From ad123452d0ea8b255127bd0c15fc5bd833566a83 Mon Sep 17 00:00:00 2001 From: Elliot Berman Date: Thu, 11 Aug 2022 11:41:02 -0700 Subject: [PATCH 01/11] virt: haven: rsc_mgr: Allocate right buffer size of requests The correct size for sending RM messages is HH_MSGQ_MAX_MSG_SIZE_BYTES. The amount of actual payload data is HH_RM_MAX_MSG_SIZE_BYTES and is incorrect. Change-Id: I8aa7de79ab57b60da366c0a4a1f82233d22ab59c Signed-off-by: Elliot Berman --- drivers/virt/haven/hh_rm_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/virt/haven/hh_rm_core.c b/drivers/virt/haven/hh_rm_core.c index 02fcfcb8ef82..cb45cd65aad4 100644 --- a/drivers/virt/haven/hh_rm_core.c +++ b/drivers/virt/haven/hh_rm_core.c @@ -525,7 +525,7 @@ static int hh_rm_send_request(u32 message_id, return -E2BIG; } - msg = kzalloc(HH_RM_MAX_MSG_SIZE_BYTES, GFP_KERNEL); + msg = kzalloc(HH_MSGQ_MAX_MSG_SIZE_BYTES, GFP_KERNEL); if (!msg) return -ENOMEM; @@ -542,7 +542,7 @@ static int hh_rm_send_request(u32 message_id, payload_size = buff_size_remaining; } - memset(msg, 0, HH_RM_MAX_MSG_SIZE_BYTES); + memset(msg, 0, HH_MSGQ_MAX_MSG_SIZE_BYTES); /* Fill header */ hdr = msg; From 4b3ce87e4720ff14047613532977c11c5d21e4ae Mon Sep 17 00:00:00 2001 From: Raihan Haider Date: Tue, 14 Feb 2023 17:40:00 +0530 Subject: [PATCH 02/11] defconfig: sdxlemur: Enable R8168 driver config Set R8168 driver config to y. Change-Id: I31cfdf90592db9da3e5e02be2f23c2d625863055 Signed-off-by: Raihan Haider --- arch/arm/configs/vendor/sdxlemur.config | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/configs/vendor/sdxlemur.config b/arch/arm/configs/vendor/sdxlemur.config index f9323a93463e..6f909a87bf87 100644 --- a/arch/arm/configs/vendor/sdxlemur.config +++ b/arch/arm/configs/vendor/sdxlemur.config @@ -363,6 +363,7 @@ CONFIG_IOSS=m CONFIG_AQFWD_IOSS=m CONFIG_R8125=y CONFIG_R8125_IOSS=m +CONFIG_R8168=y CONFIG_QCOM_SHOW_RESUME_IRQ=y CONFIG_HARDENED_USERCOPY=y # CONFIG_HARDENED_USERCOPY_FALLBACK is not set From 87acdd7036208f2656c9d1cf1cb0102f26b0073e Mon Sep 17 00:00:00 2001 From: Arun Prakash Date: Fri, 25 Feb 2022 12:25:09 +0530 Subject: [PATCH 03/11] net: qrtr: Move service id based filter check before queueing skb Move service id based filter check before queueing skb to avoid possible use after free issue since skb might get released once rx thread completed the processing of skb. Change-Id: Iff93e32abd3d55f78bf4ce80675fc3bb312b0841 Signed-off-by: Arun Prakash --- net/qrtr/qrtr.c | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 569e95262be1..5467eb4f1701 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -939,13 +939,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) return -ENODEV; } - if (sock_queue_rcv_skb(&ipc->sk, skb)) - goto err; - - /* Force wakeup for all packets except for sensors */ - if (node->nid != 9 && node->nid != 5) - pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true); - if (node->nid == 5) { svc_id = qrtr_get_service_id(cb->src_node, cb->src_port); if (svc_id > 0) { @@ -956,9 +949,19 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len) } } } - if (wake) - pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true); } + + if (sock_queue_rcv_skb(&ipc->sk, skb)) + goto err; + + /** + * Force wakeup for all packets except for sensors and blacklisted services + * from adsp side + */ + if ((node->nid != 9 && node->nid != 5) || + (node->nid == 5 && wake)) + pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true); + qrtr_port_put(ipc); } From 931dbd1b072f7b1c45adc73d7add78aeafd1d8f8 