Add HMD nordic driver suspend and sleep
mode when standlone or bonded with
remote controllers.
Change-Id: I0dda7e5d474341f8636b78a07ff70f5a164dd082
Signed-off-by: Wei Tan <quic_weitan@quicinc.com>
Enable ftrace support for clocks so that clients can measure
frequency of the clock through ftraces.
Change-Id: Ie923ac538b670598bb1be009e892a68c4f1e2a38
Signed-off-by: Kalpak Kawadkar <quic_kkawadka@quicinc.com>
Add bounds check on values read from shared memory in the tx path. In
cases where the VM is misbehaving, the qrtr transport should exit and
print a warning when bogus values may cause out of bounds to be read.
Change-Id: I7ebef28ed8eba4c4da0b32d5114365bbe6bea390
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
Everytime a boost level is disabled, if its refcount is zero, its exit
routine and the entry routine of the next boost level are called. This
causes an issue when the previous boost level and the next boost level
are same as it increments the boost count of the next boost level.This
is fixed by not calling the entry and exit routines, when the previous
and the next boost levels are same.
Change-Id: I482d0ee70c082bc647768958ffa5fcd6f5ee8e5b
Signed-off-by: Ankit Sharma <quic_anshar@quicinc.com>
Add bounds check on values read from shared memory in the tx path. In
cases where the VM is misbehaving, the qrtr transport should exit and
print a warning when bogus values may cause out of bounds to be read.
Change-Id: I7ebef28ed8eba4c4da0b32d5114365bbe6bea390
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
This change removes synx status call from each row to avoid
rare race condition resulting in UAF.
Moreover, remove unnecessary mutex lock.
Change-Id: I0e7bfdb3aa1a9b4408d14d0181de651a699919af
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
Validate the values read from shared memory in the receive path.
In the case where a VM is misbehaving, the qrtr transport should
return immediately and print a warning.
Change-Id: I088f6cc77433dfcd099e5c117b9ca6408c40f09e
Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
Add a data length validation check in fw response message in
qdss_data_send_sync().
Change-Id: I750f46549bc914698baaf4e24f1710536ca8e356
CRs-Fixed: 3366343
Signed-off-by: Alan Chen <quic_alache@quicinc.com>
For WIN use case maximum number of memory segments requested
by FW is increased to 52 in QMI layer. Since CNSS2 driver uses
same QMI header files and message structures the same maximum
number of segment is applicable for CNSS2. It means for memory
allocation, FW can request 52 memory segments to CNSS2 via QMI
indication but local CNSS2 variable which get segment info from
indication supports maximum 32 segments.
To fix it, change CNSS2 array variable size to same as number of
maximum segment supported in QMI layer.
Change-Id: I661b55b53cb31327da12f064d0a516884159eb5b
Signed-off-by: Naman Padhiar <quic_npadhiar@quicinc.com>
While cleaning up synx table entry, hold the lock for that particular
entry. This will make sure that any other read/write for same entry waits
till cleaning is done.
Also, Change log level of empty table entries from warning to debug.
Change-Id: Ib092f41a12fb943ed184c031dca481a75d3446e3
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
CNSS2 registers as both platform and PCI driver. PCI
device can be removed via sysfs exposed by kernel during
PCI device creation. When PCI device gets removed, CNSS
PCI remove ops gets called. In cnss_pci_remove, unregister
host driver and shutdown WLAN chip to cleanly remove PCI
device.
Change-Id: Ia60e8b69bda2b3bdd5990cb83f47c082d6667283
Signed-off-by: Naman Padhiar <quic_npadhiar@quicinc.com>
This change is to solve the compilation issue caused by inline.
Change-Id: Iab320101e9b30dc6fa9ceb80b321f4be00607bbd
Signed-off-by: Chang Chen <quic_chach@quicinc.com>
Avoid possible use-after-free access for a QMI handle
during driver deinit by ensuring the free happens only for
valid QMI handle and is marked NULL post free.
Change-Id: I4314dff560de2fc3aea30d636f935d7a02067a57
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
In idr_alloc the base value is becoming less than zero after some
iteration.so we are make it positive when the value is less than zero..
Change-Id: Iafa53f9f09a9ac029e57b8deee0e0b30b7851acd
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
Process init memory allowed to initialize only once
to fix possible improper acecss from remote processor.
Change-Id: Ic1a13738146fcf0d170abd76b50bdc6a75871755
Acked-by: Abhinav Parihar <parihar@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
We allow more then 255 binderfs binder devices to be created since there
are workloads that require more than that. If we use __u8 we'll overflow
after 255. So let's use a __u32.
Note that there's no released kernel with binderfs out there so this is
not a regression.
