From 253ff03050a92c32995482a55713f8ec343c78f8 Mon Sep 17 00:00:00 2001 From: Dheeraj Kumar Date: Fri, 10 Nov 2023 07:27:40 +0000 Subject: [PATCH 1/8] MobileAP: CVE-2022-2663 fix revert kernel change Added CVE-2022-2663 fix revert kernel change Change-Id: I0230a6bc4fd3903c918bce86a5e5728c044b3e3b Signed-off-by: Dheeraj Kumar --- net/netfilter/nf_conntrack_irc.c | 40 +++++++++++++++++++++++++------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c index 912e6d1a8f59..2d296830160d 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -435,15 +435,38 @@ static int help(struct sk_buff *skb, unsigned int protoff, * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ data = ib_ptr; - while (data < data_limit - (19 + MINMATCHLEN)) { - if (memcmp(data, "\1DCC ", 5)) { + /* Skip any whitespace */ + while (data < data_limit - 10) { + if (*data == ' ' || *data == '\r' || *data == '\n') + data++; + else + break; + } + + /* strlen("PRIVMSG x ")=10 */ + if (data < data_limit - 10) { + if (strncasecmp("PRIVMSG ", data, 8)) + goto out; + data += 8; + } + + /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 + * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 + */ + while (data < data_limit - (21 + MINMATCHLEN)) { + /* Find first " :", the start of message */ + if (memcmp(data, " :", 2)) { data++; continue; } + data += 2; + + /* then check that place only for the DCC command */ + if (memcmp(data, "\1DCC ", 5)) + goto out; data += 5; - /* we have at least (19+MINMATCHLEN)-5 - *bytes valid data left - */ + /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ + iph = ip_hdr(skb); pr_debug("DCC found in master %pI4:%u %pI4:%u\n", &iph->saddr, ntohs(th->source), @@ -459,7 +482,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, pr_debug("DCC %s detected\n", dccprotos[i]); /* we have at least - * (19+MINMATCHLEN)-5-dccprotos[i].matchlen + * (21+MINMATCHLEN)-7-dccprotos[i].matchlen *bytes valid data left (== 14/13 bytes) */ if (parse_dcc(data, data_limit, &dcc_ip, @@ -476,8 +499,9 @@ static int help(struct sk_buff *skb, unsigned int protoff, *external (NAT'ed) IP */ tuple = &ct->tuplehash[dir].tuple; - if (tuple->src.u3.ip != dcc_ip && - tuple->dst.u3.ip != dcc_ip) { + if ((tuple->src.u3.ip != dcc_ip && + ct->tuplehash[!dir].tuple.dst.u3.ip != dcc_ip) || + dcc_port == 0) { net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", &tuple->src.u3.ip, &dcc_ip, dcc_port); From 80f8ee28db7e6601e96df6bd21306a7c47341de3 Mon Sep 17 00:00:00 2001 From: Kasin Li Date: Fri, 17 Nov 2023 02:46:06 +0800 Subject: [PATCH 2/8] soc: hgsl: fix race of isync timeline when creating In isync timeline create, after timeline object is attached into idr and unlock the isync_timeline_lock, timeline object still is accessed. if there is a release thread which try to release the same timeline object, then maybe cause UAF issue. Move the access operation into lock to avoid. Change-Id: Ie2ff412b90924acb8f40e182f26c770b1f110a56 Signed-off-by: Kasin Li --- drivers/soc/qcom/hgsl/hgsl_sync.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/soc/qcom/hgsl/hgsl_sync.c b/drivers/soc/qcom/hgsl/hgsl_sync.c index 0b8a7fd6a1d5..5efc7c948c87 100644 --- a/drivers/soc/qcom/hgsl/hgsl_sync.c +++ b/drivers/soc/qcom/hgsl/hgsl_sync.c @@ -275,14 +275,16 @@ int hgsl_isync_timeline_create(struct hgsl_priv *priv, idr_preload(GFP_KERNEL); spin_lock(&priv->isync_timeline_lock); idr = idr_alloc(&priv->isync_timeline_idr, timeline, 1, 0, GFP_NOWAIT); - spin_unlock(&priv->isync_timeline_lock); - idr_preload_end(); - if (idr > 0) { timeline->id = idr; *timeline_id = idr; ret = 0; - } else + } + spin_unlock(&priv->isync_timeline_lock); + idr_preload_end(); + + /* allocate IDR failed */ + if (ret != 0) kfree(timeline); return ret; From ff6fb61c78a764f27555c7f08699efe3d09bf124 Mon Sep 17 00:00:00 2001 From: Deepak Kumar Singh Date: Tue, 15 Aug 2023 22:06:23 +0530 Subject: [PATCH 3/8] soc: qcom: qmi_encdec: out of bound check for input buffer Data shared by remote processors can not be trusted. QMI message could be malformed which can result in decoded bytes greater than length of input buffer supplied causing buffer overflow. Check decoded bytes against buffer length to avoid buffer overflow. Change-Id: I1d2d3aadd297718b8ecc023a20475b60f4bce022 Signed-off-by: Deepak Kumar Singh --- drivers/soc/qcom/qmi_encdec.c | 50 ++++++++++++++++++++++++++++------- 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c index 331d67fb95ed..afc0764c560b 100644 --- a/drivers/soc/qcom/qmi_encdec.c +++ b/drivers/soc/qcom/qmi_encdec.c @@ -427,6 +427,7 @@ static int qmi_encode(struct qmi_elem_info *ei_array, void *out_buf, * @buf_src: Buffer containing the elements in QMI wire format. * @elem_len: Number of elements to be decoded. * @elem_size: Size of a single instance of the element to be decoded. + * @src_len: Source buffer length. * * This function decodes the "elem_len" number of elements in QMI wire format, * each of size "elem_size" bytes from the source buffer "buf_src" and stores @@ -437,10 +438,13 @@ static int qmi_encode(struct qmi_elem_info *ei_array, void *out_buf, * Return: The total size of the decoded data elements, in bytes. */ static int qmi_decode_basic_elem(void *buf_dst, const void *buf_src, - u32 elem_len, u32 elem_size) + u32 elem_len, u32 elem_size, u32 src_len) { u32 i, rc = 0; + if (elem_len * elem_size > src_len) + return -EINVAL; + for (i = 0; i < elem_len; i++) { QMI_ENCDEC_DECODE_N_BYTES(buf_dst, buf_src, elem_size); rc += elem_size; @@ -458,6 +462,7 @@ static int qmi_decode_basic_elem(void *buf_dst, const void *buf_src, * @tlv_len: Total size of the encoded inforation corresponding to * this struct element. * @dec_level: Depth of the nested structure from the main structure. + * @src_len: Source buffer length. * * This function decodes the "elem_len" number of elements in QMI wire format, * each of size "(tlv_len/elem_len)" bytes from the source buffer "buf_src" @@ -471,16 +476,20 @@ static int qmi_decode_basic_elem(void *buf_dst, const void *buf_src, static int qmi_decode_struct_elem(struct qmi_elem_info *ei_array, void *buf_dst, const void *buf_src, u32 elem_len, u32 tlv_len, - int dec_level) + int dec_level, u32 src_len) { int i, rc, decoded_bytes = 0; struct qmi_elem_info *temp_ei = ei_array; + if (tlv_len > src_len) + return -EINVAL; + for (i = 0; i < elem_len && decoded_bytes < tlv_len; i++) { rc = qmi_decode(temp_ei->ei_array, buf_dst, buf_src, tlv_len - decoded_bytes, dec_level); if (rc < 0) return rc; + buf_src = buf_src + rc; buf_dst = buf_dst + temp_ei->elem_size; decoded_bytes += rc; @@ -505,6 +514,7 @@ static int qmi_decode_struct_elem(struct qmi_elem_info *ei_array, * @tlv_len: Total size of the encoded inforation corresponding to * this string element. * @dec_level: Depth of the string element from the main structure. + * @src_len: Source buffer length. * * This function decodes the string element of maximum length * "ei_array->elem_len" from the source buffer "buf_src" and puts it into @@ -516,7 +526,7 @@ static int qmi_decode_struct_elem(struct qmi_elem_info *ei_array, */ static int