UAF is observed while unloading the interconnect driver.
Interconnect is core to the system and should not
be unloaded once it is probed. Marking the driver as
permanent by removing the module_exit function.
Change-Id: I0c8cfd628483cd44408b987e4765dc7237ef7ad5
Signed-off-by: Raviteja Laggyshetty <quic_rlaggysh@quicinc.com>
UAF is observed while unloading the interconnect driver.
Interconnect is core to the system and should not
be unloaded once it is probed. Marking the driver as
permanent by removing the module_exit function.
Change-Id: I7a840812752b34248ec3dcb241b069cf4bf77608
Signed-off-by: Raviteja Laggyshetty <quic_rlaggysh@quicinc.com>
UAF is observed while unloading the interconnect driver.
Interconnect is core to the system and should not
be unloaded once it is probed. Marking the driver as
permanent by removing the module_exit function.
Change-Id: If4ddebec67f008e5412c1bf03bed0693fcaaffe0
Signed-off-by: Raviteja Laggyshetty <quic_rlaggysh@quicinc.com>
Suppose user has sent invalid external fence to bind API. Now, while
binding, if synx signal comes in parallel, it will set number of bound
synxs as 0 after signal. Further reduction on that number(num_bound_synxs)
(in case of callback registration failure) would make it wrap
around. So, now num_bound_synxs is large value and abrupt close on synx
fd will lead to synx_util_object_destroy. Here, the for loop on
num_bound_synxs would lead to invalid memory access.
This change decrements num_bound_synxs only if not zero.
Change-Id: I0cfffc90d4164b149c87545818ae4dcf57fc4c46
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
Added reference count for contex map indicate memory under used
in remote call. And, this memory would not removed in internal
unmap to avoid UAF.
Change-Id: Ieb4ff6b298ff9c48953bc5b3539fdfe19a14b442
Acked-by: Santosh Sakore <ssakore@qti.qualcomm.com>
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
As part of FR53657, make changes to support for boot_a and
boot_b partition access to HLOS APPS.
Change-Id: Ic173bd54df11e42b1811c198314719c4c34338db
Signed-off-by: Pradeep P V K <quic_pragalla@quicinc.com>
Postamble packets are executed in privileged mode by gpu. So we should keep
them in a privileged scratch buffer to block userspace access. For
targets with APRIV feature support, we can mark the preemption scratch
buffer as privileged too to avoid similar issues in future.
Change-Id: Ifda360dda251083f38dfde80ce1b5dc83daae902
Signed-off-by: Akhil P Oommen <quic_akhilpo@quicinc.com>
Signed-off-by: Kaushal Sanadhya <quic_ksanadhy@quicinc.com>
Move service id based filter check before queueing skb to avoid
possible use after free issue since skb might get released once
rx thread completed the processing of skb.
Change-Id: Iff93e32abd3d55f78bf4ce80675fc3bb312b0841
Signed-off-by: Arun Prakash <quic_app@quicinc.com>
In ioctls like kgsl_ioctl_submit_commands(), if both syncobj
type and cmd/marker/sparseobj type are submitted, the syncobj
is queued first followed by the other obj type. After syncobj
is successfully queued, in case of failure in get_timestamp
while queuing the other obj, both the command objs are
destroyed. As sync obj is already queued, accessing this
later would cause a crash.
Compare the user generated timestamp with the drawctxt
timestamp and return early in case of error. This avoids
unnecessary queuing of drawobjs.
Change-Id: Iedebd480bc18cd74d2f69d24a9dc1032fab01cdb
Signed-off-by: Kamal Agrawal <quic_kamaagra@quicinc.com>
If we're in the middle of series of chained TRBs, DWC3 will
avoid clearing HWO and SW has to do it manually.
We are doing it while reclaiming trbs for sg transfers.
Add check for sg queued trb and reclaim it as DWC3 skips
clearing HWO bit during sg transfers.
Change-Id: I200254728c0549da6534aea51daad94be6b6295e
Signed-off-by: AKASH KUMAR <quic_akakum@quicinc.com>
This change blocks access to channel name string,
in case channel name string length is more than permissible limits.
Change-Id: I2fe0b32498bc74011b1d42bb3c056c7e174494ca
Signed-off-by: rakegand <quic_rakegand@quicinc.com>
EDP reference clock for Yupik is required by EDP consumer.
Change-Id: I981bbaa789cdce86a140d17b81d46d590cc7d980
Signed-off-by: Taniya Das <quic_tdas@quicinc.com>
find_get_page() returns a page with increased refcount, assuming a page
exists at the given index. Ensure this refcount is dropped on error.
