summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
* Merge remote-tracking branch 'los/lineage-20' into lineage-21HEADlineage-21Raghuram Subramani2024-12-10
|\
| * dsp: q6voice: Switch to __builtin_add_overflowMichael Bestas2024-10-13
| | | | | | | | | | | | As seen on newer kernels Change-Id: I87f0a408c211f956ebe8acaf23cbdd8c89fef9e5
| * Merge tag 'LA.UM.8.4.c25-11300-8x98.0' of ↵Michael Bestas2024-10-11
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.codelinaro.org/clo/la/kernel/msm-4.4 into android13-4.4-msm8998 "LA.UM.8.4.c25-11300-8x98.0" * tag 'LA.UM.8.4.c25-11300-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4: msm: kgsl: Fix error handling during drawctxt switch dsp: q6voice: Adds checks for an integer overflow msm: adsprpc: Handle UAF in fastrpc internal munmap Conflicts: drivers/char/adsprpc.c Change-Id: I3b55e2f381f91677a3d739ba33f4f1d57f6573e0
| | * msm: kgsl: Fix error handling during drawctxt switchRakesh Naidu Bhaviripudi2024-07-08
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, separate submissions are made for page table switch and context switch to the ring buffer. However, if the page table switch succeeds but the context switch fails, it can lead to use of wrong page table for drawctxt. To address this issue, rollback the pagetable to current pagetable. Also,correctly put the refcount of adreno context during error cleanup. Change-Id: I1bb4ee3ebb0ce6ea32f0b6799cfb7fa89c0d09c7 Signed-off-by: Rakesh Naidu Bhaviripudi <quic_rakeshb@quicinc.com>
| | * dsp: q6voice: Adds checks for an integer overflowAbinath S2024-05-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | there is no check for cvs_voc_pkt[2],when receives 0xffffffff from ADSP which results in an integer overflow Fix is to address this. Change-Id: I9a85544a51a3edfe5f0b86efc62bd86f98e88c24 Signed-off-by: Abinath S <quic_abins@quicinc.com> (cherry picked from commit 4524418cd14dce47e4ea7234618f919e28dbbe5a)
| | * msm: adsprpc: Handle UAF in fastrpc internal munmapDEEPAK SANNAPAREDDY2024-05-17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Added reference count for contex map indicate memory under used in remote call. And, this memory would not removed in internal unmap to avoid UAF. Change-Id: Ieb4ff6b298ff9c48953bc5b3539fdfe19a14b442 Signed-off-by: DEEPAK SANNAPAREDDY <quic_sdeeredd@quicinc.com> (cherry picked from commit 98913b6855c765e36d95288b318826518c8b8e0d)
| * | kconfig/lxdialog: Make main() return 0LuK13372024-10-09
| | | | | | | | | | | | | | | | | | Fixes build with newer host toolchain. Change-Id: I5c69bcdf6422d86b852e29768ba6dfbe0e9c2a76
| * | fs/open.c: allow opening only regular files during execve()Tetsuo Handa2024-07-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 73601ea5b7b18eb234219ae2adf77530f389da79 upstream. syzbot is hitting lockdep warning [1] due to trying to open a fifo during an execve() operation. But we don't need to open non regular files during an execve() operation, for all files which we will need are the executable file itself and the interpreter programs like /bin/sh and ld-linux.so.2 . Since the manpage for execve(2) says that execve() returns EACCES when the file or a script interpreter is not a regular file, and the manpage for uselib(2) says that uselib() can return EACCES, and we use FMODE_EXEC when opening for execve()/uselib(), we can bail out if a non regular file is requested with FMODE_EXEC set. Since this deadlock followed by khungtaskd warnings is trivially reproducible by a local unprivileged user, and syzbot's frequent crash due to this deadlock defers finding other bugs, let's workaround this deadlock until we get a chance to find a better solution. [1] https://syzkaller.appspot.com/bug?id=b5095bfec44ec84213bac54742a82483aad578ce Link: http://lkml.kernel.org/r/1552044017-7890-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp Reported-by: syzbot <syzbot+e93a80c1bb7c5c56e522461c149f8bf55eab1b2b@syzkaller.appspotmail.com> Fixes: 8924feff66f35fe2 ("splice: lift pipe_lock out of splice_to_pipe()") Change-Id: I455fc5a93ada528260aa66fa1d7b4fab3bbfd74c Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp> Acked-by: Kees Cook <keescook@chromium.org> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Eric Biggers <ebiggers3@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> [4.9+] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | splice: reinstate SIGPIPE/EPIPE handlingLinus Torvalds2024-07-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 52bce91165e5f2db422b2b972e83d389e5e4725c upstream. Commit 8924feff66f3 ("splice: lift pipe_lock out of splice_to_pipe()") caused a regression when there were no more readers left on a pipe that was being spliced into: rather than the expected SIGPIPE and -EPIPE return value, the writer would end up waiting forever for space to free up (which obviously was not going to happen with no readers around). Fixes: 8924feff66f3 ("splice: lift pipe_lock out of splice_to_pipe()") Reported-and-tested-by: Andreas Schwab <schwab@linux-m68k.org> Debugged-by: Al Viro <viro@zeniv.linux.org.uk> Change-Id: I585c8fde68ba0ee61a8c7687eca80fc848cefc96 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | splice: lift pipe_lock out of splice_to_pipe()Al Viro2024-07-19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * splice_to_pipe() stops at pipe overflow and does *not* take pipe_lock * ->splice_read() instances do the same * vmsplice_to_pipe() and do_splice() (ultimate callers of splice_to_pipe()) arrange for waiting, looping, etc. themselves. That should make pipe_lock the outermost one. Unfortunately, existing rules for the amount passed by vmsplice_to_pipe() and do_splice() are quite ugly _and_ userland code can be easily broken by changing those. It's not even "no more than the maximal capacity of this pipe" - it's "once we'd fed pipe->nr_buffers pages into the pipe, leave instead of waiting". Considering how poorly these rules are documented, let's try "wait for some space to appear, unless given SPLICE_F_NONBLOCK, then push into pipe and if we run into overflow, we are done". Change-Id: I700882650893824562bd2cdd3f1b1056fff8d686 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | splice: switch get_iovec_page_array() to iov_iterAl Viro2024-07-19
| | | | | | | | | | | | | | | Change-Id: Ie763b839ef468fc9603891462f7d63811d26abe6 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | splice_to_pipe(): don't open-code wakeup_pipe_readers()Al Viro2024-07-19
| | | | | | | | | | | | | | | Change-Id: Iefc4f4cb702b673142bdb19875650833ab4daf79 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
| * | Merge tag 'LA.UM.8.4.c25-10700-8x98.0' of ↵Michael Bestas2024-04-21
| |\| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | https://git.codelinaro.org/clo/la/kernel/msm-4.4 into android13-4.4-msm8998 "LA.UM.8.4.c25-10700-8x98.0" * tag 'LA.UM.8.4.c25-10700-8x98.0' of https://git.codelinaro.org/clo/la/kernel/msm-4.4: soc: qcom: smem: Add boundary checks for partitions Revert "soc: qcom: smem: Add boundary checks for partitions" msm: kgsl: Do not release dma and anon buffers if unmap fails msm: kgsl: Fix memory leak for anonymous buffers soc: qcom: smem: Add boundary checks for partitions msm: kgsl: Do not free sharedmem if it cannot be unmapped dsp: q6asm: Add check for ADSP payload size msm: kgsl: Prevent wrap around during user address mapping iommu: Fix missing return check of arm_lpae_init_pte q6asm: validate payload size before access dsp: afe: Add check for sidetone iir config copy size. q6core: Avoid OOB access in q6core q6voice: Add buf size check for cvs cal data. ASoC: msm-pcm-host-voice: Handle OOB access in hpcm_start. q6lsm: Address use after free for mmap handle. msm-pcm-host-voice: Check validity of session idx Asoc: check for invalid voice session id ASoC: msm-pcm-voip: Avoid integer underflow ASoC: msm-pcm-q6-v2: Add dsp buf check msm: kgsl: Make sure that pool pages don't have any extra references msm: kgsl: Use dma_buf_get() to get dma_buf structure Conflicts: drivers/gpu/msm/kgsl.c drivers/gpu/msm/kgsl_pool.c drivers/gpu/msm/kgsl_sharedmem.c sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c Change-Id: Ic2340d2ee0800279ae3ccbe1cb222c0ba2c2ae46
| | * Merge "msm: kgsl: Do not release dma and anon buffers if unmap fails"Linux Build Service Account2024-03-25
| | |\
| | | * msm: kgsl: Do not release dma and anon buffers if unmap failsLynus Vaz2024-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If iommu unmap fails and leaves dma or anon buffers still mapped in the iommu, do not free them. Change-Id: Ice0e1a59c1ac0ee7a9d62d8899966b84fa63d5ca Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com>
