Commit graph

602757 commits

Author SHA1 Message Date
Praveen Kurapati
53f933ef2d msm: ipa3: Fix to validate check for IP type
Add proper check for validating the IP type while
sending request for ul-filter-rule install.

Change-Id: I170230310884f176cf41d5ae20287f6d74a4bc29
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>
2019-06-11 05:08:24 -07:00
Linux Build Service Account
9c3d573678 Merge "dwc3-msm: Fix dwc3_drd_state_string for undefined state" 2019-06-11 04:12:19 -07:00
Linux Build Service Account
ebbd0af9c7 Merge "msm: camera: isp: Fix frame drop pattern" 2019-06-09 18:48:02 -07:00
Linux Build Service Account
84253b6fc6 Merge "asoc: Ratelimit error logs to avoid excessive logging" 2019-06-09 08:03:25 -07:00
Linux Build Service Account
220c735ef4 Merge "msm: ipa: fix to validate input parameters" 2019-06-09 08:03:24 -07:00
Linux Build Service Account
bb646b5795 Merge "msm: mdss: hdmi: fix 4 block EDID read failure" 2019-06-09 08:03:22 -07:00
Linux Build Service Account
1569dc4f6c Merge "msm: mdss: hdmi: parse extended EDID block map" 2019-06-09 00:24:38 -07:00
Linux Build Service Account
b901478900 Merge "soc: msm8998: Add 16ch playback and record support for TDM" 2019-06-08 11:26:05 -07:00
Linux Build Service Account
5e170b6a8d Merge "asoc: Update max channels for TDM ports" 2019-06-08 11:26:02 -07:00
Dhanalakshmi Siddani
5f7a491185 soc: msm8998: Add 16ch playback and record support for TDM
Add support for 16ch playback and record usecase support
for primary and quaternary TDM ports.
Add mixer controls to set slot width, slot mapping and
calculate bit clock dynamically. Set bit clock for all
TDM ports dynamically.

Change-Id: I9d356d61f29ba18dd77138bd895139042a3c01f6
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
2019-06-08 07:47:03 -07:00
Abhishek Choubey
b308c9c029 msm: ipa: fix to validate input parameters
Validate the input parameters to avoid any unexpected
scenarios.

Change-Id: If77ac66470baf937b160800174ea14f1a8cb6408
Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>
Signed-off-by: Abhishek Choubey <abchoube@codeaurora.org>
2019-06-07 03:56:50 -07:00
kunleiz
ae49a1758f dsp: q6core: validate payload size before memory copy
Payload size is not checked before memory copy.
Check payload size to avoid out-of-boundary memory
access.

Change-Id: I07857564d4e8ce415df3810b25f0e9e17a60993d
Signed-off-by: Kunlei Zhang <kunleiz@codeaurora.org>
2019-06-07 15:16:09 +05:30
Dhanalakshmi Siddani
8c174167dc asoc: Update max channels for TDM ports
Update max channels supported for TDM ports from 8 to 16.
Update pcm driver to support 32 channels and 32bit format.

Change-Id: I3d3b42983fff22e0102b9eb2aaca1a5698820605
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
2019-06-06 21:57:27 -07:00
Aditya Bavanari
5bee717e43 asoc: Ratelimit error logs to avoid excessive logging
Ratelimit error logs of boundary check conditions
in audio effects driver to avoid excessive logging.

CRs-Fixed: 2426159
Change-Id: Iaf10eee281389773a21340997e3ffbe88c6e79f6
Signed-off-by: Aditya Bavanari <abavanar@codeaurora.org>
2019-06-06 15:03:25 +05:30
Vamsi Krishna Samavedam
92e370e629 dwc3-msm: Fix dwc3_drd_state_string for undefined state
dwc3_drd_state_string() will return null for undefined state and
fix it by adding undefined name to state_names.

Change-Id: I40be0b14c098fe2e9d77df3ff1108c3d4d55a30f
Signed-off-by: Vamsi Krishna Samavedam <vskrishn@codeaurora.org>
2019-06-06 13:48:46 +05:30
Manu Gautam
7d34ffa6c3 usb: dwc3-msm: Ensure hardware is reset during role change
Introduce additional WAIT_FOR_LPM input flag to ensure USB
enters low power mode after stop_peripheral or stop_host.
This makes sure that USB hardware is reset after LPM for
cases where quick transition to host mode happens while
its child was still preventing dwc3 to enter low power mode.
In the absence of h/w reset after stop_peripheral, host mode
doesn't work.

