Commit Graph
821754 Commits
Author SHA1 Message Date
qctecmdr 2f9d195596 Merge "HID: check for valid USB device for many HID drivers" 2022-07-21 07:11:38 -07:00
Rakesh Kota 84a85d8919 power: qpnp-fg-gen4: Update msoc on every FVSS soc update
There is possibility of a momentary SOC jump after we
exit the FVSS loop. Fix this by updating the msoc
on every FVSS soc update to make sure the soc value in
hardware tracks the FVSS scaled value.

Change-Id: I7a5638551615cc0d6da7171b05ffb2496cac4381
Signed-off-by: Rakesh Kota <quic_kotarake@quicinc.com>
2022-07-18 21:21:32 +05:30
Sivakanth Vaka f3a1bffd54 ipa3: Changes to call disable datapth API before stop channel
In disable datapth API configuring HOLB timer value to zero, it will
help if any pending packets before stop channel it helps. So adding
changes to call disable datapath API before stopping the channel.

Change-Id: Ic053bdd7b1aa45b51b746b69e83808f16e4e12a1
Signed-off-by: Sivakanth Vaka <quic_svaka@quicinc.com>
2022-07-18 11:31:02 +05:30
Sonal Aggarwal f6462ea007 tz_log : use file->private_data to get tz_id for debugfs
In msm-4.19, since we are using debugfs there is no struct
as seq_file. seq_file is introduced msm-5.4 onwards where
procfs is used.

Change-Id: I1e4571431f3847b115844e8eae41d6b559e40ef9
Signed-off-by: Sonal Aggarwal <quic_sonaagga@quicinc.com>
2022-07-15 17:30:07 +05:30
Vamsi Krishna Gattupalli 8b6c930e3c msm: adsprpc: Handle out of bounds access
Add check for channel ID in fastrpc_buf_alloc to
fix out of bounds access.

Change-Id: I92f2717edcc91c19309589ce7c11c91c8129b71a
Acked-by: Abhinav Parihar <parihar@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
2022-07-15 15:13:05 +05:30
Jiaxing Shi d035005d92 net: usb: ax88179_178a: support setting mac to eeprom
Add ioctrl cmds for writing mac address to eeprom.

Change-Id: If96b0ce23db594c061aacda43c93c12ac187b271
Signed-off-by: Jiaxing Shi <quic_jiaxshi@quicinc.com>
2022-07-14 23:30:00 -07:00
xiangxuy d41d516ea0 msm: disp: dp: add aux dp support by usb mode
dp aux config change by usb mode & orientation.

Change-Id: Ice36032ad5f7d1c67cf79f43a26fe73726df955b
Signed-off-by: xiangxuy <quic_xiangxuy@quicinc.com>
2022-07-15 14:08:19 +08:00
Vamsi Krishna Gattupalli 7dd91e3e49 msm: ADSPRPC: Restrict untrusted applications from attaching to GuestOS
Untrusted application can attach to guestOS and staticPD if it can
somehow make INIT IOCTL call with ATTACH flag. This is a potential
security issue as the untrusted application can crash guestOS or
staticPD. Restrict attach to guestOS or staticPD request if request
is being made using non-secure device node.

Change-Id: I322c7b242fd0baaf1c1bce2d83b992fecb0ca593
Acked-by: Ekansh Gupta <ekangupt@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
2022-07-13 22:27:59 -07:00
Linux Build Service Account b6b0d958d4 Merge 447fa26c5e on remote branch
Change-Id: I1168191c486193b6f9c269725a5fd98b2fda1185
2022-07-09 00:00:16 -07:00
Jagadeesh Ponduru 833e1f7408 msm: ipa3: add check in odl pipe cleanup
Adding a change to check whether the pipe has been
setup or not first before going to teardown the pipe.