| | * | Merge "msm: kgsl: Fix memory leak for anonymous buffers"Linux Build Service Account2024-03-25
| | |\|
| | | * msm: kgsl: Fix memory leak for anonymous buffersKamal Agrawal2024-03-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, clean up is not done properly for anonymous buffer (KGSL_MEM_ENTRY_USER). Fix it by freeing up resources allocated during memdesc_sg_virt. Change-Id: I75bff2e718b494c102a8075a5f27323e1823b212 Signed-off-by: Kamal Agrawal <kamaagra@codeaurora.org>
| | * | soc: qcom: smem: Add boundary checks for partitionsSarannya S2024-03-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add condition check to make sure that the end address of private entry does not go out of partition. Change-Id: Ifb942c30ebeb8bccb891eebdcae4700b64b76920 Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
| | * | Revert "soc: qcom: smem: Add boundary checks for partitions"Sarannya S2024-03-22
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 71dc69707730a693c883a94f2d390299b49ea144. Reason for revert: Few boundary checks are missing Change-Id: Ib6783b43ad447fe5ebaed20a6e7908b96fb87fdf Signed-off-by: Sarannya S <quic_sarannya@quicinc.com>
| | * soc: qcom: smem: Add boundary checks for partitionsSarannya S2024-02-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add condition check to make sure that the end address of private entry does not go out of partition. Change-Id: I88b3c69d86d90905b214c13a8c632b134b487a49 Signed-off-by: Sarannya S <quic_sarannya@quicinc.com> Signed-off-by: Pranav Mahesh Phansalkar <quic_pphansal@quicinc.com> (cherry picked from commit d3154be15b022817c95973d77d67411da3ea71ef)
| | * msm: kgsl: Do not free sharedmem if it cannot be unmappedKaushal Sanadhya2023-12-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If sharedmem cannot be unmapped from the mmu, it can still be accessed by the GPU. Therefore it is not safe to free the backing memory. In the case that unmap fails, do not free it or return it to the system. Change-Id: Iad3e86d043f129a4d71cf862865d9033d4a315e3 Signed-off-by: Lynus Vaz <quic_lvaz@quicinc.com> Signed-off-by: Kaushal Sanadhya <quic_ksanadhy@quicinc.com>
| | * dsp: q6asm: Add check for ADSP payload sizeSoumya Managoli2023-12-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | There is no check for the ADSP returned payload size for ASM_SESSION_CMD_GET_MTMX_STRTR_PARAMS_V2 cmd response. This can lead to buffer overread. Fix is to address this. Change-Id: I0bd6ee7f19823addc5dde1dfbb32b8a9b102a725 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * Merge "msm: kgsl: Prevent wrap around during user address mapping"Linux Build Service Account2023-09-27
| | |\
| | | * msm: kgsl: Prevent wrap around during user address mappingMohammed Mirza Mandayappurath Manzoor2023-09-27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When setting svm region during the gpuobj import ioctl call for a usermem address, there is a possibility of a very large input size causing the region's 64-bit end address to wrap around. This can cause the region to incorrectly be considered valid, ultimately allowing a use after free scenario. To prevent this, detect the occurrence of a wrap and reject the import. Change-Id: I4a88f56c58b830d4342e47dc1d1f6290c78ab6b4 Signed-off-by: Mohammed Mirza Mandayappurath Manzoor <quic_mmandaya@quicinc.com>
| | * | iommu: Fix missing return check of arm_lpae_init_ptePratyush Brahma2023-09-25
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | UAF scenario may occur in clients with EL1 privileges for iova mappings when we miss to check the return value of arm_lpae_init_pte which may lead to an PTE be counted as it was set even if it was already existing. This can cause a dangling IOMMU PTE to be left mapped pointing to a freed object and cause UAF in the client if the dangling PTE is accessed after a failed unmap operation. Fixes: 27de1978c331 ("ANDROID: GKI: iommu/io-pgtable-arm: LPAE related updates by vendor") Change-Id: I674b9b520e705b8f8e63ba20ed76e64cb2fe0f47 Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com> (cherry picked from commit b1405fc833e94c7b69fd4a63ed204407284a58dc)
| | * q6asm: validate payload size before accessSoumya Managoli2023-09-13
