范龙飞 reports that KASAN can report a use-after-free in __lock_acquire.
The reason is due to insufficient serialization in lo_release(), which
will continue to use the loop device even after it has decremented the
lo_refcnt to zero.
In the meantime, another process can come in, open the loop device
again as it is being shut down. Confusion ensues.
Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Git-commit: ae6650163c66a7eff1acd6eb8b0f752dcfa8eba5
Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivasa Rao Kuppala <srkupp@codeaurora.org>
Conflicts:
drivers/block/loop.c
Signed-off-by: Dheeraj Kumar Chaudhary <dheech@codeaurora.org>
Change-Id: I965ddcdc2a9d27fd56a54d2886b7c3861c21b05f
CVE-2018-5344
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
integer overflow case found where signed integer variable converted to
unsigned one without proper bounds checking.
Then this would result in kernel memory corruption by OOB write.
Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 70722061
Change-Id: Idb1aa16ae1bae9c3f601e6688cd263fa95a93bdf
CVE-2017-13292
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Default IPA header is added or deleted from the driver
directly and not by user space application. This change
prevents adding/deleting it from user application which
may cause inconsistencies in the driver. Also the change
fixes the header reset function to skip on the correct
default header.
Change-Id: Ic813433655411f1447db8b0c15efdf64038d8c26
CRs-fixed: 2151146
Signed-off-by: Ghanim Fodi <gfodi@codeaurora.org>
CVE-2018-5825
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
commit 20b50d79974ea3192e8c3ab7faf4e536e5f14d8f upstream.
Commit 8f659a03a0ba ("net: ipv4: fix for a race condition in
raw_sendmsg") fixed the issue of possibly inconsistent ->hdrincl handling
due to concurrent updates by reading this bit-field member into a local
variable and using the thus stabilized value in subsequent tests.
However, aforementioned commit also adds the (correct) comment that
/* hdrincl should be READ_ONCE(inet->hdrincl)
* but READ_ONCE() doesn't work with bit fields
*/
because as it stands, the compiler is free to shortcut or even eliminate
the local variable at its will.
Note that I have not seen anything like this happening in reality and thus,
the concern is a theoretical one.
However, in order to be on the safe side, emulate a READ_ONCE() on the
bit-field by doing it on the local 'hdrincl' variable itself:
int hdrincl = inet->hdrincl;
hdrincl = READ_ONCE(hdrincl);
This breaks the chain in the sense that the compiler is not allowed
to replace subsequent reads from hdrincl with reloads from inet->hdrincl.
Change-Id: I9d0d37a713322c49f902a70db09b9527c8635f00
Fixes: 8f659a03a0ba ("net: ipv4: fix for a race condition in raw_sendmsg")
Signed-off-by: Nicolai Stange <nstange@suse.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: use ACCESS_ONCE()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
commit 8f659a03a0ba9289b9aeb9b4470e6fb263d6f483 upstream.
inet->hdrincl is racy, and could lead to uninitialized stack pointer
usage, so its value should be read only once.
Fixes: c008ba5bdc9f ("ipv4: Avoid reading user iov twice after raw_probe_proto_opt")
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- flowi4 flags don't depend on hdrincl
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2017-17712
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: I0b221046791a39b44ed2b005d02df9ec2d938534
commit c008ba5bdc9fa830e1a349b20b0be5a137bdef7a upstream.
Ever since raw_probe_proto_opt was added it had the problem of
causing the user iov to be read twice, once during the probe for
the protocol header and once again in ip_append_data.
This is a potential security problem since it means that whatever
we're probing may be invalid. This patch plugs the hole by
firstly advancing the iov so we don't read the same spot again,
and secondly saving what we read the first time around for use
by ip_append_data.
Change-Id: Ia30045bbf1ea9406d7fb6a048dfcab3beb0ad763
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
commit 32b5913a931fd753faf3d4e1124b2bc2edb364da upstream.
The function raw_probe_proto_opt tries to extract the first two
bytes from the user input in order to seed the IPsec lookup for
ICMP packets. In doing so it's processing iovec by hand and
overcomplicating things.
