While cleaning up synx table entry, hold the lock for that particular
entry. This will make sure that any other read/write for same entry waits
till cleaning is done.
Also, Change log level of empty table entries from warning to debug.
Change-Id: Ib092f41a12fb943ed184c031dca481a75d3446e3
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
CNSS2 registers as both platform and PCI driver. PCI
device can be removed via sysfs exposed by kernel during
PCI device creation. When PCI device gets removed, CNSS
PCI remove ops gets called. In cnss_pci_remove, unregister
host driver and shutdown WLAN chip to cleanly remove PCI
device.
Change-Id: Ia60e8b69bda2b3bdd5990cb83f47c082d6667283
Signed-off-by: Naman Padhiar <quic_npadhiar@quicinc.com>
This change is to solve the compilation issue caused by inline.
Change-Id: Iab320101e9b30dc6fa9ceb80b321f4be00607bbd
Signed-off-by: Chang Chen <quic_chach@quicinc.com>
Avoid possible use-after-free access for a QMI handle
during driver deinit by ensuring the free happens only for
valid QMI handle and is marked NULL post free.
Change-Id: I4314dff560de2fc3aea30d636f935d7a02067a57
Signed-off-by: Manoj Prabhu B <quic_bmanoj@quicinc.com>
In idr_alloc the base value is becoming less than zero after some
iteration.so we are make it positive when the value is less than zero..
Change-Id: Iafa53f9f09a9ac029e57b8deee0e0b30b7851acd
Signed-off-by: Ram Nagesh <quic_ramnages@quicinc.com>
Process init memory allowed to initialize only once
to fix possible improper acecss from remote processor.
Change-Id: Ic1a13738146fcf0d170abd76b50bdc6a75871755
Acked-by: Abhinav Parihar <parihar@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
We allow more then 255 binderfs binder devices to be created since there
are workloads that require more than that. If we use __u8 we'll overflow
after 255. So let's use a __u32.
Note that there's no released kernel with binderfs out there so this is
not a regression.
Signed-off-by: Christian Brauner <christian@brauner.io>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 7d0174065f4903fb0ce0bab3d5047284faa7226d)
Bug: 228263403
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: If143c0d6511946fac6349c5db7c013535950de4a
Git-commit: b155e0447d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
For Battery charging 1.2 compliance, device needs to apply VDP_SRC
for DCP charger after charger detection. Hence add required change
to apply VDP_SRC for DCP case. Also fix command time out issue
with CDP case as turning off regulators results in command timeout
while enabling Ep0 for enumeration.
Change-Id: I311a8c76d28bdb351c6d0c72f4430c95d79f0595
Signed-off-by: Vijayavardhan Vennapusa <quic_vvreddy@quicinc.com>
Add module parameter to disable sending pulse on D+ for CDP
charger, which can be enabled while running BC1.2 compliance.
Else could see CDP test failure, as compliance tester see pullup
on D+ line and starts enumeration.
Change-Id: I25dbad69ca4e6dcdf7555617ccd6eb9b34b08d40
Signed-off-by: Vijayavardhan Vennapusa <quic_vvreddy@quicinc.com>
If PC fails due to any reason, make sure to resume the DSP back
as DSP might still have the pending transactions.
Change-Id: I82bd288869327b9bf84e9ab9bdd31b8d2983d817
Signed-off-by: Haseeb Khan <quic_hkhan@quicinc.com>
Adding of only base layered intra-refresh v4l2 API.
Change-Id: I552421ce2c35cc82001737097e687e9fb96186d0
Signed-off-by: Sayantan Majumder <quic_smajumde@quicinc.com>
Currently packing configuration is done for 8bits per
transfer word as default as part of baud rate change.
Extend packing configuration when there is a request for
5bits/6bits/7bits per transfer word from set_termios.
Change-Id: I01341c94eef3b3697db3fce7846042cbe9e9f2af
Signed-off-by: Visweswara Tanuku <quic_vtanuku@quicinc.com>
There are multiple refcounting bugs related to multi-BSSID:
- In bss_ref_get(), if the BSS has a hidden_beacon_bss, then
the bss pointer is overwritten before checking for the
transmitted BSS, which is clearly wrong. Fix this by using
the bss_from_pub() macro.
