"LA.UM.9.14.r1-22200-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-22200-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/opensource/audio-kernel:
ASoC: msm-pcm-q6-v2: Add dsp buf check
ASoC: Add the judgment for TDM
asoc: swrm: disable bus reset based on swrm verison
dsp: afe: Add check for sidetone iir config copy size
ASoC: msm-pcm-host-voice: Address buffer overflow in hpcm playback copy
ASoC: msm-pcm-voip: Avoid interger underflow
dsp: asm: validate payload size before access
dsp: afe: check for param size before copying
dsp: q6core: validate payload size before access for AVCS
dsp: afe: Add check for num_channels
soc: swr-mstr-ctrl: add new lock to sync runtime_resume and runtime_suspend
soc: reduce the auto suspend timeout when swr event finished
Change-Id: I82d3446a3ecf6cf47f75ab34a292557f24339ebb
"LA.UM.9.14.r1-22200-LAHAINA.QSSI14.0"
* tag 'LA.UM.9.14.r1-22200-LAHAINA.QSSI14.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
usb: gadget: cdev: Add spinlock to synchronize ports->cbits_updated
msm: ep_pcie: Set clock power management bit for EP
msm: Add config option for R8168 IOSS glue driver
ipa_eth: Header change to pass more info from ETH to GSI
Change-Id: Ib6b27009e9867a605881464b80926daf6e0da25b
The reg in soc_dapm_mux is 32-bit. The BE DAI ID passed
as shift(to be operated on the reg) may be more than 31,
which may cause overflow.
Set reg field to SND_SOC_NOPM to avoid any DAPM operation
while passing BE IDs in shift_l field and hence avoid overflow.
Change-Id: Ibbbca04c61b7c56eb4c5a7485a4e93dc28a09709
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
[dereference23: Forward port to msm-5.4]
Signed-off-by: Alexander Winkowski <dereference23@outlook.com>
Initialize struct cm_roam_values_copy to avoid using uninitialized
parameters in wlan_cm_roam_cfg_set_value().
Initialize struct pdev_params to zero to avoid using uninitialized
parameters in wmi_unified_pdev_param_send().
Change-Id: I820db09840431487f1756695a0562f8a794f549f
CRs-Fixed: 3187194
Based on panel hardware support, display brightness levels can
be very high value. This high value display brightness cooling
device levels can cause exceeding PAGE_SIZE for cooling device stat
buffer. It leads to buffer failure for cooling device stat feature.
Limit display panel mitigation level max to 255. If hardware
supports more than 255, then scale brightness levels fit
into above limit.
Change-Id: Ieeee4ff2aa5cd884819b30b4fd9839e48ac4d804
Signed-off-by: Manaf Meethalavalappu Pallikunhi <manafm@codeaurora.org>
Consider a scenario in which open, write and close of AT port is being
done repeatedly. At some point in time, cbits_updated in f_cdev
structure gets overwritten by the previous close instance causing the AT
port to go unresponsive. This prevents port bridge service from sending
DTR/RTS settings to at_mdm0 from at_usb0.
Fix this by adding spinlock to synchronise the updation of
ports->cbits_updated field in f_cdev structure.