This patch replaces the manual iovec processing with a call to
memcpy_fromiovecend.
Change-Id: I4ae7819475b5cf49e16ea902dd91aa2ce67eefc2
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Andrey Konovalov reported a possible out-of-bounds problem for the
cdc_parse_cdc_header function. He writes:
It looks like cdc_parse_cdc_header() doesn't validate buflen
before accessing buffer[1], buffer[2] and so on. The only check
present is while (buflen > 0).
So fix this issue up by properly validating the buffer length matches
what the descriptor says it is.
(cherry picked from commit 2e1c42391ff2556387b3cb6308b24f6f65619feb)
(The original patch fixed the generic cdc_parser_cdc_header function.
That generic function did not exist in 3.10 but there are a couple
cdc parsers that suffer from the same underlying problem.)
Bug: 69052594
Change-Id: Ib251469de39e51b0ed7c1a1b88873270afccd90f
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marissa Wall <marissaw@google.com>
CVE-2017-16534
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor. He writes:
It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
descriptor. It's only checked that the size is >= 2 in
usb_parse_configuration(), so find_iad() might do out-of-bounds access
to intf_assoc->bInterfaceCount.
And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem. Yet another issue found by syzkaller...
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
CVE-2017-16531
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: I3eb1836f8ee2cc53243b21233c3a191d6e616e52
Accessing of incorrect structure pointer is causing
memory out of bound access, fixed issue by accessing
the correct structure pointer.
Bug: 63851638
Change-Id: I3c2f5f7a97cac854093ef670184d06db4231f5e1
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>
[haggertk: Backport to 3.4/msm8974
NOTE: No current lineage targets for this kernel make use of this
driver]
CVE-2017-14879
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
These were moved to list.h, but the upstream change did not account
for this msm-specific use
Change-Id: I23b23906e15f0db5e770a32e43cd665e3c4afae3
Fixes: fce85b081c08c ("list: introduce list_next_entry() and list_prev_entry()")
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
An incomplete backport/patch failed to add this declaration to
ipa_i.h
Change-Id: I34d07ec7362c2aff8e652fec9bf30287aa51efb5
Fixes: c5b59371f93d ("msm: ipa: Prevent multiple header deletion from user space")
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Set freed pointers to NULL to avoid double free
in msm_compr_playback_open and msm_compr_playback_free
functions of the compress driver.
CRs-Fixed: 2142216
Bug: 68664502
Change-Id: Ifd011dd85dd9f610c7b69dd460f73d26e006cd66
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-3560
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Currently, while de-initializing clients, there is
a possibility of using already freed memory. The
patch adds proper protection to fix the issue.
CRs-Fixed: 2068569
Bug: 68870904
Change-Id: I4b397a82e03fa2f1c84cfa8ca912cdb6a51ba08b
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-3561
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
[ Upstream commit 4971613c1639d8e5f102c4e797c3bf8f83a5a69e ]
Once a socket has po->fanout set, it remains a member of the group
until it is destroyed. The prot_hook must be constant and identical
across sockets in the group.
If fanout_add races with packet_do_bind between the test of po->fanout
and taking the lock, the bind call may make type or dev inconsistent
with that of the fanout group.
Hold po->bind_lock when testing po->fanout to avoid this race.
I had to introduce artificial delay (local_bh_enable) to actually
observe the race.
Bug: 69160446
Fixes: dc99f60069 ("packet: Add fanout support.")
Change-Id: I899f9b6bcbd1d4b033388ef22c472857574bfc30
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Marissa Wall <marissaw@google.com>
Signed-off-by: Siqi Lin <siqilin@google.com>
CVE-2017-15649
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
sdcardfs_mkdir() calls check_min_free_space(). When reserved_mb is not zero, a negative dentry will be passed to
ext4_statfs() at last and ext4_statfs() will crash. The parent dentry is positive. So we use the parent dentry to
check free space.
Change-Id: I80ab9623fe59ba911f4cc9f0e029a1c6f7ee421b
Signed-off-by: Lianjun Huang <huanglianjun@vivo.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
After d_revalidate returns 0, the vfs will call
d_invalidate, which will call d_drop itself, along
with other cleanup.
