lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4 into android13-5.4-lahaina

Browse Source 
"LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0"

* tag 'LA.UM.9.14.r1-22000-LAHAINA.QSSI12.0' of https://git.codelinaro.org/clo/la/kernel/msm-5.4:
  cpufreq: schedutil: Fix UAF issue
  msm: mhi_dev: Support async write in UCI for size greater than 8k
  mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
  qcom: cpufreq-hw: Use the topology coreid for offset
  soc: qcom: Add Upperbounds check for program header
  msm: adsprpc: Handle UAF in fastrpc_buf_free
  interconnect: qcom: sm8150: fix UAF under remove function
  interconnect: qcom: monaco: fix UAF under remove function
  interconnect: qcom: direwolf: fix UAF under remove function
  interconnect: qcom: yupik: fix UAF under remove function
  interconnect: qcom: sdxnightjar: fix UAF under remove function
  interconnect: qcom: sdxlemur: fix UAF under remove function
  interconnect: qcom: sm6150: fix UAF under remove function
  interconnect: qcom: shima: fix UAF under remove function
  interconnect: qcom: scshrike: fix UAF under remove function
  interconnect: qcom: lahaina: fix UAF under remove function
  interconnect: qcom: holi: fix UAF under remove function
  qcedev: vote for crypto clocks during module close
  msm: synx: Check for zero before reducing bind handles
  msm: adsprpc: Handle UAF in fastrpc internal munmap
  mtd: msm_qpic_nand: Add boot_a and boot_b access to APPS
  coresight-tmc: increase qdss pcie sw path throughput
  net: qrtr: Move service id based filter check before queueing skb
  defconfig: sdxlemur: Enable R8168 driver config
  virt: haven: rsc_mgr: Allocate right buffer size of requests

 Conflicts:
	arch/arm64/boot/dts/vendor/bindings/phy/amlogic,g12a-usb3-pcie-phy.yaml
	arch/arm64/boot/dts/vendor/bindings/sound/qcom,wcd9335.txt
	drivers/edac/qcom_edac.c
	drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
	drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
	mm/khugepaged.c

Change-Id: I5b49e94db45d481ea90ba77800b26c32bd7433ab
This commit is contained in:
Michael Bestas 2023-07-11 15:43:42 +03:00
commit 98fe78f9fe
No known key found for this signature in database
GPG Key ID: CC95044519BE6669
26 changed files with 125 additions and 118 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
android/GKI_VERSION
View File

@ -1 +1 @@
LTS_5.4.226_2af3bdf29330
LTS_5.4.233_4716ccc31d55

1
arch/arm/configs/vendor/sdxlemur.config vendored
View File

@ -363,6 +363,7 @@ CONFIG_IOSS=m
CONFIG_AQFWD_IOSS=m
CONFIG_R8125=y
CONFIG_R8125_IOSS=m
CONFIG_R8168=y
CONFIG_QCOM_SHOW_RESUME_IRQ=y
CONFIG_HARDENED_USERCOPY=y
# CONFIG_HARDENED_USERCOPY_FALLBACK is not set

