Left-shifting a 32-bit integer by 32 bits or more results in UB. The
common values for vbif_xin_id[] are {10, 11} which means reg_shift
becomes 40/44. For IDs >= 8, the shift is meant to be relative to the
second 32-bit register, not to the first. Fix this issue by masking the
ID so that it will properly describe the intended shift.
Change-Id: Icd530a3bb7cfd9d087e2aecc763d24f775e20466
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
The 'display->modes' pointer must be set to NULL immediately
after calling kfree on it to prevent potential double-free
vulnerabilities or use-after-free issues.
This change ensures robust memory management by clearing the
pointer to previously freed memory, aligning with best practices
for kernel memory deallocation.
Change-Id: I4fd939bc6ee5f3d9c506f0c311a9400f366e7fd2
Signed-off-by: Vedant Yevale <vyevale@qti.qualcomm.com>
(cherry picked from commit 1d3c5a477ea8f6aca1158209e1b87209c21c61f5)
LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0
* tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/video-driver:
msm: vidc: Fix use after free in driver
msm: vidc: Enable hybrid mode only for HFR usecase
Change-Id: Ic2a5c64a04bcd2bed2c853f541255b7563d9b65c
LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0
* tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/dataipa:
ipa: Added changes to move the hdr entry to free list
msm: ipa: Avoid use-after-free scenario
Change-Id: I53d9b6e5cd83948d5a7cd67b8b7ffa58af13efef
LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0
* tag 'LA.UM.9.14.1.r1-21100-QCM6490.QISI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: lsm: thread safety issue in hw params management
asoc: lsm: Race condition protection in confidence levels handling
asoc: lsm: thread safety issue while accessing substream data
asoc: compress: race condition handling in stream cmd put function
asoc: handle heap overflow in effect driver
asoc: Update dai link for ACM8625S AMP.
asoc: Modification for 8ch capture
audio-kernel: Fix wcd938x DMIC unable to record
audio-kernel: Enable hdmi in audio function for AIO bar
dsp: q6adm: Checking array sizeof channel_type
asoc: codec: avoid out of bound write to map array
dsp: q6lsm: Check size of payload before access
Change-Id: I9eebb44e5b838891dc094853e28535930dee6b83
LA.UM.9.14.r1-26000-LAHAINA.QSSI15.0
# By Jayasri Sampath Kumaran
# Via Karthik Veeranki (1) and Linux Build Service Account (1)
* tag 'clo/display-drivers/LA.UM.9.14.r1-26000-LAHAINA.QSSI15.0':
disp: msm: sde: fix kms NULL pointer access in encoder IRQ control
Change-Id: I52a1f3a27d8eed895e1db8a48f15c225d1c1c3ea
LA.UM.9.14.r1-26000-LAHAINA.QSSI15.0
# By Ratna Deepthi Kudaravalli
# Via Linux Build Service Account (1) and Ratna Deepthi Kudaravalli (1)
* tag 'clo/audio-kernel/LA.UM.9.14.r1-26000-LAHAINA.QSSI15.0':
audio-kernel: avoid out of bound read while checking a bit
Change-Id: I70a5aa2eb95361d9181d5e93a2bbbcce590ce7db
This partially reverts commit 2e77a46f0d.
Reason for revert: ipa3_mdt_load_ipa_fws is not present in this kernel,
this is a bad cherrypick resolution by qcom.
Change-Id: I218978168a6c3fe9f6139a6688be1cb4c0f96b94
"LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-25800-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: codec: avoid out of bound write to map array
asoc: codec: avoid out of bound write to map array
asoc: Fixed OOB issue in qcs405
asoc: codec: wcd934x: enable auto recovery when port overflows
Change-Id: I51a30fe905251b6f66e733bae43fdcd3b0a7e787
- Proper Handling in case of invalid pinctrl index
- Removing dead code and unused variables
- Change to dereference s_ctrl only after proper
NULL Dereference Check.
CRs-Fixed: 3875406
Change-Id: I8e2c717b22efff2a7d6503d38c048e30eff230da
Signed-off-by: Swami Reddy Reddy <quic_swamired@quicinc.com>
"LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
msm: camera: sensor: handling condition for random read
msm: camera: icp: io buf config num validation
msm: camera: ope: check cpu buffer offset and cmd buf idx
Change-Id: Id26854dd09597215befc5aaff1e5f6731a0fb3e0
"LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-25000.02-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
dsp: q6voice: Add buf size check for cvp cal data
asoc: msm-lsm-client: check for param size before copying
Change-Id: Ia786a33ae66c307d1af54b84796178928cf6ca01
sde_splash_data struct can fit MAX_DSI_DISPLAYS displays and >=
comparison here prevents us from storing the last display when
num_displays == MAX_DSI_DISPLAYS.
Change-Id: I56e62f77a56cdd2d5086e46762614c941ddacd6a
"LA.UM.9.14.1.r1-14100-QCM6490.QSSI14.0"
* tag 'LA.UM.9.14.1.r1-14100-QCM6490.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
asoc: Fix out-of-bound write
dsp: q6voice: Adds checks for an integer overflow
dsp: q6voice: Adds checks for an integer overflow
Change-Id: Ieb4b3e8ead0616624b7492cfc42bb72a024525b7
In the event when msm_gem_delayed_import returns an error, reset
the obj_dirty property to true to allow the buffer to detach and
attach again.
