From: Greg Kroah-Hartman Date: Mon, 18 Aug 2025 09:20:01 +0000 (+0200) Subject: fix up queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch X-Git-Tag: v6.12.43~44 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aa410be6a3d88dfac54f83fffb146217d18a8cc7;p=thirdparty%2Fkernel%2Fstable-queue.git fix up queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch --- diff --git a/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch b/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch index 97aa00b97b..b8b932ae57 100644 --- a/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch +++ b/queue-5.15/media-dvb-frontends-w7090p-fix-null-ptr-deref-in-w70.patch @@ -18,31 +18,28 @@ Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- - drivers/media/dvb-frontends/dib7000p.c | 4 ++++ - 1 file changed, 4 insertions(+) + drivers/media/dvb-frontends/dib7000p.c | 6 ++++++ + 1 file changed, 6 insertions(+) -diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c -index a4d060fb1bab..08b3ac8ff108 100644 --- a/drivers/media/dvb-frontends/dib7000p.c +++ b/drivers/media/dvb-frontends/dib7000p.c -@@ -2198,6 +2198,8 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms - struct dib7000p_state *state = i2c_get_adapdata(i2c_adap); - u8 n_overflow = 1; +@@ -2200,6 +2200,9 @@ static int w7090p_tuner_write_serpar(str u16 i = 1000; -+ if (msg[0].len < 3) -+ return -EOPNOTSUPP; u16 serpar_num = msg[0].buf[0]; - while (n_overflow == 1 && i) { -@@ -2217,6 +2219,8 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg - struct dib7000p_state *state = i2c_get_adapdata(i2c_adap); - u8 n_overflow = 1, n_empty = 1; - u16 i = 1000; -+ if (msg[0].len < 1 || msg[1].len < 2) ++ if (msg[0].len < 3) + return -EOPNOTSUPP; ++ + while (n_overflow == 1 && i) { + n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1; + i--; +@@ -2220,6 +2223,9 @@ static int w7090p_tuner_read_serpar(stru u16 serpar_num = msg[0].buf[0]; u16 read_word; --- -2.39.5 - ++ if (msg[0].len < 1 || msg[1].len < 2) ++ return -EOPNOTSUPP; ++ + while (n_overflow == 1 && i) { + n_overflow = (dib7000p_read_word(state, 1984) >> 1) & 0x1; + i--; diff --git a/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch b/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch index 3ada681240..5db8c9355c 100644 --- a/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch +++ b/queue-5.15/net-mlx5-correctly-set-gso_segs-when-lro-is-used.patch @@ -39,14 +39,12 @@ Link: https://patch.msgid.link/20250729-mlx5_gso_segs-v1-1-b48c480c1c12@openai.c Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin --- - drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 1 + 1 file changed, 1 insertion(+) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index de2737b1a7e1..b64bb0c7b9db 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1065,6 +1065,7 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, +@@ -1061,6 +1061,7 @@ static inline void mlx5e_build_rx_skb(st unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); @@ -54,6 +52,3 @@ index de2737b1a7e1..b64bb0c7b9db 100644 /* Subtract one since we already counted this as one * "regular" packet in mlx5e_complete_rx_cqe() */ --- -2.39.5 -