Change-Id: Ibb408fdf3509facd6c18e3238bdbfd7da0b4a643
Signed-off-by: Jagadeesh Ponduru <quic_jponduru@quicinc.com>
2022-07-09 11:20:25 +05:30
Jaegeuk Kim 5f510d03b6 f2fs: guarantee to write dirty data when enabling checkpoint back
We must flush all the dirty data when enabling checkpoint back. Let's guarantee
that first by adding a retry logic on sync_inodes_sb(). In addition to that,
this patch adds to flush data in fsync when checkpoint is disabled, which can
mitigate the sync_inodes_sb() failures in advance.

Change-Id: Ia79be96c2fefceeeb862c7d9c7dffc028a7c2762
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Git-commit: 6608ba097f
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git
Signed-off-by: Sayali Lokhande <quic_sayalil@quicinc.com>
2022-07-08 16:37:35 +05:30
Jaegeuk Kim 2453031338 f2fs: flush data when enabling checkpoint back
During checkpoint=disable period, f2fs bypasses all the synchronous IOs such as
sync and fsync. So, when enabling it back, we must flush all of them in order
to keep the data persistent. Otherwise, suddern power-cut right after enabling
checkpoint will cause data loss.

Change-Id: I60dbaf9c720372c76f1c384446383dd8ff1ea4e9
Fixes: 4354994f097d ("f2fs: checkpoint disabling")
Cc: stable@vger.kernel.org
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Git-commit: 046c59c130
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git
Signed-off-by: Sayali Lokhande <quic_sayalil@quicinc.com>
2022-07-08 16:29:55 +05:30
qctecmdr 34bb42eb71 Merge "FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration" 2022-07-05 21:44:33 -07:00
Jagadeesh Ponduru 4660afd566 msm: ipahal: modify parameter from eq_bitfield[i] to i
From IPAv4.5 versions IPA_TOS_EQ is considered as not supported
and it made to 0XFF, instead IPA_IS_PURE_ACK is given support.
So, when validating the bitfield equations of them passing
eq_bitfield[i] will throw shift overflow warning as it takes 0xFF.
So, added change to ensure there are no overflow warnings.

Change-Id: I84384723433706784a4ef21b88f33b036edb0a5d
Signed-off-by: Jagadeesh Ponduru <quic_jponduru@quicinc.com>
2022-07-05 17:06:01 +05:30
Greg Kroah-Hartman 8c0432fb51 HID: check for valid USB device for many HID drivers
commit 93020953d0fa7035fd036ad87a47ae2b7aa4ae33 upstream.

Many HID drivers assume that the HID device assigned to them is a USB
device as that was the only way HID devices used to be able to be
created in Linux.  However, with the additional ways that HID devices
can be created for many different bus types, that is no longer true, so
properly check that we have a USB device associated with the HID device
before allowing a driver that makes this assumption to claim it.

Change-Id: I2b885c4b90acfd5c76ca773554f8a49b64670073
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: Michael Zaidman <michael.zaidman@gmail.com>
Cc: Stefan Achatz <erazor_de@users.sourceforge.net>
Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com>
Cc: Alexandre Torgue <alexandre.torgue@foss.st.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
[bentiss: amended for thrustmater.c hunk to apply]
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-3-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 128074f16e
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-07-02 00:12:42 +05:30
qctecmdr 6658722af9 Merge "soc: qcom: socinfo: Add support for Kona-7230 soc-id" 2022-07-01 05:41:09 -07:00
qctecmdr 8c95e6b831 Merge "msm: ADSPRPC: Restrict untrusted applications from attaching to GuestOS" 2022-07-01 01:18:45 -07:00
Chetan C R aac2ecbbcc soc: qcom: socinfo: Add support for Kona-7230 soc-id
Add support for getting soc-id and dummy handle
on Kona-7230.

Change-Id: I1c93ffd1d3b2575549d39390f18dddc85bf5d8e8
Signed-off-by: Chetan C R <quic_cchinnad@quicinc.com>
2022-06-30 22:38:38 -07:00
qctecmdr a755913753 Merge "qcom: genoa_extcon_notifier: Add genoa extcon notifier driver" 2022-06-30 12:32:25 -07:00
Tejun Heo c2a170c293 FROMGIT: cgroup: Use separate src/dst nodes when preloading css_sets for migration
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.

Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others are actually moving across cgroups. For example, this can happen with
the following sequence on cgroup1:

 #1> mkdir -p /sys/fs/cgroup/misc/a/b
 #2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs
 #3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS &
 #4> PID=$!
 #5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks
 #6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs

the process including the group leader back into a. In this final migration,
non-leader threads would be doing identity migration while the group leader
is doing an actual one.

After #3, let's say the whole process was in cset A, and that after #4, the
leader moves to cset B. Then, during #6, the following happens:

 1. cgroup_migrate_add_src() is called on B for the leader.

 2. cgroup_migrate_add_src() is called on A for the other threads.

 3. cgroup_migrate_prepare_dst() is called. It scans the src list.

 4. It notices that B wants to migrate to A, so it tries to A to the dst
    list but realizes that its ->mg_preload_node is already busy.

 5. and then it notices A wants to migrate to A as it's an identity
    migration, it culls it by list_del_init()'ing its ->mg_preload_node and
    putting references accordingly.

 6. The rest of migration takes place with B on the src list but nothing on
    the dst list.

This means that A isn't held while migration is in progress. If all tasks
leave A before the migration finishes and the incoming task pins it, the
cset will be destroyed leading to use-after-free.

This is caused by overloading cset->mg_preload_node for both src and dst
preload lists. We wanted to exclude the cset from the src list but ended up
inadvertently excluding it from the dst list too.

This patch fixes the issue by separating out cset->mg_preload_node into
->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst
preloadings don't interfere with each other.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reported-by: shisiyuan <shisiyuan19870131@gmail.com>
Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com
Link: https://www.spinics.net/lists/cgroups/msg33313.html
Fixes: f817de9851 ("cgroup: prepare migration path for unified hierarchy")
Cc: stable@vger.kernel.org # v3.16+
(cherry picked from commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447
 https://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup.git for-5.19-fixes)
Bug: 235577024
Change-Id: Ieaf1c0c8fc23753570897fd6e48a54335ab939ce
Signed-off-by: Steve Muckle <smuckle@google.com>
Git-commit: d1faa010ca160216a17435b81c642daf08ecbcbd
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
2022-06-30 08:19:43 -07:00
qctecmdr bc44705648 Merge "msm: kgsl: fix division results for UBSAN warnings" 2022-06-30 04:45:15 -07:00
qctecmdr dd63dc1f14 Merge "msm: camera: Add Page Read, DelayUSEC support in camera i2c" 2022-06-30 00:40:16 -07:00
Gaurav Jindal 925291428b msm: camera: Add Page Read, DelayUSEC support in camera i2c
Add Page Read, writeDelayUSEC and Continuous Read support in
camera i2c operations.

Change-Id: I58e269477c8158dd1cc394925cb7a3d175546b0a
Signed-off-by: Gaurav Jindal <quic_gjindal@quicinc.com>
2022-06-30 11:13:39 +05:30
Vamsi Krishna Gattupalli 40cb5f52c2 msm: ADSPRPC: Restrict untrusted applications from attaching to GuestOS
Untrusted application can attach to guestOS and staticPD if it can
somehow make INIT IOCTL call with ATTACH flag. This is a potential
security issue as the untrusted application can crash guestOS or
staticPD. Restrict attach to guestOS or staticPD request if request
is being made using non-secure device node.

Change-Id: I322c7b242fd0baaf1c1bce2d83b992fecb0ca593
Acked-by: Ekansh Gupta <ekangupt@qti.qualcomm.com>
Signed-off-by: Vamsi Krishna Gattupalli <quic_vgattupa@quicinc.com>
2022-06-30 11:02:09 +05:30
qctecmdr ab4261413e Merge "HID: wacom: fix problems when device is not a valid USB device" 2022-06-29 13:04:44 -07:00
Pranav Patel c840316522 msm: kgsl: fix division results for UBSAN warnings
Possible divide by zero can occur in wait_active_percent
calculation as reported by UBSAN. Fix this possible
division by zero.

