ASoC: msm: Add bounds checking to ADM get params
-
-Add additional bounds checking to ADM get params.
-Validate that all buffer sizes are valid before
-dereferencing.
-
-BUG=27947307
-
-Change-Id: Iae3643985b5b72b78606f4dff94f8068ee0ddc09
-
diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c
-index 08caf51..14565cc 100644
---- a/sound/soc/msm/qdsp6v2/q6adm.c
-+++ b/sound/soc/msm/qdsp6v2/q6adm.c
-
@@ -508,9 +508,18 @@
- rc = -EINVAL;
- goto adm_get_param_return;
- }
-- if (params_data) {
-+ if ((params_data) &&
-+ (ARRAY_SIZE(adm_get_parameters) > 0) &&
-+ (ARRAY_SIZE(adm_get_parameters) >= 1+adm_get_parameters[0]) &&
-+ (params_length/sizeof(int) >= adm_get_parameters[0])) {
- for (i = 0; i < adm_get_parameters[0]; i++)
- params_data[i] = adm_get_parameters[1+i];
-+ } else {
-+ pr_err("%s: Get param data not copied! get_param array size %zd, index %d, params array size %zd, index %d\n",
-+ __func__, ARRAY_SIZE(adm_get_parameters),
-+ (1+adm_get_parameters[0]),
-+ params_length/sizeof(int),
-+ adm_get_parameters[0]);
- }
- rc = 0;
- adm_get_param_return:
-@@ -799,17 +808,18 @@
- data->payload_size))
- break;
-
-- if (payload[0] == 0) {
-- if (data->payload_size >
-- (4 * sizeof(uint32_t))) {
-- adm_get_parameters[0] = payload[3];
-+ if ((payload[0] == 0) &&
-+ (data->payload_size > (4 * sizeof(*payload))) &&
-+ (data->payload_size/sizeof(*payload)-4 >= payload[3]) &&
-+ (ARRAY_SIZE(adm_get_parameters) > 0) &&
-+ (ARRAY_SIZE(adm_get_parameters)-1 >= payload[3])) {
-+ adm_get_parameters[0] = payload[3];
- pr_debug("GET_PP PARAM:received parameter length: 0x%x\n",
- adm_get_parameters[0]);
- /* storing param size then params */
- for (i = 0; i < payload[3]; i++)
- adm_get_parameters[1+i] =
- payload[4+i];
-- }
- } else {
- adm_get_parameters[0] = -1;
- pr_err("%s: GET_PP_PARAMS failed, setting size to %d\n",
-msm: kgsl: Add missing checks for alloc size and sglen
-
-In _kgsl_sharedmem_page_alloc():
-
-- Make len of type size_t to be in line with size.
-- Check for boundary limits of requested alloc size before honoring.
-- Make sure sglen is greater than zero before marking it as end
-of sg list.
-
-Bug: 27475454
-Change-Id: I5b2e6f657f532fc256627cb6b2ab3ca01938a11b
-Signed-off-by: Yuan Lin <yualin@google.com>
-
diff --git a/drivers/gpu/msm/kgsl_sharedmem.c b/drivers/gpu/msm/kgsl_sharedmem.c
-index 29f6162..a138719 100644
---- a/drivers/gpu/msm/kgsl_sharedmem.c
-+++ b/drivers/gpu/msm/kgsl_sharedmem.c
-
@@ -592,13 +592,18 @@
- size_t size)
- {
- int pcount = 0, order, ret = 0;
-- int j, len, page_size, sglen_alloc, sglen = 0;
-+ int j, page_size, sglen_alloc, sglen = 0;
- struct page **pages = NULL;
- pgprot_t page_prot = pgprot_writecombine(PAGE_KERNEL);
- void *ptr;
-+ size_t len;
- unsigned int align;
- int step = SZ_2M >> PAGE_SHIFT;
-
-+ size = PAGE_ALIGN(size);
-+ if (size == 0 || size > UINT_MAX)
-+ return -EINVAL;
-+
- align = (memdesc->flags & KGSL_MEMALIGN_MASK) >> KGSL_MEMALIGN_SHIFT;
-
- page_size = (align >= ilog2(SZ_64K) && size >= SZ_64K)
-Don't show empty tag stats for unprivileged uids
-
-BUG: 27577101
-BUG: 27532522
-Change-Id: I890831a72e5ad4485fdf30e51a146712b18052ed
-Signed-off-by: Mohamad Ayyash <mkayyash@google.com
-
diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c
-index c690e0f..9ce6228 100644
---- a/net/netfilter/xt_qtaguid.c
-+++ b/net/netfilter/xt_qtaguid.c
-
@@ -2521,7 +2521,7 @@
- uid_t stat_uid = get_uid_from_tag(tag);
- struct proc_print_info *ppi = m->private;
- /* Detailed tags are not available to everybody */
-- if (get_atag_from_tag(tag) && !can_read_other_uid_stats(stat_uid)) {
-+ if (!can_read_other_uid_stats(stat_uid)) {
- CT_DEBUG("qtaguid: stats line: "
- "%s 0x%llx %u: insufficient priv "
- "from pid=%u tgid=%u uid=%u stats.gid=%u\n",
-ANDROID: ion: Protect kref from userspace manipulation
-
-This separates the kref for ion handles into two components.
