"LA.UM.9.14.1.r1-14100-QCM6490.QSSI14.0"
* tag 'LA.UM.9.14.1.r1-14100-QCM6490.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
msm: adsprpc: use-after-free (UAF) in global maps
sdxnightJar.config: kernel changes for TRIGGER target
msm: mhi_dev: Add UCI support if client req > TRE length
usb: gadget: f_cdev: Call function wakeup if func_wakeup_pending is set
usb: gadget: f_cdev: Bail out from cer_resume if func_suspended
msm: kgsl: Do not release dma and anon buffers if unmap fails
ALSA: compress: Remove redefinition
BACKPORT: media: venus: hfi: fix the check in session buffer requirement
msm: kgsl: Do not free sharedmem if it cannot be unmapped
ALSA: compress: allow pause and resume during draining
securemsm-kernel: Fix multiple listener registration on same fd
Configured process_madvise with upstream syscall number
msm: kgsl: Limit the syncpoint count for AUX commands
msm: kgsl: Prevent wrap around during user address mapping
iommu: Fix missing return check of arm_lpae_init_pte
Change-Id: I59256059b3d15fed896a7ce58d09f0950829dabb
* tag 'LA.UM.9.16.r1-14900-MANNAR.QSSI14.0':
ARM: dts: msm: Set refclock base address for sdxnightjar
ARM: dts: qcom: Add qcom minidump id for sdxlemur
ARM: dts: msm: Add non-wake-svc node
ARM: dts: msm: Add APQ-XR support for Blair
ARM: dts: qcom: Set number of descriptors to 1024
ARM: dts: qcom: Add property for multiple rx queues
ARM: dts: qcom: Add pcie node for Realtek r8168 driver
ARM: dts: msm: add backlight properties for eDP
Change-Id: I1321fe0f79f87f670fe20de4d1635103964638af
In the event when msm_gem_delayed_import returns an error, reset
the obj_dirty property to true to allow the buffer to detach and
attach again.
Change-Id: Ib8da8f237c5a4ab696675cbcf66f1a3dfae02639
Signed-off-by: Samantha Tran <samtran@codeaurora.org>
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
When we import an ION buffer, we call the dma_buf_map_attachment().
The intent is to not map it to the dma device(which in this case is the
KGSl device), but to only get the sg_table. Once we have the sg_table
we later map the physical pages to the GPU SMMU manually and not by using
the dma device ops.
The ION driver as part of the partial cache maintenance requires that
all the sg_tables of the attached devices to the buffer have a single
segment. This creates a problem for KGSL since in this case the kgsl is
a dummy device, so the buffer for KGSL always has multiple segments.
This patch calls the dma_buf_unmap_attachment() as soon we get a hold of
the sg_table as doing so a) we don't need the buffer to be mapped to a
dummy device, b) removes the buffer from the cache maintenance constraints
of the ION driver.
Change-Id: I0675e62c4a27b4e368d53ea6310c9244b687baa6
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
Signed-off-by: Puranam V G Tejaswi <pvgtejas@codeaurora.org>
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Currently, remote heap maps get added to the global list before the
fastrpc_internal_mmap function completes the mapping. Meanwhile, the
fastrpc_internal_munmap function accesses the map, starts unmapping, and
frees the map before the fastrpc_internal_mmap function completes,
resulting in a use-after-free (UAF) issue. Add the map to the list after
the fastrpc_internal_mmap function completes the mapping.
Change-Id: Ia524f142edba57a1f389dd0e5c83a1967c7f5a59
Acked-by: Abhishek Singh <abhishes@qti.qualcomm.com>
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
(cherry picked from commit 6f9f631c90)
"LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/camera-kernel:
msm: camera: memmgr: Add refcount to track umd in use buffers
msm: camera: memmgr: Add refcount to track umd in use buffers
msm: camera: sensor: Handling race condition in util api
Change-Id: I4708288ccf2096b70148fbeb2bb543991ac8df4d
"LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
Asoc: dsp: Fix to check the list is empty or not
dsp: q6lsm: Check size of payload before access
Fix for OOB access issue
dsp: q6asm increase the locking range
ASoC: msm-pcm-q6-v2: Add size check
ASoC : Add proper copyright marking.