Mon Sep 17 00:00:00 2001 From: Yuanfang Zhang Date: Tue, 21 Mar 2023 18:44:03 +0800 Subject: [PATCH 04/11] coresight-tmc: increase qdss pcie sw path throughput Increase throughput for qdss pcie sw path. Change-Id: I4bb52e81d2617d8e83d0dcfe525cad2f6f5ca93a Signed-off-by: Yuanfang Zhang --- drivers/hwtracing/coresight/coresight-tmc-etr.c | 4 +++- drivers/hwtracing/coresight/coresight-tmc.h | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c index 86987252862f..552e202e7226 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -1129,9 +1129,11 @@ tmc_etr_setup_sysfs_buf(struct tmc_drvdata *drvdata) && drvdata->byte_cntr->sw_usb) new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_SW_USB_BUF_SIZE, 0, cpu_to_node(0), NULL); - else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE) + else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE) { new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_PCIE_MEM_SIZE, 0, cpu_to_node(0), NULL); + drvdata->size = TMC_ETR_PCIE_MEM_SIZE; + } else new_buf = tmc_alloc_etr_buf(drvdata, drvdata->size, 0, cpu_to_node(0), NULL); diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h index 0c70b54863bb..e911342ddf31 100644 --- a/drivers/hwtracing/coresight/coresight-tmc.h +++ b/drivers/hwtracing/coresight/coresight-tmc.h @@ -104,7 +104,7 @@ #define TMC_ETR_BAM_PIPE_INDEX 0 #define TMC_ETR_BAM_NR_PIPES 2 -#define TMC_ETR_PCIE_MEM_SIZE 0x400000 +#define TMC_ETR_PCIE_MEM_SIZE 0x2000000 #define TMC_AUTH_NSID_MASK GENMASK(1, 0) From b4b121f38dccaec2677e9e61090673c9e73a498f Mon Sep 17 00:00:00 2001 From: Pradeep P V K Date: Tue, 11 Apr 2023 16:34:04 +0530 Subject: [PATCH 05/11] mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS As part of FR53657, make changes to support for boot_a and boot_b partition access to HLOS APPS. Change-Id: Ic173bd54df11e42b1811c198314719c4c34338db Signed-off-by: Pradeep P V K --- drivers/mtd/devices/msm_qpic_nand.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/devices/msm_qpic_nand.c b/drivers/mtd/devices/msm_qpic_nand.c index 78517b27c309..19fdb76fb697 100644 --- a/drivers/mtd/devices/msm_qpic_nand.c +++ b/drivers/mtd/devices/msm_qpic_nand.c @@ -2,6 +2,7 @@ /* * Copyright (C) 2007 Google, Inc. * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include "msm_qpic_nand.h" @@ -797,9 +798,15 @@ static int msm_nand_flash_onfi_probe(struct msm_nand_info *info) memset(&data, 0, sizeof(struct msm_nand_flash_onfi_data)); - /* Lookup the partition to which apps has access to */ + /* + * Lookup the partition to which apps has access to + * As a part of FR53657, add support for boot_a + * and boot_b partitions. + */ for (i = 0; i < FLASH_PTABLE_MAX_PARTS_V4; i++) { - if (mtd_part[i].name && !strcmp("boot", mtd_part[i].name)) { + if (mtd_part[i].name && (!strcmp("boot", mtd_part[i].name) || + !strcmp("boot_a", mtd_part[i].name) || + !strcmp("boot_b", mtd_part[i].name))) { page_address = mtd_part[i].offset << 6; break; } From 96507bd86309aa9330dbb9adaf6a260deecd4cea Mon Sep 17 00:00:00 2001 From: Santosh Sakore Date: Thu, 23 Mar 2023 16:44:49 +0530 Subject: [PATCH 06/11] msm: adsprpc: Handle UAF in fastrpc internal munmap Added reference count for contex map indicate memory under used in remote call. And, this memory would not removed in internal unmap to avoid UAF. Change-Id: Ieb4ff6b298ff9c48953bc5b3539fdfe19a14b442 Acked-by: Santosh Sakore Signed-off-by: Santosh Sakore --- drivers/char/adsprpc.c | 42 ++++++++++++++++++++++++++++++------------ 1 file changed, 30 insertions(+), 