Possible buffer overflow when reading next_read_size bytes into
tmp buffer after next_read_size was extracted from a previous packet.
Bug: 62678828
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Out of bounds kernel accesses in st21nfca's NFC HCI layer
might happen when handling ATR_REQ events if user-specified
atr_req->length is bigger than the buffer size. In
that case memcpy() inside st21nfca_tm_send_atr_res() will
read extra bytes resulting in OOB read from the kernel heap.
Bug: 62679012
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Add debugfs entries for reading/writing WLAN hardware registers.
This is for runtime debugging enhancement.
Change-Id: If7a85181858e127187906beca69870a98f4a1184
CRs-fixed: 2059087
Signed-off-by: Yue Ma <yuem@codeaurora.org>
If the request->length is zero, a ZLP should already be sent due to that
and another ZLP is not needed to terminate the transfer.
(cherry-picked from commit
d9261898a4b2c143c28568dc686a1becfc637a99)
Fixes: 04c03d10e507 ("usb: dwc3: gadget: handle request->zero")
Signed-off-by: John Youn <johnyoun@synopsys.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Bug: 63867169
Change-Id: I97a1801c57dc169b6e9371d5aec599a14f316aff
So far, dwc3 has always missed request->zero
handling for every endpoint. Let's implement
that so we can handle cases where transfer must
be finished with a ZLP.
Note that dwc3 is a little special. Even though
we're dealing with a ZLP, we still need a buffer
of wMaxPacketSize bytes; to hide that detail from
every gadget driver, we have a preallocated buffer
of 1024 bytes (biggest bulk size) to use (and
share) among all endpoints.
(cherry-picked from commit
04c03d10e507052cfce6910ddf34091196e79e1c)
Reported-by: Ravi B <ravibabu@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Bug: 63867169
Change-Id: Ied4093e92dd080f2d9dd1fd9aefb36406f66bb67
The req->complete seems to presist the callback pointer for
the control requests. This causes the serial of the accessory
to be overridden when an accessory function specific out
control request is issued right after the ACCESSORY_SEND_STRING
control request. Therefore, assign a no-op req complete function
when nothing needs to be done once the request is completed.
Signed-off-by: Badhri Jagan Sridharan <Badhri@google.com>
Bug: 63867169
Change-Id: I78c1602e9a044b8718b270b8a068cf5afc83f984
Enable ATL1C for ethernet driver, DEVMEM for debugging memory
mapped registers and PPS for the pulse per second driver.
Change-Id: I169a2f34b352008bd6c4d72111c53cdcdf16e566
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Force probing the sdhc1 bus even if it is not the boot device
by reading the device tree property qcom,force-sdhc1-probe.
Enables using the primary port for other use cases even when
the board is not using eMMC for boot.
Change-Id: I2a2b9d6a51037641720bdfd3107b2fadf385d7b5
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Check to see if the host is not NULL before trying to use
it, this avoids a crash when the driver is probed, but the
card is not available. Also remove dependency on ARCH_MSM
since it is not used anymore.
Change-Id: I476a512dd41e0c336b71c96d8dd2972cdadb8732
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
Add compatible flags for CAN controller and HSM chip to use them
with the spidev driver from user space.
Change-Id: I154c29b6c912cac2560333ef635aa4a542fd1985
Signed-off-by: Gustavo Solaira <gustavos@codeaurora.org>
ASM max active sessions increase to 9 to allow 8 interactive and
one primary stream concurrently.
CRs-Fixed: 2093120
Change-Id: I92a51dd1937634abb472fc06edbdd879b3d152d0
Signed-off-by: Varun Balaraj <varunb@codeaurora.org>
Modularize the wcnss power up sequence like wcnss voltage
regulator enable/disable sequence and voltage regulator
current and voltage level parsing method. Remove hack code
from the power wcnss power process and enable/disable
the power resource if it's defined in the wcnss device node.