Change-Id: Ibf39aa90f3918cd5f22e32a3b06685db4c4298ae
Signed-off-by: Pratham Pratap <quic_ppratap@quicinc.com>
"LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0"
* tag 'LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
cpufreq: schedutil: Fix UAF issue
msm: mhi_dev: Support async write in UCI for size greater than 8k
mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
qcom: cpufreq-hw: Use the topology coreid for offset
soc: qcom: Add Upperbounds check for program header
msm: adsprpc: Handle UAF in fastrpc_buf_free
interconnect: qcom: sm8150: fix UAF under remove function
interconnect: qcom: monaco: fix UAF under remove function
interconnect: qcom: direwolf: fix UAF under remove function
interconnect: qcom: yupik: fix UAF under remove function
interconnect: qcom: sdxnightjar: fix UAF under remove function
interconnect: qcom: sdxlemur: fix UAF under remove function
interconnect: qcom: sm6150: fix UAF under remove function
interconnect: qcom: shima: fix UAF under remove function
interconnect: qcom: scshrike: fix UAF under remove function
interconnect: qcom: lahaina: fix UAF under remove function
interconnect: qcom: holi: fix UAF under remove function
qcedev: vote for crypto clocks during module close
msm: synx: Check for zero before reducing bind handles
msm: adsprpc: Handle UAF in fastrpc internal munmap
mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
coresight-tmc: increase qdss pcie sw path throughput
net: qrtr: Move service id based filter check before queueing skb
defconfig: sdxlemur: Enable R8168 driver config
virt: haven: rsc_mgr: Allocate right buffer size of requests
Conflicts:
arch/arm64/boot/dts/vendor/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
arch/arm64/boot/dts/vendor/bindings/sound/qcom,wcd9335.txt
drivers/edac/qcom_edac.c
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
mm/khugepaged.c
Change-Id: I5b49e94db45d481ea90ba77800b26c32bd7433ab
https://source.android.com/docs/security/bulletin/2023-07-01
CVE-2022-42703
CVE-2023-21255
CVE-2023-25012
* tag 'ASB-2023-07-05_11-5.4' of https://android.googlesource.com/kernel/common:
UPSTREAM: ipvlan:Fix out-of-bounds caused by unclear skb->cb
UPSTREAM: net/sched: cls_u32: Fix reference counter leak leading to overflow
UPSTREAM: memstick: r592: Fix UAF bug in r592_remove due to race condition
BACKPORT: btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
ANDROID: HID: Only utilise UHID provided exports if UHID is enabled
UPSTREAM: bluetooth: Perform careful capability checks in hci_sock_ioctl()
ANDROID: HID; Over-ride default maximum buffer size when using UHID
Revert "ANDROID: AVB error handler to invalidate vbmeta partition."
UPSTREAM: mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
UPSTREAM: mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
UPSTREAM: efi: rt-wrapper: Add missing include
BACKPORT: arm64: efi: Execute runtime services from a dedicated stack
Change-Id: I1f90844654d86b0a8507de963cb574813fdbf99b
According to PCIe spec, PCIE_CAP_CLOCK_POWER_MAN bit in
LINK_CAPABILITIES_REG register should be set for EP. But it is seen as
cleared after core reset. In the current driver this bit is being set
but it is not taking effect. Enabling CLK_PM_EN in PCIE_ELBI_SYS_CTRL
register, so that PCIE_CAP_CLOCK_POWER_MAN is set.
Change-Id: I16654d5a477fa8eeaad61d6ec1dd32757627e2f9
Signed-off-by: Sai Chaitanya Kaveti <quic_skaveti@quicinc.com>
Fix is to add check for this ADSP returned buf offset + size,
if it is within the available buf size range
Change-Id: I400cc4f5c07164f0a9b405ebea144ea0ae4b6cf2
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
[ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ]
In the event of a failure in tcf_change_indev(), u32_set_parms() will
immediately return without decrementing the recently incremented
reference counter. If this happens enough times, the counter will
rollover and the reference freed, leading to a double free which can be
used to do 'bad things'.
In order to prevent this, move the point of possible failure above the
point where the reference counter is incremented. Also save any
meaningful return values to be applied to the return data at the
appropriate point in time.
This issue was caught with KASAN.
Bug: 273251569
Fixes: 705c709126 ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 07f9cc229b44cbcee6385802d390091d915f38c3)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I95524bfda9a08a40b3d54515e528419dba18dc55
[ Upstream commit 63264422785021704c39b38f65a78ab9e4a186d7 ]
In r592_probe, dev->detect_timer was bound with r592_detect_timer.
In r592_irq function, the timer function will be invoked by mod_timer.
If we remove the module which will call hantro_release to make cleanup,
there may be a unfinished work. The possible sequence is as follows,
which will cause a typical UAF bug.
Fix it by canceling the work before cleanup in r592_remove.
CPU0 CPU1
|r592_detect_timer
r592_remove |
memstick_free_host|
put_device; |
kfree(host); |
|
| queue_work
| &host->media_checker //use
Bug: 287729043
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Link: https://lore.kernel.org/r/20230307164338.1246287-1-zyytlz.wz@163.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 9a342d4eb9fb8e52f7d1afe088a79513f3f9a9a5)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: Idb15f593287ebaeec294b3e276126306fa6743ba
commit 85f02d6c856b9f3a0acf5219de6e32f58b9778eb upstream.
