[PATCH] isdn/eicon: do integrity check on cmd->adapter == a->controller early

after the xdi_copy_from_user() in diva_xdi_write(), which is what this patch is for. Signed-off-by: Meng Xu --- drivers/isdn/hardware/eicon/diva.c| 10 +- drivers/isdn/hardware/eicon/os_4bri.c | 6 -- drivers/isdn/hardware/eicon/os_bri.c | 6 -- drivers/isdn/hardware/eicon/os_pr

[PATCH] net/tls: move version check after second userspace fetch

version check after the second userspace fetch. Signed-off-by: Meng Xu --- net/tls/tls_main.c | 12 ++-- 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 60aff60..d4a7bc6 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c

[PATCH] isdn/i4l: fetch the ppp_write buffer in one shot

double-fetch behavior into two single fetches decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0). A more detailed discussion can be found at https://marc.info/?l=linux-kernel&m=150586376926123&w=2 Signed-off-by: Meng Xu --- drivers/isdn

[PATCH] isdn/i4l: check the message proto does not change across fetches

between the two fetches and abort if changes to the protobuf is detected across fetches. Signed-off-by: Meng Xu --- drivers/isdn/i4l/isdn_ppp.c | 13 - 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c index 6c44609

[PATCH] net: compat: assert the size of cmsg copied in is as expected

al sanity check and ensures that what is recorded in kmsg->msg_controllen is the actual cmsg length. Signed-off-by: Meng Xu --- net/compat.c | 7 +++ 1 file changed, 7 insertions(+) diff --git a/net/compat.c b/net/compat.c index 6ded6c8..2238171 100644 --- a/net/compat.c +++ b/net/com