Change-Id: I67e4fcdc11a3337e3e90b4ca8f461e328a6e8ecf
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
2019-06-06 13:48:35 +05:30
Manu Gautam
582ce26ce1 usb: dwc3-msm: add enum for drd_states to remove otg_state usage
otg_state enum defines states for USB OTG devices. Since, driver
supports only role change (DRD) and no OTG support, hence, instead
of using otg_states create separate drd_state enums.

Change-Id: Ifda1fac712e751c980ce51b60b473e5921f2001d
Signed-off-by: Manu Gautam <mgautam@codeaurora.org>
2019-06-06 13:47:35 +05:30
Anmolpreet Kaur
6dc4873f91 qcom: smcinvoke: Fix stack overflow for arr_filp
arr_filp is an alias to filp_to_release. It is exposed
to access indices greater than allotted space of 15 bytes,
equal to size of OBJECT_COUNTS_MAX_OO. This change fixes
the stack overflow by taking an independent variable to track
the number of output objects.

Change-Id: Idca9cef3c69693d27d4ca3d0e0b4845fc27c998a
Signed-off-by: Anmolpreet Kaur <anmolpre@codeaurora.org>
2019-06-04 03:32:39 -07:00
Linux Build Service Account
56267aa801 Merge "msm: ais: handle the error value returned during get clock" into kernel.lnx.4.4.r35-rel 2019-06-03 11:54:49 -07:00
E V Ravi
8d1f0491ed msm: ais: handle the error value returned during get clock
currently only NULL pointer check is used to validate the return
value from clk_get, this change to handle all the failures.
This snapshot is taken from auto-kernel.lnx.4.4.c1
ported it from auto-kernel.lnx.4.4.c1 to 4.4

Change-Id: I275cb4717c675baf528e05c50058f2c6b0025011
Signed-off-by: E V Ravi <evenka@codeaurora.org>
2019-06-03 11:47:32 -07:00
Abhishek Choubey
cac305db85 msm: ipa: fix to validate input parameters
Validate the input parameters to avoid any unexpected
scenarios.

Change-Id: If77ac66470baf937b160800174ea14f1a8cb6408
Signed-off-by: Pooja Kumari <kumarip@codeaurora.org>
Signed-off-by: Abhishek Choubey <abchoube@codeaurora.org>
2019-06-03 11:47:17 -07:00
Meera Gande
cc4d1a6cb1 msm: camera: isp: Fix frame drop pattern
In few scenarios, the request frame may get
delayed and current and request frame id may
become same. While user space is informed to
delay a frame in such scenarios, the pattern
shouldn't get reset.

Change-Id: I63f1301fbbe7cba024a686cbd783af25232f1293
Signed-off-by: Meera Gande <mgande@codeaurora.org>
2019-06-03 15:43:52 +05:30
Linux Build Service Account
10a5c5b618 Merge 96eca37071 on remote branch
Change-Id: Ib1b8db2b2d165effaca8114bd41c8afbec79f437
2019-06-01 22:21:22 -07:00
Manoj Prabhu B
96eca37071 diag: Check command size against the minimum before parsing
Add check for minimum length before typecasting to build mask
structure to prevent out of bound access while processing
get msg mask command.

CRs-Fixed: 2431047
Change-Id: I5b8341f278b0b46359800e43c604c5671261c728
Signed-off-by: Manoj Prabhu B <bmanoj@codeaurora.org>
2019-05-30 02:04:29 -07:00
Narender Ankam
ad283e50ec msm: mdss: hdmi: parse extended EDID block map
As part of EDID parser, add support to parse extended EDID
Block Map (0xf0) block and parse all subsequent CEA (0x02)
extended EDID Blocks.

Change-Id: I581efae59dde3abf6f297d5a2519ac0088554b64
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
2019-05-29 13:38:49 +05:30
Narender Ankam
639259bb32 msm: mdss: hdmi: fix 4 block EDID read failure
Only Block0 and Block1 of EDID are being read successfully.
Fix EDID segment read failure for Block2 and Block3.

Change-Id: I2d501878c6089b275e77587f3f41416aec2ef389
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
2019-05-29 00:59:36 -07:00
Linux Build Service Account
10da01940d Merge "msm: adm: validate ADSP payload size before access" 2019-05-24 10:20:00 -07:00
Narender Ankam
526404d09d msm: mdss: assign block_id for INTF_3
As part of destination scalar on HDMI, INTF3 will be
configured as dual LM single display for higher video
timings. Assign block_id for HDMI INTF.

Change-Id: I09f5eb4136c4a8248f3dc9a36e2d94110419112d
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
2019-05-24 00:41:02 -07:00
Vignesh Kulothungan
a935cbe437 msm: adm: validate ADSP payload size before access
Check the size of ADSP payload before accessing it.