Signed-off-by: Christian Brauner <christian@brauner.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7d0174065f4903fb0ce0bab3d5047284faa7226d)
Bug: 228263403
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: If143c0d6511946fac6349c5db7c013535950de4a
Git-commit: b155e0447d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
For Battery charging 1.2 compliance, device needs to apply VDP_SRC
for DCP charger after charger detection. Hence add required change
to apply VDP_SRC for DCP case. Also fix command time out issue
with CDP case as turning off regulators results in command timeout
while enabling Ep0 for enumeration.
Change-Id: I311a8c76d28bdb351c6d0c72f4430c95d79f0595
Signed-off-by: Vijayavardhan Vennapusa <quic_vvreddy@quicinc.com>
Add module parameter to disable sending pulse on D+ for CDP
charger, which can be enabled while running BC1.2 compliance.
Else could see CDP test failure, as compliance tester see pullup
on D+ line and starts enumeration.
Change-Id: I25dbad69ca4e6dcdf7555617ccd6eb9b34b08d40
Signed-off-by: Vijayavardhan Vennapusa <quic_vvreddy@quicinc.com>
If PC fails due to any reason, make sure to resume the DSP back
as DSP might still have the pending transactions.
Change-Id: I82bd288869327b9bf84e9ab9bdd31b8d2983d817
Signed-off-by: Haseeb Khan <quic_hkhan@quicinc.com>
Adding of only base layered intra-refresh v4l2 API.
Change-Id: I552421ce2c35cc82001737097e687e9fb96186d0
Signed-off-by: Sayantan Majumder <quic_smajumde@quicinc.com>
Currently packing configuration is done for 8bits per
transfer word as default as part of baud rate change.
Extend packing configuration when there is a request for
5bits/6bits/7bits per transfer word from set_termios.
Change-Id: I01341c94eef3b3697db3fce7846042cbe9e9f2af
Signed-off-by: Visweswara Tanuku <quic_vtanuku@quicinc.com>
There are multiple refcounting bugs related to multi-BSSID:
- In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
the bss pointer is overwritten before checking for the
transmitted BSS, which is clearly wrong. Fix this by using
the bss_from_pub() macro.
- In cfg80211_bss_update() we copy the transmitted_bss pointer
from tmp into new, but then if we release new, we'll unref
it erroneously. We already set the pointer and ref it, but
need to NULL it since it was copied from the tmp data.
- In cfg80211_inform_single_bss_data(), if adding to the non-
transmitted list fails, we unlink the BSS and yet still we
return it, but this results in returning an entry without
a reference. We shouldn't return it anyway if it was broken
enough to not get added there.
This fixes CVE-2022-42720.
Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: a3584f56de1c ("cfg80211: Properly track transmitting and non-transmitting BSS")
Link: https://lore.kernel.org/lkml/20221013175147.168042993@linuxfoundation.org/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: If6ed330dc65fdf387ee8584b5a69840242edf5cc
Signed-off-by: Balaji Pothunoori <quic_bpothuno@quicinc.com>
In the copy code of the elements, we do the following calculation
to reach the end of the MBSSID element:
/* copy the IEs after MBSSID */
cpy_len = mbssid[1] + 2;
This looks fine, however, cpy_len is a u8, the same as mbssid[1],
so the addition of two can overflow. In this case the subsequent
memcpy() will overflow the allocated buffer, since it copies 256
bytes too much due to the way the allocation and memcpy() sizes
are calculated.
Fix this by using size_t for the cpy_len variable.
This fixes CVE-2022-41674.
Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/lkml/20221013175147.067414219@linuxfoundation.org/
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d
Git-repo: https://android.googlesource.com/kernel/common
Change-Id: If6ed330dc65fdf387ee8584b5a69840242edf5cf
Signed-off-by: Vulupala Shashank Reddy<quic_vulupa@quicinc.com>
If a non-transmitted BSS shares enough information (both
SSID and BSSID!) with another non-transmitted BSS of a
different AP, then we can find and update it, and then
try to add it to the non-transmitted BSS list. We do a
search for it on the transmitted BSS, but if it's not
there (but belongs to another transmitted BSS), the list
gets corrupted.
Since this is an erroneous situation, simply fail the
list insertion in this case and free the non-transmitted
BSS.
This fixes CVE-2022-42721.
Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/all/20221013175145.382242160@linuxfoundation.org/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: bcca852027e5878aec911a347407ecc88d6fff7f
Git-repo: https://android.googlesource.com/kernel/common
Change-Id: Icb2106b5ac5ff5e3ecb50bd09440bce5560fbb05
Signed-off-by: Srikanth Marepalli <quic_srimarep@quicinc.com>
check the num_fds passed into unmap buf ioctl,
or else it can lead to an out of bounds access.
Test: Build compilation. qcedev tests.
Change-Id: I206ba01dfa989346ade769a0f68b372b21f84043
Signed-off-by: Gaurav Kashyap <quic_gaurkash@quicinc.com>
Signed-off-by: Pranav Lavhate <quic_plavhate@quicinc.com>
Wei Tan