Commit 4541c226 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'driver-core-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core

Pull driver core fixes from Greg KH:
 "Here are two bugfixes for things reported.  One regression in kernfs,
  and another issue fixed in the LZ4 code that was fixed in the
  "upstream" codebase that solves a reported kernel crash

  Both have been in linux-next for a while"

* tag 'driver-core-4.0-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  LZ4 : fix the data abort issue
  kernfs: handle poll correctly on 'direct_read' files.
parents b93dbeea d5e7cafd
...@@ -207,6 +207,7 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of, ...@@ -207,6 +207,7 @@ static ssize_t kernfs_file_direct_read(struct kernfs_open_file *of,
goto out_free; goto out_free;
} }
of->event = atomic_read(&of->kn->attr.open->event);
ops = kernfs_ops(of->kn); ops = kernfs_ops(of->kn);
if (ops->read) if (ops->read)
len = ops->read(of, buf, len, *ppos); len = ops->read(of, buf, len, *ppos);
......
...@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize) ...@@ -139,6 +139,9 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
/* Error: request to write beyond destination buffer */ /* Error: request to write beyond destination buffer */
if (cpy > oend) if (cpy > oend)
goto _output_error; goto _output_error;
if ((ref + COPYLENGTH) > oend ||
(op + COPYLENGTH) > oend)
goto _output_error;
LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH)); LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
while (op < cpy) while (op < cpy)
*op++ = *ref++; *op++ = *ref++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment