Santosh Sakore
c6635960b2
adsprpc: Handle UAF scenario in put_args
...
Currently, the DSP updates header buffers with unused DMA handle fds.
In the put_args section, if any DMA handle FDs are present in the
header buffer, the corresponding map is freed. However, since the
header buffer is exposed to users in unsigned PD, users can update
invalid FDs. If this invalid FD matches with any FD that is already
in use, it could lead to a use-after-free (UAF) vulnerability.
As a solution,add DMA handle references for DMA FDs, and the map for
the FD will be freed only when a reference is found.
Acked-by: Om Deore <quic_odeore@quicinc.com>
Change-Id: I19ae21230bf11fe89858b10c9069a5daccabc392
Signed-off-by: Santosh Sakore <quic_ssakore@quicinc.com>
(cherry picked from commit c6e7698c0c )
2024-09-13 20:37:48 -07:00
..
accessibility
acpi
Merge 5.4.274 into android11-5.4-lts
2024-04-18 07:23:10 +00:00
amba
This is the 5.4.257 stable release
2023-09-30 11:33:27 +00:00
android
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
ata
ata: sata_mv: Fix PCI device ID table declaration compilation warning
2024-04-13 12:51:36 +02:00
atm
atm: idt77252: fix a memleak in open_card_ubr0
2024-02-23 08:25:06 +01:00
auxdisplay
base
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
bcma
block
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
bluetooth
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
bus
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
cdrom
char
adsprpc: Handle UAF scenario in put_args
2024-09-13 20:37:48 -07:00
clk
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
clocksource
Merge android11-5.4.265+ ( a34cc1d) into msm-5.4
2024-02-29 15:10:56 +05:30
connector
counter
cpufreq
Merge android11-5.4.265+ ( a34cc1d) into msm-5.4
2024-02-29 15:10:56 +05:30
cpuidle
crypto
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
dax
dca
devfreq
Merge android11-5.4.259+ ( 81334f2) into msm-5.4
2023-12-18 15:40:18 +05:30
dio
dma
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
dma-buf
Merge android11-5.4.259+ ( 81334f2) into msm-5.4
2023-12-18 15:40:18 +05:30
edac
Merge android11-5.4.268+ ( 66f4b04) into msm-5.4
2024-04-10 23:53:13 -07:00
eisa
extcon
Merge android11-5.4.254+ ( 91f7025) into msm-5.4
2023-10-30 22:46:41 -07:00
firewire
firewire: core: use long bus reset on gap count error
2024-03-26 18:22:13 -04:00
firmware
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
fpga
fsi
fsi: master-ast-cf: Add MODULE_FIRMWARE macro
2023-09-23 10:59:37 +02:00
gnss
gpio
gpio: 74x164: Enable output pins after registers are reset
2024-03-06 14:36:10 +00:00
gpu
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
greybus
hid
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
hsi
hv
Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
2023-06-28 10:18:36 +02:00
hwmon
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
hwspinlock
hwtracing
Merge android11-5.4.268+ ( 66f4b04) into msm-5.4
2024-04-10 23:53:13 -07:00
i2c
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
i3c
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
ide
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
idle
iio
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
infiniband
Merge 5.4.273 into android11-5.4-lts
2024-04-16 15:17:08 +00:00
input
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
interconnect
Merge android11-5.4.268+ ( 66f4b04) into msm-5.4
2024-04-10 23:53:13 -07:00
iommu
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
ipack
irqchip
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
isdn
mISDN: Update parameter type of dsp_cmx_send()
2023-08-16 18:19:23 +02:00
leds
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
lightnvm
macintosh
mailbox
Merge android11-5.4.254+ ( 91f7025) into msm-5.4
2023-10-30 22:46:41 -07:00
mcb
mcb: fix error handling for different scenarios when parsing
2023-11-28 16:50:19 +00:00
md
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
media
msm: eva: Adding kref count for cvp_get_inst_from_id
2024-08-06 00:21:39 -07:00
memory
memory: brcmstb_dpfe: fix testing array offset after use
2023-07-27 08:37:14 +02:00
memstick
memstick r592: make memstick_debug_get_tpc_name() static
2023-07-27 08:37:10 +02:00
message
mfd
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
misc
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
mmc
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
mtd
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
mux
net
Merge 13dd90963a on remote branch
2024-08-11 01:29:45 -07:00
nfc
Merge android11-5.4.249+ ( d57e792) into msm-5.4
2023-09-28 16:45:28 +05:30
ntb
ntb: Fix calculation ntb_transport_tx_free_entry()
2023-09-23 10:59:55 +02:00
nubus
nvdimm
nd_btt: Make BTT lanes preemptible
2023-11-20 10:30:12 +01:00
nvme
nvmet-fc: abort command when there is no binding
2024-03-01 13:13:34 +01:00
nvmem
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
of
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
opp
This is the 5.4.257 stable release
2023-09-30 11:33:27 +00:00
oprofile
parisc
parisc: iosapic.c: Fix sparse warnings
2023-10-10 21:46:39 +02:00
parport
parport: parport_serial: Add Brainboxes device IDs and geometry
2024-01-25 14:34:21 -08:00
pci
Merge 13dd90963a on remote branch
2024-08-11 01:29:45 -07:00
pcmcia
pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
2023-11-20 10:30:14 +01:00
perf
Merge android11-5.4.259+ ( 81334f2) into msm-5.4
2023-12-18 15:40:18 +05:30
phy
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
pinctrl
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
platform
msm: ep_pcie: Avoid writing req_L1_exit during dstate change
2024-07-10 23:27:28 -07:00
pnp
PNP: ACPI: fix fortify warning
2024-02-23 08:24:54 +01:00
power
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
powercap
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
2023-07-27 08:37:06 +02:00
pps
ps3
ptp
ptp: annotate data-race around q->head and q->tail
2023-11-28 16:50:16 +00:00
pwm
Merge android11-5.4.265+ ( a34cc1d) into msm-5.4
2024-02-29 15:10:56 +05:30
rapidio
ras
regulator
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
remoteproc
This is the 5.4.243 stable release
2023-06-15 10:57:33 +00:00
reset
This is the 5.4.268 stable release
2024-01-26 02:15:05 +00:00
rpmsg
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
rtc
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
s390
s390/zcrypt: fix reference counting on zcrypt card objects
2024-04-13 12:51:27 +02:00
sbus
scsi
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
sfi
sh
siox
slimbus
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
soc
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
soundwire
soundwire: stream: fix NULL pointer dereference for multi_link
2023-12-20 15:41:24 +01:00
spi
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
spmi
Merge android11-5.4.249+ ( d57e792) into msm-5.4
2023-09-28 16:45:28 +05:30
ssb
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
staging
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
target
scsi: target: core: Add TMF to tmr_list handling
2024-03-01 13:13:33 +01:00
tc
tee
thermal
thermal: qcom: Add support to update tsens trip based on nvmem data
2024-07-14 00:15:53 -07:00
thunderbolt
tty
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
uio
Merge android11-5.4.268+ ( 66f4b04) into msm-5.4
2024-04-10 23:53:13 -07:00
usb
Merge "Merge android11-5.4.274 ( 564901b) into msm-5.4"
2024-08-03 23:34:20 -07:00
vfio
Merge 5.4.274 into android11-5.4-lts
2024-04-18 07:23:10 +00:00
vhost
This is the 5.4.269 stable release
2024-02-24 15:47:08 +00:00
video
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
virt
virt: haven: Correct max_buf_size for a connection
2023-08-24 11:48:01 -07:00
virtio
Merge android11-5.4.274 ( 564901b) into msm-5.4
2024-07-24 20:38:43 -07:00
visorbus
vlynq
vme
w1
w1: fix loop in w1_fini()
2023-07-27 08:37:19 +02:00
watchdog
watchdog: stm32_iwdg: initialize default timeout
2024-03-26 18:22:24 -04:00
xen
xen/events: close evtchn after mapping cleanup
2024-04-13 12:51:29 +02:00
zorro
Kconfig
Makefile
OWNERS