Change-Id: I9068fbcc9347eade8a51c7fc3526491511188f03
Signed-off-by: Pranav Patel <quic_pranavp@quicinc.com>
2022-06-29 22:31:31 +05:30
qctecmdr 6aa7b8f37c Merge "HID: add USB_HID dependancy on some USB HID drivers" 2022-06-29 09:21:51 -07:00
qctecmdr 69452f1e0a Merge "HID: add hid_is_usb() function to make it simpler for USB detection" 2022-06-29 05:26:51 -07:00
qctecmdr 17ee78ddfd Merge "igmp: Add ip_mc_list lock in ip_check_mc_rcu" 2022-06-29 05:26:49 -07:00
Greg Kroah-Hartman 471de394e8 HID: wacom: fix problems when device is not a valid USB device
The wacom driver accepts devices of more than just USB types, but some
code paths can cause problems if the device being controlled is not a
USB device due to a lack of checking.  Add the needed checks to ensure
that the USB device accesses are only happening on a "real" USB device,
and not one on some other bus.

Change-Id: I2215a2a72958fcaeb46d2993837bd7204bd0553c
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 945e3464ba
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-29 01:46:08 -07:00
qctecmdr ded0049a15 Merge "ANDROID: selinux: modify RTM_GETNEIGH{TBL}" 2022-06-29 00:56:50 -07:00
Greg Kroah-Hartman c9ca8ab1ef HID: add USB_HID dependancy on some USB HID drivers
commit f237d9028f844a86955fc9da59d7ac4a5c55d7d5 upstream.

Some HID drivers are only for USB drivers, yet did not depend on
CONFIG_USB_HID.  This was hidden by the fact that the USB functions were
stubbed out in the past, but now that drivers are checking for USB
devices properly, build errors can occur with some random
configurations.

Change-Id: I938c6d0d4c43ff707c44e643c8106d3f610068dd
Reported-by: kernel test robot <lkp@intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211202114819.2511954-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: b0f286d9b1
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-29 00:38:01 -07:00
Greg Kroah-Hartman fb27b53398 HID: add USB_HID dependancy to hid-chicony
commit d080811f27936f712f619f847389f403ac873b8f upstream.

The chicony HID driver only controls USB devices, yet did not have a
dependancy on USB_HID.  This causes build errors on some configurations
like sparc when building due to new changes to the chicony driver.

Change-Id: Iee96674debe1c06911181ba1ffc2d4bf675178b5
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: stable@vger.kernel.org
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211203075927.2829218-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: de8ac0cf03
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-29 00:36:42 -07:00
Greg Kroah-Hartman 71c1123b78 HID: add USB_HID dependancy to hid-prodikeys
commit 30cb3c2ad24b66fb7639a6d1f4390c74d6e68f94 upstream.

The prodikeys HID driver only controls USB devices, yet did not have a
dependancy on USB_HID.  This causes build errors on some configurations
like nios2 when building due to new changes to the prodikeys driver.

Change-Id: Ifbe8d1a637b74c6aa90308c89d3cf4a958388ade
Reported-by: kernel test robot <lkp@intel.com>
Cc: stable@vger.kernel.org
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211203081231.2856936-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: cb54ea86f2
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-29 00:34:42 -07:00
qctecmdr 591cc49bf4 Merge "USB: gadget: validate interface OS descriptor requests" 2022-06-28 13:51:14 -07:00
qctecmdr ca08a3cc00 Merge "UPSTREAM: usb: gadget: clear related members when goto fail" 2022-06-28 13:51:10 -07:00
Bram Bonné 5523c1b277 ANDROID: selinux: modify RTM_GETNEIGH{TBL}
Map the permission gating RTM_GETNEIGH/RTM_GETNEIGHTBL messages to a
new permission so that it can be distinguished from the other netlink
route permissions in selinux policy. The new permission is triggered by
a flag set in system images T and up.