Change-Id: Ib8da8f237c5a4ab696675cbcf66f1a3dfae02639
Signed-off-by: Samantha Tran <samtran@codeaurora.org>
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
"LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
msm: camera: memmgr: Add refcount to track umd in use buffers
msm: camera: memmgr: Add refcount to track umd in use buffers
msm: camera: sensor: Handling race condition in util api
Change-Id: I4708288ccf2096b70148fbeb2bb543991ac8df4d
"LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
Asoc: dsp: Fix to check the list is empty or not
dsp: q6lsm: Check size of payload before access
Fix for OOB access issue
dsp: q6asm increase the locking range
ASoC: msm-pcm-q6-v2: Add size check
ASoC : Add proper copyright marking.
dsp: afe: Add check for num_spks
soc: pinctrl-lpi: remove pm ops
asoc: msm-compress: Fix compress_pause failure on gki
Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));
ASoC : Add macro to differentiate auto code
ASoC: msm: get CoPP index based on FE id
asoc: codecs: add array bound check
soc: Address SWR rate mismatch interrupt
asoc : add configuration about SLIMBUS_7_TX
asoc: lahaina: add support for aud_ref_clk_sel mux
dsp: afe: add support for aud_ref_clk_sel mux
ASoC: dsp: Release lock before return
ASoC: wcd937x: Add flag to decide RX_MUTE for HPHL and EAR
ASoC: bolero: Add check for CMPDR switch
ASoC : add support of HDMI controller for rb3gen2 platform
asoc: lahaina: fractional sample rate support for TDM
asoc: support for fractional sample rate over tdm
Revert "asoc: msm-compress : Fix for CTS-on-gsi with gki"
audio-kernel:swr: Add dynamic SWRM clk support
asoc: codec: make mclk freq configurable in Bolero
asoc: lahaina: Add ext clk source support
asoc: ext-clk: Add support for configuring ext clk
dsp: afe: Enhance and expose API for configuring ext clk
dsp: q6voice: Handle mutex lock-unlock
asoc: msm-compress : Fix for CTS-on-gsi with gki
Change-Id: I21b8e5f5ef608bf298230419123e4ee37c9b0797
../techpack/dataipa/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c:510:41: warning: implicit conversion from enumeration type 'enum ipa_ip_type_enum_v01' to different enumeration type 'enum ipa_ip_type' [-Wenum-conversion]
q6_ul_flt_rule_ptr->ip = flt_spec_ptr->ip_type;
~ ~~~~~~~~~~~~~~^~~~~~~
../techpack/dataipa/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c:511:45: warning: implicit conversion from enumeration type 'enum ipa_filter_action_enum_v01' to different enumeration type 'enum ipa_flt_action' [-Wenum-conversion]
q6_ul_flt_rule_ptr->action = flt_spec_ptr->filter_action;
~ ~~~~~~~~~~~~~~^~~~~~~~~~~~~
Change-Id: I0eb68d707151cd103676a30659ab81bf6fced131
strlen(swr_dmic_name_prefix_of) + 1 bytes are allocated for prefix_name just above
techpack/audio/asoc/codecs/swr-dmic.c:685:11: error: size argument in 'strlcpy' call appears to be size of the source; expected the size of the destination [-Werror,-Wstrlcpy-strlcat-size]
strlen(swr_dmic_name_prefix_of) + 1);
~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
Change-Id: I808b4f135d42fc50587eeb9348848f7e0a3561cc
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
We don't need to know that PM notifiers are working. Silence the entry/exit
log spam in ipa_pm_notify().
Change-Id: I9bae89fa5e27b8835683ec1423ecc751491ea13c
Signed-off-by: Sultan Alsawaf <sultan@osomprivacy.com>
"LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/dataipa:
msm: ipa3: reduce rx-wan pool and cmn page, temp pool sizes
msm: ipa: allocate page recycling buffers only once
msm: ipa: avoid OOM Killer for temp allocations
msm: ipa3: Flush free page WQ only for page recyle replenish handler
msm: ipa3: Fix to flush to workqueue during teardown pipe
msm: ipa3: Fix to destory workqueue only if created
msm: ipa3: Changes to enhance find free pages from list
msm: ipa: page pool recycling enhancements
msm: ipa: page pool recycling enhancements
Change-Id: I21c0f5974f08fc032605d2710858eb28e592d1f0
"LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0"
* tag 'LA.UM.9.14.r1-24200-LAHAINA.QSSI13.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
msm: camera: sensor: Proper handling of race condition in util api
msm: camera: sensor: Proper handling of race condition in util api
msm: camera: memmgr: Add missing calls of put buf to avoid leak
Change-Id: I0aff5a21e16f44c2e13ed99b463f326eb57b1653
"LA.UM.9.14.r1-23800-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23800-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/dataipa:
msm: ipa: Null terminated interface name string argument received from ioctl
msm: ipa3: creating new ipc log file for IPA Clocks
Change-Id: I4135d434cb5e7dd1009ce2a66ce0f3d81bf3588a
"LA.UM.9.14.r1-23300-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-23300-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/display-drivers:
disp: msm: sde: skip msm_lastclose if display is stuck in splash
disp: msm: cancel all delayed_works before triggering msm_lastclose
disp: msm: sde: cancel delayed work items during TUI transition
Change-Id: I8dbdda8ada31d7d58a5aceaf7e72d6955cee2ec2