- In cfg80211_bss_update() we copy the transmitted_bss pointer
from tmp into new, but then if we release new, we'll unref
it erroneously. We already set the pointer and ref it, but
need to NULL it since it was copied from the tmp data.
- In cfg80211_inform_single_bss_data(), if adding to the non-
transmitted list fails, we unlink the BSS and yet still we
return it, but this results in returning an entry without
a reference. We shouldn't return it anyway if it was broken
enough to not get added there.
This fixes CVE-2022-42720.
Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: a3584f56de1c ("cfg80211: Properly track transmitting and non-transmitting BSS")
Link: https://lore.kernel.org/lkml/20221013175147.168042993@linuxfoundation.org/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Change-Id: If6ed330dc65fdf387ee8584b5a69840242edf5cc
Signed-off-by: Balaji Pothunoori <quic_bpothuno@quicinc.com>
In the copy code of the elements, we do the following calculation
to reach the end of the MBSSID element:
/* copy the IEs after MBSSID */
cpy_len = mbssid[1] + 2;
This looks fine, however, cpy_len is a u8, the same as mbssid[1],
so the addition of two can overflow. In this case the subsequent
memcpy() will overflow the allocated buffer, since it copies 256
bytes too much due to the way the allocation and memcpy() sizes
are calculated.
Fix this by using size_t for the cpy_len variable.
This fixes CVE-2022-41674.
Reported-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Soenke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/lkml/20221013175147.067414219@linuxfoundation.org/
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: aebe9f4639b13a1f4e9a6b42cdd2e38c617b442d
Git-repo: https://android.googlesource.com/kernel/common
Change-Id: If6ed330dc65fdf387ee8584b5a69840242edf5cf
Signed-off-by: Vulupala Shashank Reddy<quic_vulupa@quicinc.com>
If a non-transmitted BSS shares enough information (both
SSID and BSSID!) with another non-transmitted BSS of a
different AP, then we can find and update it, and then
try to add it to the non-transmitted BSS list. We do a
search for it on the transmitted BSS, but if it's not
there (but belongs to another transmitted BSS), the list
gets corrupted.
Since this is an erroneous situation, simply fail the
list insertion in this case and free the non-transmitted
BSS.
This fixes CVE-2022-42721.
Reported-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Tested-by: Sönke Huster <shuster@seemoo.tu-darmstadt.de>
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Link: https://lore.kernel.org/all/20221013175145.382242160@linuxfoundation.org/
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Git-commit: bcca852027e5878aec911a347407ecc88d6fff7f
Git-repo: https://android.googlesource.com/kernel/common
Change-Id: Icb2106b5ac5ff5e3ecb50bd09440bce5560fbb05
Signed-off-by: Srikanth Marepalli <quic_srimarep@quicinc.com>
check the num_fds passed into unmap buf ioctl,
or else it can lead to an out of bounds access.
Test: Build compilation. qcedev tests.
Change-Id: I206ba01dfa989346ade769a0f68b372b21f84043
Signed-off-by: Gaurav Kashyap <quic_gaurkash@quicinc.com>
Signed-off-by: Pranav Lavhate <quic_plavhate@quicinc.com>
Milestone call for QRKS on SDM660 feature is
added which will be handled in hypervisor.
Change-Id: I5a0ac1c1eff0035fe7b91003ffae161dda6e81ca
Signed-off-by: Ashutosh Kaushik <quic_ashukaus@quicinc.com>
commit 228a26b912287934789023b4132ba76065d9491c upstream.
Future CPUs may implement a clearbhb instruction that is sufficient
to mitigate SpectreBHB. CPUs that implement this instruction, but
not CSV2.3 must be affected by Spectre-BHB.
Add support to use this instruction as the BHB mitigation on CPUs
that support it. The instruction is in the hint space so it will
be treated by a NOP as older CPUs.
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
[ modified for stable: Use a KVM vector template instead of alternatives ]
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: ed5dec3fae
Git-repo: https://android.googlesource.com/kernel/common/
Change-Id: I78e5a1888e44ef45294ed35226c4cce43f249126
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit a5905d6af492ee6a4a2205f0d550b3f931b03d03 upstream.