Bug: 78262592
Change-Id: Idbb30e008c05d62edf2217679cb6a5517d8d1a2c
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bug: 77923821
Change-Id: I1705bfd146009561d2d1da5f0e6a342ec6932a1c
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
d_make_root will call iput on failure, so we
shouldn't try to do that ourselves.
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bug: 77923821
Change-Id: I1abb4afb0f894ab917b7c6be8c833676f436beb7
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
When an sdcardfs dentry is destroyed, it may not yet
have its fsdata initialized. It must be checked before
we try to access the paths in its private data.
Additionally, when cleaning up the superblock after
a failure, we don't have our sb private data, so
check for that case.
Bug: 77923821
Change-Id: I89caf6e121ed86480b42024664453fe0031bbcf3
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
page allocated in fuse_dentry_canonical_path to be handled in
fuse_dev_do_write is allocated using __get_free_pages(GFP_KERNEL).
This may not return a page with data filled with 0. Now this
page may not have a null terminator at all.
If this happens and userspace fuse daemon screws up by passing a string
to kernel which is not NULL terminated (or did not fill anything),
then inside fuse driver in kernel when we try to do
strlen(fuse_dev_write->kern_path->getname_kernel)
on that page data -> it may give us issue with kernel paging request.
Unable to handle kernel paging request at virtual address
------------[ cut here ]------------
<..>
PC is at strlen+0x10/0x90
LR is at getname_kernel+0x2c/0xf4
<..>
strlen+0x10/0x90
kern_path+0x28/0x4c
fuse_dev_do_write+0x5b8/0x694
fuse_dev_write+0x74/0x94
do_iter_readv_writev+0x80/0xb8
do_readv_writev+0xec/0x1cc
vfs_writev+0x54/0x64
SyS_writev+0x64/0xe4
el0_svc_naked+0x24/0x28
To avoid this we should ensure in case of FUSE_CANONICAL_PATH,
the page is null terminated.
Change-Id: I33ca7cc76b4472eaa982c67bb20685df451121f5
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Bug: 75984715
[Daniel - small edit, using args size ]
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
sdcardfs_name_match gets a 'name' argument from the underlying FS.
This need not be null terminated string.
So in sdcardfs_name_match -> qstr_case_eq -> we should use
str_n_case_eq.
This happens because few of the entries in lower level FS may not be
NULL terminated and may have some garbage characters passed while
doing sdcardfs_name_match.
For e.g.
# dmesg |grep Download
[ 103.646386] sdcardfs_name_match: q1->name=.nomedia, q1->len=8,
q2->name=Download\x17\x80\x03, q2->len=8
[ 104.021340] sdcardfs_name_match: q1->name=.nomedia, q1->len=8,
q2->name=Download\x17\x80\x03, q2->len=8
[ 105.196864] sdcardfs_name_match: q1->name=.nomedia, q1->len=8,
q2->name=Download\x17\x80\x03, q2->len=8
[ 109.113521] sdcardfs_name_match: q1->name=logs, q1->len=4,
q2->name=Download\x17\x80\x03, q2->len=8
Now when we try to create a directory with different case for a such
files. SDCARDFS creates a entry if it could not find the underlying
entry in it's dcache.
To reproduce:-
1. bootup the device wait for some time after sdcardfs mounting to
complete.
2. cd /storage/emulated/0
3. echo 3 > /proc/sys/vm/drop_caches
4. mkdir download
We now start seeing two entries with name.
Download & download.
Change-Id: I976d92a220a607dd8cdb96c01c2041c5c2bc3326
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
bug: 75987238
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
userptr may or may not be a null-value. Checking for this field
to qualify a plane as extradata has no merit. Ignore that check
Bug: 28747768
Change-Id: I08d85ef462f09003aaa17f6ebc5d27de7083796f
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
Signed-off-by: Praneeth Paladugu <ppaladug@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Compare ion handles in driver instead of matching fds
to check if a buffer is already mapped or not.