12 deletions(-) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 56d93e1ccb27..3e9e9589b155 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2012-2021, The Linux Foundation. All rights reserved. - * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved. + * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved. */ /* Uncomment this block to log an error on every VERIFY failure */ @@ -579,10 +579,11 @@ struct fastrpc_mmap { bool is_persistent; /* Indicates whether map is persistent */ int frpc_md_index; /* Minidump unique index */ uintptr_t attr; - bool in_use; /* Indicates if persistent map is in use*/ + bool in_use; /* Indicates if persistent map is in use */ struct timespec64 map_start_time; struct timespec64 map_end_time; - bool is_filemap; /*flag to indicate map used in process init*/ + bool is_filemap; /* flag to indicate map used in process init */ + unsigned int ctx_refs; /* Indicates reference count for context map */ }; enum fastrpc_perfkeys { @@ -1220,7 +1221,7 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va, hlist_for_each_entry_safe(map, n, &me->maps, hn) { if (map->refs == 1 && map->raddr == va && map->raddr + map->len == va + len && - /*Remove map if not used in process initialization*/ + /* Remove map if not used in process initialization */ !map->is_filemap) { match = map; hlist_del_init(&map->hn); @@ -1233,9 +1234,10 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va, return 0; } hlist_for_each_entry_safe(map, n, &fl->maps, hn) { - if (map->refs == 1 && map->raddr == va && - map->raddr + map->len == va + len && - /*Remove map if not used in process initialization*/ + /* Remove if only one reference map and no context map */ + if (map->refs == 1 && !map->ctx_refs && + map->raddr == va && map->raddr + map->len == va + len && + /* Remove map if not used in process initialization */ !map->is_filemap) { match = map; hlist_del_init(&map->hn); @@ -1274,7 +1276,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags) map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) { spin_lock(&me->hlock); map->refs--; - if (!map->refs && !map->is_persistent) + if (!map->refs && !map->is_persistent && !map->ctx_refs) hlist_del_init(&map->hn); spin_unlock(&me->hlock); if (map->refs > 0) { @@ -1290,7 +1292,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags) } } else { map->refs--; - if (!map->refs) + if (!map->refs && !map->ctx_refs) hlist_del_init(&map->hn); if (map->refs > 0 && !flags) return; @@ -1426,6 +1428,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd, map->attr = attr; map->frpc_md_index = -1; map->is_filemap = false; + map->ctx_refs = 0; ktime_get_real_ts64(&map->map_start_time); if (mflags == ADSP_MMAP_HEAP_ADDR || mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) { @@ -2177,8 +2180,11 @@ static void context_free(struct smq_invoke_ctx *ctx) spin_unlock(&ctx->fl->hlock); mutex_lock(&ctx->fl->map_mutex); - for (i = 0; i < nbufs; ++i) + for (i = 0; i < nbufs; ++i) { + if (ctx->maps[i] && ctx->maps[i]->ctx_refs) + ctx->maps[i]->ctx_refs--; fastrpc_mmap_free(ctx->maps[i], 0); + } mutex_unlock(&ctx->fl->map_mutex); fastrpc_buf_free(ctx->buf, 1); @@ -2485,6 +2491,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) err = fastrpc_mmap_create(ctx->fl, ctx->fds[i], ctx->attrs[i], buf, len, mflags, &ctx->maps[i]); + if (ctx->maps[i]) + ctx->maps[i]->ctx_refs++; mutex_unlock(&ctx->fl->map_mutex); if (err) goto bail; @@ -2502,9 +2510,14 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx) err = fastrpc_mmap_create(ctx->fl, ctx->fds[i], FASTRPC_ATTR_NOVA, 0, 0, dmaflags, &ctx->maps[i]); + if (!err && ctx->maps[i]) + ctx->maps[i]->ctx_refs++; if (err) { - for (j = bufs; j < i; j++) + for (j = bufs; j < i; j++) { + if (ctx->maps[j] && ctx->maps[j]->ctx_refs) + ctx->maps[j]->ctx_refs--; fastrpc_mmap_free(ctx->maps[j], 0); + } mutex_unlock(&ctx->fl->map_mutex); goto bail; } @@ -2835,6 +2848,8 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx, } } else { mutex_lock(&ctx->fl->map_mutex); + if (ctx->maps[i]->ctx_refs) + ctx->maps[i]->ctx_refs--; fastrpc_mmap_free(ctx->maps[i], 0); mutex_unlock(&ctx->fl->map_mutex); ctx->maps[i] = NULL; @@ -2845,8 +2860,11 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx, if (!fdlist[i]) break; if (!fastrpc_mmap_find(ctx->fl, (int)fdlist[i], 0, 0, - 0, 0, &mmap)) + 0, 0, &mmap)) { + if (mmap && mmap->ctx_refs) + mmap->ctx_refs--; fastrpc_mmap_free(mmap, 0); + } } mutex_unlock(&ctx->fl->map_mutex); if (ctx->crc && crclist && rpra) From f20dfe7d99f89a826830bd3d650adade62a07f48 Mon Sep 17 00:00:00 2001 From: Ram Nagesh Date: Mon, 13 Mar 2023 16:00:34 +0530 Subject: [PATCH 07/11] msm: synx: Check for zero before reducing bind handles Suppose user has sent invalid external fence to bind API. Now, while binding, if synx signal comes in parallel, it will set number of bound synxs as 0 after signal. Further reduction on that number(num_bound_synxs) (in case of callback registration failure) would make it wrap around. So, now num_bound_synxs is large value and abrupt close on synx fd will lead to synx_util_object_destroy. Here, the for loop on num_bound_synxs would lead to invalid memory access. This change decrements num_bound_synxs only if not zero. Change-Id: I0cfffc90d4164b149c87545818ae4dcf57fc4c46 Signed-off-by: Ram Nagesh --- drivers/media/platform/msm/synx/synx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/msm/synx/synx.c b/drivers/media/platform/msm/synx/synx.c index 8043cc1489ed..21c9cce7a958 100644 --- a/drivers/media/platform/msm/synx/synx.c +++ b/drivers/media/platform/msm/synx/synx.c @@ -870,7 +870,8 @@ int synx_bind(struct synx_session session_id, mutex_lock(&synx_obj->obj_lock); memset(&synx_obj->bound_synxs[bound_idx], 0, sizeof(struct synx_external_desc)); - synx_obj->num_bound_synxs--; + if (synx_obj->num_bound_synxs) + synx_obj->num_bound_synxs--; goto free; } From e57b2b062ec19f9c6e09af2298072b3d1768cfe0 Mon Sep 17 00:00:00 2001 From: Raviteja Laggyshetty Date: Tue, 2 May 2023 14:45:42 +0530 Subject: [PATCH 08/11] interconnect: qcom: holi: fix UAF under remove function UAF is observed while unloading the interconnect driver. Interconnect is core to the system and should not be unloaded once it is probed. Marking the driver as permanent by removing the module_exit function. Change-Id: If4ddebec67f008e5412c1bf03bed0693fcaaffe0 Signed-off-by: Raviteja Laggyshetty --- drivers/interconnect/qcom/holi.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/interconnect/qcom/holi.c b/drivers/interconnect/qcom/holi.c index a6a92e8719c8..8503687a1cd5 100644 --- a/drivers/interconnect/qcom/holi.c +++ b/drivers/interconnect/qcom/holi.