Update the debug logs to track the exact state of the power
state during device bootup. Remove the unnecessary logging
for the optional resource request fails during device bootup.
CRs-Fixed: 2086414
Change-Id: I30b1e2196eb9d1c933275f3db34ca0ff5664ea3b
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
Added code changes to check ipa3_ctx initilized or not
during bootup in sdm670.
Change-Id: I03e5b8de30c77da140e9575c2315b0878cf5363c
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
The WLAN host driver use device serial number to generate
MAC address. The wcnss platform driver export symbol for
WLAN host driver to read the device serial number to generate
the MAC address. Add updated SOC API to get the device serial
number in the wcnss platform driver.
CRs-Fixed: 2089225
Change-Id: Ic540f2e6e705131f18b59e8f139087d5d99024f6
Signed-off-by: Sarada Prasanna Garnayak <sgarna@codeaurora.org>
Add support to validate the result and error code
received from the WLAN firmware service.
CRs-fixed: 2095184
Change-Id: I454df58e293fbf2d99601d1c6820e67b5cae370c
Signed-off-by: Anurag Chouhan <achouhan@codeaurora.org>
Protecting operations performed during ois powerdown
from race condition by adding mutex locks.
CRs-Fixed: 2081806
Change-Id: I27a735fd69d3e98fdd2ed48456336c560b6f3adc
Signed-off-by: VijayaKumar T M <vtmuni@codeaurora.org>
In function parse_qos_dt_params, memory is allocated to arr32 but it
is never freed.
Free memory when exiting the function.
CRs-Fixed: 2093722
Change-Id: Ic1fc58c6685990e2865ef4033b54303d47311560
Signed-off-by: Dhoat Harpal <hdhoat@codeaurora.org>
On 64bit platforms, the amount of memory allocated by ion can exceed
32 bits. Therefore the counters which track this information must be
64 bits as well.
Change-Id: I81daf2cec78de5787279daaf98264c5462ba6645
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
Signed-off-by: Prakash Gupta <guptap@codeaurora.org>
The patch updates the PD packet length prior to
being processed, adds a check for core PD buffer busy
status before being processed and marks the core PD buffers free
only when there is no data to be processed in user PD.
CRs-Fixed: 2068243
Change-Id: Ida215b4df75ddc96ebd5d436850bddf56f3a4fce
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
In case of no requirement of internal scratch buffers, driver
propagate error to upper layer leading to stream on failure.
This commit could avoid setting scratch buffers when there
is no requirement.
Change-Id: Iedcac8a54f2ae4136b6d885b3955927d4566d9db
Signed-off-by: Deepak Kushwah <dkushwah@codeaurora.org>
Hide kernel pointers from unprivileged users by using %pK format-
specifier instead of %p. This respects the kptr_restrict sysctl
setting which is by default on. echo 0 to kptr_restrict to print
proper kernel addresses.
Change-Id: I6f14b039f2f193196edfce8160ae38341229085c
Signed-off-by: Deepak Kushwah <dkushwah@codeaurora.org>
This patch addresses an issue in the GPU init sequence where
the clocks are turned on during the process but after the
init is complete the clocks are not turned off. Due to this,
the GPU clocks always have a refcount delta of 1 and never
get disabled later even when explicitly requested.
Change-Id: I40fa9a25cd86f5d39fbe6f6e3f83d6ab467d615f
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
After enabling the GPU clocks, the GPU can pagefault
when trying to access memory(example the ringbuffer).
This patch addresses the pagefault issue by enabling
the memory retention flags on the GPU core clock.
Change-Id: Ibabecba77501d6a3b188b19c90c172de7d667c8c
Signed-off-by: Sharat Masetty <smasetty@codeaurora.org>
add depends on MSM_GVM_QUIN for SND_SOC_MSM8996
and remove SND_SOC_MSM_HDMI_CODEC_RX for virtual platform
CRs-Fixed: 2085351
Change-Id: I1e911ffa5b34d69c9286f22d7b2c001a065cbfc1
Signed-off-by: Yonghui Zhang <yonghuiz@codeaurora.org>
The status debug property lists all of the voters, their enable and
value status, and the effective result. Currently the status is
presented on multiple lines which is difficult to parse. Change the
format to be more parsable.
