fix up queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch

diff --git a/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch b/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
index 97aa00b97b79c63e6eda9186f4aa7693bd34ae3b..b8b932ae57a1e512b078655d7849053ab289f316 100644 (file)
--- a/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
+++ b/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch
@@ -18,31 +18,28 @@ Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com
 Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/media/dvb-frontends/dib7000p.c | 4 ++++
- 1 file changed, 4 insertions(+)
+ drivers/media/dvb-frontends/dib7000p.c |    6 ++++++
+ 1 file changed, 6 insertions(+)
 
-diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
-index a4d060fb1bab..08b3ac8ff108 100644
 --- a/drivers/media/dvb-frontends/dib7000p.c
 +++ b/drivers/media/dvb-frontends/dib7000p.c
-@@ -2198,6 +2198,8 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
-       struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
-       u8 n_overflow = 1;
+@@ -2200,6 +2200,9 @@ static int w7090p_tuner_write_serpar(str
        u16 i = 1000;
-+      if (msg[0].len < 3)
-+              return -EOPNOTSUPP;
        u16 serpar_num = msg[0].buf[0];
  
-       while (n_overflow == 1 && i) {
-@@ -2217,6 +2219,8 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
-       struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
-       u8 n_overflow = 1, n_empty = 1;
-       u16 i = 1000;
-+      if (msg[0].len < 1 || msg[1].len < 2)
++      if (msg[0].len < 3)
 +              return -EOPNOTSUPP;
++
+       while (n_overflow == 1 && i) {
+               n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+               i--;
+@@ -2220,6 +2223,9 @@ static int w7090p_tuner_read_serpar(stru
        u16 serpar_num = msg[0].buf[0];
        u16 read_word;
  
--- 
-2.39.5
-
++      if (msg[0].len < 1 || msg[1].len < 2)
++              return -EOPNOTSUPP;
++
+       while (n_overflow == 1 && i) {
+               n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1;
+               i--;

diff --git a/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch b/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch
index 3ada681240b0468a33e6ef84d83ee4adab6372e2..5db8c9355c1082cd76334d436634c09a8581ed99 100644 (file)
--- a/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch
+++ b/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch
@@ -39,14 +39,12 @@ Link: https://patch.msgid.link/20250729-mlx5_gso_segs-v1-1-b48c480c1c12@openai.c
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 Signed-off-by: Sasha Levin <sashal@kernel.org>
 ---
- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 +
+ drivers/net/ethernet/mellanox/mlx5/core/en_rx.c |    1 +
  1 file changed, 1 insertion(+)
 
-diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-index de2737b1a7e1..b64bb0c7b9db 100644
 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
 +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
-@@ -1065,6 +1065,7 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe,
+@@ -1061,6 +1061,7 @@ static inline void mlx5e_build_rx_skb(st
                unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt);
  
                skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg);
@@ -54,6 +52,3 @@ index de2737b1a7e1..b64bb0c7b9db 100644
                /* Subtract one since we already counted this as one
                 * "regular" packet in mlx5e_complete_rx_cqe()
                 */
--- 
-2.39.5
-