Bug: 28747768
Change-Id: Ifd18d8689351c4a6a22c988d359fb413be19e142
Signed-off-by: Ashray Kulkarni <ashrayk@codeaurora.org>
Signed-off-by: Praveen Chavan <pchavan@codeaurora.org>
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Arun Menon <avmenon@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Add same fd ref only for static buffer mode.
Driver is configured for dynamic buffer mode by
default on Venus 3xx targets. If client uses the
same fd for all output buffers, then the first
buffer can remain mapped without reference, which
is incompatible with the curently logic which
assumes buffers to have a reference if they are
already mapped
CRs-Fixed: 773605
Change-Id: I025fe373532e185660d43bae28457cbf06f20e7a
Signed-off-by: Surajit Podder <spodder@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
* This is the proper thing to do for filesystem drivers
Change-Id: I109b201d85e324cc0a72c3fcd09df4a3e1703042
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
* Don't force TIMA_LKMAUTH for modules
* Make all TIMA options depend on TIMA
Change-Id: I8c2c81ba8df5ca6a92ab0fbcba2501c6680a4c57
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
Without this patch when you delete an extension from configfs
it still exists in the hash table data structures and we are
unable to delete it or change it's group.
This happens because during deletion the key & value is taken from
extension_details, and was not properly set.
Fix it by this patch.
Change-Id: I7c20cb1ab4d99e6aceadcb5ef850f0bb47f18be8
Signed-off-by: Ritesh Harjani <riteshh@codeaurora.org>
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bug: 73055997
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
* Samsung version G960USQU1ARBG with -lineage patches applied
Change-Id: I0432751926085aa249b377a418728854618929e5
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
dest_step_position is sent from userspace and is used in
kernel to calculate the final DAC value.
dest_step_position must be validated against total steps.
Actuator will have an unexpected behavior if lens value is
programed to actuator based on invalid dest_step_position.
CRs-Fixed: 1102580
Change-Id: Idcd97043d3bd583d8577233d446a99d1829a4ee6
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
The size of uvc_control_mapping is user controlled leading to a
potential heap overflow in the uvc driver. This adds a check to verify
the user provided size fits within the bounds of the defined buffer
size.
Signed-off-by: Robb Glasser <rglasser@google.com>
[groeck: cherry picked from
https://source.codeaurora.org/quic/la/kernel/msm-3.10
commit b7b99e55bc7770187913ed092990852ea52d7892;
updated subject]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
CVE-2017-0627
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Change-Id: I20cf8a2b443dad1f9f93dae3cae3cf17b76af99d
* It has diverged enough to add this to differentiate it
Change-Id: I5e43ee01c785acbc5292c6c115a4e083eeeb36a6
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
This reverts commit 2a397b60665d5e1b8d1ecb044eb77ff79a65c52f.
Revert "usb: gadget: Add file for USB HID function"
This reverts commit 2aa1159f573e0d5dee4f8a9a3411acc56baa27d4.
* No longer needed in M
Change-Id: If6f95e9fff14268f3e47efc96bf26452ba6a306d
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
usb: gadget: f_fs: HACK: Round reads up to 512 bytes to work with dwc3
Signed-off-by: Arve Hjønnevåg <arve@android.com>
USB: f_fs: Fix epfile crash during composition switch
epfile's ep pointer may be NULL during adb transfer
and composition switch happening in parallel. As part
of composition switch, first it is set to NONE. Setting
sys.usb.config to NONE stops adb and disables the composition.
stop adb is not blocking call and adb still might be doing
epfile read/write for some time when function unbind is
ongoing making the data structures NULL.
To fix this crash, call usb_ep_dequeue only if ep->ep is
valid. Similarly in success case, return ep->status only
if ep->ep is valid otherwise return -ENODEV.
CRs-Fixed: 643663
Change-Id: Ic152fc1db31cad6f97b8d16d91350dad857a4bf9
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
USB: gadget: f_fs: Release endpoint upon disable
Endpoints are claimed using usb_ep_autoconfig function,
It will choose an unclaimed usb_ep and prevent the endpoint
from being returned by a later autoconfig calls. We can mark
the driver_data pointer once ep_enable is done in bind.