Print each voter in the following format:
VOTABLE: CLIENT: en=1 v=1000
Print a single summary line at the end in the following format:
VOTABLE: effective=EFFECTIVE_CLIENT type=VOTABLE_TYPE v=1000
Change-Id: I0671cdd8e0911450bafe4869cb49cc48bd622a81
Signed-off-by: Nicholas Troast <ntroast@codeaurora.org>
To avoid leak info of pointers addresses to dmesg,
use %pK instead of %p to print virtual addresses.
Change-Id: I7d8e900d7cd62e9ad3fb9ea3ba9865d6911bdfcb
Acked-by: Chenna Kesava Raju <chennak@qti.qualcomm.com>
Signed-off-by: Tharun Kumar Merugu <mtharu@codeaurora.org>
There's a race between usb_gadget_udc_stop() which is likely
to set the gadget driver to NULL in the udc driver and this drivers
gadget disconnect fn which likely checks for the gadget driver to
a null ptr. It happens that unbind (doing set_gadget_data(NULL))
is called before the gadget driver is set to NULL and the udc driver
calls disconnect fn which results in cdev being a null ptr.
As a workaround we check cdev in android_disconnect() to prevent
the following panic:
Unable to handle kernel NULL pointer dereference at virtual address 000000a8
pgd = ffffff800940a000
[000000a8] *pgd=00000000be1fe003, *pud=00000000be1fe003, *pmd=0000000000000000
Internal error: Oops: 96000046 [#1] PREEMPT SMP
CPU: 7 PID: 1134 Comm: kworker/u16:3 Tainted: G S 4.9.41-g75cd2a0231ea-dirty #4
Hardware name: HiKey960 (DT)
Workqueue: events_power_efficient event_work
task: ffffffc0b5f4f000 task.stack: ffffffc0b5b94000
PC is at android_disconnect+0x54/0xa4
LR is at android_disconnect+0x54/0xa4
pc : [<ffffff8008855938>] lr : [<ffffff8008855938>] pstate: 80000185
sp : ffffffc0b5b97bf0
x29: ffffffc0b5b97bf0 x28: 0000000000000003
x27: ffffffc0b5181c54 x26: ffffffc0b5181c68
x25: ffffff8008dc1000 x24: ffffffc0b5181d70
x23: ffffff8008dc18a0 x22: ffffffc0b5f5a018
x21: ffffffc0b5894ad8 x20: 0000000000000000
x19: ffffff8008ddaec8 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 00000000007c9ccd
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000001 x10: 0000000000000001
x9 : ffffff800930f1a8 x8 : ffffff800932a133
x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffffffc0b5b97a50 x4 : ffffffc0be19f090
x3 : 0000000000000000 x2 : ffffff80091ca000
x1 : 000000000000002f x0 : 000000000000002f
This happened on a hikey960 with the following backtrace:
[<ffffff8008855938>] android_disconnect+0x54/0xa4
[<ffffff80089def38>] dwc3_disconnect_gadget.part.19+0x114.888119]
[<ffffff80087f7d48>] dwc3_gadget_suspend+0x6c/0x70
[<ffffff80087ee674>] dwc3_suspend_device+0x58/0xa0
[<ffffff80087fb418>] dwc3_otg_work+0x214/0x474
[<ffffff80087fdc74>] event_work+0x3bc/0x5ac
[<ffffff80080e5d88>] process_one_work+0x14c/0x43c
[<ffffff80080e60d4>] worker_thread+0x5c/0x438
[<ffffff80080ece68>] kthread+0xec/0x100
[<ffffff8008083680>] ret_from_fork+0x10/0x50
dwc3_otg_work tries to handle a switch from host to device mode
and therefore calls disconnect on the gadget driver.
