From 154323d2ad5bb21244d8a1a38e1f73d8132fe5d3 Mon Sep 17 00:00:00 2001 From: Selvarasu Ganesan Date: Tue, 31 Jan 2023 04:19:42 -0800 Subject: [PATCH 1/9] usb: kpi: update_marker api for USB suspend resume Replace place_marker with update_marker api to capture suspend resume kpi of USB. Change-Id: Ibbc30625d56f185ef856ae1ee18191aa0592955b Signed-off-by: Selvarasu Ganesan --- drivers/usb/dwc3/dwc3-msm.c | 4 ++-- drivers/usb/gadget/composite.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/usb/dwc3/dwc3-msm.c b/drivers/usb/dwc3/dwc3-msm.c index 1cf76b17463a..c4ad1fd62601 100644 --- a/drivers/usb/dwc3/dwc3-msm.c +++ b/drivers/usb/dwc3/dwc3-msm.c @@ -3879,7 +3879,7 @@ static irqreturn_t msm_dwc3_pwr_irq(int irq, void *data) if (mdwc->drd_state == DRD_STATE_PERIPHERAL_SUSPEND) { dev_info(mdwc->dev, "USB Resume start\n"); #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER - place_marker("M - USB device resume started"); + update_marker("M - USB device resume started"); #endif } @@ -5958,7 +5958,7 @@ static int dwc3_msm_pm_resume(struct device *dev) mdwc->drd_state == DRD_STATE_PERIPHERAL_SUSPEND) { dev_info(mdwc->dev, "USB Resume start\n"); #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER - place_marker("M - USB device resume started"); + update_marker("M - USB device resume started"); #endif } diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index d947f2a848cb..3730ea7f5d35 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -893,7 +893,7 @@ static int set_config(struct usb_composite_dev *cdev, goto done; #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER - place_marker("M - USB Device is enumerated"); + update_marker("M - USB device is enumerated"); #endif usb_gadget_set_state(gadget, USB_STATE_CONFIGURED); cdev->config = c; @@ -2436,7 +2436,7 @@ void composite_resume(struct usb_gadget *gadget) */ INFO(cdev, "USB Resume end\n"); #ifdef CONFIG_QGKI_MSM_BOOT_TIME_MARKER - place_marker("M - USB Device is resumed"); + update_marker("M - USB device is resumed"); #endif if (cdev->driver->resume) cdev->driver->resume(cdev); From 5e1030eb494b5d3db9ceb9380efa59e4e3db87dd Mon Sep 17 00:00:00 2001 From: Baowei Liu Date: Tue, 15 Aug 2023 11:21:05 +0530 Subject: [PATCH 2/9] char: virtio_eavb: use new update_marker api Replace place_marker with update_marker. Change-Id: I2e0115d0b5d96bda2f8ca89e2ba3f814f4623360 Signed-off-by: Baowei Liu --- drivers/char/virtio_eavb/virtio_eavb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/char/virtio_eavb/virtio_eavb.c b/drivers/char/virtio_eavb/virtio_eavb.c index 2654673c5f93..6ebb7104a9ea 100644 --- a/drivers/char/virtio_eavb/virtio_eavb.c +++ b/drivers/char/virtio_eavb/virtio_eavb.c @@ -60,7 +60,7 @@ do { \ do { \ static int times; \ if (times < 1) { \ - place_marker(log); \ + update_marker(log); \ times++; \ } \ } while (0) @@ -1586,7 +1586,7 @@ static int virtio_eavb_probe(struct virtio_device *vdev) priv->debugfs_root, NULL, &fops_debugfs_timeout); #endif - place_marker("M - DRIVER EAVB FE Ready"); + update_marker("M - DRIVER EAVB FE Ready"); return 0; alloc_rxbufs_fail: @@ -1649,7 +1649,7 @@ static struct virtio_driver virtio_eavb_driver = { static int __init virtio_eavb_init(void) { - place_marker("M - DRIVER EAVB FE