This change is intended to be backported to all kernels that a T system
image can run on top of.

Bug: 171572148
Test: atest NetworkInterfaceTest
Test: atest CtsSelinuxTargetSdkCurrentTestCases
Test: atest bionic-unit-tests-static
Test: On Cuttlefish, run combinations of:
    - Policy bit set or omitted (see https://r.android.com/1701847)
    - This patch applied or omitted
    - App having nlmsg_readneigh permission or not
  Verify that only the combination of this patch + the policy bit being
  set + the app not having the nlmsg_readneigh permission prevents the
  app from sending RTM_GETNEIGH messages.

Change-Id: I4bcfce4decb34ea9388eeedfc4be67403de8a980
Signed-off-by: Bram Bonné <brambonne@google.com>
(cherry picked from commit fac07550bdac9adea0dbe3edbdbec7a9a690a178)
Git-commit: 19c8fef96d
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Srinivasarao Pathipati <quic_c_spathi@quicinc.com>
2022-06-28 13:45:10 +05:30
Rajesh Bharathwaj 3e7bb833ef misc: updates to controller's driver
Cleaned up the controller driver and formatted the driver.

Change-Id: Iaf6e796503f5c4ad0646511454f2b01960fa7315
Signed-off-by: Rajesh Bharathwaj <quic_rabharat@quicinc.com>
2022-06-24 07:35:23 -07:00
Greg Kroah-Hartman 9142379431 HID: add hid_is_usb() function to make it simpler for USB detection
A number of HID drivers already call hid_is_using_ll_driver() but only
for the detection of if this is a USB device or not.  Make this more
obvious by creating hid_is_usb() and calling the function that way.

Also converts the existing hid_is_using_ll_driver() functions to use the
new call.

Change-Id: I1ca5d75db2232fc37353f52039d20b14a78c9e55
Cc: Jiri Kosina <jikos@kernel.org>
Cc: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Cc: linux-input@vger.kernel.org
Cc: stable@vger.kernel.org
Tested-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Link: https://lore.kernel.org/r/20211201183503.2373082-1-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: b1efa723b9
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-24 10:52:15 +05:30
qctecmdr cbeb2a841e Merge "lib/iov_iter: initialize "flags" in new pipe_buffer" 2022-06-23 16:12:05 -07:00
qctecmdr b50c828436 Merge "UPSTREAM: USB: gadget: validate interface OS descriptor requests" 2022-06-23 10:54:18 -07:00
qctecmdr a4bb12ce13 Merge "UPSTREAM: net/packet: rx_owner_map depends on pg_vec" 2022-06-22 10:42:00 -07:00
qctecmdr 3ecc3920a6 Merge "UPSTREAM: mmc: block: fix read single on recovery logic" 2022-06-22 10:41:58 -07:00
qctecmdr 7ffc455822 Merge "defconfig: Enable KinecticsXR Nordic chip for SKU4" 2022-06-21 22:53:27 -07:00
qctecmdr b99b6bd857 Merge "smcinvoke : file private data validation which is sent by userspace" 2022-06-21 16:51:58 -07:00
Szymon Heidrich 83b0a5fafe USB: gadget: validate interface OS descriptor requests
commit 75e5b4849b81e19e9efe1654b30d7f3151c33c2c upstream.

Stall the control endpoint in case provided index exceeds array size of
MAX_CONFIG_INTERFACES or when the retrieved function pointer is null.

Change-Id: Ieda0428f07a6f848c46bde5c906c5c3a0a6d210e
Signed-off-by: Szymon Heidrich <szymon.heidrich@gmail.com>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: e5eb8d19ae
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-19 18:45:36 +05:30
Hangyu Hua 36383a963c UPSTREAM: usb: gadget: clear related members when goto fail
commit 501e38a5531efbd77d5c73c0ba838a889bfc1d74 upstream.

dev->config and dev->hs_config and dev->dev need to be cleaned if
dev_config fails to avoid UAF.