qmi_decode_string_elem(struct qmi_elem_info *ei_array, void *buf_dst, const void *buf_src, - u32 tlv_len, int dec_level) + u32 tlv_len, int dec_level, u32 src_len) { int rc; int decoded_bytes = 0; @@ -530,7 +540,10 @@ static int qmi_decode_string_elem(struct qmi_elem_info *ei_array, string_len_sz = temp_ei->elem_len <= U8_MAX ? sizeof(u8) : sizeof(u16); rc = qmi_decode_basic_elem(&string_len, buf_src, - 1, string_len_sz); + 1, string_len_sz, src_len); + if (rc < 0) + return rc; + decoded_bytes += rc; } @@ -545,7 +558,11 @@ static int qmi_decode_string_elem(struct qmi_elem_info *ei_array, } rc = qmi_decode_basic_elem(buf_dst, buf_src + decoded_bytes, - string_len, temp_ei->elem_size); + string_len, temp_ei->elem_size, + src_len - decoded_bytes); + if (rc < 0) + return rc; + *((char *)buf_dst + string_len) = '\0'; decoded_bytes += rc; @@ -611,6 +628,9 @@ static int qmi_decode(struct qmi_elem_info *ei_array, void *out_c_struct, if (dec_level == 1) { tlv_pointer = buf_src; + if (decoded_bytes + TLV_TYPE_SIZE + TLV_LEN_SIZE > in_buf_len) + return -EINVAL; + QMI_ENCDEC_DECODE_TLV(&tlv_type, &tlv_len, tlv_pointer); buf_src += (TLV_TYPE_SIZE + TLV_LEN_SIZE); @@ -643,7 +663,11 @@ static int qmi_decode(struct qmi_elem_info *ei_array, void *out_c_struct, data_len_sz = temp_ei->elem_size == sizeof(u8) ? sizeof(u8) : sizeof(u16); rc = qmi_decode_basic_elem(&data_len_value, buf_src, - 1, data_len_sz); + 1, data_len_sz, + in_buf_len - decoded_bytes); + if (rc < 0) + return rc; + memcpy(buf_dst, &data_len_value, sizeof(u32)); temp_ei = temp_ei + 1; buf_dst = out_c_struct + temp_ei->offset; @@ -670,24 +694,32 @@ static int qmi_decode(struct qmi_elem_info *ei_array, void *out_c_struct, case QMI_SIGNED_4_BYTE_ENUM: rc = qmi_decode_basic_elem(buf_dst, buf_src, data_len_value, - temp_ei->elem_size); + temp_ei->elem_size, + in_buf_len - decoded_bytes); + if (rc < 0) + return rc; + UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc); break; case QMI_STRUCT: rc = qmi_decode_struct_elem(temp_ei, buf_dst, buf_src, data_len_value, tlv_len, - dec_level + 1); + dec_level + 1, + in_buf_len - decoded_bytes); if (rc < 0) return rc; + UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc); break; case QMI_STRING: rc = qmi_decode_string_elem(temp_ei, buf_dst, buf_src, - tlv_len, dec_level); + tlv_len, dec_level, + in_buf_len - decoded_bytes); if (rc < 0) return rc; + UPDATE_DECODE_VARIABLES(buf_src, decoded_bytes, rc); break; From 330843f54465ee9b62e1a1e2f6c5d12b14c3b548 Mon Sep 17 00:00:00 2001 From: Lynus Vaz Date: Mon, 27 Nov 2023 06:53:01 -0800 Subject: [PATCH 4/8] msm: kgsl: Do not free sharedmem if it cannot be unmapped If sharedmem cannot be unmapped from the mmu, it can still be accessed by the GPU. Therefore it is not safe to free the backing memory. In the case that unmap fails, do not free it or return it to the system. Change-Id: Iad3e86d043f129a4d71cf862865d9033d4a315e3 Signed-off-by: Lynus Vaz --- drivers/gpu/msm/kgsl_mmu.c | 2 ++ drivers/gpu/msm/kgsl_sharedmem.c | 24 ++++++++++++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/msm/kgsl_mmu.c b/drivers/gpu/msm/kgsl_mmu.c index 2633b72f18f7..33fcaabf838d 100644 --- a/drivers/gpu/msm/kgsl_mmu.c +++ b/drivers/gpu/msm/kgsl_mmu.c @@ -483,6 +483,8 @@ kgsl_mmu_unmap(struct kgsl_pagetable *pagetable, size = kgsl_memdesc_footprint(memdesc); ret = pagetable->pt_ops->mmu_unmap(pagetable, memdesc); + if (ret) + return ret; atomic_dec(&pagetable->stats.entries); atomic_long_sub(size, &pagetable->stats.mapped); diff --git a/drivers/gpu/msm/kgsl_sharedmem.c b/drivers/gpu/msm/kgsl_sharedmem.c index ae66f3acba30..d77ec299ae04 100644 --- a/drivers/gpu/msm/kgsl_sharedmem.c +++ b/drivers/gpu/msm/kgsl_sharedmem.