36
drivers/char/adsprpc.c
View File

@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2012-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
*/
/* Uncomment this block to log an error on every VERIFY failure */
@ -583,6 +583,7 @@ struct fastrpc_mmap {
struct timespec64 map_start_time;
struct timespec64 map_end_time;
bool is_filemap; /* flag to indicate map used in process init */
unsigned int ctx_refs; /* Indicates reference count for context map */
};
enum fastrpc_perfkeys {
@ -1016,8 +1017,8 @@ static void fastrpc_buf_free(struct fastrpc_buf *buf, int cache)
}
hlist_add_head(&buf->hn, &fl->cached_bufs);
fl->num_cached_buf++;
spin_unlock(&fl->hlock);
buf->type = -1;
spin_unlock(&fl->hlock);
return;
}
skip_buf_cache:
@ -1233,8 +1234,9 @@ static int fastrpc_mmap_remove(struct fastrpc_file *fl, int fd, uintptr_t va,
return 0;
}
hlist_for_each_entry_safe(map, n, &fl->maps, hn) {
if (map->refs == 1 && map->raddr == va &&
map->raddr + map->len == va + len &&
/* Remove if only one reference map and no context map */
if (map->refs == 1 && !map->ctx_refs &&
map->raddr == va && map->raddr + map->len == va + len &&
/* Remove map if not used in process initialization */
!map->is_filemap) {
match = map;
@ -1274,7 +1276,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
map->flags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
spin_lock(&me->hlock);
map->refs--;
if (!map->refs && !map->is_persistent)
if (!map->refs && !map->is_persistent && !map->ctx_refs)
hlist_del_init(&map->hn);
spin_unlock(&me->hlock);
if (map->refs > 0) {
@ -1290,7 +1292,7 @@ static void fastrpc_mmap_free(struct fastrpc_mmap *map, uint32_t flags)
}
} else {
map->refs--;
if (!map->refs)
if (!map->refs && !map->ctx_refs)
hlist_del_init(&map->hn);
if (map->refs > 0 && !flags)
return;
@ -1426,6 +1428,7 @@ static int fastrpc_mmap_create(struct fastrpc_file *fl, int fd,
map->attr = attr;
map->frpc_md_index = -1;
map->is_filemap = false;
map->ctx_refs = 0;
ktime_get_real_ts64(&map->map_start_time);
if (mflags == ADSP_MMAP_HEAP_ADDR ||
mflags == ADSP_MMAP_REMOTE_HEAP_ADDR) {
@ -2177,8 +2180,11 @@ static void context_free(struct smq_invoke_ctx *ctx)
spin_unlock(&ctx->fl->hlock);
mutex_lock(&ctx->fl->map_mutex);
for (i = 0; i < nbufs; ++i)
for (i = 0; i < nbufs; ++i) {
if (ctx->maps[i] && ctx->maps[i]->ctx_refs)
ctx->maps[i]->ctx_refs--;
fastrpc_mmap_free(ctx->maps[i], 0);
}
mutex_unlock(&ctx->fl->map_mutex);
fastrpc_buf_free(ctx->buf, 1);
@ -2485,6 +2491,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
err = fastrpc_mmap_create(ctx->fl, ctx->fds[i],
ctx->attrs[i], buf, len,
mflags, &ctx->maps[i]);
if (ctx->maps[i])
ctx->maps[i]->ctx_refs++;
mutex_unlock(&ctx->fl->map_mutex);
if (err)
goto bail;
@ -2502,9 +2510,14 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
err = fastrpc_mmap_create(ctx->fl, ctx->fds[i],
FASTRPC_ATTR_NOVA, 0, 0, dmaflags,
&ctx->maps[i]);
if (!err && ctx->maps[i])
ctx->maps[i]->ctx_refs++;
if (err) {
for (j = bufs; j < i; j++)
for (j = bufs; j < i; j++) {
if (ctx->maps[j] && ctx->maps[j]->ctx_refs)
ctx->maps[j]->ctx_refs--;
fastrpc_mmap_free(ctx->maps[j], 0);
}
mutex_unlock(&ctx->fl->map_mutex);
goto bail;
}
@ -2835,6 +2848,8 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx,
}
} else {
mutex_lock(&ctx->fl->map_mutex);
if (ctx->maps[i]->ctx_refs)
ctx->maps[i]->ctx_refs--;
fastrpc_mmap_free(ctx->maps[i], 0);
mutex_unlock(&ctx->fl->map_mutex);
ctx->maps[i] = NULL;
@ -2845,9 +2860,12 @@ static int put_args(uint32_t kernel, struct smq_invoke_ctx *ctx,
if (!fdlist[i])
break;
if (!fastrpc_mmap_find(ctx->fl, (int)fdlist[i], 0, 0,
0, 0, &mmap))
0, 0, &mmap)) {
if (mmap && mmap->ctx_refs)
mmap->ctx_refs--;
fastrpc_mmap_free(mmap, 0);
}
}
mutex_unlock(&ctx->fl->map_mutex);
if (ctx->crc && crclist && rpra)
K_COPY_TO_USER(err, kernel, ctx->crc,