In btrfs_relocate_block_group(), the rc is allocated. Then
btrfs_relocate_block_group() calls
relocate_block_group()
prepare_to_relocate()
set_reloc_control()
that assigns rc to the variable fs_info->reloc_ctl. When
prepare_to_relocate() returns, it calls
btrfs_commit_transaction()
btrfs_start_dirty_block_groups()
btrfs_alloc_path()
kmem_cache_zalloc()
which may fail for example (or other errors could happen). When the
failure occurs, btrfs_relocate_block_group() detects the error and frees
rc and doesn't set fs_info->reloc_ctl to NULL. After that, in
btrfs_init_reloc_root(), rc is retrieved from fs_info->reloc_ctl and
then used, which may cause a use-after-free bug.
This possible bug can be triggered by calling btrfs_ioctl_balance()
before calling btrfs_ioctl_defrag().
To fix this possible bug, in prepare_to_relocate(), check if
btrfs_commit_transaction() fails. If the failure occurs,
unset_reloc_control() is called to set fs_info->reloc_ctl to NULL.
The error log in our fault-injection testing is shown as follows:
[ 58.751070] BUG: KASAN: use-after-free in btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
...
[ 58.753577] Call Trace:
...
[ 58.755800] kasan_report+0x45/0x60
[ 58.756066] btrfs_init_reloc_root+0x7ca/0x920 [btrfs]
[ 58.757304] record_root_in_trans+0x792/0xa10 [btrfs]
[ 58.757748] btrfs_record_root_in_trans+0x463/0x4f0 [btrfs]
[ 58.758231] start_transaction+0x896/0x2950 [btrfs]
[ 58.758661] btrfs_defrag_root+0x250/0xc00 [btrfs]
[ 58.759083] btrfs_ioctl_defrag+0x467/0xa00 [btrfs]
[ 58.759513] btrfs_ioctl+0x3c95/0x114e0 [btrfs]
...
[ 58.768510] Allocated by task 23683:
[ 58.768777] ____kasan_kmalloc+0xb5/0xf0
[ 58.769069] __kmalloc+0x227/0x3d0
[ 58.769325] alloc_reloc_control+0x10a/0x3d0 [btrfs]
[ 58.769755] btrfs_relocate_block_group+0x7aa/0x1e20 [btrfs]
[ 58.770228] btrfs_relocate_chunk+0xf1/0x760 [btrfs]
[ 58.770655] __btrfs_balance+0x1326/0x1f10 [btrfs]
[ 58.771071] btrfs_balance+0x3150/0x3d30 [btrfs]
[ 58.771472] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
[ 58.771902] btrfs_ioctl+0x4caa/0x114e0 [btrfs]
...
[ 58.773337] Freed by task 23683:
...
[ 58.774815] kfree+0xda/0x2b0
[ 58.775038] free_reloc_control+0x1d6/0x220 [btrfs]
[ 58.775465] btrfs_relocate_block_group+0x115c/0x1e20 [btrfs]
[ 58.775944] btrfs_relocate_chunk+0xf1/0x760 [btrfs]
[ 58.776369] __btrfs_balance+0x1326/0x1f10 [btrfs]
[ 58.776784] btrfs_balance+0x3150/0x3d30 [btrfs]
[ 58.777185] btrfs_ioctl_balance+0xd84/0x1410 [btrfs]
[ 58.777621] btrfs_ioctl+0x4caa/0x114e0 [btrfs]
...
Bug: 286629572
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Sweet Tea Dorminy <sweettea-kernel@dorminy.me>
Reviewed-by: Nikolay Borisov <nborisov@suse.com>
Signed-off-by: Zixuan Fu <r33s3n6@gmail.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Stefan Ghinea <stefan.ghinea@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit b60e862e133f646f19023ece1d476d630a660de1)
[Lee: Fixed minor conflict - returning result vs returning 0]
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I9212b61a85d36e20eed337d59fbadc2782d96a24
Commit "ANDROID: HID; Over-ride default maximum buffer size when using
UHID" provided a means for the UHID driver to offer an alternative
(smaller) report buffer size when dealing with user-space. The method
used was an Android-only solution designed to prevent the KMI ABI from
being broken (nb: the upstream solution was cleaner, but broke the ABI).