dsp: afe: Add check for num_spks
soc: pinctrl-lpi: remove pm ops
asoc: msm-compress: Fix compress_pause failure on gki
Audio legacy: Integer overflow in msm_lsm_ioctl_compat during audio playback usecase. size = sizeof(p_info_32) + p_info_32.param_size; This overflow issue may result heap overflow during copying the data: memcpy(param_info_rsp, &p_info_32, sizeof(p_info_32));
ASoC : Add macro to differentiate auto code
ASoC: msm: get CoPP index based on FE id
asoc: codecs: add array bound check
soc: Address SWR rate mismatch interrupt
asoc : add configuration about SLIMBUS_7_TX
asoc: lahaina: add support for aud_ref_clk_sel mux
dsp: afe: add support for aud_ref_clk_sel mux
ASoC: dsp: Release lock before return
ASoC: wcd937x: Add flag to decide RX_MUTE for HPHL and EAR
ASoC: bolero: Add check for CMPDR switch
ASoC : add support of HDMI controller for rb3gen2 platform
asoc: lahaina: fractional sample rate support for TDM
asoc: support for fractional sample rate over tdm
Revert "asoc: msm-compress : Fix for CTS-on-gsi with gki"
audio-kernel:swr: Add dynamic SWRM clk support
asoc: codec: make mclk freq configurable in Bolero
asoc: lahaina: Add ext clk source support
asoc: ext-clk: Add support for configuring ext clk
dsp: afe: Enhance and expose API for configuring ext clk
dsp: q6voice: Handle mutex lock-unlock
asoc: msm-compress : Fix for CTS-on-gsi with gki
Change-Id: I21b8e5f5ef608bf298230419123e4ee37c9b0797
"LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0"
* tag 'LA.UM.9.14.r1-24700-LAHAINA.QSSI15.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
msm: npu v1: Fix OOB issue in IPC between driver and firmware
mmc: sdhci-msm: Disable partial_init and clk-scaling to avoid RED error
slimbus: qcom-ngd-ctrl: Avoid accessing deallocated stack
msm_ipa: new structure for tunnel design for uC
msm: ipa3: change variable name for indication of rx tlv format
soc: qcom: llcc: Handle a second device without data corruption
msm: eva: User after free fix in msm_cvp_mark_user_persist
rpmsg: slatecom: out of bound read from process_cmd
soc: qcom: msm_minidump: Configurable Encryption support
defconfig: arm64: Disable trimming non-whitelisted symbols
soc: qcom: add out of bound check for AON fifo
rpmsg: slatecom: maintain rx_size to read
Revert LLCC changes
bus: mhi: Fix potential out-of-bound access
Conflicts:
arch/arm64/boot/dts/vendor/bindings/interrupt-controller/ti,sci-intr.txt
drivers/soc/qcom/llcc-slice.c
drivers/usb/dwc3/core.c
kernel/events/core.c
mm/memory-failure.c
Change-Id: Ie4d89454f0766d0a48ebd4f2e6facb6deca9ea57
Currently struct ipa_wdi_conn_in_params occupies 1588 bytes and putting
it on the stack is rather expensive, which could potentially lead to
stack corruption.
Fix is to reduce stack usage in dp_ipa_setup by dynamically allocating
struct ipa_wdi_conn_in_params on the heap.
Change-Id: I8f71f44906a5c95f37627f7573b57b7825daaa7e
CRs-Fixed: 2852027
In qrtr_get_service_id, use xa_load instead of node_get to check
if the node exists or not. Calling node_get from interrupt context
can cause potential deadlock since it calls into xa_store to
allocate the node if it does not exist.
Change-Id: Ida9f7a113417f0d184c0903004d94dd2eca6c472
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
The return value for of_property_count_u32_elems can be negative in the
case of an error or the property is not found. It is incorrect to use
size_t, unsigned type, as this can cause an overflow. Switch size from
type size_t to int.
Change-Id: Ica0425abd034b82994ab32087f04d602ce3dd9e9
Signed-off-by: Tony Truong <quic_truong@quicinc.com>
Fix a compilation error seen when casting void pointer to
int by casting it to uintptr_t instead.