Bug: 271079833
Fixes: 59d4d125 ("BACKPORT: FROMLIST: mm: implement speculative handling in filemap_fault()")
Change-Id: Idc7b9e3f11f32a02bed4c6f4e11cec9200a5c790
Signed-off-by: Patrick Daly <quic_pdaly@quicinc.com>
(cherry picked from commit 6232eecfa7ca0d8d0ca088da6d0edb2c3a879ff9)
Signed-off-by: Zhenhua Huang <quic_zhenhuah@quicinc.com>
Git-commit: 1d05213028b6dbdb8801e20f29b6a6f91c216033
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_dst_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others are actually moving across cgroups. For example, this can happen with
the following sequence on cgroup1:
#1> mkdir -p /sys/fs/cgroup/misc/a/b
#2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs
#3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS &
#4> PID=$!
#5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks
#6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs
the process including the group leader back into a. In this final migration,
non-leader threads would be doing identity migration while the group leader
is doing an actual one.
After #3, let's say the whole process was in cset A, and that after #4, the
leader moves to cset B. Then, during #6, the following happens:
1. cgroup_migrate_add_src() is called on B for the leader.
2. cgroup_migrate_add_src() is called on A for the other threads.
3. cgroup_migrate_prepare_dst() is called. It scans the src list.
3. It notices that B wants to migrate to A, so it tries to A to the dst
list but realizes that its ->mg_preload_node is already busy.
4. and then it notices A wants to migrate to A as it's an identity
migration, it culls it by list_del_init()'ing its ->mg_preload_node and
putting references accordingly.
5. The rest of migration takes place with B on the src list but nothing on
the dst list.
This means that A isn't held while migration is in progress. If all tasks
leave A before the migration finishes and the incoming task pins it, the
cset will be destroyed leading to use-after-free.
This is caused by overloading cset->mg_preload_node for both src and dst
preload lists. We wanted to exclude the cset from the src list but ended up
inadvertently excluding it from the dst list too.
This patch fixes the issue by separating out cset->mg_preload_node into
->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst
preloadings don't interfere with each other.
Bug: 236582926
Change-Id: Ieaf1c0c8fc23753570897fd6e48a54335ab939ce
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reported-by: shisiyuan <shisiyuan19870131@gmail.com>
Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com
Link: https://lore.kernel.org/lkml/Yh+RGIJ0f3nrqIiN@slm.duckdns.org/#t
Fixes: f817de9851 ("cgroup: prepare migration path for unified hierarchy")
Cc: stable@vger.kernel.org # v3.16+
(cherry picked from commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447
https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-5.19-fixes)
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
[mojha: Move the two new list heads into a wrapper ext_css_set struct to ensure
ABI doesn't break and also defined a macro init_css_set which will be replaced
with init_ext_css_set.cset to avoid too much code changes]
Git-commit: e8fce594347a77af0481c18b6b56509b954fa771
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
In some targets, it is observed that the time difference between vbus
being provided by exerciser and the terminations being applied is
more than 1 second causing failures of Type-C compliance testcases
4.10.2 and 4.10.3
When policy engine's psy changed work gets kicked in first time from
vbus present interrupt callback of charger driver, we kick in usb pd
sm work and it keeps running. Since apsd is not yet done, we don't
queue peripheral work. When apsd is done and charger driver invokes
power supply changed work, policy engine bails out as sm work is
already running although the charger type is detected as SDP/CDP and
were supposed to send an extcon notification. As a result the extcon
is sent when the sm work hits enter snk startup call and it
recognises that apsd is done and charger type is SDP or CDP and sends
extcon. This is results in a delay of roughly 1.3 seconds from the
moment vbus got detected to the moment we provide extcon notification
to dwc3-msm.
To avoid this, check for charger type and provide extcon if haven't
done already in the psy_changed_notifier_work. This reduces the time
delay to around 0.5 seconds helping resolve compliance issue.
Change-Id: I02c9a4a6b21ca75d43fd68f2447a7388210a4856
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
* refs/heads/tmp-2af3bdf:
UPSTREAM: ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop
UPSTREAM: net_sched: reject TCF_EM_SIMPLE case for complex ematch module
UPSTREAM: ipv6: ensure sane device mtu in tunnels
BACKPORT: iommu: Avoid races around device probe
BACKPORT: mac80211_hwsim: notify wmediumd of used MAC addresses
FROMGIT: mac80211_hwsim: add concurrent channels scanning support over virtio
ANDROID: ABI: Cuttlefish Symbol update
UPSTREAM: media: dvb-core: Fix UAF due to refcount races at releasing
Change-Id: I92cded046f502ab95484e44ecc3d01337a065d87
Signed-off-by: kamasali Satyanarayan <quic_kamasali@quicinc.com>
In mhi_unregister_mhi_controller function, flush the work queue and then
destroy it for releasing the memory of unused workqueues.
When multiple mhi-based WLAN endpoints are attached directly or
over switch, then there can be multiple mhi controllers and
so CNSS driver calls for mhi controller registration multiple times.
Each time invoking mhi controller register creates another set of
workqueues and previous workqueues become stale.
By doing so, it will consume the system memory.
So, better to release the memory assigned to workqueue by destroying
the work queue in mhi_unregister_mhi_controller function.