CRs-Fixed: 2380694
Change-Id: Icdc19a85b39a397ba6d7177f42ece4626b901832
Signed-off-by: Vignesh Kulothungan <vigneshk@codeaurora.org>
2019-05-22 12:18:41 -07:00
E V Ravi
dabba2bc7b msm: ais : Lock Implementation for avoid race condition
Lock Implementation for avoid race condition leading
to out-of-bound write in "msm_vb2_queue_setup

Change-Id: I386f1709bdf3328ae0c1db44980db8453849babf
Signed-off-by: E V Ravi <evenka@codeaurora.org>
2019-05-22 02:29:29 -07:00
Linux Build Service Account
44d964e1d2 Merge "dsp: afe: check for minimum size before payload access" 2019-05-21 18:16:58 -07:00
Karthikeyan Mani
a919f50d96 dsp: afe: check for minimum size before payload access
Check if payload data is atleast the minimum expected size
before accessing the data in it.

Change-Id: Ia1295ca5ad5d002122e416fae53588681da687ea
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2019-05-21 10:37:29 -07:00
Linux Build Service Account
403885b338 Merge "msm: qdsp6v2: Check size of payload before access" 2019-05-21 10:20:09 -07:00
Vatsal Bucha
f455966ef0 msm: qdsp6v2: Check size of payload before access
Check size of payload array before access in qdsp_mvm_callback.

Change-Id: I81d945f963cfb4a3cb26155700b82880d891ec5e
Signed-off-by: Vatsal Bucha <vbucha@codeaurora.org>
2019-05-21 05:43:31 -07:00
Linux Build Service Account
5bfaf959ac Merge "msm: mdss: hdmi: reset sink_caps before parsing EDID" 2019-05-21 02:24:45 -07:00
Narender Ankam
ee8a9362ca msm: mdss: hdmi: reset sink_caps before parsing EDID
Within EDID parser's data structure, sink_caps of previous
EDID are being retained. Reset sink_caps before parsing new
EDID.

Change-Id: I7927161256ec87ab77b26a9d7bc5e0cd1df5583b
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
2019-05-21 00:41:10 -07:00
Narender Ankam
2cbfe924cf msm: mdss: mdp: mixer allocation for pluggable primary display
Try to allocate mixers LM0 and LM1 to an external pluggable
display if it is configured as primary display.

Change-Id: I81672132a6452535dcd7c2977e76f88a5f3aecf9
Signed-off-by: Narender Ankam <nankam@codeaurora.org>
2019-05-21 00:35:22 -07:00
Linux Build Service Account
eddc389f5a Merge "net: sockev: avoid races between sockev and socket_close" 2019-05-20 09:12:57 -07:00
Sharath Chandra Vurukala
4d2f6ab9a8 net: sockev: avoid races between sockev and socket_close
Use-after-free is seen when sending a sockev netlink message
since socket is not held which can race with sk_free.

KASAN: use-after-free in sockev_client_cb+0x41c/0x4b8
	in net/core/sockev_nlmcast.c:104
Read of size 2 at addr ffffffc08420c550
Call trace:
dump_backtrace+0x0/0x388 arch/arm64/kernel/time.c:55
show_stack+0x24/0x30 arch/arm64/kernel/traps.c:152
__dump_stack+0x24/0x2c lib/dump_stack.c:17
dump_stack+0x8c/0xd0 lib/dump_stack.c:53
print_address_description+0x74/0x234 mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report+0x240/0x264 mm/kasan/report.c:412
__asan_report_load2_noabort+0x2c/0x38 mm/kasan/report.c:431
sockev_client_cb+0x41c/0x4b8 net/core/sockev_nlmcast.c:104
notifier_call_chain+0x104/0x158 kernel/notifier.c:93
__blocking_notifier_call_chain+0x80/0xb0 kernel/notifier.c:317
blocking_notifier_call_chain+0x3c/0x4c kernel/notifier.c:328
sockev_notify+0x30/0x3c net/socket.c:181
SYSC_bind net/socket.c:1509 [inline]
SyS_bind+0x1ec/0x30c net/socket.c:1489
el0_svc_naked+0x34/0x38
Freed by task 19460:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
__kasan_slab_free+0x134/0x20c mm/kasan/kasan.c:520
kasan_slab_free+0x10/0x1c mm/kasan/kasan.c:527
slab_free_hook mm/slub.c:1401 [inline]
slab_free_freelist_hook mm/slub.c:1422 [inline]
slab_free mm/slub.c:2979 [inline]
kmem_cache_free+0x114/0x664 mm/slub.c:3001
sk_prot_free net/core/sock.c:1504 [inline]
__sk_destruct+0x324/0x3c0 net/core/sock.c:1585
__sk_free+0x180/0x200 net/core/sock.c:1601
sk_free+0x44/0x50 net/core/sock.c:1612
sock_put include/net/sock.h:1643 [inline]
sk_common_release+0x198/0x20c net/core/sock.c:3014
raw_close+0x38/0x44 net/ipv4/raw.c:703
inet_release+0x128/0x15c net/ipv4/af_inet.c:446
__sock_release+0xb8/0x258 net/socket.c:614
sock_close+0x24/0x34 net/socket.c:1150
__fput+0x1f4/0x4e4 fs/file_table.c:345
____fput+0x20/0x2c fs/file_table.c:380
task_work_run+0x9c/0x174 kernel/task_work.c:113