Since this solution involved consuming resources exported by a
subordinate driver, that driver would have to be enabled for the export
to take place. Since all of our default configs enable UHID, an issue
was not detected. However, for more specific kernel configs, where HID
is enabled, but UHID is not, this leads to compile-time undefined symbol
errors:
ld.lld: error: undefined symbol: uhid_hid_driver
This patch relies on the compiler to leave out unutilised sections of
the code if the associated resources are not available.
Bug: 260007429
Reported-by: Paul Lawrence <paullawrence@google.com>
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I80b1aa7454c89d5c5e21f0268252ffb666efab97
Signed-off-by: Lee Jones <joneslee@google.com>
Add support to remove unnecessary TDM route where TDM is not need.
Change-Id: I56aee33cbb9ecbc190fc24bfa14a071263661292
Signed-off-by: Boyuan Yan <quic_boyuyan@quicinc.com>
commit 25c150ac103a4ebeed0319994c742a90634ddf18 upstream.
Previously, capability was checked using capable(), which verified that the
caller of the ioctl system call had the required capability. In addition,
the result of the check would be stored in the HCI_SOCK_TRUSTED flag,
making it persistent for the socket.
However, malicious programs can abuse this approach by deliberately sharing
an HCI socket with a privileged task. The HCI socket will be marked as
trusted when the privileged task occasionally makes an ioctl call.
This problem can be solved by using sk_capable() to check capability, which
ensures that not only the current task but also the socket opener has the
specified capability, thus reducing the risk of privilege escalation
through the previously identified vulnerability.
Bug: 286456284
Cc: stable@vger.kernel.org
Fixes: f81f5b2db8 ("Bluetooth: Send control open and close messages for HCI raw sockets")
Signed-off-by: Ruihan Li <lrh2000@pku.edu.cn>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 47e6893a5b0ad14c0b1c25983a1facb1cf667b6e)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I9a4b20c7b1e9b4e6bbd6371264aec039770a52ff
There is no check for voip pkt pkt_len,if it contains the
min required data. This can lead to integer underflow.
Add check for the same.
Change-Id: I40242429542b6c32a0e6c3bbe03975c244c2f61a
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Presently, when a report is processed, its proposed size, provided by
the user of the API (as Report Size * Report Count) is compared against
the subsystem default HID_MAX_BUFFER_SIZE (16k). However, some
low-level HID drivers allocate a reduced amount of memory to their
buffers (e.g. UHID only allocates UHID_DATA_MAX (4k) buffers), rending
this check inadequate in some cases.
In these circumstances, if the received report ends up being smaller
than the proposed report size, the remainder of the buffer is zeroed.
That is, the space between sizeof(csize) (size of the current report)
and the rsize (size proposed i.e. Report Size * Report Count), which can
be handled up to HID_MAX_BUFFER_SIZE (16k). Meaning that memset()
shoots straight past the end of the buffer boundary and starts zeroing
out in-use values, often resulting in calamity.
This is an Android specific patch which essentially achieves the same
goal as the recently reverted upstream commits b1a37ed00d790 "(HID:
core: Provide new max_buffer_size attribute to over-ride the default")
and 1c5d4221240a2 ("HID: uhid: Over-ride the default maximum data buffer
value with our own") only it does so in an ABI friendly (albeit more
hacky) way.
Bug: 260007429
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I1f56673bb67b63ab14b58634bfe74a04b0758e3d
(cherry picked from commit 71761b36c37ae15a09fdd4d4adcc98bb939c426c)
Adding Support rtk8111k and add additional member
which fill from ioss and pass to GSI via IPA
num_queues_enabled (Total nuber of queue).
Change-Id: I7a127a9a60e1e45eb384634a7c7d74f813df3e08
Signed-off-by: Himansu Nayak <quic_himansu@quicinc.com>
This driver is not used and can cause problems if used on modern
devices. Remove it.
This reverts commit 6115619831.
Bug: 185178770
Signed-off-by: Alistair Delva <adelva@google.com>
Change-Id: I1d5acb96dda765a1e3ea0cf62a3bf4b2a78892ea
(cherry picked from commit ce6a5172613f990c6aaef168953d1be684f86e12)
[ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ]
There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed. Fix this issue, by moving the allocation outside the
lock.
Bug: 275340532
Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 7d233f93594f0d9afe44e9409131a8d6ad4f593c)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I7a4a1bf06abbb2092aceb72610e3f894b2bfbf0f