9
drivers/cpufreq/qcom-cpufreq-hw.c
View File

@ -17,6 +17,7 @@
#include <linux/pm_opp.h>
#include <linux/sched.h>
#include <linux/slab.h>
#include <linux/topology.h>
#define CREATE_TRACE_POINTS
#include <trace/events/dcvsh.h>
@ -33,8 +34,8 @@
#define LIMITS_POLLING_DELAY_MS 10
#define MAX_ROW 2
#define CYCLE_CNTR_OFFSET(c, m, acc_count) \
(acc_count ? ((c - cpumask_first(m) + 1) * 4) : 0)
#define CYCLE_CNTR_OFFSET(core_id, m, acc_count) \
(acc_count ? ((core_id + 1) * 4) : 0)
enum {
REG_ENABLE,
@ -214,7 +215,7 @@ static u64 qcom_cpufreq_get_cpu_cycle_counter(int cpu)
cpu_counter = &qcom_cpufreq_counter[cpu];
spin_lock_irqsave(&cpu_counter->lock, flags);
offset = CYCLE_CNTR_OFFSET(cpu, policy->related_cpus,
offset = CYCLE_CNTR_OFFSET(topology_core_id(cpu), policy->related_cpus,
accumulative_counter);
val = readl_relaxed_no_log(policy->driver_data +
offsets[REG_CYCLE_CNTR] + offset);
@ -232,6 +233,8 @@ static u64 qcom_cpufreq_get_cpu_cycle_counter(int cpu)
cycle_counter_ret = cpu_counter->total_cycle_counter;
spin_unlock_irqrestore(&cpu_counter->lock, flags);
pr_debug("CPU %u, core-id 0x%x, offset %u\n", cpu, topology_core_id(cpu), offset);
return cycle_counter_ret;
}

3
drivers/crypto/msm/qcedev.c
View File

@ -2163,8 +2163,11 @@ static int qcedev_remove(struct platform_device *pdev)
podev = platform_get_drvdata(pdev);
if (!podev)
return 0;
qcedev_ce_high_bw_req(podev, true);
if (podev->qce)
qce_close(podev->qce);
qcedev_ce_high_bw_req(podev, false);
if (podev->icc_path)
icc_put(podev->icc_path);

4
drivers/hwtracing/coresight/coresight-tmc-etr.c
View File

@ -1129,9 +1129,11 @@ tmc_etr_setup_sysfs_buf(struct tmc_drvdata *drvdata)
&& drvdata->byte_cntr->sw_usb)
new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_SW_USB_BUF_SIZE,
0, cpu_to_node(0), NULL);
else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE)
else if (drvdata->out_mode == TMC_ETR_OUT_MODE_PCIE) {
new_buf = tmc_alloc_etr_buf(drvdata, TMC_ETR_PCIE_MEM_SIZE,
0, cpu_to_node(0), NULL);
drvdata->size = TMC_ETR_PCIE_MEM_SIZE;
}
else
new_buf = tmc_alloc_etr_buf(drvdata, drvdata->size,
0, cpu_to_node(0), NULL);

2
drivers/hwtracing/coresight/coresight-tmc.h
View File

@ -104,7 +104,7 @@
#define TMC_ETR_BAM_PIPE_INDEX 0
#define TMC_ETR_BAM_NR_PIPES 2
#define TMC_ETR_PCIE_MEM_SIZE 0x400000
#define TMC_ETR_PCIE_MEM_SIZE 0x2000000
#define TMC_AUTH_NSID_MASK GENMASK(1, 0)

7
drivers/interconnect/qcom/direwolf.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2693,11 +2694,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Direwolf NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/holi.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -1868,11 +1869,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Holi NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/lahaina.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2019-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2903,11 +2904,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Lahaina NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/monaco.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -1389,11 +1390,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Monaco NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/scshrike.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2977,11 +2978,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("SCSHRIKE NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/sdxlemur.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -1289,11 +1290,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("SDXLEMUR NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/sdxnightjar.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -1027,11 +1028,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("sdxnightjar NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/shima.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2708,11 +2709,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Shima NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/sm6150.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2457,11 +2458,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("SM6150 NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/sm8150.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2899,11 +2900,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("SM8150 NoC driver");
MODULE_LICENSE("GPL v2");

7
drivers/interconnect/qcom/yupik.c
View File

@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright (c) 2020-2021, The Linux Foundation. All rights reserved.
* Copyright (c) 2023, Qualcomm Innovation Center, Inc. All rights reserved.
*
*/
@ -2731,11 +2732,5 @@ static int __init qnoc_driver_init(void)
}
core_initcall(qnoc_driver_init);
static void __exit qnoc_driver_exit(void)
{
platform_driver_unregister(&qnoc_driver);
}
module_exit(qnoc_driver_exit);
MODULE_DESCRIPTION("Yupik NoC driver");
MODULE_LICENSE("GPL v2");