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -948,6 +949,9 @@ static void kgsl_contiguous_free(struct kgsl_memdesc *memdesc) if (!memdesc->hostptr) return; + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.coherent); #ifdef CONFIG_MM_STAT_UNRECLAIMABLE_PAGES @@ -963,9 +967,14 @@ static void kgsl_free_secure_system_pages(struct kgsl_memdesc *memdesc) { int i; struct scatterlist *sg; - int ret = unlock_sgt(memdesc->sgt); + int ret; int order = get_order(PAGE_SIZE); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + + ret = unlock_sgt(memdesc->sgt); + if (ret) { /* * Unlock of the secure buffer failed. This buffer will @@ -998,7 +1007,12 @@ static void kgsl_free_secure_system_pages(struct kgsl_memdesc *memdesc) static void kgsl_free_secure_pool_pages(struct kgsl_memdesc *memdesc) { - int ret = unlock_sgt(memdesc->sgt); + int ret; + + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + + ret = unlock_sgt(memdesc->sgt); if (ret) { /* @@ -1028,6 +1042,9 @@ static void kgsl_free_pool_pages(struct kgsl_memdesc *memdesc) kgsl_paged_unmap_kernel(memdesc); WARN_ON(memdesc->hostptr); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc); kgsl_pool_free_pages(memdesc->pages, memdesc->page_count); @@ -1045,6 +1062,9 @@ static void kgsl_free_system_pages(struct kgsl_memdesc *memdesc) kgsl_paged_unmap_kernel(memdesc); WARN_ON(memdesc->hostptr); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc); for (i = 0; i < memdesc->page_count; i++) { From b3194eb5caa222c60aaccd7e26fa49f255e08e01 Mon Sep 17 00:00:00 2001 From: Lynus Vaz Date: Mon, 27 Nov 2023 06:53:01 -0800 Subject: [PATCH 5/8] msm: kgsl: Do not free sharedmem if it cannot be unmapped If sharedmem cannot be unmapped from the mmu, it can still be accessed by the GPU. Therefore it is not safe to free the backing memory. In the case that unmap fails, do not free it or return it to the system. Change-Id: Iad3e86d043f129a4d71cf862865d9033d4a315e3 Signed-off-by: Lynus Vaz (cherry picked from commit 330843f54465ee9b62e1a1e2f6c5d12b14c3b548) --- drivers/gpu/msm/kgsl_mmu.c | 2 ++ drivers/gpu/msm/kgsl_sharedmem.c | 24 ++++++++++++++++++++++-- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/msm/kgsl_mmu.c b/drivers/gpu/msm/kgsl_mmu.c index 2633b72f18f7..33fcaabf838d 100644 --- a/drivers/gpu/msm/kgsl_mmu.c +++ b/drivers/gpu/msm/kgsl_mmu.c @@ -483,6 +483,8 @@ kgsl_mmu_unmap(struct kgsl_pagetable *pagetable, size = kgsl_memdesc_footprint(memdesc); ret = pagetable->pt_ops->mmu_unmap(pagetable, memdesc); + if (ret) + return ret; atomic_dec(&pagetable->stats.entries); atomic_long_sub(size, &pagetable->stats.mapped); diff --git a/drivers/gpu/msm/kgsl_sharedmem.c b/drivers/gpu/msm/kgsl_sharedmem.c index ae66f3acba30..d77ec299ae04 100644 --- a/drivers/gpu/msm/kgsl_sharedmem.c +++ b/drivers/gpu/msm/kgsl_sharedmem.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-only /* * Copyright (c) 2002,2007-2021, The Linux Foundation. All rights reserved. + * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved. */ #include @@ -948,6 +949,9 @@ static void kgsl_contiguous_free(struct kgsl_memdesc *memdesc) if (!memdesc->hostptr) return; + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.coherent); #ifdef CONFIG_MM_STAT_UNRECLAIMABLE_PAGES @@ -963,9 +967,14 @@ static void kgsl_free_secure_system_pages(struct kgsl_memdesc *memdesc) { int i; struct scatterlist *sg; - int ret = unlock_sgt(memdesc->sgt); + int ret; int order = get_order(PAGE_SIZE); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + + ret = unlock_sgt(memdesc->sgt); + if (ret) { /* * Unlock of the secure buffer failed. This buffer will @@ -998,7 +1007,12 @@ static void kgsl_free_secure_system_pages(struct kgsl_memdesc *memdesc) static void kgsl_free_secure_pool_pages(struct kgsl_memdesc *memdesc) { - int ret = unlock_sgt(memdesc->sgt); + int ret; + + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + + ret = unlock_sgt(memdesc->sgt); if (ret) { /* @@ -1028,6 +1042,9 @@ static void kgsl_free_pool_pages(struct kgsl_memdesc *memdesc) kgsl_paged_unmap_kernel(memdesc); WARN_ON(memdesc->hostptr); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc); kgsl_pool_free_pages(memdesc->pages, memdesc->page_count); @@ -1045,6 +1062,9 @@ static void kgsl_free_system_pages(struct kgsl_memdesc *memdesc) kgsl_paged_unmap_kernel(memdesc); WARN_ON(memdesc->hostptr); + if (memdesc->priv & KGSL_MEMDESC_MAPPED) + return; + atomic_long_sub(memdesc->size, &kgsl_driver.stats.page_alloc); for (i = 0; i < memdesc->page_count; i++) { From c5ebf4ce1aa4525cb76ca91a5152dee07ad60771 Mon Sep 17 00:00:00 2001 From: Taniya Das Date: Tue, 14 Dec 2021 16:32:21 +0530 Subject: [PATCH 6/8] bindings: clk: gpucc: Add support for LIMITER reset Add support for the consumer to be able to set/reset the GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR register as an when required on BLAIR and HOLI platforms. Change-Id: I0d041066e36c0152fdcc8e306367aebdc5fd6283 Signed-off-by: Taniya Das --- include/dt-bindings/clock/qcom,gpucc-blair.h | 3 +++ include/dt-bindings/clock/qcom,gpucc-holi.h | 3 +++ 2 files changed, 6 insertions(+) diff --git a/include/dt-bindings/clock/qcom,gpucc-blair.h b/include/dt-bindings/clock/qcom,gpucc-blair.h index c9fc5e5cc854..4f2472215e87 100644 --- a/include/dt-bindings/clock/qcom,gpucc-blair.h +++ b/include/dt-bindings/clock/qcom,gpucc-blair.h @@ -31,4 +31,7 @@ #define GPU_CC_RBCPR_CLK_SRC 21 #define GPU_CC_SLEEP_CLK 22 +/* GPU_CC resets */ +#define GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR 0 + #endif diff --git a/include/dt-bindings/clock/qcom,gpucc-holi.h b/include/dt-bindings/clock/qcom,gpucc-holi.h index 9d7a282238e3..3f0344ad767f 100644 --- a/include/dt-bindings/clock/qcom,gpucc-holi.h +++ b/include/dt-bindings/clock/qcom,gpucc-holi.h @@ -27,4 +27,7 @@ #define CX_GDSC 0 #define GX_GDSC 1 +/* GPU_CC resets */ +#define GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR 0 + #endif From f8831e2d340cf90927107570c6eabb5f947b6cdd Mon Sep 17 00:00:00 2001 From: Taniya Das Date: Tue, 14 Dec 2021 16:39:28 +0530 Subject: [PATCH 7/8] clk: qcom: gpucc: Add support for LIMITER reset Add support for the consumer to be able to set/reset the GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR register as an when required on BLAIR and HOLI platforms. Change-Id: I4706352102159f0465c50e53b759a2600f909de0 Signed-off-by: Taniya Das --- drivers/clk/qcom/gpucc-blair.c | 8 ++++++++ drivers/clk/qcom/gpucc-holi.c | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/drivers/clk/qcom/gpucc-blair.c b/drivers/clk/qcom/gpucc-blair.c index 8749c0c5fefd..6abd747a9c33 100644 --- a/drivers/clk/qcom/gpucc-blair.c +++ b/drivers/clk/qcom/gpucc-blair.c @@ -441,6 +441,10 @@ static struct clk_regmap *gpu_cc_blair_clocks[] = { [GPU_CC_SLEEP_CLK] = &gpu_cc_sleep_clk.clkr, }; +static const struct qcom_reset_map gpu_cc_blair_resets[] = { + [GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR] = { 0x153c, 0 }, +}; + static