Init"); + update_marker("M - DRIVER EAVB FE Init"); return register_virtio_driver(&virtio_eavb_driver); } From 6139a3e1b0a4c7297b1d3c2c31ca89ce118c010c Mon Sep 17 00:00:00 2001 From: Khaja Hussain Shaik Khaji Date: Tue, 12 Sep 2023 18:20:58 +0530 Subject: [PATCH 3/9] net: qrtr: use new update_marker api Boot KPI driver has a limitation to print a maximum of 73 KPI node entries due to sysfs implementation limitation. To fix this issue replace place_marker calls with update_marker in the required drivers. Unlike place_maker API update_marker API will first remove the marker and add it again. So, the marker comes at end of the table when we cat /sys/kernel/bootkpi/kpi_values. Change-Id: I3137e6909c17a3e8f3237c0bc4df62ee628d8e7e Signed-off-by: Khaja Hussain Shaik Khaji --- net/qrtr/qrtr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c index 5467eb4f1701..fd1591c3fbcf 100644 --- a/net/qrtr/qrtr.c +++ b/net/qrtr/qrtr.c @@ -268,7 +268,7 @@ static void qrtr_log_tx_msg(struct qrtr_node *node, struct qrtr_hdr_v1 *hdr, type, hdr->src_node_id); if (le32_to_cpu(hdr->dst_node_id) == 0 || le32_to_cpu(hdr->dst_node_id) == 3) { - place_marker("M - Modem QMI Readiness TX"); + update_marker("M - Modem QMI Readiness TX"); pr_err("qrtr: Modem QMI Readiness TX cmd:0x%x node[0x%x]\n", type, hdr->src_node_id); } @@ -340,7 +340,7 @@ static void qrtr_log_rx_msg(struct qrtr_node *node, struct sk_buff *skb) "RX CTRL: cmd:0x%x node[0x%x]\n", cb->type, cb->src_node); if (cb->src_node == 0 || cb->src_node == 3) { - place_marker("M - Modem QMI Readiness RX"); + update_marker("M - Modem QMI Readiness RX"); pr_err("qrtr: Modem QMI Readiness RX cmd:0x%x node[0x%x]\n", cb->type, cb->src_node); } From 77799976865f3eb9c60efcf529434c0b64f9f3e4 Mon Sep 17 00:00:00 2001 From: Kaushal Sanadhya Date: Fri, 15 Sep 2023 11:35:16 +0530 Subject: [PATCH 4/9] msm: kgsl: Limit the syncpoint count for AUX commands KGSL internally has a limit on the length of the list of syncpoints submitted in a single AUX command. Enforce this limit so we don't overwrite memory beyond the structures that track these syncpoints. Change-Id: I261bfd4f786ff7e4fbe07e8bca9e9b8d8b87c950 Signed-off-by: Lynus Vaz Signed-off-by: Kaushal Sanadhya --- drivers/gpu/msm/kgsl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/msm/kgsl.c b/drivers/gpu/msm/kgsl.c index 0a311a79bfb9..964b8536666b 100644 --- a/drivers/gpu/msm/kgsl.c +++ b/drivers/gpu/msm/kgsl.c @@ -2038,6 +2038,10 @@ long kgsl_ioctl_gpu_aux_command(struct kgsl_device_private *dev_priv, (KGSL_GPU_AUX_COMMAND_TIMELINE))) return -EINVAL; + if ((param->flags & KGSL_GPU_AUX_COMMAND_SYNC) && + (param->numsyncs > KGSL_MAX_SYNCPOINTS)) + return -EINVAL; + context = kgsl_context_get_owner(dev_priv, param->context_id); if (!context) return -EINVAL; From e47d921a39f1c84a2ba61cae477c917917c7335f Mon Sep 17 00:00:00 2001 From: Ravi Kumar Bokka Date: Tue, 5 Sep 2023 14:05:00 +0530 Subject: [PATCH 5/9] securemsm-kernel: Fix multiple listener registration on same fd Currently, multiple listeners can register on same fd which could lead to potential vulnerabilities of use after free while unregistering the listener. Add check to prevent more than one listener registration on a fd. Change-Id: Ia2973853943b5619bcf2047629b9c193f6a8c5cf Signed-off-by: Pawan Rai Signed-off-by: Ravi Kumar Bokka --- drivers/misc/qseecom.