KVM allows the guest to discover whether the ARCH_WORKAROUND SMCCC are
implemented and to preserve that state during migration through its
firmware register interface.
Add the necessary boiler plate for SMCCC_ARCH_WORKAROUND_3.
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
[ kvm code moved to virt/kvm/arm, removed fw regs ABI. Added 32bit stub ]
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 5f051d32b0
Git-repo: https://android.googlesource.com/kernel/common/
Change-Id: Id7ed70b94bd3a3f0575e13691c4c211bb23c1ec3
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit 558c303c9734af5a813739cd284879227f7297d2 upstream.
Speculation attacks against some high-performance processors can
make use of branch history to influence future speculation.
When taking an exception from user-space, a sequence of branches
or a firmware call overwrites or invalidates the branch history.
The sequence of branches is added to the vectors, and should appear
before the first indirect branch. For systems using KPTI the sequence
is added to the kpti trampoline where it has a free register as the exit
from the trampoline is via a 'ret'. For systems not using KPTI, the same
register tricks are used to free up a register in the vectors.
For the firmware call, arch-workaround-3 clobbers 4 registers, so
there is no choice but to save them to the EL1 stack. This only happens
for entry from EL0 so if we take an exception due to the stack access,
it will not become re-entrant.
For KVM, the existing branch-predictor-hardening vectors are used.
When a spectre version of these vectors is in use, the firmware call
is sufficient to mitigate against Spectre-BHB. For the non-spectre
versions the sequence of branches is added to the indirect vector.
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@kernel.org> # <v5.17.x 72bb9dcb6c33c arm64: Add Cortex-X2 CPU part definition
Cc: <stable@kernel.org> # <v5.16.x 2d0d656700d67 arm64: Add Neoverse-N2, Cortex-A710 CPU part definition
Cc: <stable@kernel.org> # <v5.10.x 8a6b88e66233f arm64: Add part number for Arm Cortex-A77
[ modified for stable, moved code to cpu_errata.c removed bitmap of
mitigations, use kvm template infrastructure ]
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: c20d551744
Git-repo: https://android.googlesource.com/kernel/common/
Change-Id: Ib5f1191b3e81b68edbcd2a0ba4f45e0c1041ad05
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
KVM writes the Spectre-v2 mitigation template at the beginning of each
vector when a CPU requires a specific sequence to run.
Because the template is copied, it can not be modified by the alternatives
at runtime. As the KVM template code is intertwined with the bp-hardening
callbacks all templates must have a bp-hardening callback.
Add templates for calling ARCH_WORKAROUND_3 and one for each value of K
in the brancy-loop. Identify these sequences by a new parameter
template_start, and add a copy of install_bp_hardening_cb() that is able to
install them.
Change-Id: I3dbb2d1e06663cbf39b1d212547ac64d569fd72e
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: a68912a3ae
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit dee435be76f4117410bbd90573a881fd33488f37 upstream.
Speculation effect against some high-performance processors can
make use of branch history to influence future speculation as part of
a spectre-v2. This is not mitigated by CSV2 meaning CPUs that
previously reported 'Not affected' are now moderately mitigated by CSV2.
Update the value in /sys/devices/system/cpu/vulnerabilities/spectre_v2
to show the state of the BHB mitigation.
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
[ code move to cpu_errata.c for backport ]
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 7b012f6597
Git-repo: https://android.googlesource.com/kernel/common/
Change-Id: I7dc0fc8e5d198c1d9d7b3d8227a93b43d746c97a
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit bd09128d16fac3c34b80bd6a29088ac632e8ce09 upstream.
The Spectre-BHB workaround adds a firmware call to the vectors. This
is needed on some CPUs but not others. To avoid the unaffected CPU in
a big or little pair from making the firmware call create per cpu vectors.
The per-cpu vectors only apply when returning from EL0.
Systems using KPTI can use the canonical 'full-fat' vectors directly at
EL1, the trampoline exit code will switch to this_cpu_vector on exit to
EL0. Systems not using KPTI should always use this_cpu_vector.
this_cpu_vector will point at a vector in tramp_vecs or
__bp_harden_el1_vectors, depending on whether KPTI is in use.
Change-Id: I9983edd36ee880f3f951f4933b6fa4fca5a91a5b
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 5b5ca2608f
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit b28a8eebe81c186fdb1a0078263b30576c8e1f42 upstream.
