Merge tag 'char-misc-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char/misc driver updates from Greg KH:
 "Here's the big char/misc driver pull request for 4.2-rc1.

  Lots of mei, extcon, coresight, uio, mic, and other driver updates in
  here.  Full details in the shortlog.  All of these have been in
  linux-next for some time with no reported problems"

* tag 'char-misc-4.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (176 commits)
  mei: me: wait for power gating exit confirmation
  mei: reset flow control on the last client disconnection
  MAINTAINERS: mei: add mei_cl_bus.h to maintained file list
  misc: sram: sort and clean up included headers
  misc: sram: move reserved block logic out of probe function
  misc: sram: add private struct device and virt_base members
  misc: sram: report correct SRAM pool size
  misc: sram: bump error message level on unclean driver unbinding
  misc: sram: fix device node reference leak on error
  misc: sram: fix enabled clock leak on error path
  misc: mic: Fix reported static checker warning
  misc: mic: Fix randconfig build error by including errno.h
  uio: pruss: Drop depends on ARCH_DAVINCI_DA850 from config
  uio: pruss: Add CONFIG_HAS_IOMEM dependence
  uio: pruss: Include <linux/sizes.h>
  extcon: Redefine the unique id of supported external connectors without 'enum extcon' type
  char:xilinx_hwicap:buffer_icap - change 1/0 to true/false for bool type variable in function buffer_icap_set_configuration().
  Drivers: hv: vmbus: Allocate ring buffer memory in NUMA aware fashion
  parport: check exclusive access before register
  w1: use correct lock on error in w1_seq_show()
  ...

1 files changed, 11 insertions, 1 deletions

diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index 26cc6029b280..6d940c72b5fc 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -140,8 +140,12 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
                         /* Error: request to write beyond destination buffer */
                         if (cpy > oend)
                                 goto _output_error;
+#if LZ4_ARCH64
+                        if ((ref + COPYLENGTH) > oend)
+#else
                         if ((ref + COPYLENGTH) > oend ||
                                         (op + COPYLENGTH) > oend)
+#endif
                                 goto _output_error;
                         LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
                         while (op < cpy)
@@ -266,7 +270,13 @@ static int lz4_uncompress_unknownoutputsize(const char *source, char *dest,
                 if (cpy > oend - COPYLENGTH) {
                         if (cpy > oend)
                                 goto _output_error; /* write outside of buf */
-
+#if LZ4_ARCH64
+                        if ((ref + COPYLENGTH) > oend)
+#else
+                        if ((ref + COPYLENGTH) > oend ||
+                                        (op + COPYLENGTH) > oend)
+#endif
+                                goto _output_error;
                         LZ4_SECURECOPY(ref, op, (oend - COPYLENGTH));
                         while (op < cpy)
                                 *op++ = *ref++;