Bug: 220261709
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211231172138.7993-3-hbh25y@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I149a16bc8db7262c3ab9c2f72a0f10c6caebee83
Git-commit: 590a98d5d108653cb4ebdf61ec73b2d31a1f7b81
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-19 18:34:02 +05:30
Hangyu Hua 580c3432c1 UPSTREAM: usb: gadget: don't release an existing dev->buf
commit 89f3594d0de58e8a57d92d497dea9fee3d4b9cda upstream.

dev->buf does not need to be released if it already exists before
executing dev_config.

Bug: 220261709
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Link: https://lore.kernel.org/r/20211231172138.7993-2-hbh25y@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: Id53d6770fbae0a7fcf0fa136157c0ab34fb5da64
Git-commit: ff0000fe82f45cee26c83abb40b01e43c52739e9
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-19 18:27:07 +05:30
Liu Jian 0d2816327f igmp: Add ip_mc_list lock in ip_check_mc_rcu
I got below panic when doing fuzz test:

Kernel panic - not syncing: panic_on_warn set ...
CPU: 0 PID: 4056 Comm: syz-executor.3 Tainted: G    B             5.14.0-rc1-00195-gcff5c4254439-dirty #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x7a/0x9b
panic+0x2cd/0x5af
end_report.cold+0x5a/0x5a
kasan_report+0xec/0x110
ip_check_mc_rcu+0x556/0x5d0
__mkroute_output+0x895/0x1740
ip_route_output_key_hash_rcu+0x2d0/0x1050
ip_route_output_key_hash+0x182/0x2e0
ip_route_output_flow+0x28/0x130
udp_sendmsg+0x165d/0x2280
udpv6_sendmsg+0x121e/0x24f0
inet6_sendmsg+0xf7/0x140
sock_sendmsg+0xe9/0x180
____sys_sendmsg+0x2b8/0x7a0
___sys_sendmsg+0xf0/0x160
__sys_sendmmsg+0x17e/0x3c0
__x64_sys_sendmmsg+0x9e/0x100
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x462eb9
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8
 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48>
 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f3df5af1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462eb9
RDX: 0000000000000312 RSI: 0000000020001700 RDI: 0000000000000007
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3df5af26bc
R13: 00000000004c372d R14: 0000000000700b10 R15: 00000000ffffffff

It is one use-after-free in ip_check_mc_rcu.
In ip_mc_del_src, the ip_sf_list of pmc has been freed under pmc->lock protection.
But access to ip_sf_list in ip_check_mc_rcu is not protected by the lock.

Change-Id: Ic1a2b2c0f312a35ac0a86aa05cd14d1698d84c20
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Git-commit: 4768973dff
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-19 18:20:11 +05:30
Willem de Bruijn 75faeb6920 UPSTREAM: net/packet: rx_owner_map depends on pg_vec
[ Upstream commit ec6af094ea28f0f2dda1a6a33b14cd57e36a9755 ]

Packet sockets may switch ring versions. Avoid misinterpreting state
between versions, whose fields share a union. rx_owner_map is only
allocated with a packet ring (pg_vec) and both are swapped together.
If pg_vec is NULL, meaning no packet ring was allocated, then neither
was rx_owner_map. And the field may be old state from a tpacket_v3.

Bug: 213464034
Fixes: 61fad6816fc1 ("net/packet: tpacket_rcv: avoid a producer race condition")
Reported-by: Syzbot <syzbot+1ac0994a0a0c55151121@syzkaller.appspotmail.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20211215143937.106178-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Aaron Ding <aaronding@google.com>
Change-Id: Ifd09717336bafe2a3e20389f7f7eb7b95d19e8cd
Git-commit: 27fc5a7c6972bd73ac0cc0cf811ec2ecb989014f
Git-repo: https://android.googlesource.com/kernel/common
Signed-off-by: PavanKumar S.R <quic_pavasr@quicinc.com>
2022-06-19 17:56:28 +05:30