| | | | | | | | | | | | | | | | | | | | | | | | | | | Payload size is not checked before payload access. Check size to avoid out-of-boundary memory access. Change-Id: I1bd8281ad263b8c0102335504a740312755b8d15 Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com> Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * Merge "dsp: afe: Add check for sidetone iir config copy size."Linux Build Service Account2023-09-06
| | |\
| | | * dsp: afe: Add check for sidetone iir config copy size.Soumya Managoli2023-09-05
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Avoid OOB access of sidetone iir config array when iir_num_biquad_stages returned from cal block is > 10 Change-Id: I45b95e8bdd1a993a526590c94cf2f9a85c12af37 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * | Merge "q6core: Avoid OOB access in q6core"Linux Build Service Account2023-09-05
| | |\ \
| | | * | q6core: Avoid OOB access in q6coreSoumya Managoli2023-09-04
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | "num_services", a signed integer when compared with constant results in conversion of signed integer to max possible unsigned int value when "num_services" is a negative value. This can lead to OOB read. Fix is to handle this case. Change-Id: Id6a8f150d9019c972a87f789e4c626337a97bfff Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * / q6voice: Add buf size check for cvs cal data.Soumya Managoli2023-09-04
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Check for the max size of cvs command register calibration data that can be copied else will result in buffer overflow. Change-Id: Id7a4c5a9795143798b68dfde779f17fb450e3848 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com> (cherry picked from commit 606e2a66f0cd284cfe0d445230b45430b99578e8)
| | * ASoC: msm-pcm-host-voice: Handle OOB access in hpcm_start.Soumya Managoli2023-08-29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is no error check for case when hpcm_start is called for the same RX or TX tap points multiple times. This can result in OOB access of struct vss_ivpcm_tap_point. Handle this scenario with appropriate no_of_tp check. Change-Id: Ib384d21c9bf372f3e5d78f64b5c056e836728399 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com> (cherry picked from commit 521277c4c3ffc4a3f4a232de41cfa4fc7b6aaa35)
| | * Merge "q6lsm: Address use after free for mmap handle."Linux Build Service Account2023-08-25
| | |\
| | | * q6lsm: Address use after free for mmap handle.Soumya Managoli2023-08-25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The global declared mmap_handle can be left dangling for case when the handle is freed by the calling function. Fix is to address this. Also add a check to make sure the mmap_handle is accessed legally. Change-Id: I367f8a41339aa0025b545b125ee820220efedeee Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * | msm-pcm-host-voice: Check validity of session idxSoumya Managoli2023-08-25
| | |/ | | | | | | | | | | | | | | | | | | | | | Added check for voice session index. Change-Id: Ifff36add5d62f2fdc3395de1447075d297f2c2df Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com> (cherry picked from commit fd59b4b0abb1efb064f705fb47723a9262be9a0f)
| | * Asoc: check for invalid voice session idSaurav Kumar2023-08-23
| | | | | | | | | | | | | | | | | | | | | | | | Add check to return if session id is invalid. Change-Id: Ida0e07b78657102a3bf6e73a1ca23c44ad112426 Signed-off-by: Lakshman Chaluvaraju <lchalu@codeaurora.org> Signed-off-by: Tapas Dey <quic_tapadey@quicinc.com>
| | * ASoC: msm-pcm-voip: Avoid integer underflowSoumya Managoli2023-06-16
| | | | | | | | | | | | | | | | | | | | | | | | | | | There is no check for voip pkt pkt_len,if it contains the min required data. This can lead to integer underflow. Add check for the same. Change-Id: I4f57eb125967d52ad8da60d21a440af1f81d2579 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * ASoC: msm-pcm-q6-v2: Add dsp buf checkSoumya Managoli2023-06-06
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Current logic copies user buf size of data from the avail dsp buf at a given offset. If this offset returned from DSP in READ_DONE event goes out of bounds or is corrupted, then it can lead to out of bounds DSP buffer access, resulting in memory fault. Fix is to add check for this buf offset, if it is within the buf size range. Change-Id: Ia81bf25a5a32a69c39dce7589c96bff99b9452f0 Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
