Skip to content

GitLab

and though bugs are the bane of my existence, rest assured the wretched thing will get the best of care here

Switch branch/tag
  1. 21 Jun, 2017 1 commit
  3. 20 Jun, 2017 3 commits
  5. 19 Jun, 2017 2 commits
  7. 16 Jun, 2017 1 commit
  9. 08 Jun, 2017 2 commits
  11. 05 Jun, 2017 1 commit
  13. 02 Jun, 2017 1 commit
  15. 01 Jun, 2017 1 commit
  17. 27 May, 2017 3 commits
  19. 23 May, 2017 1 commit
  21. 16 May, 2017 4 commits
  23. 15 May, 2017 1 commit
    • Thomas Yang's avatar
      <YETI_N><mmc><yangpn1> add timed-out dynamic wakelocks for mmc host during rw operation · 5ad476d3
      Thomas Yang authored 
      [issue] [YETIN-1689] fixed

[rootcause]

	if screen is off when mmc rw operation is on going, suspend sequence would sync filesystems but it hangs in sys_sync() because there is some sdhci_tasklet_finish() cmds left. mmc bus clock should be kept.

[solution]
	1.	include mmc0 and mmc1 to sdhci_runtime_suspend/resume_host() sequence for ext4 rw operation
	2.	isolate tasklet skip_cnt and wakelock timeout value for mmc0 and mmc1
	3.	include mmc1 to mmc_bus_suspend/resume() for vfat rw operation
	4.	as for usbotg device, there is constant wakelock defined in bq2589x_charger.c
	5.	as for screen off mp3 case, the case itself holds system wakelock named PowerManagementService.WakeLocks, so the new wakelock would not introduce power consumption impact.
	6.	add spin_lock_irqsave and spin_unlock_irqrestore to protect busbusy_wakelock_en and tasklet_cnt

Change-Id: I726b18efcd066784723415d230314727ec392c3c
      5ad476d3
  25. 11 May, 2017 4 commits
  27. 10 May, 2017 1 commit
  29. 09 May, 2017 1 commit
  31. 08 May, 2017 1 commit
  33. 02 May, 2017 5 commits
  35. 24 Apr, 2017 1 commit
  37. 19 Apr, 2017 6 commits
    • Pankaj Bharadiya's avatar
      atomisp: Protect buffers_waiting_for_param list access · da11a8d5
      Pankaj Bharadiya authored 
      We are seeing multiple list corruption issues

1.

[80329.240487] WARNING: CPU: 0 PID: 22520 at ../../../../../../kernel/cht/lib/list_debug.c:63 __list_del_entry+0xc5/0xf0()
[80329.252539] list_del corruption. prev->next should be ffff88002af75838, but was ffff88002af75438
[80329.252562] Modules linked in: tcp_diag inet_diag atomisp_css2401a0_v21 videobuf_vmalloc videobuf_core bt_lpm rfkill_gpio 8723bs(O) cfg80211 ov2680 ov8858_driver silead_ts ltr501 bmg160 ak09911 kxcjk_1013
[80329.273007] CPU: 0 PID: 22520 Comm: kworker/0:1 Tainted: G        W  O 3.14.79-x86_64-02759-gbc7150af8263 #1
[80329.283989] Hardware name: Insyde CherryTrail/T3 MRD, BIOS CHTMRD.A6.002.016.004 12/13/2016
[80329.293363] Workqueue: atomisp-css2401a0_v21 0 atomisp_wdt_work [atomisp_css2401a0_v21]
[80329.302316]  0000000000000000 ffff8800083ffc10 ffffffff81ad90a2 ffff8800083ffc58
[80329.302442]  0000000000000009 ffff8800083ffc48 ffffffff8108b83d ffff88006de23a40
[80329.302570]  ffff88006de23da0 ffff88006de20028 0000000000000286 ffff88002af75800
[80329.302698] Call Trace:
[80329.302732]  [<ffffffff81ad90a2>] dump_stack+0x67/0x90
[80329.308477]  [<ffffffff8108b83d>] warn_slowpath_common+0x7d/0xa0
[80329.315190]  [<ffffffff8108b8ac>] warn_slowpath_fmt+0x4c/0x50
[80329.321611]  [<ffffffff813ab0e5>] __list_del_entry+0xc5/0xf0
[80329.327957]  [<ffffffffa02ad7e6>] atomisp_flush_video_pipe.part.20+0x116/0x180 [atomisp_css2401a0_v21]
[80329.338382]  [<ffffffffa02af0a4>] atomisp_flush_bufs_and_wakeup+0x44/0x90 [atomisp_css2401a0_v21]
[80329.348322]  [<ffffffffa02b3abe>] __atomisp_css_recover+0x45e/0x660 [atomisp_css2401a0_v21]
[80329.357678]  [<ffffffffa02b4187>] atomisp_wdt_work+0x4c7/0x560 [atomisp_css2401a0_v21]
[80329.366529]  [<ffffffff81ae0a2d>] ? __schedule+0x39d/0x940
[80329.372662]  [<ffffffff810a8faf>] process_one_work+0x16f/0x4f0
[80329.379180]  [<ffffffff810a9d3c>] worker_thread+0x12c/0x3d0
[80329.385408]  [<ffffffff810a9c10>] ? manage_workers.isra.27+0x290/0x290
[80329.392704]  [<ffffffff810afcfd>] kthread+0xed/0x110
[80329.398252]  [<ffffffff810afc10>] ? kthread_create_on_node+0x190/0x190