If we cannot mark to null upon function disable the corresponding
endpoint is not allocated by a later autoconfig call. The current
code does not make the ep->driver_data to null upon function disable.
This is leading to unclaimed endpoints for later autoconfig calls.
Claim the endpoints by assigning ep->driver_data to NULL.
CRs-Fixed: 633673
Change-Id: I221b98ef36cc2a60d27507a2442061a30ed410f4
Signed-off-by: ChandanaKishori Chiluveru <cchilu@codeaurora.org>
USB: gagget: f_fs: Return error if TX req is queued during device offline
when USB cable is disconnected during TX data transfers, endpoints will
be disabled during function disable. If userspace client tries to queue
requests on disabled endpoints, driver will wait till endpoints are
enabled and then queues previous session requests. This results in kernel
driver and userspace driver out of sync and due to this, stall will be
seen. Hence fix this issue by returning error value if client tries to
queue requests on TX endpoint during device offline.
CRs-Fixed: 633497
Change-Id: I3e43b8a704367aff7fe8dd88159315aef811c51c
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: f_fs: Fail stale read IOs after disconnect
After a USB disconnect, endpoints for adb are disabled.
After this no IO is allowed on the endpoints.
Since, adbd is not aware of this disconnect, it may
still perform read/writes IO. For adb writes, IOs are
failed, but for adb reads kernel waits untill endpoints
are enabled.
When a USB disconnect and adb read still queued
a buffer to kernel, ffs_epfile_io simply waits for
endpoint to be enabled. A next connect happens
and endpoints are enabled after set_alt, the adb
read stale buffer from previous session continues
and queues to endpoint.
All this time, adb did not close the epfile because
it did not get return status on the IOs which it
queued. This is an issue, because a new session
is not established and both userspace and kernel
goes out of sync.
To fix this issue, when endpoints are disbled
set epfile error. This epfile error is only cleared
in epfile open. This will ensure that after a USB
disconnect and connect, new session is established.
Also, return ENODEV if endpoints not enabled rather
than EINTR as EINTR case, and simply retries the
request. Incase usb_ep_queue failed, return -EIO
inspite of depend on return status from usb_ep_queue.
CRs-Fixed: 633497
Change-Id: I6e677e98ec28e5462b372ed290acdde251286f48
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
USB: f_fs: Cutoff epfile IO before epfile could get freed
epfile may get freed and accessing epfile's error flag to
cut off IOs may lead to use after free.
Move the epfile error flag setting above in the order
so that it guaranteed to be valid.
CRs-Fixed: 668046
Change-Id: I0017513393ddb4fd288cd4e1c2adf9d5ee3bc660
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
USB: f_fs: Check error status before doing epfile I/O
Set error status before disabling endpoint during function
disable and also check error status before handling I/O. If error
status is set, return error status to read/write calls made by
userspace. Also set file's private data to NULL during epfile
release.
CRs-Fixed: 671880
Change-Id: I14b5ee541dfc18a7802ef4a8033878a7729d9adb
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
USB: f_fs: Fix disconnect check during ongoing IO
F_FS function driver allocated ffs_eps and updates ffs_ep->ep
to corresponding usb_ep during func->bind and never clears it.
On bind it also saves ffs_ep context in epfile->ep.
During func->disable, it clears only ffs_ep context in epfile->ep
and on func->unbind it frees ffs_eps memory.
ffs_epfile_io routine currently relies on ffs_ep->ep (which is
never cleared and ffs_ep could be freed on unbind) to detect any
disconnect during active IO. This can result in various issues e.g.
use after free use of ffs_ep if unbind finished before epfile_io
could resume or "stop adbd" trying to dequeue a freed USB request
when epfile_io could execute only after F_FS got disabled as
'if (ep->ep)' check would be TRUE.
Fix this by checking stored ffs_ep context against latest epfile->ep
to figure out if endpoint got disabled or changed before acquiring
spin_lock.
Change-Id: I6bdcdf0dff0813ed7b2af8c24f544a22796b0369
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: f_fs: Move ep completion out of stack
Allocating completion on the stack may lead to
invalid access when udc irq tries to complete
the request but interrupted completion returns
immediately. This happens because request is not
held to be dequeued anymore making the completion
invalid.