To reproduce the issue it is enaugh to enable tethering (rndis gadget),
unplug and plug in again the usb connector which causes the change
from device to host and back to device mode.
Signed-off-by: Danilo Krummrich <danilokrummrich@gmail.com>
cnss_genl driver creates a netlink family and multicast groups
to facilitate communication between WLAN driver and userspace.
Define flag CONFIG_CNSS_GENL and set to 'y'(yes) to enable
compilation of the cnss_genl driver inorder to use the same.
Change-Id: I9d81f933e4fe3c9383f213c777d335e1fe51bdd2
Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
CRs-Fixed: 1117130
Fix pan control gain param to accommodate Q28 format.
Convert 32bit gain to be inlined with 16bit mixer coefficients
of ADSP.
Change-Id: I85ebd11c49b4af982f34091937acabb9e6580e8f
Signed-off-by: Varun Balaraj <varunb@codeaurora.org>
Include linux/mm.h for get_cmdline() declaration.
Change-Id: Icad6ef7deef4d93d92d423c96bfa61fb5d66d0b7
Fixes: Change-Id: I30083b757eaef8c61e55a213a883ce8d0c9cf2b1
("uid_sys_stats: log task io with a debug flag")
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Few PCIe clients does not have option to call for enumeration.
Update boot option for PCIe such that enumeration is done as
part of PCIe RC probe.
Change-Id: I1bb977b7e21c046ee7757ed509762897e2bcdd8d
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
Correct FM on/off sequence with following changes ->
- FM slave port close is called after LPASS port close (remove hw_free)
- Use the watermark level of 8 for FM slave ports
- Do not reset the watermark to 0 upon port disable
Change-Id: Ie785715c2b92dae6b46b346bebd45e044f54ea53
Signed-off-by: Rupesh Tatiya <rtatiya@codeaurora.org>
Add tp rev property to expose TP-REV information via
rev-id peripheral.
Change-Id: I0236f84947dbf256f090ea32895904024c1f3fcf
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
Update scaling factor for RRADC USBIN current
based on USBIN voltage.
Change-Id: I87b2ac56166f2e0812ec56d88c68298094eb86ac
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
Currently, there is a possibility of using already
freed memory while client reads from diag driver.
The patch adds proper protection to fix the issue.
CRs-Fixed: 2076623
Change-Id: Ic946865ac79f2684c06176be64fd2f3abc6048f7
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
Some PMICs software drivers (PM660) require the TP revision
information to implement specific logic. Add an optional
property qcom,tp-rev-valid to check if support for TP REV is
available in the REVID peripheral for the PMIC.
Change-Id: Ia7a344e60bedcc6fb28d9ed9f18dc29a3d7f4fd7
Signed-off-by: Rama Krishna Phani A <rphani@codeaurora.org>
config the pin for TDM pass through
CRs-Fixed: 2085351
Change-Id: Ifdfebca773e7fd32ecd04c642a24b5eb9d818789
Signed-off-by: Yonghui Zhang <yonghuiz@codeaurora.org>
Changes to reflect slight change in HAB API return values.
Change-Id: I8825f6fca6a50449a929f05c317d0beeb6908d26
Signed-off-by: Amit Blay <ablay@codeaurora.org>
Changes to reflect slight change in HAB API return values.
Change-Id: I8825f6fca6a50449a929f05c317d0beeb6908d26
Signed-off-by: Amit Blay <ablay@codeaurora.org>
MTU defaults to standard CAN frame, however,
since rh850 driver supports CANFD frames MTU
needs to be set accordingly.
CRs-Fixed: 2071638
Change-Id: I5015af6e61ef4b4e021a715a8dec60d42a8a9e5b
Signed-off-by: Alex Yakavenka <ayakav@codeaurora.org>
Currently we use WIPOWER as the type for dc power supply.