-Userspace requests through the ioctl will hold at most one
-reference to the internally used kref. All additional requests
-will increment a separate counter, and the original reference is
-only put once that counter hits 0. This protects the kernel from
-a poorly behaving userspace.
-
-Bug: 34276203
-
-Change-Id: Ibc36bc4405788ed0fea7337b541cad3be2b934c0
-Signed-off-by: Daniel Rosenberg <drosen@google.com>
-
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
-index ee1c2f3..e99ea9a 100755
---- a/drivers/staging/android/ion/ion.c
-+++ b/drivers/staging/android/ion/ion.c
-
@@ -116,6 +116,7 @@
- */
- struct ion_handle {
- struct kref ref;
-+ unsigned int user_ref_count;
- struct ion_client *client;
- struct ion_buffer *buffer;
- struct rb_node node;
-@@ -429,6 +430,50 @@
- return ret;
- }
-
-+/* Must hold the client lock */
-+static void user_ion_handle_get(struct ion_handle *handle)
-+{
-+ if (handle->user_ref_count++ == 0) {
-+ kref_get(&handle->ref);
-+ }
-+}
-+
-+/* Must hold the client lock */
-+static struct ion_handle* user_ion_handle_get_check_overflow(struct ion_handle *handle)
-+{
-+ if (handle->user_ref_count + 1 == 0)
-+ return ERR_PTR(-EOVERFLOW);
-+ user_ion_handle_get(handle);
-+ return handle;
-+}
-+
-+/* passes a kref to the user ref count.
-+ * We know we're holding a kref to the object before and
-+ * after this call, so no need to reverify handle. */
-+static struct ion_handle* pass_to_user(struct ion_handle *handle)
-+{
-+ struct ion_client *client = handle->client;
-+ struct ion_handle *ret;
-+
-+ mutex_lock(&client->lock);
-+ ret = user_ion_handle_get_check_overflow(handle);
-+ ion_handle_put_nolock(handle);
-+ mutex_unlock(&client->lock);
-+ return ret;
-+}
-+
-+/* Must hold the client lock */
-+static int user_ion_handle_put_nolock(struct ion_handle *handle)
-+{
-+ int ret;
-+
-+ if (--handle->user_ref_count == 0) {
-+ ret = ion_handle_put_nolock(handle);
-+ }
-+
-+ return ret;
-+}
-+
- static struct ion_handle *ion_handle_lookup(struct ion_client *client,
- struct ion_buffer *buffer)
- {
-@@ -645,6 +690,24 @@
- ion_handle_put_nolock(handle);
- }
-
-+static void user_ion_free_nolock(struct ion_client *client, struct ion_handle *handle)
-+{
-+ bool valid_handle;
-+
-+ BUG_ON(client != handle->client);
-+
-+ valid_handle = ion_handle_validate(client, handle);
-+ if (!valid_handle) {
-+ WARN(1, "%s: invalid handle passed to free.\n", __func__);
-+ return;
-+ }
-+ if (!handle->user_ref_count > 0) {
-+ WARN(1, "%s: User does not have access!\n", __func__);
-+ return;
-+ }
-+ user_ion_handle_put_nolock(handle);
-+}
-+
- void ion_free(struct ion_client *client, struct ion_handle *handle)
- {
- BUG_ON(client != handle->client);
-@@ -1439,7 +1502,7 @@
- data.allocation.flags, true);
- if (IS_ERR(handle))
- return PTR_ERR(handle);
--
-+ pass_to_user(handle);
- data.allocation.handle = handle->id;
-
- cleanup_handle = handle;
-@@ -1455,7 +1518,7 @@
- mutex_unlock(&client->lock);
- return PTR_ERR(handle);
- }
-- ion_free_nolock(client, handle);
-+ user_ion_free_nolock(client, handle);
- ion_handle_put_nolock(handle);
- mutex_unlock(&client->lock);
- break;
-@@ -1478,10 +1541,15 @@
- {
- struct ion_handle *handle;
- handle = ion_import_dma_buf(client, data.fd.fd);
-- if (IS_ERR(handle))
-+ if (IS_ERR(handle)) {
- ret = PTR_ERR(handle);
-- else
-- data.handle.handle = handle->id;
-+ } else {
-+ handle = pass_to_user(handle);
-+ if (IS_ERR(handle))
-+ ret = PTR_ERR(handle);
-+ else
-+ data.handle.handle = handle->id;
-+ }
- break;
- }
- case ION_IOC_SYNC:
-@@ -1518,8 +1586,10 @@
- if (dir & _IOC_READ) {
- if (copy_to_user((void __user *)arg, &data, _IOC_SIZE(cmd))) {
- if (cleanup_handle) {
-- ion_free(client, cleanup_handle);
-- ion_handle_put(cleanup_handle);
-+ mutex_lock(&client->lock);
-+ user_ion_free_nolock(client, cleanup_handle);
-+ ion_handle_put_nolock(cleanup_handle);
-+ mutex_unlock(&client->lock);
- }
- return -EFAULT;
- }
-net: wireless: bcmdhd: adding boundary check in wl_cfg80211_mgmt_tx
-
-added boundary check for user-input parameter not to corrupt kernel
-memmory.