Move the completions in ffs data like it is for ep0.
CRs-Fixed: 653761
Change-Id: I15102538d1b5bee14dfa3c7b3fa1f8e3f767cf71
Signed-off-by: Sujeet Kumar <ksujeet@codeaurora.org>
usb: dwc3: gadget: Release gadget lock when handling suspend/resume
gadget_driver suspend/resume operations might require some
dwc3-gadget operations, such as enabling and disabling
endpoints. If the lock is not released, this can cause a
deadlock scenario.
Change-Id: I1e12de65e40492b115ab35de78c2352730649db5
Signed-off-by: Bar Weiner <bweiner@codeaurora.org>
usb: dwc3: gadget: Iterate only over valid endpoints
Make dwc3_gadget_resize_tx_fifos() iterate only over IN
endpoints that are actually present, based on the
num_in_eps parameter. This terminates the loop so as to
prevent dereferencing a potential NULL dwc->eps[i] where
i >= (num_in_eps + num_out_eps).
Change-Id: I07f711bfd380dce212e86b59cf417f84ca7eb006
Signed-off-by: Jack Pham <jackp@codeaurora.org>
usb: dwc3: gadget: Protect against ep disabling during completion
In dwc3_cleanup_done_reqs(), a potential race condition
could arise when dwc3_gadget_giveback() temporarily
releases the main spinlock. If during this window the
very endpoint being handled becomes disabled, it would
lead to a NULL pointer dereference in the code that
follows. Guard against this by making sure the endpoint
is still enabled after returning from the giveback call.
CRs-fixed: 628972
Change-Id: Ifdb823fff12747f699217d871a5959c85b5340f7
Signed-off-by: Jack Pham <jackp@codeaurora.org>
usb: dwc3: calculate the number of endpoints
hwparams2 holds the number of endpoints which
were selected during RTL generation, we can
use that on our driver.
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: dwc3: gadget: use num_(in|out)_eps from HW params
that way we will only tell gadget framework about
the endpoints we actually have.
Change-Id: Iabc6a5712b640a9f5b0310984650a4ac44e5f579
Signed-off-by: Felipe Balbi <balbi@ti.com>
usb: gadget: always update HS/SS descriptors and create a copy of them
HS and SS descriptors are staticaly created. They are updated during the
bind process with the endpoint address, string id or interface numbers.
After that, the descriptor chain is linked to struct usb_function which
is used by composite in order to serve the GET_DESCRIPTOR requests,
number of available configs and so on.
There is no need to assign the HS descriptor only if the UDC supports
HS speed because composite won't report those to the host if HS support
has not been reached. The same reasoning is valid for SS.
This patch makes sure each function updates HS/SS descriptors
unconditionally and uses the newly introduced helper function to create a
copy the descriptors for the speed which is supported by the UDC.
While at that, also rename f->descriptors to f->fs_descriptors in order
to make it more explicit what that means.
Change-Id: Id670fcc25b0a1cb3020722cfc6eda2e1b08441f1
Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
USB: Add super speed descriptors for android functions
Update android function drivers like diag, adb, modem, rmnet, mtp
and accessory to operate in super speed. The burst capability is
not enabled for now.
Change-Id: Ie95cbfc9444c56c8268b70e2916713190699c71a
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: Finish conversion to fs_descriptor change
Change-Id: Iaf72d66bb5cd6b84f14c5aaeb01ffb286568c97b
usb: gadget: f_fs: Add support for SuperSpeed Mode
Allow userspace to pass SuperSpeed descriptors and
handle them in the driver accordingly.
This change doesn't modify existing desc_header and thereby
keeps the ABI changes backward compatible i.e. existing
userspace drivers compiled with old header (functionfs.h)
would continue to work with the updated kernel.
Change-Id: Ic27035fdef2a83828024348d75be1518e9f8c5c6
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
USB: f_fs: Set ffs->func to NULL after disabling endpoint in set_alt()
When adb root is performed, userspace will close and open ffs_epsfile.
