = le16_to_cpu(nth16->wNdpIndex); @@ -108,7 +108,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> /* follow the chain of NDPs, looking for a match */ while (ndpoffset) { ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb->data + ndpoffset); -@@ -995,7 +1019,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -999,7 +1023,8 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm } /* align new NDP */ @@ -118,7 +118,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> /* verify that there is room for the NDP and the datagram (reserve) */ if ((ctx->tx_max - skb->len - reserve) < ctx->max_ndp_size) -@@ -1008,7 +1033,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm +@@ -1012,7 +1037,11 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncm nth16->wNdpIndex = cpu_to_le16(skb->len); /* push a new empty NDP */ @@ -131,7 +131,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> ndp16->dwSignature = sign; ndp16->wLength = cpu_to_le16(sizeof(struct usb_cdc_ncm_ndp16) + sizeof(struct usb_cdc_ncm_dpe16)); return ndp16; -@@ -1023,6 +1052,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1027,6 +1056,15 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev struct sk_buff *skb_out; u16 n = 0, index, ndplen; u8 ready2send = 0; @@ -147,7 +147,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> /* if there is a remaining skb, it gets priority */ if (skb != NULL) { -@@ -1077,7 +1115,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1081,7 +1119,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev cdc_ncm_align_tail(skb_out, ctx->tx_modulus, ctx->tx_remainder, ctx->tx_max); /* check if we had enough room left for both NDP and frame */ @@ -156,7 +156,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> if (n == 0) { /* won't fit, MTU problem? */ dev_kfree_skb_any(skb); -@@ -1150,6 +1188,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev +@@ -1154,6 +1192,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev /* variables will be reset at next call */ } |