Change-Id: I838371e9c00969a64e658e6175115363ccb916bf
Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu@quicinc.com>
Fix for the timing difference between host writing into MSI
capability register and MHI MMIO init where the first instance
of setting or resetting the msi_disable flag. Hence, updating
the msi_disable flag on fetching the MSI config from PCIe.
This will ensure to update the flag value in the case of EP
reading the MSI capability register before the host sets it.
Change-Id: I508a85e7107ee5a575fc03d54ab3e445049d73b2
Signed-off-by: Mohana Basava Tejesh Reddy Mareddy <quic_mmareddy@quicinc.com>
Memory allocation is happening without checking the overflow.
This could lead to an unexpected results. Check for overflow
before allocating memory.
Change-Id: Icb513ebd8030976e3f0970e9542596f9c5917843
Signed-off-by: Murali Nalajala <quic_mnalajal@quicinc.com>
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
SPF attempts page faults without taking the mmap lock, but takes the
PTL. If there is a concurrent fast mremap (at PMD/PUD level), this
can lead to a UAF as fast mremap will only take the PTL locks at the
PMD/PUD level. SPF cannot take the PTL locks at the larger subtree
granularity since this introduces much contention in the page fault
paths.
To address the race:
1) Only try fast mremaps if there are no users of the VMA. Android
is concerned with this optimization in the context of
GC stop-the-world pause. So there are no other threads active
and this should almost always succeed.
2) Speculative faults detect ongoing fast mremaps and fallback
to conventional fault handling (taking mmap read lock).
Bug: 263177905
Change-Id: I23917e493ddc8576de19883cac053dfde9982b7f
Signed-off-by: Kalesh Singh <kaleshsingh@google.com>
Git-commit: 529351c4c8202aa7f5bc4a8a100e583a70ab6110
Git-repo: https://android.googlesource.com/kernel/common/
[quic_c_spathi@quicinc.com: resolve merge conflicts]
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
Make changes to add new proc ctx and uCP commands to support Proxy Mobile IPv6.
Change-Id: I4c0995ffe6969c3183e6b16dd6dbd1203d7bec43
Signed-off-by: Krishna Nagaraja <quic_krisnag@quicinc.com>
commit eee22187b53611e173161e38f61de1c7ecbeb876 upstream.
In do_writepages, if the value returned by ext4_writepages is "-ENOMEM"
and "wbc->sync_mode == WB_SYNC_ALL", retry until the condition is not met.
In __ext4_get_inode_loc, if the bh returned by sb_getblk is NULL,
the function returns -ENOMEM.
In __getblk_slow, if the return value of grow_buffers is less than 0,
the function returns NULL.
When the three processes are connected in series like the following stack,
an infinite loop may occur:
do_writepages <--- keep retrying
ext4_writepages
mpage_map_and_submit_extent
mpage_map_one_extent
ext4_map_blocks
ext4_ext_map_blocks
ext4_ext_handle_unwritten_extents
ext4_ext_convert_to_initialized
ext4_split_extent
ext4_split_extent_at
__ext4_ext_dirty
__ext4_mark_inode_dirty
ext4_reserve_inode_write
ext4_get_inode_loc
__ext4_get_inode_loc <--- return -ENOMEM
sb_getblk
__getblk_gfp
__getblk_slow <--- return NULL
grow_buffers
grow_dev_page <--- return -ENXIO
ret = (block < end_block) ? 1 : -ENXIO;
In this issue, bg_inode_table_hi is overwritten as an incorrect value.
As a result, `block < end_block` cannot be met in grow_dev_page.
Therefore, __ext4_get_inode_loc always returns '-ENOMEM' and do_writepages
keeps retrying. As a result, the writeback process is in the D state due
to an infinite loop.
Add a check on inode table block in the __ext4_get_inode_loc function by
referring to ext4_read_inode_bitmap to avoid this infinite loop.
Cc: stable@kernel.org
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20220817132701.3015912-3-libaokun1@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 264629802
Bug: 264632463
Change-Id: Id3bb71336059cac33f16fca383e783add3a01295
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
[ Upstream commit 9cd3fd2054c3b3055163accbf2f31a4426f10317 ]
When TCF_EM_SIMPLE was introduced, it is supposed to be convenient
for ematch implementation:
https://lore.kernel.org/all/20050105110048.GO26856@postel.suug.ch/
"You don't have to, providing a 32bit data chunk without TCF_EM_SIMPLE
set will simply result in allocating & copy. It's an optimization,
nothing more."
So if an ematch module provides ops->datalen that means it wants a
complex data structure (saved in its em->data) instead of a simple u32
value. We should simply reject such a combination, otherwise this u32
could be misinterpreted as a pointer.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+4caeae4c7103813598ae@syzkaller.appspotmail.com
Reported-by: Jun Nie <jun.nie@linaro.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Cong Wang <cong.wang@bytedance.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Bug: 262113355
Bug: 262114215
Change-Id: I03be57351f76f699d4635cf31178e0f3a19e61a5
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