2.
<4>[31010.186503] WARNING: CPU: 2 PID: 9496 at ../../../../../../kernel/cht/lib/list_debug.c:31 __list_add+0xe8/0xf0()
<7>[31010.197896] list_add corruption. next->prev should be prev (ffff880068429f38), but was ffff88006a363d78. (next=ffff88006a363d78).
<4>[31010.197913] Modules linked in: tcp_diag inet_diag atomisp_css2401a0_v21 videobuf_vmalloc videobuf_core 8723bs(O) cfg80211 bt_lpm rfkill_gpio ov2680 ov8858_driver silead_ts ltr501 bmg160 ak09911 kxcjk_1013
<4>[31010.218499] CPU: 2 PID: 9496 Comm: PreviewStream Tainted: G W O 3.14.70-x86_64-02220-g4d315b0b #1
<4>[31010.229108] Hardware name: Insyde CherryTrail/T3 MRD, BIOS CHTMRD.A6.002.016 09/20/2016
<7>[31010.238073] 0000000000000000 ffff880005a77978 ffffffff81a9c698 ffff880005a779c0
<7>[31010.238196] 0000000000000009 ffff880005a779b0 ffffffff8108b67d ffff880033a49338
<7>[31010.238325] ffff88006a363d78 ffff880068429f38 ffff880033a49301 0000000000000202
<7>[31010.238453] Call Trace:
<4>[31010.238507] [<ffffffff81a9c698>] dump_stack+0x67/0x90
<4>[31010.244283] [<ffffffff8108b67d>] warn_slowpath_common+0x7d/0xa0
<4>[31010.251019] [<ffffffff8108b6ec>] warn_slowpath_fmt+0x4c/0x50
<4>[31010.257473] [<ffffffff81aa73f2>] ? __mutex_lock_slowpath+0x292/0x3d0
<4>[31010.264692] [<ffffffff813a5b58>] __list_add+0xe8/0xf0
<4>[31010.270566] [<ffffffffa02c83e2>] atomisp_buf_queue+0x52/0x90 [atomisp_css2401a0_v21]
<4>[31010.279356] [<ffffffffa00d1911>] videobuf_qbuf+0x441/0x4e0 [videobuf_core]
<4>[31010.287261] [<ffffffffa02b54cf>] atomisp_qbuf+0x14f/0x540 [atomisp_css2401a0_v21]
<4>[31010.295762] [<ffffffff817793db>] v4l_qbuf+0x3b/0x50
<4>[31010.301330] [<ffffffff81778a4c>] __video_do_ioctl+0x26c/0x360
<4>[31010.307887] [<ffffffff8116bfa5>] ? __alloc_pages_nodemask+0x175/0xb50
<4>[31010.315212] [<ffffffff817787e0>] ? v4l_dqevent+0x20/0x20
<4>[31010.321276] [<ffffffff8177a3e0>] video_usercopy+0x390/0x650
<4>[31010.327630] [<ffffffff810e7b8a>] ? __srcu_read_lock+0x7a/0xb0
<4>[31010.334179] [<ffffffff8177a6b5>] video_ioctl2+0x15/0x20
<4>[31010.340135] [<ffffffff81774b64>] v4l2_ioctl+0x154/0x190
<4>[31010.346096] [<ffffffff817834e7>] do_video_ioctl+0x477/0x1690

capq.bufs[x] video buffers get added to buffers_waiting_for_param /
activeq lists. Any update/access to these lists should be proected
with the lock.

Looks like this issue is causing because the list opearations on
buffers_waiting_for_param list are not protected properly with the
lock.