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 8c338aaa615c..2eeabe55d6ca 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -378,7 +378,7 @@ struct qseecom_client_handle { struct qseecom_listener_handle { u32 id; - bool unregister_pending; + bool register_pending; bool release_called; }; @@ -1550,6 +1550,11 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data, struct qseecom_registered_listener_list *new_entry; struct qseecom_registered_listener_list *ptr_svc; + if (data->listener.register_pending) { + pr_err("Already a listner registration is in process on this FD\n"); + return -EINVAL; + } + ret = copy_from_user(&rcvd_lstnr, argp, sizeof(rcvd_lstnr)); if (ret) { pr_err("copy_from_user failed\n"); @@ -1559,6 +1564,13 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data, rcvd_lstnr.sb_size)) return -EFAULT; + ptr_svc = __qseecom_find_svc(data->listener.id); + if (ptr_svc) { + pr_err("Already a listener registered on this data: lid=%d\n", + data->listener.id); + return -EINVAL; + } + ptr_svc = __qseecom_find_svc(rcvd_lstnr.listener_id); if (ptr_svc) { if (!ptr_svc->unregister_pending) { @@ -1602,13 +1614,16 @@ static int qseecom_register_listener(struct qseecom_dev_handle *data, new_entry->svc.listener_id = rcvd_lstnr.listener_id; new_entry->sb_length = rcvd_lstnr.sb_size; new_entry->user_virt_sb_base = rcvd_lstnr.virt_sb_base; + data->listener.register_pending = true; if (__qseecom_set_sb_memory(new_entry, data, &rcvd_lstnr)) { pr_err("qseecom_set_sb_memory failed for listener %d, size %d\n", rcvd_lstnr.listener_id, rcvd_lstnr.sb_size); __qseecom_free_tzbuf(&new_entry->sglistinfo_shm); kzfree(new_entry); + data->listener.register_pending = false; return -ENOMEM; } + data->listener.register_pending = false; init_waitqueue_head(&new_entry->rcv_req_wq); init_waitqueue_head(&new_entry->listener_block_app_wq); From 02923fa81a2697ff4c5cbc102183e50302d07b6d Mon Sep 17 00:00:00 2001 From: Pratham Pratap Date: Mon, 7 Aug 2023 12:01:01 +0530 Subject: [PATCH 6/9] usb: gadget: cdev: Don't use spinlock with sleeping functions Commit c99a841d40aa8 ("usb: gadget: cdev: Add spinlock to synchronize ports->cbits_updated")added spinlock to synchronize ports->cbits_updated which is calling a sleeping function(put_user) after spinlock is held. Fix this by protecting just variable, ports->cbits_updated. Change-Id: I0a52a88344c449c9485f41b871cc97e54b4bf3ca Signed-off-by: Pratham Pratap --- drivers/usb/gadget/function/f_cdev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_cdev.c b/drivers/usb/gadget/function/f_cdev.c index f1044c29027a..1f9751d251de 100644 --- a/drivers/usb/gadget/function/f_cdev.c +++ b/drivers/usb/gadget/function/f_cdev.c @@ -1639,13 +1639,13 @@ static long f_cdev_ioctl(struct file *fp, unsigned int cmd, break; case TIOCMGET: pr_debug("TIOCMGET on port(%s)%pK\n", port->name, port); - spin_lock_irqsave(&port->port_lock, flags); ret = f_cdev_tiocmget(port); if (ret >= 0) { ret = put_user(ret, (uint32_t *)arg); + spin_lock_irqsave(&port->port_lock, flags); port->cbits_updated = false; + spin_unlock_irqrestore(&port->port_lock, flags); } - spin_unlock_irqrestore(&port->port_lock, flags); break; default: pr_err("Received cmd:%d not supported\n", cmd); From a0ad1961666eaa4b1bba58b57353c3bbf9848b3a Mon Sep 17 00:00:00 2001 From: Pratyush Brahma Date: Fri, 15 Sep 2023 16:14:49 +0530 Subject: [PATCH 7/9] iommu: Fix missing return check of arm_lpae_init_pte UAF scenario may occur in clients with EL1 privileges for iova mappings when we miss to check the return value of arm_lpae_init_pte which may lead to an PTE be counted as it was set even if it was already existing. This can cause a dangling IOMMU PTE to be left mapped pointing to a freed object and cause UAF in the client if the dangling PTE is accessed after a failed unmap operation. Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor") Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47 Signed-off-by: Pratyush Brahma --- drivers/iommu/io-pgtable-arm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c index 12fa224ff8b3..f8cfb9382594 100644 --- a/drivers/iommu/io-pgtable-arm.c +++ b/drivers/iommu/io-pgtable-arm.c @@ -683,9 +683,11 @@ static int arm_lpae_map_sg(struct io_pgtable_ops *ops, unsigned long iova, arm_lpae_iopte *ptep = ms.pgtable + ARM_LPAE_LVL_IDX(iova, MAP_STATE_LVL, data); - arm_lpae_init_pte( + ret = arm_lpae_init_pte( data, iova, phys, prot, MAP_STATE_LVL, ptep, ms.prev_pgtable, false); + if (ret) + goto out_err; ms.num_pte++; } else { ret = __arm_lpae_map(data, iova, phys, pgsize, From ab1865af0cd4cae64828f62866db4fd7a99ab504 Mon Sep 17 00:00:00 2001 From: Saranya R Date: Thu, 31 Aug 2023 16:40:12 +0530 Subject: [PATCH 8/9] Configured process_madvise with upstream syscall number Fixing the syscall mapping which was done wrongly by 'commit f4ed73112f31 ("mm/madvise: introduce process_madvise() syscall: an external memory hinting API")' by correcting the syscall number. unistd#close_range cts testcase is expecting errno as ENOSYS because msm-5.4 does not support close_range syscall, but it receives errno as EINVAL because process_madvise is configured with 436 which is close_range syscall number which leads to this cts testcase failure. Hence, configured process_madvise with proper upstream syscall number to fix this cts failure. Applications using process_madvise that are built with previous headers needs to be rebuilt. Otherwise the program would not work as expected. Change-Id: If524d109aa1f4072e9ed03d7d9f70cc517fd59dc Signed-off-by: Saranya R --- arch/alpha/kernel/syscalls/syscall.tbl | 6 +++++- arch/arm/tools/syscall.tbl | 6 +++++- arch/arm64/include/asm/unistd.h | 2 +- arch/arm64/include/asm/unistd32.h | 2 +- arch/ia64/kernel/syscalls/syscall.tbl | 6 +++++- arch/m68k/kernel/syscalls/syscall.tbl | 6 +++++- arch/microblaze/kernel/syscalls/syscall.tbl | 6 +++++- arch/mips/kernel/syscalls/syscall_n32.tbl | 6 +++++- arch/mips/kernel/syscalls/syscall_n64.tbl | 6 +++++- arch/parisc/kernel/syscalls/syscall.tbl | 6 +++++- arch/powerpc/kernel/syscalls/syscall.tbl | 6 +++++- arch/s390/kernel/syscalls/syscall.tbl | 6 +++++- arch/sh/kernel/syscalls/syscall.tbl | 6 +++++- arch/sparc/kernel/syscalls/syscall.tbl | 6 +++++- arch/x86/entry/syscalls/syscall_32.tbl | 6 +++++- arch/x86/entry/syscalls/syscall_64.tbl | 6 +++++- arch/xtensa/kernel/syscalls/syscall.tbl | 6 +++++- include/uapi/asm-generic/unistd.h | 4 ++-- 18 files changed, 79 insertions(+), 19 deletions(-) diff --git a/arch/alpha/kernel/syscalls/syscall.tbl b/arch/alpha/kernel/syscalls/syscall.tbl index 517820726be1..7a04003bfcb4 100644 --- a/arch/alpha/kernel/syscalls/syscall.tbl +++ b/arch/alpha/kernel/syscalls/syscall.tbl @@ -475,4 +475,8 @@ 543 common fspick sys_fspick 544 common pidfd_open sys_pidfd_open # 545 reserved for clone3 -546 common process_madvise sys_process_madvise +# 546 reserved for close_range +# 547 reserved for openat2 +# 548 reserved for pidfd_getfd +# 549 reserved for faccessat2 +550 common process_madvise sys_process_madvise diff --git a/arch/arm/tools/syscall.tbl b/arch/arm/tools/syscall.tbl index d98b34066200..b7eb74edf569 100644 --- a/arch/arm/tools/syscall.tbl +++ b/arch/arm/tools/syscall.tbl @@ -449,4 +449,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open 435 common clone3 sys_clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/arm64/include/asm/unistd.h b/arch/arm64/include/asm/unistd.h index febc1aa57714..b3b2019f8d16 100644 --- a/arch/arm64/include/asm/unistd.h +++ b/arch/arm64/include/asm/unistd.h @@ -38,7 +38,7 @@ #define __ARM_NR_compat_set_tls (__ARM_NR_COMPAT_BASE + 5) #define __ARM_NR_COMPAT_END (__ARM_NR_COMPAT_BASE + 0x800) -#define __NR_compat_syscalls 437 +#define __NR_compat_syscalls 441 #endif #define __ARCH_WANT_SYS_CLONE diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h index c885dcfcd605..52879c7aaa54 100644 --- a/arch/arm64/include/asm/unistd32.h +++ b/arch/arm64/include/asm/unistd32.h @@ -879,7 +879,7 @@ __SYSCALL(__NR_fspick, sys_fspick) __SYSCALL(__NR_pidfd_open, sys_pidfd_open) #define __NR_clone3 435 __SYSCALL(__NR_clone3, sys_clone3) -#define __NR_process_madvise 436 +#define __NR_process_madvise 440 __SYSCALL(__NR_process_madvise, sys_process_madvise) /* diff --git a/arch/ia64/kernel/syscalls/syscall.tbl b/arch/ia64/kernel/syscalls/syscall.tbl index ec028e67cda4..6915e787a037 100644 --- a/arch/ia64/kernel/syscalls/syscall.tbl +++ b/arch/ia64/kernel/syscalls/syscall.tbl @@ -356,4 +356,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open # 435 reserved for clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/m68k/kernel/syscalls/syscall.tbl b/arch/m68k/kernel/syscalls/syscall.tbl index ac37a032eb1f..95cc3b9d40ef 100644 --- a/arch/m68k/kernel/syscalls/syscall.tbl +++ b/arch/m68k/kernel/syscalls/syscall.tbl @@ -435,4 +435,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open # 435 reserved for clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/microblaze/kernel/syscalls/syscall.tbl b/arch/microblaze/kernel/syscalls/syscall.tbl index 9ea93304751e..0bf9a04e19b5 100644 --- a/arch/microblaze/kernel/syscalls/syscall.tbl +++ b/arch/microblaze/kernel/syscalls/syscall.tbl @@ -441,4 +441,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open 435 common clone3 sys_clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/mips/kernel/syscalls/syscall_n32.tbl b/arch/mips/kernel/syscalls/syscall_n32.tbl index 2af8bfac917e..6ae6842599ac 100644 --- a/arch/mips/kernel/syscalls/syscall_n32.tbl +++ b/arch/mips/kernel/syscalls/syscall_n32.tbl @@ -374,4 +374,8 @@ 433 n32 fspick sys_fspick 434 n32 pidfd_open sys_pidfd_open 435 