-
-Signed-off-by: Insun Song <insun.song@broadcom.com>
-Bug: 35195787
-Change-Id: Ia497feae5f502c9a650e50a39fd0620fa976d908
-
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
-index 9081988..a73b030 100644
---- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c
-+++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
-
@@ -5830,6 +5830,10 @@
-
- WL_DBG(("Enter \n"));
-
-+ if (len > (ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN)) {
-+ WL_ERR(("bad length:%zu\n", len));
-+ return BCME_BADARG;
-+ }
- dev = cfgdev_to_wlc_ndev(cfgdev, cfg);
-
- /* set bsscfg idx for iovar (wlan0: P2PAPI_BSSCFG_PRIMARY, p2p: P2PAPI_BSSCFG_DEVICE) */
-UPSTREAM: packet: fix races in fanout_add()
-
-commit d199fab63c11998a602205f7ee7ff7c05c97164b upstream.
-
-Multiple threads can call fanout_add() at the same time.
-
-We need to grab fanout_mutex earlier to avoid races that could
-lead to one thread freeing po->rollover that was set by another thread.
-
-Do the same in fanout_release(), for peace of mind, and to help us
-finding lockdep issues earlier.
-
-[js] no rollover in 3.12
-
-Fixes: dc99f600698d ("packet: Add fanout support.")
-Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
-Signed-off-by: Eric Dumazet <edumazet@google.com>
-Cc: Willem de Bruijn <willemb@google.com>
-Signed-off-by: David S. Miller <davem@davemloft.net>
-Signed-off-by: Jiri Slaby <jslaby@suse.cz>
-Signed-off-by: Willy Tarreau <w@1wt.eu>
-(cherry picked from commit 2a272abc4e543f488b3a73292ee75a06f20d077a)
-Bug: 37897645
-Change-Id: I3b021869ee26b88d10f4d6408ce34d351543ce74
-diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 05cfee7..2ae5ae2 100644
---- a/net/packet/af_packet.c
-+++ b/net/packet/af_packet.c
-
@@ -1429,13 +1429,16 @@
- return -EINVAL;
- }
-
-- if (!po->running)
-- return -EINVAL;
--
-- if (po->fanout)
-- return -EALREADY;
--
- mutex_lock(&fanout_mutex);
-+
-+ err = -EINVAL;
-+ if (!po->running)
-+ goto out;
-+
-+ err = -EALREADY;
-+ if (po->fanout)
-+ goto out;
-+
- match = NULL;
- list_for_each_entry(f, &fanout_list, list) {
- if (f->id == id &&
-@@ -1491,17 +1494,16 @@
- struct packet_sock *po = pkt_sk(sk);
- struct packet_fanout *f;
-
-- f = po->fanout;
-- if (!f)
-- return;
--
- mutex_lock(&fanout_mutex);
-- po->fanout = NULL;
-+ f = po->fanout;
-+ if (f) {
-+ po->fanout = NULL;
-
-- if (atomic_dec_and_test(&f->sk_ref)) {
-- list_del(&f->list);
-- dev_remove_pack(&f->prot_hook);
-- kfree(f);
-+ if (atomic_dec_and_test(&f->sk_ref)) {
-+ list_del(&f->list);
-+ dev_remove_pack(&f->prot_hook);
-+ kfree(f);
-+ }
- }
- mutex_unlock(&fanout_mutex);
- }
-
Mahesh A Saptasagar
Mukul Sharma
Hanumantha Reddy Pothula