Instead use WIRELESS in the type and use WIPOWER in the
real_type property.
Change-Id: I9081e752e5b3ff725a6ba935d6f6df4e36fec3fa
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
Add a hashmap inside each uid_entry to keep track of task name and io.
Task full name is a combination of thread and process name.
Bug: 63739275
Change-Id: I30083b757eaef8c61e55a213a883ce8d0c9cf2b1
Signed-off-by: Yang Jin <yajin@google.com>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlmUrdAACgkQONu9yGCS
aT49MBAAqKJXpRzIBnzLR45QLRU5jfkUhaCtCckBAbyLE+rUH0lE4L37JHYcZ9jr
79gG06QAuWJaTd4Nug7DocmPiqpPWi+PY46yjUQ1j3tllKWdp7b/PJXvYX3zbK+d
vDgn6T1AyAoCBKa2aLU26SAYmfLCT+jhHzbMaRQ4eAcYE8u8w8jrfngVmnunXVme
u6CkAZpPMXXm5jUpxgPguEOm2WMubPYEF2BMJIVuvYypeJGM0EYbOHNEUMK5jkPv
T17+4EzSCeqGaDZElxPW4NuaHMStZW36g9gQOti3o/8/5shNLyJK3vYzWG+06zfH
6CNElSk7Y3Fl6qALLWfd1dkjImtJvWKDVWTC43woFT/96DtXueGxrYJYRF+px9bq
dBWAW86g5Tp2JTM+6VhN0N/Z5ANK48Oi2NrzqJXK7DrmZbS5mxMIZw239QJnEOBh
hSxDbe9pkNJvSmR+yF+qxkz78XOOvBz4zIkGl6M70cRQWnJ0g4tCSyy2hrEooDzZ
sfaokSdClzt3qRoFwSZIGZLpvRp9vSepXNN/nvUTX3dOLcjproVYMZJWiAUqTUyD
/0gwrJTpDP3nZGrHdmeWL/erQDWP1aFiXlsJ0E87ymSt7KYNYFGH2ePv7Ujov/AH
dlmvQFhSW1v7xiuiiQo9gxIo8djHqZ8FLbTCznQcQ8Scm4cMNAM=
=riD5
-----END PGP SIGNATURE-----
Merge 4.4.83 into android-4.4
Changes in 4.4.83
cpuset: fix a deadlock due to incomplete patching of cpusets_enabled()
mm: ratelimit PFNs busy info message
iscsi-target: fix memory leak in iscsit_setup_text_cmd()
iscsi-target: Fix iscsi_np reset hung task during parallel delete
fuse: initialize the flock flag in fuse_file on allocation
nfs/flexfiles: fix leak of nfs4_ff_ds_version arrays
USB: serial: option: add D-Link DWM-222 device ID
USB: serial: cp210x: add support for Qivicon USB ZigBee dongle
USB: serial: pl2303: add new ATEN device id
usb: musb: fix tx fifo flush handling again
USB: hcd: Mark secondary HCD as dead if the primary one died
staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
iio: accel: bmc150: Always restore device to normal mode after suspend-resume
iio: light: tsl2563: use correct event code
uas: Add US_FL_IGNORE_RESIDUE for Initio Corporation INIC-3069
USB: Check for dropped connection before switching to full speed
usb: core: unlink urbs from the tail of the endpoint's urb_list
usb: quirks: Add no-lpm quirk for Moshi USB to Ethernet Adapter
usb:xhci:Add quirk for Certain failing HP keyboard on reset after resume
iio: adc: vf610_adc: Fix VALT selection value for REFSEL bits
pnfs/blocklayout: require 64-bit sector_t
pinctrl: sunxi: add a missing function of A10/A20 pinctrl driver
pinctrl: samsung: Remove bogus irq_[un]mask from resource management
Linux 4.4.83
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
