From 244df28ca3274c0d8109752f0f6171c21c70e4a9 Mon Sep 17 00:00:00 2001 From: engstk Date: Fri, 10 Feb 2023 16:28:00 +0000 Subject: [PATCH] Merge branch android-msm-sunfish-4.14-android13-qpr1 (android-13.0.0_r0.56) FEB 2023.1 Signed-off-by: engstk --- drivers/char/adsprpc.c | 13 +++++++++++++ .../platform/msm/camera/cam_req_mgr/cam_mem_mgr.c | 6 +++--- .../cam_sensor_module/cam_eeprom/cam_eeprom_core.c | 8 ++++++++ drivers/video/fbdev/pxa3xx-gcu.c | 2 +- 4 files changed, 25 insertions(+), 4 deletions(-) diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index 932934f6ec20..8a1994641fef 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -2191,6 +2191,12 @@ static int fastrpc_init_process(struct fastrpc_file *fl, remote_arg_t ra[1]; int tgid = fl->tgid; + if (fl->dev_minor == MINOR_NUM_DEV) { + err = -ECONNREFUSED; + pr_err("adsprpc: %s: untrusted app trying to attach to privileged DSP PD\n", + __func__); + return err; + } ra[0].buf.pv = (void *)&tgid; ra[0].buf.len = sizeof(tgid); ioctl.inv.handle = FASTRPC_STATIC_HANDLE_PROCESS_GROUP; @@ -2327,6 +2333,13 @@ static int fastrpc_init_process(struct fastrpc_file *fl, unsigned int pageslen; } inbuf; + if (fl->dev_minor == MINOR_NUM_DEV) { + err = -ECONNREFUSED; + pr_err("adsprpc: %s: untrusted app trying to attach to audio PD\n", + __func__); + return err; + } + if (!init->filelen) goto bail; diff --git a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c index f86f63ef86c9..8628c533ff77 100644 --- a/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c +++ b/drivers/media/platform/msm/camera/cam_req_mgr/cam_mem_mgr.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2016-2019, The Linux Foundation. All rights reserved. +/* Copyright (c) 2016-2019, 2022 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -682,7 +682,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) if (rc) { CAM_ERR(CAM_MEM, "Ion Alloc failed, len=%llu, align=%llu, flags=0x%x, num_hdl=%d", - cmd->len, cmd->align, cmd->flags, cmd->num_hdl); + len, cmd->align, cmd->flags, cmd->num_hdl); return rc; } @@ -745,7 +745,7 @@ int cam_mem_mgr_alloc_and_map(struct cam_mem_mgr_alloc_cmd *cmd) tbl.bufq[idx].kmdvaddr = kvaddr; tbl.bufq[idx].vaddr = hw_vaddr; tbl.bufq[idx].dma_buf = dmabuf; - tbl.bufq[idx].len = cmd->len; + tbl.bufq[idx].len = len; tbl.bufq[idx].num_hdl = cmd->num_hdl; memcpy(tbl.bufq[idx].hdls, cmd->mmu_hdls, sizeof(int32_t) * cmd->num_hdl); diff --git a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c index d4cdc49b1d4e..f25cf0142c5f 100644 --- a/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c +++ b/drivers/media/platform/msm/camera/cam_sensor_module/cam_eeprom/cam_eeprom_core.c @@ -650,6 +650,14 @@ static int32_t cam_eeprom_init_pkt_parser(struct cam_eeprom_ctrl_t *e_ctrl, rc = -EINVAL; goto rel_cmd_buf; } + + if ((num_map + 1) >= + (MSM_EEPROM_MAX_MEM_MAP_CNT * + MSM_EEPROM_MEMORY_MAP_MAX_SIZE)) { + CAM_ERR(CAM_EEPROM, "OOB error"); + rc = -EINVAL; + goto rel_cmd_buf; + } /* Configure the following map slave address */ map[num_map + 1].saddr = i2c_info->slave_addr; rc = cam_eeprom_update_slaveInfo(e_ctrl, diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c index 4febbe21b9b5..db861bb39150 100644 --- a/drivers/video/fbdev/pxa3xx-gcu.c +++ b/drivers/video/fbdev/pxa3xx-gcu.c @@ -391,7 +391,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff, struct pxa3xx_gcu_batch *buffer; struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file); - int words = count / 4; + size_t words = count / 4; /* Does not need to be atomic. There's a lock in user space, * but anyhow, this is just for statistics. */