Change-Id: I679da04f21041c386fa7ad8905ede94e12ea160c
Signed-off-by: Jishnu Prakash <quic_jprakash@quicinc.com>
../drivers/thermal/qcom/max31760_fan.c:331:3: error: ignoring return
value of function declared with 'warn_unused_result' attribute
[-Werror,-Wunused-result]
(pdata->vdd_reg);
^~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~
Change-Id: I06fb07da60cb765e4daf98c38afdb97690491c6f
Fixes:
../drivers/input/touchscreen/focaltech_touch/focaltech_core.c:979:3:
error: ignoring return value of function declared with
'warn_unused_result' attribute [-Werror,-Wunused-result]
PTR_ERR(acl_desc);
^~~~~~~ ~~~~~~~~
../drivers/input/touchscreen/focaltech_touch/focaltech_core.c:986:3:
error: ignoring return value of function declared with
'warn_unused_result' attribute [-Werror,-Wunused-result]
PTR_ERR(sgl_desc);
^~~~~~~ ~~~~~~~~
Change-Id: I941c32696a52a84a0a9272d4f969755932925aaa
../net/ipv4/tcp_timer.c:202:27: warning: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Wsingle-bit-bitfield-constant-conversion]
icsk->icsk_mtup.enabled = 1;
Change-Id: I7e1b4013ba6a67fad27a611d30f98939ceaa5109
../techpack/dataipa/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c:510:41: warning: implicit conversion from enumeration type 'enum ipa_ip_type_enum_v01' to different enumeration type 'enum ipa_ip_type' [-Wenum-conversion]
q6_ul_flt_rule_ptr->ip = flt_spec_ptr->ip_type;
~ ~~~~~~~~~~~~~~^~~~~~~
../techpack/dataipa/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c:511:45: warning: implicit conversion from enumeration type 'enum ipa_filter_action_enum_v01' to different enumeration type 'enum ipa_flt_action' [-Wenum-conversion]
q6_ul_flt_rule_ptr->action = flt_spec_ptr->filter_action;
~ ~~~~~~~~~~~~~~^~~~~~~~~~~~~
Change-Id: I0eb68d707151cd103676a30659ab81bf6fced131
Ensures that no new warnings are introduced to the build.
Bug: 141372918
Change-Id: I4107af91f5c1ddd655037823350e005e8362d588
Signed-off-by: Chenglu Lin <chenglulin@google.com>
Add configuration option CONFIG_CC_WERROR to prevent warnings
from creeping in.
Bug: 141372918
Change-Id: Ie2d067c0177d8f13e9aaa9a78867998e390f89ee
Signed-off-by: Chenglu Lin <chenglulin@google.com>
When CONFIG_CFI_CLANG and CONFIG_DYNAMIC_FTRACE are enabled, LLVM will
generate a jump function named ftrace_call.cfi_jt for ftrace_call, which
makes "&ftrace_call" in ftrace_update_ftrace_func() actually the address
of ftrace_call.cfi_jt. As a result, the tracer can't be really enabled
through runtime modification. Use __va_function() to get the actual address
of ftrace_call to fix the issue.
Bug: 184105181
Signed-off-by: Ben Dai <ben.dai@unisoc.com>
Change-Id: Ic9272cd4ab447b3b145d8e397e5c9010c49f7a12
After the switch to non-canonical CFI jump tables, the jump table
sections were placed after the .text section. Merge these sections
into .text to fix issues with error injection and kallsyms.
Bug: 225079388
Bug: 190422440
Change-Id: I6c81b3e4dbba62739f7fc5f6b45271c54f278c8f
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Handle error return value from copy_to_user() in ioctls to avoid
following compilation failure.
"error: ignoring return value of function declared with 'warn_unused_result'
attribute".
Change-Id: I92944ade7fb88e0543ca4254fab226da5777def7
Signed-off-by: Jeevan Shriram <quic_jshriram@quicinc.com>
It never hurts to know if drivers have some flaws.
Change-Id: Iba3acda0eeec9448fc907def5b3d25f117bc818b
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
This flag is specific to clang, where it is only used by the 32-bit and
64-bit ARM backends. In certain situations, the presence of this flag
will cause a warning, as shown by commit 6580c5c18fb3 ("um: clang: Strip
out -mno-global-merge from USER_CFLAGS").
Since commit 61163efae0 ("kbuild: LLVMLinux: Add Kbuild support for
building kernel with Clang") that added this flag back in 2014, there
have been quite a few changes to the GlobalMerge pass in LLVM. Building
several different ARCH=arm and ARCH=arm64 configurations with LLVM 11
(minimum) and 15 (current main version) with this flag removed (i.e.,
with the default of '-mglobal-merge') reveals no modpost warnings, so it
is likely that the issue noted in the comment is no longer relevant due
to changes in LLVM or modpost, meaning this flag can be removed.