const struct regmap_config gpu_cc_blair_regmap_config = { .reg_bits = 32, .reg_stride = 4, @@ -455,6 +459,8 @@ static const struct qcom_cc_desc gpu_cc_blair_desc = { .num_clks = ARRAY_SIZE(gpu_cc_blair_clocks), .clk_regulators = gpu_cc_blair_regulators, .num_clk_regulators = ARRAY_SIZE(gpu_cc_blair_regulators), + .resets = gpu_cc_blair_resets, + .num_resets = ARRAY_SIZE(gpu_cc_blair_resets), }; static const struct of_device_id gpu_cc_blair_match_table[] = { @@ -491,6 +497,8 @@ static int gpu_cc_blair_probe(struct platform_device *pdev) clk_lucid_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config); clk_lucid_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config); + regmap_write(regmap, 0x1538, 0x0); + ret = qcom_cc_really_probe(pdev, &gpu_cc_blair_desc, regmap); if (ret) { dev_err(&pdev->dev, "Failed to register GPU CC clocks\n"); diff --git a/drivers/clk/qcom/gpucc-holi.c b/drivers/clk/qcom/gpucc-holi.c index ef05bc2944cc..b549a7fcefa2 100644 --- a/drivers/clk/qcom/gpucc-holi.c +++ b/drivers/clk/qcom/gpucc-holi.c @@ -443,6 +443,10 @@ static struct clk_regmap *gpu_cc_holi_clocks[] = { [GPU_CC_SLEEP_CLK] = &gpu_cc_sleep_clk.clkr, }; +static const struct qcom_reset_map gpu_cc_holi_resets[] = { + [GPU_CC_FREQUENCY_LIMITER_IRQ_CLEAR] = { 0x153c, 0 }, +}; + static const struct regmap_config gpu_cc_holi_regmap_config = { .reg_bits = 32, .reg_stride = 4, @@ -455,6 +459,8 @@ static const struct qcom_cc_desc gpu_cc_holi_desc = { .config = &gpu_cc_holi_regmap_config, .clks = gpu_cc_holi_clocks, .num_clks = ARRAY_SIZE(gpu_cc_holi_clocks), + .resets = gpu_cc_holi_resets, + .num_resets = ARRAY_SIZE(gpu_cc_holi_resets), }; static const struct of_device_id gpu_cc_holi_match_table[] = { @@ -496,6 +502,8 @@ static int gpu_cc_holi_probe(struct platform_device *pdev) clk_fabia_pll_configure(&gpu_cc_pll0, regmap, &gpu_cc_pll0_config); clk_fabia_pll_configure(&gpu_cc_pll1, regmap, &gpu_cc_pll1_config); + regmap_write(regmap, 0x1538, 0x0); + ret = qcom_cc_really_probe(pdev, &gpu_cc_holi_desc, regmap); if (ret) { dev_err(&pdev->dev, "Failed to register GPU CC clocks\n"); From 76b781c8e54b39ffb2f908376f42d914a66f3fb8 Mon Sep 17 00:00:00 2001 From: Vikash Garodia Date: Wed, 29 Nov 2023 09:32:28 +0530 Subject: [PATCH 8/8] BACKPORT: media: venus: hfi: fix the check in session buffer requirement Buffer requirement, for different buffer type, comes from video firmware. While copying these requirements, there is an OOB possibility when the payload from firmware is more than expected size. Fix the check to avoid the OOB possibility. cherry picked from b18e36dfd6c9 ("media: venus: hfi: fix the check to handle session buffer requirement"). Change-Id: I8169c57b2c244c52bac0b4de460b9820707f6ff7 Cc: stable@vger.kernel.org Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Reviewed-by: Nathan Hebert Signed-off-by: Stanimir Varbanov Signed-off-by: Hans Verkuil Signed-off-by: Vikash Garodia --- drivers/media/platform/qcom/venus/hfi_msgs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/qcom/venus/hfi_msgs.c b/drivers/media/platform/qcom/venus/hfi_msgs.c index 04ef2286efc6..5694d18b43d5 100644 --- a/drivers/media/platform/qcom/venus/hfi_msgs.c +++ b/drivers/media/platform/qcom/venus/hfi_msgs.c @@ -350,7 +350,7 @@ session_get_prop_buf_req(struct hfi_msg_session_property_info_pkt *pkt, memcpy(&bufreq[idx], buf_req, sizeof(*bufreq)); idx++; - if (idx > HFI_BUFFER_TYPE_MAX) + if (idx >= HFI_BUFFER_TYPE_MAX) return HFI_ERR_SESSION_INVALID_PARAMETER; req_bytes -= sizeof(struct hfi_buffer_requirements);