Closing this file will call ffs_functionfs_callback() which does call
remove_config(). This will call ffs_function_eps_disable to disable
endpoints and then calls ffs_func_unbind(). Unbind() will also call
endpoint disable which might lead to disabling endpoint which is already
disabled. Hence set ffs->func to NULL after disabling endpoints in
set_alt().
CRs-Fixed: 557532
Change-Id: I3052bdee74a1793d4e003de4b991d353e5d699b0
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>
usb: gadget: throttle IRQ rate for SuperSpeed
There was a merge error from commit 6e0c86d12 "USB: gadget:
u_ether: Fix data stall issue in RNDIS tethering mode"
that resulted in the accidental removal of checking if
the gadget is connected at SuperSpeed. Re-introduce this
check so that IRQs on the downlink path are throttled,
decreasing the load on the CPU.
Change-Id: Ic2aa1d433e0fded95c6e825a760e89f726360522
Signed-off-by: Jack Pham <jackp@codeaurora.org>
USB: mbim: Add super speed descriptors for MBIM function
This change adds super speed descriptors which is required to
get MBIM function to work with SSUSB mode. The burst
capability is not enabled for now.
CRs-Fixed: 626744
Change-Id: I2a492182c94265ab58014cac470448f61782625c
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
usb: gadget: ECM: Add super speed descriptors for qc_ecm function
This change adds super speed descriptors which is required to get
ECM function to work with SSUSB mode.
CRs-Fixed: 627063
Change-Id: I275a32f6cb957b59bfdf1c5b5377ba6e189efb6d
Signed-off-by: Mayank Rana <mrana@codeaurora.org>
usb: gadget: Add file for USB HID function
This file the same as f_hid.c.
Change-Id: I951b3067f477c3cb502c8320693ab11df90150d2
Signed-off-by: muluhe <muluhe@codeaurora.org>
Signed-off-by: Aravind Asam <aasam@codeaurora.org>
Signed-off-by: Ameya Thakur <ameyat@codeaurora.org>
usb: gadget: Enable HID function for charging mode
Provide HID function for only charging mode, in this mode device
enumerated as one input device.
Change-Id: I769adf76807b8a28adcc298de0536fa779176016
Signed-off-by: Mulu He <muluhe@codeaurora.org>
usb: gadget: composite: Fix USB version number for L1
When usb version number is greater than 2.01 USB-CV expects to find a
Super Speed USB Device Capability descriptor. When we want to enable BOS
descriptor capabilities for a high-speed device the USB version number
should be 2.01.
CRs-Fixed: 521752
Change-Id: Ic75b5e570b3c2df8e67370389dfddc8de6fb72d4
Signed-off-by: Shimrit Malichi <smalichi@codeaurora.org>
usb: gadget: Fix compilation of f_mbim driver after SS updates
Change-Id: I72e7dfa5c8f3905bbe57e227ebb7e7035d8b671c
[haggertk: port to samsung_msm8974, don't pick this for your own use]
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Fix a possible NULL pointer dereference of dev pointer in
android_disable() called from adb_closed_callback(). It happens
when adb device file is opened/closed and adb is not in the
current composition.
CRs-Fixed: 492464
Change-Id: I80f646658ce56c6883eb79773705e01967f9234e
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
usb: gadget: Fix a race condition in dynamic composition switching
This fix solves a race condition that causes a crash when switching
composition with USB cable disconnected.
The following race condition is fixed by protecting data->opened
with a mutex:
1. enable_store(0) is called.
2. While in enable_store(), adb_closed_callback() is invoked and
data->opened is set to false.
3. The execution is blocked on a mutex in closed_callback().
4. From adb_android_function_disable(), android_enable is invoked,
where we didn't call android_disable() just yet.
CRs-fixed: 482312
Change-Id: I7e37850a594e2e1c6d2cabbdb39760b00827afbd
Signed-off-by: Amit Blay <ablay@codeaurora.org>
USB: android: Fail ffs_ready (i.e. start adbd) if ADB not enabled
F_FS function notifies android composite driver of userspace client's
open and close (start/stop adbd) using android.c's ready and closed
callbacks. Typically userspace starts adbd only in ADB composition as
functionfs_bind from ready_callback happens only if ADB is enabled.