If any new warnings show up that are a result of the removal of this
flag, it can be added back under arch/arm{,64}/Makefile to avoid
warnings on other architectures.
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: David Gow <davidgow@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Sedat Dilek <sedat.dilek@gmail.com>
Reviewed-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
(cherry picked from commit cf300b83c793c25c6b485fdaf7a4447d8ea4c655)
Change-Id: Ice39a960619319828b83c8091798fe383395a2b0
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
strlen(swr_dmic_name_prefix_of) + 1 bytes are allocated for prefix_name just above
techpack/audio/asoc/codecs/swr-dmic.c:685:11: error: size argument in 'strlcpy' call appears to be size of the source; expected the size of the destination [-Werror,-Wstrlcpy-strlcat-size]
strlen(swr_dmic_name_prefix_of) + 1);
~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~
1 error generated.
Change-Id: I808b4f135d42fc50587eeb9348848f7e0a3561cc
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
The size is checked just above.
../drivers/hwtracing/coresight/coresight-tmc.c:423:26: warning: 'sscanf' may overflow; destination buffer in argument 3 has size 10, but the corresponding specifier may require size 11 [-Wfortify-source]
423 | if (sscanf(buf, "%10s", str) != 1)
| ^
../drivers/hwtracing/coresight/coresight-tmc.c:464:26: warning: 'sscanf' may overflow; destination buffer in argument 3 has size 10, but the corresponding specifier may require size 11 [-Wfortify-source]
464 | if (sscanf(buf, "%10s", str) != 1)
| ^
2 warnings generated.
Change-Id: I5db199a85ba0c7dfc15fae5d62c9c4d8c550d3e7
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Extracted from I54b58226e3d6de0b674ac4ca1407138d1c9707e8
../drivers/soc/qcom/msm_minidump.c:521:39: warning: size argument in 'strlcpy' call appears to be size of the source; expected the size of the destination [-Wstrlcpy-strlcat-size]
521 | strlcpy(banner, linux_banner, strlen(linux_banner) + 1);
| ~~~~~~~^~~~~~~~~~~~~~~~~
1 warning generated.
Change-Id: I43fa5006150dd402405f8c942571f08da0eb714a
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Only 19 characters out of total 20 can be used due to the '\0' terminator.
Change-Id: I34883be26f97a16fdcb5ff97ff326d98f4d93c18
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
CAF cherry-picked an obsolete LLVMLinux patch from 2014 in commit
a2a31f1ddc that introduced this
unnecessary flag. Now that the functions used by Clang's libcall
optimizations have been implemented, we can allow Clang to perform said
optimizations for a minor performance bump in certain code paths.
Change-Id: Ifa6b731c9702973be2c656d341e33a6186ed7cf2
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
This reverts commit 1210d2329b.
Unnecessary with Clang 6.0+.
Change-Id: I6f29ca050566e9027e51605e64bf6893602344ef
Signed-off-by: Danny Lin <danny@kdrag0n.dev>
We don't need to know that PM notifiers are working. Silence the entry/exit
log spam in ipa_pm_notify().
Change-Id: I9bae89fa5e27b8835683ec1423ecc751491ea13c
Signed-off-by: Sultan Alsawaf <sultan@osomprivacy.com>
After commit 1248f43abe ("arm64: Move the LSE gas support detection to Kconfig")
CONFIG_ARM64_USE_LSE_ATOMICS should be used to disable LSE atomics usage.
Change-Id: Ibb1abef274883b74b3d6151cc0fbe1647d5b9076
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
The conditional was mistakenly removed in e4e5585516.
Change-Id: If8fdb03cbda21a75b2c6ad00cee268f1a1c3ebe1
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Do not mark MPM as wake irq. Break s2idle suspend when MPM irq
is pending.
Change-Id: Ia455c589fdadcaa3be6084a68990887a2d4c3517
Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
Add IRQCHIP_SET_TYPE_MASKED flag for gpio and gic irqchips.
Change-Id: Ie6bf76ab2c98e4bc40ad4adfb13da9c9b69734c9
Signed-off-by: Maulik Shah <quic_mkshah@quicinc.com>
