Merge tag 'char-misc-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregk...

Pull char/misc driver fixes from Greg KH:
 "Here are five small bugfixes for reported issues with 4.12-rc1 and
  earlier kernels. Nothing huge here, just a lp, mem, vpd, and uio
  driver fix, along with a Kconfig fixup for one of the misc drivers.

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-4.12-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  firmware: Google VPD: Fix memory allocation error handling
  drivers: char: mem: Check for address space wraparound with mmap()
  uio: fix incorrect memory leak cleanup
  misc: pci_endpoint_test: select CRC32
  char: lp: fix possible integer overflow in lp_setup()

diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 565e4cf04a0215934e9b0f4df6f4398fbd0b2344..8249762192d55ed86a9794895a6faab01afe649e 100644 (file)
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -859,7 +859,11 @@ static int __init lp_setup (char *str)
        } else if (!strcmp(str, "auto")) {
                parport_nr[0] = LP_PARPORT_AUTO;
        } else if (!strcmp(str, "none")) {
-               parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+               if (parport_ptr < LP_NO)
+                       parport_nr[parport_ptr++] = LP_PARPORT_NONE;
+               else
+                       printk(KERN_INFO "lp: too many ports, %s ignored.\n",
+                              str);
        } else if (!strcmp(str, "reset")) {
                reset = 1;
        }

diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index 7e4a9d1296bb7fb666f6b37ced2757a8585b7d75..6e0cbe09222059f0d8e8ccf821edfee5c575703e 100644 (file)
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -340,6 +340,11 @@ static const struct vm_operations_struct mmap_mem_ops = {
 static int mmap_mem(struct file *file, struct vm_area_struct *vma)
 {
        size_t size = vma->vm_end - vma->vm_start;
+       phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT;
+
+       /* It's illegal to wrap around the end of the physical address space. */
+       if (offset + (phys_addr_t)size < offset)
+               return -EINVAL;
 
        if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size))
                return -EINVAL;

diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
index 3ce813110d5e11bca8f3ea3e87c50cd32562b930..1e7860f02f4fa99e821e6a71bec7758621bc9a7d 100644 (file)
--- a/drivers/firmware/google/vpd.c
+++ b/drivers/firmware/google/vpd.c
@@ -116,9 +116,13 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
                return VPD_OK;
 
        info = kzalloc(sizeof(*info), GFP_KERNEL);
-       info->key = kzalloc(key_len + 1, GFP_KERNEL);
-       if (!info->key)
+       if (!info)
                return -ENOMEM;
+       info->key = kzalloc(key_len + 1, GFP_KERNEL);
+       if (!info->key) {
+               ret = -ENOMEM;
+               goto free_info;
+       }
 
        memcpy(info->key, key, key_len);
 
@@ -135,12 +139,17 @@ static int vpd_section_attrib_add(const u8 *key, s32 key_len,
        list_add_tail(&info->list, &sec->attribs);
 
        ret = sysfs_create_bin_file(sec->kobj, &info->bin_attr);
-       if (ret) {
-               kfree(info->key);
-               return ret;
-       }
+       if (ret)
+               goto free_info_key;
 
        return 0;
+
+free_info_key:
+       kfree(info->key);
+free_info:
+       kfree(info);
+
+       return ret;
 }
 
 static void vpd_section_attrib_destroy(struct vpd_section *sec)

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2cba76e6fa3cb0bd8b2148bdd472c44f5abaf0d7..07bbd4cc18526514a2f1029b3d12b4d1b4724613 100644 (file)
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -492,6 +492,7 @@ config ASPEED_LPC_CTRL
 
 config PCI_ENDPOINT_TEST
        depends on PCI
+       select CRC32
        tristate "PCI Endpoint Test driver"
        ---help---
            Enable this configuration option to enable the host side test driver

diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index 1c196f87e9d967886c88b1ae7fe05cc5f01ed4ee..ff04b7f8549f06f5730afb1cf6334785afab9d05 100644 (file)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -279,7 +279,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                map = kzalloc(sizeof(*map), GFP_KERNEL);
                if (!map) {
                        ret = -ENOMEM;
-                       goto err_map_kobj;
+                       goto err_map;
                }
                kobject_init(&map->kobj, &map_attr_type);
                map->mem = mem;
@@ -289,7 +289,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                        goto err_map_kobj;
                ret = kobject_uevent(&map->kobj, KOBJ_ADD);
                if (ret)
-                       goto err_map;
+                       goto err_map_kobj;
        }
 
        for (pi = 0; pi < MAX_UIO_PORT_REGIONS; pi++) {
@@ -308,7 +308,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                portio = kzalloc(sizeof(*portio), GFP_KERNEL);
                if (!portio) {
                        ret = -ENOMEM;
-                       goto err_portio_kobj;
+                       goto err_portio;
                }
                kobject_init(&portio->kobj, &portio_attr_type);
                portio->port = port;
@@ -319,7 +319,7 @@ static int uio_dev_add_attributes(struct uio_device *idev)
                        goto err_portio_kobj;
                ret = kobject_uevent(&portio->kobj, KOBJ_ADD);
                if (ret)
-                       goto err_portio;
+                       goto err_portio_kobj;
        }
 
        return 0;