Current design has couple of issues:
1) If adbd is started before enabling ADB then USB composition gets
enabled without functionfs_bind resulting a crash in ffs_func->set_alt.
2) Additionally, even if userspace script for composition switch performs
"stop adbd" before enabling new composition, there is a possibility that
closed_callback runs in parallel with ffs_enable/disable as adb daemon
is stopped asynchronously. Even though these functions use android_dev
mutex but closed callback may not use this mutex if ready_callback
gets called before ADB/FFS is enabled, resulting in different crashes.
This is possible mainly due to above 1st issue or during quick
composition switches from ADB to non-ADB to ADB and by the time adb got
started, userspace enabled non-ADB composition.
To fix both of the above issues only option is to fail ffs_ready
callback (start adbd) if ADB is not enabled. This restriction clearly
avoid 1st issue, and for 2nd: closed callback would always use mutex
to avoid any potential synchronization issues. While we are at this,
also fix config->opened getting cleared twice from disabled_callback.
Change-Id: I9fe80d09b9eefaa87e396ff451a71026b798175b
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Gadget driver calls WARN_ON_ONCE in some of the APIs which
are called from interrupt context. This may lead to watchdog
bark if repeated WARN_ON_ONCE condition occurs. Hence print
error message and/or log it in debug buffer.
CRs-Fixed: 747698
Change-Id: Ieecd6342135e7d2bad36c82a12958b78054150db
Signed-off-by: Hemant Kumar <hemantk@codeaurora.org>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Add support for FunctionFS (ffs) to implement usb functions in userspace.
The aliases property stores the list of functions that are implemented
using functionfs.
For example:
echo "adb,mtp" > /sys/class/android_usb/android0/f_ffs/aliases
Then when the function are enabled:
echo "adb,acm" > /sys/class/android_usb/android0/functions
Internally, ffs and acm will be used.
Change-Id: I44117b183d48a5a99ddbee3ef2cf8998be74598e
Signed-off-by: Benoit Goby <benoit@android.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
fix typo error introduced by commit ea0e6276 (usb: gadget: add
multiple definition guards) which causes the following build warning:
warning: "pr_vdebug" redefined
Change-Id: I5d634acf115c1c123d1c9bdfca091bc391615b26
Signed-off-by: Bo Shen <voice.shen@atmel.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
If f_fs.c and u_serial.c are combined together using #include, which has
been a common practice so far, the pr_vdebug macro is defined multiple
times. Define it only once.
Change-Id: I59da498b028a36158bc9b55a2554ad504fbe7141
Acked-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrzej Pietrasiewicz <andrzej.p@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
When we call i_size_write, we must be holding i_mutex to avoid
possible lockups on 32 bit/SMP architectures. This is not
necessary on 64 bit architectures.
Change-Id: Ic3b946507c54d81b5c9046f9b57d25d4b0f9feef
Signed-off-by: Daniel Rosenberg <drosen@google.com>
Bug: 73287721
[haggertk: Backport to 3.4. We don't have sdcardfs_write_iter()
or file_inode().]
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
* Regen defconfigs
* Update default charset for fat to utf8
Change-Id: I23315ecf4022b7160f6ba1dcdff6ce92449ae482
Signed-off-by: Paul Keith <javelinanddart@gmail.com>
Linus Torvalds
Insun Song
Ghanim Fodi
Nicolai Stange
Mohamed Ghannam
Herbert Xu
Marissa Wall
Greg Kroah-Hartman
Mohammed Javid
Kevin F. Haggerty
Aditya Bavanari
Mohit Aggarwal
Lianjun Huang
Daniel Rosenberg
Ritesh Harjani
Praveen Chavan
Surajit Podder
Paul Keith
Rajesh Bondugula
Robb Glasser
Michael Bestas
Arve Hjønnevåg
Pavankumar Kondeti
Hemant Kumar
Benoit Goby
Bo Shen
Andrzej Pietrasiewicz