Take a lock before accessing/modifying the buffers_waiting_for_param
list

Change-Id: I3ce95f41fda31bf4bd99170a4559ff2b8b557f27
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43791Signed-off-by: default avatarPankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
Reviewed-on: https://android.intel.com:443/574687
      da11a8d5
    • Pankaj Bharadiya's avatar
      binder: Use mutex instead of rt_mutex · 25540a96
      Pankaj Bharadiya authored 
      This patch is cherry-picked from -
- Repository - https://android.googlesource.com/kernel/common.git
- Branch - android-3.18
- Commit - d018e6f70470ce01ab6275e423906dcc79f847e2.

To quote Riley Andrews(riandrews@google.com) - This ends up doing
more damage than good on most devices. Go back to using a standard
mutex.

rt_mutex is causing issues while warm reboot regression test hence
use standard mutex.

Change-Id: I5d839e875be5ccff6dd9ff210adf150cc00376e5
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43742Signed-off-by: default avatarPankaj Bharadiya <pankaj.laxminarayan.bharadiya@intel.com>
Reviewed-on: https://android.intel.com:443/573109
      25540a96
    • Jan Kara's avatar
      BACKPORT: posix_acl: Clear SGID bit when setting file permissions · 711b2fc3
      Jan Kara authored 
      (cherry pick from commit 073931017b49d9458aa351605b43a7e34598caef)

When file permissions are modified via chmod(2) and the user is not in
the owning group or capable of CAP_FSETID, the setgid bit is cleared in
inode_change_ok().  Setting a POSIX ACL via setxattr(2) sets the file
permissions as well as the new ACL, but doesn't clear the setgid bit in
a similar way; this allows to bypass the check in chmod(2).  Fix that.

NB: conflicts resolution included extending the change to all visible
    users of the near deprecated function posix_acl_equiv_mode
    replaced with posix_acl_update_mode. We did not resolve the ACL
    leak in this CL, require additional upstream fixes.

References: CVE-2016-7097
Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
Reviewed-by: default avatarJeff Layton <jlayton@redhat.com>
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
Bug: 32458736

Change-Id: I19591ad452cc825ac282b3cfd2daaa72aa9a1ac1
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43399Signed-off-by: default avatarDave Lin <dave.lin@intel.com>
Reviewed-on: https://android.intel.com:443/572049
      711b2fc3
    • Insun Song's avatar
      net: wireless: bcmdhd: fix buffer overrun in wl_android_set_roampref · 825fdfb1
      Insun Song authored 
      added boundary check not to override allocated buffer.
Specially when user input corrupted or manipulated.
Signed-off-by: default avatarInsun Song <insun.song@broadcom.com>
Bug: 34469904

Change-Id: Id6196da10111517696eda5f186b1e2dd19f66085
CVE: CVE-2017-0573
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43399Signed-off-by: default avatarDave Lin <dave.lin@intel.com>
Reviewed-on: https://android.intel.com:443/572047
      825fdfb1
    • Insun Song's avatar
      net: wireless: bcmdhd: fix buffer overrun in wlfc reordering · e2e1de71
      Insun Song authored 
      added boundary check not to override allocated buffer
Signed-off-by: default avatarInsun Song <insun.song@broadcom.com>
Bug: 34203305

Change-Id: Iad44141ba4e4cd224eda292c05ffe525bf74227d
CVE: CVE-2017-0571
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43399Signed-off-by: default avatarDave Lin <dave.lin@intel.com>
Reviewed-on: https://android.intel.com:443/572046
      e2e1de71
    • Sudhir Kohalli's avatar
      net: wireless: bcmdhd: Heap overflow in wl_run_escan. · 2ddebbff
      Sudhir Kohalli authored 
      1) The default_chan_list buffer overflow is avoided by checking
n_nodfs index does not exceed num_chans, which is the length
of default_chan_list buffer.
2) The SSID length check 32(max limit) is done and then the SSID
name copied in extra buffer is null terminated. The extra buffer
is allocated a length of of 33 in wl_iw_ioctl.c.
3) Issue of chances of cumulative results->pkt_count length
exceeding allocated memory length of results->total_count is
avoided in this fix. change_array is the destination array
whose length is allocated to results->total_count.
Signed-off-by: default avatarSudhir Kohalli <sudhir.kohalli@broadcom.com>

Bug: 34197514
Bug: 34199963
Bug: 34198729

Change-Id: I0cd268ab696daac938a99f451607a3f4b2cfaed3
CVE: CVE-2017-0569, CVE-2017-0570, CVE-2017-0568
Tracked-On: https://jira01.devtools.intel.com/browse/OAM-43399Signed-off-by: default avatarDave Lin <dave.lin@intel.com>
Reviewed-on: https://android.intel.com:443/572045
      2ddebbff