28
drivers/mtd/devices/msm_qpic_nand.c
View File

@ -2,6 +2,7 @@
/*
* Copyright (C) 2007 Google, Inc.
* Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
* Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
*/
#include "msm_qpic_nand.h"
@ -18,8 +19,24 @@
#define SMEM_AARM_PARTITION_TABLE 9
#define SMEM_APPS 0
#define ONE_CODEWORD_SIZE 516
#define ACTIVE_BOOT_PART_MAX 30
static struct device *dev_node;
static char active_boot_part[ACTIVE_BOOT_PART_MAX] = "boot";
/*
* Function to get the active boot partition information
* from kernel command line during system boot.
*/
#ifndef MODULE
static int __init get_active_boot_part(char *str)
{
strlcpy(active_boot_part, str, ACTIVE_BOOT_PART_MAX);
return 0;
}
__setup("part.activeboot=", get_active_boot_part);
#endif
/*
* Get the DMA memory for requested amount of size. It returns the pointer
@ -797,18 +814,25 @@ static int msm_nand_flash_onfi_probe(struct msm_nand_info *info)
memset(&data, 0, sizeof(struct msm_nand_flash_onfi_data));
/* Lookup the partition to which apps has access to */
/* Lookup the partition to which apps has access to
*
* active_boot_part value gets updated to either kernel command line
* parameter "part.activeboot=" value (if present) or hold the default
* "boot" value.
*/
for (i = 0; i < FLASH_PTABLE_MAX_PARTS_V4; i++) {
if (mtd_part[i].name && !strcmp("boot", mtd_part[i].name)) {
if (mtd_part[i].name && !strcmp(active_boot_part, mtd_part[i].name)) {
page_address = mtd_part[i].offset << 6;
break;
}
}
if (!page_address) {
pr_err("%s: no apps partition found in smem\n", __func__);
ret = -EPERM;
goto free_dma;
}
data.cfg.cmd = MSM_NAND_CMD_PAGE_READ_ONFI;
data.exec = 1;
data.cfg.addr0 = (page_address << 16) |

4
drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.c
View File

@ -1646,6 +1646,8 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
plat_dat->has_gmac4 = 1;
plat_dat->pmt = 1;
plat_dat->tso_en = of_property_read_bool(np, "snps,tso");
if (of_device_is_compatible(np, "qcom,qcs404-ethqos"))
plat_dat->rx_clk_runs_in_lpi = 1;
plat_dat->early_eth = ethqos->early_eth_enabled;
plat_dat->handle_prv_ioctl = ethqos_handle_prv_ioctl;
plat_dat->request_phy_wol = qcom_ethqos_request_phy_wol;
@ -1683,8 +1685,6 @@ static int qcom_ethqos_probe(struct platform_device *pdev)
}
plat_dat->stmmac_emb_smmu_ctx = emac_emb_smmu_ctx;
if (of_device_is_compatible(np, "qcom,qcs404-ethqos"))
plat_dat->rx_clk_runs_in_lpi = 1;
ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
if (ret)

1
drivers/platform/msm/mhi_dev/mhi.h
View File

@ -267,6 +267,7 @@ struct mhi_config {
#define MHI_ENV_VALUE 2
#define MHI_MASK_ROWS_CH_EV_DB 4
#define TRB_MAX_DATA_SIZE 8192
#define TRB_MAX_DATA_SIZE_16K 16384
#define MHI_CTRL_STATE 100
/* maximum transfer completion events buffer */