n32 clone3 __sys_clone3 -436 n32 process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 n32 process_madvise sys_process_madvise diff --git a/arch/mips/kernel/syscalls/syscall_n64.tbl b/arch/mips/kernel/syscalls/syscall_n64.tbl index 2074bfcb61ac..6a663f85820c 100644 --- a/arch/mips/kernel/syscalls/syscall_n64.tbl +++ b/arch/mips/kernel/syscalls/syscall_n64.tbl @@ -350,4 +350,8 @@ 433 n64 fspick sys_fspick 434 n64 pidfd_open sys_pidfd_open 435 n64 clone3 __sys_clone3 -436 n64 process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 n64 process_madvise sys_process_madvise diff --git a/arch/parisc/kernel/syscalls/syscall.tbl b/arch/parisc/kernel/syscalls/syscall.tbl index 920d4c17a672..32347996e8e0 100644 --- a/arch/parisc/kernel/syscalls/syscall.tbl +++ b/arch/parisc/kernel/syscalls/syscall.tbl @@ -433,4 +433,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open 435 common clone3 sys_clone3_wrapper -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/powerpc/kernel/syscalls/syscall.tbl b/arch/powerpc/kernel/syscalls/syscall.tbl index 4675cd96f132..f3b2b0c58abb 100644 --- a/arch/powerpc/kernel/syscalls/syscall.tbl +++ b/arch/powerpc/kernel/syscalls/syscall.tbl @@ -517,4 +517,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open 435 nospu clone3 ppc_clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/s390/kernel/syscalls/syscall.tbl b/arch/s390/kernel/syscalls/syscall.tbl index d30228a28524..3c7aa43482b9 100644 --- a/arch/s390/kernel/syscalls/syscall.tbl +++ b/arch/s390/kernel/syscalls/syscall.tbl @@ -438,4 +438,8 @@ 433 common fspick sys_fspick sys_fspick 434 common pidfd_open sys_pidfd_open sys_pidfd_open 435 common clone3 sys_clone3 sys_clone3 -443 common process_madvise sys_process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise sys_process_madvise diff --git a/arch/sh/kernel/syscalls/syscall.tbl b/arch/sh/kernel/syscalls/syscall.tbl index ebdaf971c3d7..5a4b36ba71c4 100644 --- a/arch/sh/kernel/syscalls/syscall.tbl +++ b/arch/sh/kernel/syscalls/syscall.tbl @@ -438,4 +438,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open # 435 reserved for clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/sparc/kernel/syscalls/syscall.tbl b/arch/sparc/kernel/syscalls/syscall.tbl index 9dc5e4581e33..4822c37f044c 100644 --- a/arch/sparc/kernel/syscalls/syscall.tbl +++ b/arch/sparc/kernel/syscalls/syscall.tbl @@ -481,4 +481,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open # 435 reserved for clone3 -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/arch/x86/entry/syscalls/syscall_32.tbl b/arch/x86/entry/syscalls/syscall_32.tbl index 93dc19bc9394..3b161e17479e 100644 --- a/arch/x86/entry/syscalls/syscall_32.tbl +++ b/arch/x86/entry/syscalls/syscall_32.tbl @@ -440,4 +440,8 @@ 433 i386 fspick sys_fspick __ia32_sys_fspick 434 i386 pidfd_open sys_pidfd_open __ia32_sys_pidfd_open 435 i386 clone3 sys_clone3 __ia32_sys_clone3 -436 i386 process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 i386 process_madvise sys_process_madvise diff --git a/arch/x86/entry/syscalls/syscall_64.tbl b/arch/x86/entry/syscalls/syscall_64.tbl index a0908fff28e8..9ebbe98df765 100644 --- a/arch/x86/entry/syscalls/syscall_64.tbl +++ b/arch/x86/entry/syscalls/syscall_64.tbl @@ -357,7 +357,11 @@ 433 common fspick __x64_sys_fspick 434 common pidfd_open __x64_sys_pidfd_open 435 common clone3 __x64_sys_clone3/ptregs -436 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise # # x32-specific system call numbers start at 512 to avoid cache impact diff --git a/arch/xtensa/kernel/syscalls/syscall.tbl b/arch/xtensa/kernel/syscalls/syscall.tbl index 0303a5c0952d..efb08d731a01 100644 --- a/arch/xtensa/kernel/syscalls/syscall.tbl +++ b/arch/xtensa/kernel/syscalls/syscall.tbl @@ -406,4 +406,8 @@ 433 common fspick sys_fspick 434 common pidfd_open sys_pidfd_open 435 common clone3 sys_clone3 -443 common process_madvise sys_process_madvise +# 436 reserved for close_range +# 437 reserved for openat2 +# 438 reserved for pidfd_getfd +# 439 reserved for faccessat2 +440 common process_madvise sys_process_madvise diff --git a/include/uapi/asm-generic/unistd.h b/include/uapi/asm-generic/unistd.h index 619fdf93772e..674a0b04693c 100644 --- a/include/uapi/asm-generic/unistd.h +++ b/include/uapi/asm-generic/unistd.h @@ -850,11 +850,11 @@ __SYSCALL(__NR_pidfd_open, sys_pidfd_open) #define __NR_clone3 435 __SYSCALL(__NR_clone3, sys_clone3) #endif -#define __NR_process_madvise 436 +#define __NR_process_madvise 440 __SYSCALL(__NR_process_madvise, sys_process_madvise) #undef __NR_syscalls -#define __NR_syscalls 437 +#define __NR_syscalls 441 /* * 32 bit systems traditionally used different From 970275cba23e35055f90d60e3ff643ddb4da84ca Mon Sep 17 00:00:00 2001 From: Pankaj Gupta Date: Thu, 14 Sep 2023 21:44:26 +0530 Subject: [PATCH 9/9] msm: kgsl: Prevent wrap around during user address mapping When setting svm region during the gpuobj import ioctl call for a usermem address, there is a possibility of a very large input size causing the region's 64-bit end address to wrap around. This can cause the region to incorrectly be considered valid, ultimately allowing a use after free scenario. To prevent this, detect the occurrence of a wrap and reject the import. Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4 Signed-off-by: Mohammed Mirza Mandayappurath Manzoor Signed-off-by: Pankaj Gupta --- drivers/gpu/msm/kgsl_iommu.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/gpu/msm/kgsl_iommu.c b/drivers/gpu/msm/kgsl_iommu.c index fc75683dd210..690ffe008811 100644 --- a/drivers/gpu/msm/kgsl_iommu.c +++ b/drivers/gpu/msm/kgsl_iommu.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2011-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -2157,14 +2158,18 @@ static uint64_t kgsl_iommu_find_svm_region(struct kgsl_pagetable *pagetable, static bool iommu_addr_in_svm_ranges(struct kgsl_iommu_pt *pt, u64 gpuaddr, u64 size) { + u64 end = gpuaddr + size; + + /* Make sure size is not zero and we don't wrap around */ + if (end <= gpuaddr) + return false; + if ((gpuaddr >= pt->compat_va_start && gpuaddr < pt->compat_va_end) && - ((gpuaddr + size) > pt->compat_va_start && - (gpuaddr + size) <= pt->compat_va_end)) + (end > pt->compat_va_start && end <= pt->compat_va_end)) return true; if ((gpuaddr >= pt->svm_start && gpuaddr < pt->svm_end) && - ((gpuaddr + size) > pt->svm_start && - (gpuaddr + size) <= pt->svm_end)) + (end > pt->svm_start && end <= pt->svm_end)) return true; return false;