Merge tag 'v5.9-rc7' into patchwork

Linux 5.9-rc7

* tag 'v5.9-rc7': (683 commits)
  Linux 5.9-rc7
  mm/thp: Split huge pmds/puds if they're pinned when fork()
  mm: Do early cow for pinned pages during fork() for ptes
  mm/fork: Pass new vma pointer into copy_page_range()
  mm: Introduce mm_struct.has_pinned
  mm: validate pmd after splitting
  mm: don't rely on system state to detect hot-plug operations
  mm: replace memmap_context by meminit_context
  arch/x86/lib/usercopy_64.c: fix __copy_user_flushcache() cache writeback
  lib/memregion.c: include memregion.h
  lib/string.c: implement stpcpy
  mm/migrate: correct thp migration stats
  mm/gup: fix gup_fast with dynamic page table folding
  mm: memcontrol: fix missing suffix of workingset_restore
  mm, THP, swap: fix allocating cluster for swapfile by mistake
  mm: slab: fix potential double free in ___cache_free
  Documentation/llvm: Fix clang target examples
  io_uring: ensure async buffered read-retry is setup properly
  KVM: SVM: Add a dedicated INVD intercept routine
  io_uring: don't unconditionally set plug->nowait = true
  ...

1 files changed, 8 insertions, 0 deletions

diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 84dde5a2066e..16014ad19406 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1426,6 +1426,7 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh,
 {
 	const struct dcbnl_rtnl_ops *ops = netdev->dcbnl_ops;
 	struct nlattr *ieee[DCB_ATTR_IEEE_MAX + 1];
+	int prio;
 	int err;
 
 	if (!ops)
@@ -1475,6 +1476,13 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh,
 		struct dcbnl_buffer *buffer =
 			nla_data(ieee[DCB_ATTR_DCB_BUFFER]);
 
+		for (prio = 0; prio < ARRAY_SIZE(buffer->prio2buffer); prio++) {
+			if (buffer->prio2buffer[prio] >= DCBX_MAX_BUFFERS) {
+				err = -EINVAL;
+				goto err;
+			}
+		}
+
 		err = ops->dcbnl_setbuffer(netdev, buffer);
 		if (err)
 			goto err;