33
drivers/platform/msm/mhi_dev/mhi_uci.c
View File

@ -173,7 +173,7 @@ static const struct chan_attr mhi_chan_attr_table[] = {
},
{
MHI_CLIENT_DIAG_OUT,
TRB_MAX_DATA_SIZE,
TRB_MAX_DATA_SIZE_16K,
MAX_NR_TRBS_PER_CHAN,
MHI_DIR_OUT,
NULL,
@ -184,7 +184,7 @@ static const struct chan_attr mhi_chan_attr_table[] = {
},
{
MHI_CLIENT_DIAG_IN,
TRB_MAX_DATA_SIZE,
TRB_MAX_DATA_SIZE_16K,
MAX_NR_TRBS_PER_CHAN,
MHI_DIR_IN,
NULL,
@ -629,10 +629,17 @@ static int mhi_uci_send_sync(struct uci_client *uci_handle,
struct mhi_req ureq;
int ret_val;
uci_log(UCI_DBG_VERBOSE,
uci_log(UCI_DBG_DBG,
"Sync write for ch_id:%d size %d\n",
uci_handle->out_chan, size);
if (size > TRB_MAX_DATA_SIZE) {
uci_log(UCI_DBG_ERROR,
"Too big write size: %lu, max supported size is %d\n",
size, TRB_MAX_DATA_SIZE);
return -EFBIG;
}
ureq.client = uci_handle->out_handle;
ureq.buf = data_loc;
ureq.len = size;
@ -945,7 +952,7 @@ static int mhi_uci_read_sync(struct uci_client *uci_handle, int *bytes_avail)
struct mhi_req ureq;
struct mhi_dev_client *client_handle;
uci_log(UCI_DBG_INFO,
uci_log(UCI_DBG_DBG,
"Sync read for ch_id:%d\n", uci_handle->in_chan);
client_handle = uci_handle->in_handle;
@ -1484,11 +1491,10 @@ static ssize_t mhi_uci_client_write(struct file *file,
return -ENODEV;
}
if (count > TRB_MAX_DATA_SIZE) {
uci_log(UCI_DBG_ERROR,
"Too big write size: %lu, max supported size is %d\n",
count, TRB_MAX_DATA_SIZE);
return -EFBIG;
if (count > uci_handle->out_chan_attr->max_packet_size) {
uci_log(UCI_DBG_DBG,
"Warning: big write size: %lu, max supported size is %d\n",
count, uci_handle->out_chan_attr->max_packet_size);
}
data_loc = kmalloc(count, GFP_KERNEL);
@ -1543,11 +1549,10 @@ static ssize_t mhi_uci_client_write_iter(struct kiocb *iocb,
return -ENODEV;
}
if (count > TRB_MAX_DATA_SIZE) {
uci_log(UCI_DBG_ERROR,
"Too big write size: %lu, max supported size is %d\n",
count, TRB_MAX_DATA_SIZE);
return -EFBIG;
if (count > uci_handle->out_chan_attr->max_packet_size) {
uci_log(UCI_DBG_DBG,
"Warning: big write size: %lu, max supported size is %d\n",
count, uci_handle->out_chan_attr->max_packet_size);
}
data_loc = kmalloc(count, GFP_KERNEL);

2
drivers/soc/qcom/mdt_loader.c
View File

@ -95,7 +95,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len)
ehdr = (struct elf32_hdr *)fw->data;
phdrs = (struct elf32_phdr *)(ehdr + 1);
if (ehdr->e_phnum < 2)
if (ehdr->e_phnum < 2 || ehdr->e_phnum > PN_XNUM)
return ERR_PTR(-EINVAL);
if (phdrs[0].p_type == PT_LOAD)

4
drivers/virt/haven/hh_rm_core.c
View File

@ -525,7 +525,7 @@ static int hh_rm_send_request(u32 message_id,
return -E2BIG;
}
msg = kzalloc(HH_RM_MAX_MSG_SIZE_BYTES, GFP_KERNEL);
msg = kzalloc(HH_MSGQ_MAX_MSG_SIZE_BYTES, GFP_KERNEL);
if (!msg)
return -ENOMEM;
@ -542,7 +542,7 @@ static int hh_rm_send_request(u32 message_id,
payload_size = buff_size_remaining;
}
memset(msg, 0, HH_RM_MAX_MSG_SIZE_BYTES);
memset(msg, 0, HH_MSGQ_MAX_MSG_SIZE_BYTES);
/* Fill header */
hdr = msg;

8
kernel/sched/cpufreq_schedutil.c
View File

@ -1296,12 +1296,14 @@ static void sugov_exit(struct cpufreq_policy *policy)
mutex_lock(&global_tunables_lock);
/* Save tunables before last owner release it in gov_attr_set_put() */
if (tunables->attr_set.usage_count == 1)
sugov_tunables_save(policy, tunables);
count = gov_attr_set_put(&tunables->attr_set, &sg_policy->tunables_hook);
policy->governor_data = NULL;
if (!count) {
sugov_tunables_save(policy, tunables);
if (!count)
sugov_clear_global_tunables();
}
mutex_unlock(&global_tunables_lock);

21
net/qrtr/qrtr.c
View File

@ -939,13 +939,6 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
return -ENODEV;
}
if (sock_queue_rcv_skb(&ipc->sk, skb))
goto err;
/* Force wakeup for all packets except for sensors */
if (node->nid != 9 && node->nid != 5)
pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
if (node->nid == 5) {
svc_id = qrtr_get_service_id(cb->src_node, cb->src_port);
if (svc_id > 0) {
@ -956,9 +949,19 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const void *data, size_t len)
}
}
}
if (wake)
pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
}
if (sock_queue_rcv_skb(&ipc->sk, skb))
goto err;
/**
* Force wakeup for all packets except for sensors and blacklisted services
* from adsp side
*/
if ((node->nid != 9 && node->nid != 5) ||
(node->nid == 5 && wake))
pm_wakeup_ws_event(node->ws, qrtr_wakeup_ms, true);
qrtr_port_put(ipc);
}