Change-Id: Idb4335889b6e4228f36d76ca5b6156cc5e5838da
Signed-off-by: Sharath Chandra Vurukala <sharathv@codeaurora.org>
2019-05-20 15:51:25 +05:30
Karthikeyan Mani
26ac9f568e dsp: afe: check for payload size before payload access
Check if payload data is big enough before accessing
the data in it.

Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
2019-05-20 00:39:09 -07:00
Rajesh Kemisetti
51f1f59a3f msm: kgsl: Fix race condition while making page as dirty
set_page_dirty() is racy if the caller has no
reference against page->mapping->host, and if
the page is unlocked. This is because another
CPU could truncate the page off the mapping and
then free the mapping.

Use set_page_dirty_lock() to avoid this race condition.

Change-Id: I517fb9aee66560618c7676b311368f7a7498011f
Signed-off-by: Rajesh Kemisetti <rajeshk@codeaurora.org>
Signed-off-by: Archana Sriram <apsrir@codeaurora.org>
2019-05-15 22:10:58 -07:00
Linux Build Service Account
b1d5c60aa5 Merge "msm: camera : Lock Implementation for avoid race condition" 2019-05-15 11:46:08 -07:00
Vijay kumar Tumati
edc083e812 msm: camera : Lock Implementation for avoid race condition
Lock Implementation for avoid race condition leading
to out-of-bound write in "msm_vb2_queue_setup

CRs-Fixed: 2362627
Change-Id: I7f7420c7437b9ac2f215929a8614b0846e890c98
Signed-off-by: Vijay kumar Tumati <vtumati@codeaurora.org>
Signed-off-by: Haibin Liu <haibinl@codeaurora.org>
2019-05-15 19:31:19 +08:00
Naman Padhiar
1c16771a7b icnss: Add check on msa region
When icnss receive server arrive it send wlfw_msa_mem_info_send_sync_msg
QMI request to firmware and in response expect range of addresses and size
to be mapped. Add condition to check whether addresses in response falls
under valid range otherwise it asserts.

Change-Id: I9a8542cb6c3b3cefe112d1f08a76dd2eadf68d2f
Signed-off-by: Naman Padhiar <npadhiar@codeaurora.org>
2019-05-14 23:14:39 -07:00
Sumalatha Malothu
2153161639 msm: camera_v2: handle the error value returned during get clock
currently only NULL pointer check is used to validate the return
value from clk_get, this change to handle all the failures.
This snapshot is taken from msm-4.9
Ported it from 4.9 to 4.4

Change-Id: Icd8b7e33d0f235a7c5dde2307972a594908e6a60
Signed-off-by: Sumalatha Malothu <smalot@codeaurora.org>
2019-05-14 04:37:59 -07:00
Linux Build Service Account
8258c6a068 Merge "msm: mdss: hdmi: skip pan_display during handoff" 2019-05-13 09:47:44 -07:00
Linux Build Service Account
0e545f94b2 Merge "diag: Check buffer size against command structure size" 2019-05-10 01:53:18 -07:00
Venkata Prahlad Valluru
b03b261cfc msm: mdss: hdmi: skip pan_display during handoff
In case of HDMI as primary, skip pan_display until
handoff completes.

Change-Id: I5af8142292bcac0f085fffab1af99f635d3ff304
Signed-off-by: Venkata Prahlad Valluru <vvalluru@codeaurora.org>
2019-05-10 01:10:39 -07:00
Linux Build Service Account
f311145c92 Merge "ARM: msm: dts: add splash memory region for APQ8098" 2019-05-09 15:11:37 -07:00
Linux Build Service Account
1204b2acd6 Merge "msm: sps: Update debug message format specifier" 2019-05-09 15:11:37 -07:00