Merge tag 'LA.UM.8.4.c25-06600-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4 into android13-4.4-msm8998

"LA.UM.8.4.c25-06600-8x98.0"

* tag 'LA.UM.8.4.c25-06600-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4:
  diag: Prevent out of bound write while sending dci pkt to remote
  diag: Ensure dci entry is valid before sending the packet
  ion: Fix integer overflow in msm_ion_custom_ioctl
  diag: Use valid data_source for a valid token
  msm: kgsl: Remove 'fd' dependency to get dma_buf handle
  msm: kgsl: Fix gpuaddr_in_range() to check upper bound
  msm: adsprpc: Handle UAF in fastrpc debugfs read
  msm: kgsl: Add a sysfs node to control performance counter reads
  msm: kgsl: Perform cache flush on the pages obtained using get_user_pages()
  soc: qcom: hab: Add sanity check for payload_count
  msm: kgsl: Fix out of bound write in adreno_profile_submit_time
  futex: Fix inode life-time issue
  futex: Handle faults correctly for PI futexes
  futex: Simplify fixup_pi_state_owner()
  futex: Use pi_state_update_owner() in put_pi_state()
  rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
  futex: Provide and use pi_state_update_owner()
  futex: Replace pointless printk in fixup_owner()
  futex: Avoid violating the 10th rule of futex
  futex: Rework inconsistent rt_mutex/futex_q state
  futex: Remove rt_mutex_deadlock_account_*()
  futex,rt_mutex: Provide futex specific rt_mutex API
  msm: adsprpc: Handle UAF in process shell memory
  Disable TRACER Check to improve Camera Performance
  msm: kgsl: Deregister gpu address on memdesc_sg_virt failure
  crypto: Fix possible stack out-of-bound error
  msm: kgsl: Correct the refcount on current process PID.
  msm: kgsl: Compare pid pointer instead of TGID for a new process
  qcom,max-freq-level change for trial
  msm: kgsl: Protect the memdesc->gpuaddr in SVM use cases.
  msm: kgsl: Stop using memdesc->usermem.

 Conflicts:
	drivers/char/adsprpc.c
	drivers/char/diag/diag_dci.c
	drivers/gpu/msm/kgsl.c
	drivers/gpu/msm/kgsl_debugfs.c
	drivers/gpu/msm/kgsl_iommu.c
	drivers/gpu/msm/kgsl_mmu.c
	drivers/gpu/msm/kgsl_sharedmem.c
	drivers/gpu/msm/kgsl_trace.h
	kernel/futex.c
	kernel/locking/rtmutex.c
	kernel/locking/rtmutex_common.h

Change-Id: I777ee96b855e2967ef6733e603d12f40174974d0

1 files changed, 11 insertions, 1 deletions

diff --git a/drivers/crypto/msm/qce50.c b/drivers/crypto/msm/qce50.c
index 7740a8c59126..3f8c512e0cd9 100644
--- a/drivers/crypto/msm/qce50.c
+++ b/drivers/crypto/msm/qce50.c
@@ -1,6 +1,6 @@
 /* Qualcomm Crypto Engine driver.
  *
- * Copyright (c) 2012-2018, 2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2018, 2020-2021 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -866,6 +866,11 @@ static int _ce_setup_cipher(struct qce_device *pce_dev, struct qce_req *creq,
 		break;
 	case CIPHER_ALG_3DES:
 		if (creq->mode !=  QCE_MODE_ECB) {
+			if (ivsize > MAX_IV_LENGTH) {
+				pr_err("%s: error: Invalid length parameter\n",
+					 __func__);
+				return -EINVAL;
+			}
 			_byte_stream_to_net_words(enciv32, creq->iv, ivsize);
 			pce = cmdlistinfo->encr_cntr_iv;
 			pce->data = enciv32[0];
@@ -914,6 +919,11 @@ static int _ce_setup_cipher(struct qce_device *pce_dev, struct qce_req *creq,
 			}
 		}
 		if (creq->mode !=  QCE_MODE_ECB) {
+			if (ivsize > MAX_IV_LENGTH) {
+				pr_err("%s: error: Invalid length parameter\n",
+					 __func__);
+				return -EINVAL;
+			}
 			if (creq->mode ==  QCE_MODE_XTS)
 				_byte_stream_swap_to_net_words(enciv32,
 							creq->iv, ivsize);