| | * Merge "msm: kgsl: Make sure that pool pages don't have any extra references"Linux Build Service Account2023-03-01
| | |\
| | | * msm: kgsl: Make sure that pool pages don't have any extra referencesHarshitha Sai Neelati2023-02-28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Before putting a page back in the pool be sure that it doesn't have any additional references that would be a signal that somebody else is looking at the page and that it would be a bad idea to keep it around and run the risk of accidentally handing it to a different process. Change-Id: Ic0dedbad0cf2ffb34b76ad23e393c5a911114b82 Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org> Signed-off-by: Harshitha Sai Neelati <quic_hsaineel@quicinc.com>
| | * | msm: kgsl: Use dma_buf_get() to get dma_buf structurePankaj Gupta2023-02-28
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently we don't ensure if vma->vm_file is associated with dma_buf. This can cause issues later when private_data from a non dma_buf file is used as dma_buf structure. Hence get the fd that is associated with vma->vm_file and use dma_buf_get() to get pointer to dma_buf structure. dma_buf_get() ensures that the file from the input fd is associated with dma_buf. Change-Id: Ib78aef8b16bedca5ca86d3a132278ff9f07dce73 Signed-off-by: Puranam V G Tejaswi <quic_pvgtejas@quicinc.com> Signed-off-by: Pankaj Gupta <quic_gpankaj@quicinc.com>
| * | usb: dwc3: Handle charging behavior when usb data is disabledJimmy Hu2024-03-21
| | | | | | | | | | | | | | | | | | | | | Bug: 221009551 Test: build, boot Signed-off-by: Jimmy Hu <hhhuuu@google.com> Change-Id: I82add2a6cb5e3060c930105b1b8b4f45da85f5f8
| * | usb: dwc3: Set the initial value of usb_data_enabled before useAlbert Wang2024-03-21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes: 4b7e37cbcd65 ("usb: new attributes implementation to enable/disable usb data") Bug: 194649527 Test: build, boot Signed-off-by: Jimmy Hu <hhhuuu@google.com> Change-Id: I63f58c3df620e91367b23b405fa0e9a577313964 Signed-off-by: Albert Wang <albertccwang@google.com>
| * | usb: new attributes implementation to enable/disable usb dataAlbert Wang2024-03-21
| | | | | | | | | | | | | | | | | | | | | Bug: 184613044 Test: driver probe and attributes access normally Signed-off-by: Albert Wang <albertccwang@google.com> Change-Id: Ia34cfd8e76a21f7239e356608e46ddeebd6fa10a
| * | arm64: insn: Fix ldadd instruction encodingJean-Philippe Brucker2024-03-11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit c5e2edeb01ae9ffbdde95bdcdb6d3614ba1eb195 upstream. GCC 8.1.0 reports that the ldadd instruction encoding, recently added to insn.c, doesn't match the mask and couldn't possibly be identified: linux/arch/arm64/include/asm/insn.h: In function 'aarch64_insn_is_ldadd': linux/arch/arm64/include/asm/insn.h:280:257: warning: bitwise comparison always evaluates to false [-Wtautological-compare] Bits [31:30] normally encode the size of the instruction (1 to 8 bytes) and the current instruction value only encodes the 4- and 8-byte variants. At the moment only the BPF JIT needs this instruction, and doesn't require the 1- and 2-byte variants, but to be consistent with our other ldr and str instruction encodings, clear the size field in the insn value. Fixes: 34b8ab091f9ef57a ("bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd") Acked-by: Daniel Borkmann <daniel@iogearbox.net> Reported-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Change-Id: I914ba0c9ca65af2996d6b67bf45a0d9fabd0ec92 Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com> Signed-off-by: Will Deacon <will.deacon@arm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| * | BACKPORT: Bluetooth: hci_sock: Correctly bounds check and pad ↵Kees Cook2024-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | HCI_MON_NEW_INDEX name The code pattern of memcpy(dst, src, strlen(src)) is almost always wrong. In this case it is wrong because it leaves memory uninitialized if it is less than sizeof(ni->name), and overflows ni->name when longer. Normally strtomem_pad() could be used here, but since ni->name is a trailing array in struct hci_mon_new_index, compilers that don't support -fstrict-flex-arrays=3 can't tell how large this array is via __builtin_object_size(). Instead, open-code the helper and use sizeof() since it will work correctly. Additionally mark ni->name as __nonstring since it appears to not be a %NUL terminated C string. Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Cc: Edward AD <twuufnxlz@gmail.com> Cc: Marcel Holtmann <marcel@holtmann.org> Cc: Johan Hedberg <johan.hedberg@gmail.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: linux-bluetooth@vger.kernel.org Cc: netdev@vger.kernel.org Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event") Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/ Change-Id: I083f12f697e746f8d376824745d7d38d6400a9d0 Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> [AG: Remove __nonstring attribute not present in 4.4] Signed-off-by: Alexander Grund <theflamefire89@gmail.com>
| * | Bluetooth: hci_sock: fix slab oob read in create_monitor_eventEdward AD2024-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 18f547f3fc074500ab5d419cf482240324e73a7e upstream. When accessing hdev->name, the actual string length should prevail Reported-by: syzbot+c90849c50ed209d77689@syzkaller.appspotmail.com Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings") Change-Id: I978cec1690e143ad263c0557f036b457ed84af24 Signed-off-by: Edward AD <twuufnxlz@gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ulrich Hecht <uli@kernel.org>
| * | string: uninline memcpy_and_padGuenter Roeck2024-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 5c4e0a21fae877a7ef89be6dcc6263ec672372b8 upstream. When building m68k:allmodconfig, recent versions of gcc generate the following error if the length of UTS_RELEASE is less than 8 bytes. In function 'memcpy_and_pad', inlined from 'nvmet_execute_disc_identify' at drivers/nvme/target/discovery.c:268:2: arch/m68k/include/asm/string.h:72:25: error: '__builtin_memcpy' reading 8 bytes from a region of size 7 Discussions around the problem suggest that this only happens if an architecture does not provide strlen(), if -ffreestanding is provided as compiler option, and if CONFIG_FORTIFY_SOURCE=n. All of this is the case for m68k. The exact reasons are unknown, but seem to be related to the ability of the compiler to evaluate the return value of strlen() and the resulting execution flow in memcpy_and_pad(). It would be possible to work around the problem by using sizeof(UTS_RELEASE) instead of strlen(UTS_RELEASE), but that would only postpone the problem until the function is called in a similar way. Uninline memcpy_and_pad() instead to solve the problem for good. Suggested-by: Linus Torvalds <torvalds@linux-foundation.org> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Acked-by: Andy Shevchenko <andriy.shevchenko@intel.com> Change-Id: I21516b6de0b5f3d8af30ebbbfcac2d4a495658ac Signed-off-by: Guenter Roeck <linux@roeck-us.net> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Alexander Grund <theflamefire89@gmail.com>
| * | string.h: un-fortify memcpy_and_padMartin Wilck2024-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 1359798f9d4082eb04575efdd19512fbd9c28464 upstream. The way I'd implemented the new helper memcpy_and_pad with __FORTIFY_INLINE caused compiler warnings for certain kernel configurations. This helper is only used in a single place at this time, and thus doesn't benefit much from fortification. So simplify the code by dropping fortification support for now. Fixes: 01f33c336e2d "string.h: add memcpy_and_pad()" Change-Id: I8bb1ec4490e27d450ba2042074d6f228b102462a Signed-off-by: Martin Wilck <mwilck@suse.com> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Alexander Grund <theflamefire89@gmail.com>
| * | BACKPORT: string.h: add memcpy_and_pad()Martin Wilck2024-03-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | commit 01f33c336e2d298ea5d4ce5d6e5bcd12865cc30f upstream. This helper function is useful for the nvme subsystem, and maybe others. Note: the warnings reported by the kbuild test robot for this patch are actually generated by the use of CONFIG_PROFILE_ALL_BRANCHES together with __FORTIFY_INLINE. Change-Id: I5f7e1e9143ce9df88af0afd02aef971d5172bd3e Signed-off-by: Martin Wilck <mwilck@suse.com> Reviewed-by: Sagi Grimberg <sagi@grimbeg.me> Signed-off-by: Christoph Hellwig <hch@lst.de> [AG: Backported to 4.4] Signed-off-by: Alexander Grund <theflamefire89@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-10-21 14:30:57 +0000