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. * */ @@ -1868,11 +1869,5 @@ static int __init qnoc_driver_init(void) } core_initcall(qnoc_driver_init); -static void __exit qnoc_driver_exit(void) -{ - platform_driver_unregister(&qnoc_driver); -} -module_exit(qnoc_driver_exit); - MODULE_DESCRIPTION("Holi NoC driver"); MODULE_LICENSE("GPL v2"); From c36b875972f1c2945b389bc275945ebb5e77cb33 Mon Sep 17 00:00:00 2001 From: Raviteja Laggyshetty Date: Tue, 2 May 2023 14:57:22 +0530 Subject: [PATCH 09/11] interconnect: qcom: lahaina: fix UAF under remove function UAF is observed while unloading the interconnect driver. Interconnect is core to the system and should not be unloaded once it is probed. Marking the driver as permanent by removing the module_exit function. Change-Id: I7a840812752b34248ec3dcb241b069cf4bf77608 Signed-off-by: Raviteja Laggyshetty --- drivers/interconnect/qcom/lahaina.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/interconnect/qcom/lahaina.c b/drivers/interconnect/qcom/lahaina.c index 4f4847dfd65b..114fa54f250b 100644 --- a/drivers/interconnect/qcom/lahaina.c +++ b/drivers/interconnect/qcom/lahaina.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2019-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. * */ @@ -2903,11 +2904,5 @@ static int __init qnoc_driver_init(void) } core_initcall(qnoc_driver_init); -static void __exit qnoc_driver_exit(void) -{ - platform_driver_unregister(&qnoc_driver); -} -module_exit(qnoc_driver_exit); - MODULE_DESCRIPTION("Lahaina NoC driver"); MODULE_LICENSE("GPL v2"); From 153bf8409ab9a4b9f74b7e69966b2661b4cad4dc Mon Sep 17 00:00:00 2001 From: Raviteja Laggyshetty Date: Tue, 2 May 2023 15:01:17 +0530 Subject: [PATCH 10/11] interconnect: qcom: shima: fix UAF under remove function UAF is observed while unloading the interconnect driver. Interconnect is core to the system and should not be unloaded once it is probed. Marking the driver as permanent by removing the module_exit function. Change-Id: I296b40141d3d844f3011cd704e8c593c8bc0f5e0 Signed-off-by: Raviteja Laggyshetty --- drivers/interconnect/qcom/shima.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/interconnect/qcom/shima.c b/drivers/interconnect/qcom/shima.c index f372f4515d28..967386d1f80a 100644 --- a/drivers/interconnect/qcom/shima.c +++ b/drivers/interconnect/qcom/shima.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. * */ @@ -2708,11 +2709,5 @@ static int __init qnoc_driver_init(void) } core_initcall(qnoc_driver_init); -static void __exit qnoc_driver_exit(void) -{ - platform_driver_unregister(&qnoc_driver); -} -module_exit(qnoc_driver_exit); - MODULE_DESCRIPTION("Shima NoC driver"); MODULE_LICENSE("GPL v2"); From a5e1d0fedf8ac275e450baabc94d51ef610e82e6 Mon Sep 17 00:00:00 2001 From: Raviteja Laggyshetty Date: Fri, 12 May 2023 19:16:16 +0530 Subject: [PATCH 11/11] interconnect: qcom: monaco: fix UAF under remove function UAF is observed while unloading the interconnect driver. Interconnect is core to the system and should not be unloaded once it is probed. Marking the driver as permanent by removing the module_exit function. Change-Id: I249472490349c227d9f30f276439fd1d0de0bdb9 Signed-off-by: Raviteja Laggyshetty --- drivers/interconnect/qcom/monaco.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/drivers/interconnect/qcom/monaco.c b/drivers/interconnect/qcom/monaco.c index f839bc69cef4..841554a7c1c5 100644 --- a/drivers/interconnect/qcom/monaco.c +++ b/drivers/interconnect/qcom/monaco.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2020-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. * */ @@ -1389,11 +1390,5 @@ static int __init qnoc_driver_init(void) } core_initcall(qnoc_driver_init); -static void __exit qnoc_driver_exit(void) -{ - platform_driver_unregister(&qnoc_driver); -} -module_exit(qnoc_driver_exit); - MODULE_DESCRIPTION("Monaco NoC driver"); MODULE_LICENSE("GPL v2");