The trampoline code needs to use the address of symbols in the wider
kernel, e.g., vectors. PC-relative addressing wouldn't work as the
trampoline code doesn't run at the address the linker expected.
tramp_ventry uses a literal pool, unless CONFIG_RANDOMIZE_BASE is
set in which case it uses the data page as a literal pool because
the data page can be unmapped when running in user-space, which is
required for CPUs vulnerable to meltdown.
Pull this logic out as a macro instead of adding a third copy
of it.
Change-Id: Ic2c62933b6a49c15f572c40e430a83bfa50dedae
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: e18876b523
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit ba2689234be92024e5635d30fe744f4853ad97db upstream.
Some CPUs affected by Spectre-BHB need a sequence of branches, or a
firmware call to be run before any indirect branch. This needs to go
in the vectors. No CPU needs both.
While this can be patched in it would run on all CPUs as there is a
single set of vectors. If the only one part of a big or little combination is
affected the unaffected CPUs have to run the mitigation too.
Create extra vectors that include the sequence. Subsequent patches will
allow affected CPUs to select this set of vectors. Later patches will
modify the loop count to match what the CPU requires.
Change-Id: I83274b2d90e65c1c5bf3b11fb236c08731b83456
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 91429ed04e
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit aff65393fa1401e034656e349abd655cfe272de0 upstream.
kpti is an optional feature for systems not using kpti a set of
vectors for the spectre-bhb mitigations is needed.
Add another set of vectors, __bp_harden_el1_vectors that will be
used if a mitigation is needed and kpti is not in use.
The EL1 ventries are repeated verbatim as there is no additional
work needed for entry from EL1.
Change-Id: Ib7ad5dfccb9dd86e75796ae8b6303024c9019848
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 901c0a20aa
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit a9c406e6462ff14956d690de7bbe5131a5677dc9 upstream.
Adding a second set of vectors to .entry.tramp.text will make it
larger than a single 4K page.
Allow the trampoline text to occupy up to three pages by adding two
more fixmap slots. So previous changes to tramp_valias allowed it to reach
beyond a single page.
Change-Id: Iaecfa089c3c7c2edaffe257a841c3dbb0a15e1a4
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 22fdfcf1c2
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit c47e4d04ba0f1ea17353d85d45f611277507e07a upstream.
Spectre-BHB needs to add sequences to the vectors. Having one global
set of vectors is a problem for big/little systems where the sequence
is costly on cpus that are not vulnerable.
Making the vectors per-cpu in the style of KVM's bh_harden_hyp_vecs
requires the vectors to be generated by macros.
Make the kpti remapping of the kernel optional so the macros can be
used without kpti.
Change-Id: I4dc98f5af303700bd3ae02eb80e17772f52fde36
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 9e056623df
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit 13d7a08352a83ef2252aeb464a5e08dfc06b5dfd upstream.
The macros for building the kpti trampoline are all behind
CONFIG_UNMAP_KERNEL_AT_EL0 and in a region that outputs to the
.entry.tramp.text section.
Move the macros out so they can be used to generate other kinds of
trampoline. Only the symbols that need to be guarded by
CONFIG_UNMAP_KERNEL_AT_EL0 and appear in the .entry.tramp.text section.
Change-Id: I126e6fc751f5ed64ed9916ea21026203c1a403d1
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: f689fa53bb
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
commit ed50da7764535f1e24432ded289974f2bf2b0c5a upstream.
The tramp_ventry macro uses tramp_vectors as the address of the vectors
when calculating which ventry in the 'full fat' vectors to branch to.
While there is a one set of tramp_vectors this will be true.
Adding multiple sets of vectors will break this assumption.
Move the generation of the vectors to a macro and pass the start
of the vectors as an argument to tramp_ventry.
Change-Id: Ia9607bea454f9822be63c8be7bfbf55d3dabedd0
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: James Morse <james.morse@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: af484e69b5
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Kishor Krishna Bhat <quic_kishkris@quicinc.com>
Ram Nagesh