linux-stable.git/drivers/staging, branch v3.16.82

binder: Handle start==NULL in binder_update_page_range()

2020-02-11T20:03:40+00:00

commit 2a9edd056ed4fbf9d2e797c3fc06335af35bccc4 upstream.

The old loop wouldn't stop when reaching `start` if `start==NULL`, instead
continuing backwards to index -1 and crashing.

Luckily you need to be highly privileged to map things at NULL, so it's not
a big problem.

Fix it by adjusting the loop so that the loop variable is always in bounds.

This patch is deliberately minimal to simplify backporting, but IMO this
function could use a refactor. The jump labels in the second loop body are
horrible (the error gotos should be jumping to free_range instead), and
both loops would look nicer if they just iterated upwards through indices.
And the up_read()+mmput() shouldn't be duplicated like that.

Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Signed-off-by: Jann Horn 
Acked-by: Christian Brauner 
Link: https://lore.kernel.org/r/20191018205631.248274-3-jannh@google.com
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: There is no continue statement in the loop,
 so we only need to check the exit condition at the bottom]
Signed-off-by: Ben Hutchings

staging: rtl8192e: fix potential use after free

2020-02-11T20:03:26+00:00

commit b7aa39a2ed0112d07fc277ebd24a08a7b2368ab9 upstream.

The variable skb is released via kfree_skb() when the return value of
_rtl92e_tx is not zero. However, after that, skb is accessed again to
read its length, which may result in a use after free bug. This patch
fixes the bug by moving the release operation to where skb is never
used later.

Signed-off-by: Pan Bian 
Reviewed-by: Dan Carpenter 
Link: https://lore.kernel.org/r/1572965351-6745-1-git-send-email-bianpan2016@163.com
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings

ALSA: line6: Fix memory leak at line6_init_pcm() error path

2020-02-11T20:03:09+00:00

commit 1bc8d18c75fef3b478dbdfef722aae09e2a9fde7 upstream.

I forgot to release the allocated object at the early error path in
line6_init_pcm().  For addressing it, slightly shuffle the code so
that the PCM destructor (pcm->private_free) is assigned properly
before all error paths.

Fixes: 3450121997ce ("ALSA: line6: Fix write on zero-sized buffer")
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings

ALSA: line6: Drop superfluous snd_device for PCM

2020-02-11T20:03:08+00:00

commit b45a7c565473d29bd7e02ac8ca86232a24ca247f upstream.

Instead of handling the card-specific resource in snd_device, attach
it into pcm->private_data and release it directly in private_free.
This simplifies the code and structure.

Tested-by: Chris Rorvick 
Signed-off-by: Takashi Iwai 
[bwh: Backported to 3.16 as dependency of commit 1bc8d18c75fe
 "ALSA: line6: Fix memory leak at line6_init_pcm() error path"]
 - Adjust filename, context]
Signed-off-by: Ben Hutchings

staging: goldfish: audio: fix compiliation on arm

2020-01-11T02:04:53+00:00

commit 4532150762ceb0d6fd765ebcb3ba6966fbb8faab upstream.

We do actually need slab.h, by luck we get it on other platforms but not
always on ARM. Include it properly.

Signed-off-by: Greg Hackmann 
Signed-off-by: Jin Qian 
Signed-off-by: Alan 
Signed-off-by: Greg Kroah-Hartman 
Cc: Arnd Bergmann 
Signed-off-by: Ben Hutchings

staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT

2020-01-11T02:04:52+00:00

commit 1328d8efef17d5e16bd6e9cfe59130a833674534 upstream.

In carveout heap, change minimum allocation order from 12 to
PAGE_SHIFT. After this change each bit in bitmap (genalloc -
General purpose special memory pool) represents one page size
memory.

Cc: sprd-ind-kernel-group@googlegroups.com
Cc: sanjeev.yadav@spreadtrum.com
Cc: Colin Cross 
Cc: Android Kernel Team 
Cc: Greg KH 
Cc: Sumit Semwal 
Signed-off-by: Rajmal Menariya 
[jstultz: Reworked commit message]
Signed-off-by: John Stultz 
Acked-by: Laura Abbott 
Signed-off-by: Greg Kroah-Hartman 
Cc: Arnd Bergmann 
Signed-off-by: Ben Hutchings

staging: ashmem: Add missing include

2020-01-11T02:04:52+00:00

commit 90a2f171383b5ae43b33ab4d9d566b9765622ac7 upstream.

Include  into ashmem.h to ensure referenced types
are defined

Cc: Android Kernel Team 
Cc: Greg KH 
Signed-off-by: Rom Lemarchand 
[jstultz: Minor commit message tweaks]
Signed-off-by: John Stultz 
Signed-off-by: Greg Kroah-Hartman 
Cc: Arnd Bergmann 
Signed-off-by: Ben Hutchings

staging: ashmem: Avoid deadlock with mmap/shrink

2020-01-11T02:04:51+00:00

commit 18e77054de741ef3ed2a2489bc9bf82a318b2d5e upstream.

Both ashmem_mmap and ashmem_shrink take the ashmem_lock. It may
be possible for ashmem_mmap to invoke ashmem_shrink:

-000|mutex_lock(lock = 0x0)
-001|ashmem_shrink(?, sc = 0x0) <--- try to take ashmem_mutex again
-002|shrink_slab(shrink = 0xDA5F1CC0, nr_pages_scanned = 0, lru_pages
-002|=
-002|124)
-003|try_to_free_pages(zonelist = 0x0, ?, ?, ?)
-004|__alloc_pages_nodemask(gfp_mask = 21200, order = 1, zonelist =
-004|0xC11D0940,
-005|new_slab(s = 0xE4841E80, ?, node = -1)
-006|__slab_alloc.isra.43.constprop.50(s = 0xE4841E80, gfpflags =
-006|2148925462, ad
-007|kmem_cache_alloc(s = 0xE4841E80, gfpflags = 208)
-008|shmem_alloc_inode(?)
-009|alloc_inode(sb = 0xE480E800)
-010|new_inode_pseudo(?)
-011|new_inode(?)
-012|shmem_get_inode(sb = 0xE480E800, dir = 0x0, ?, dev = 0, flags =
-012|187)
-013|shmem_file_setup(?, ?, flags = 187)
-014|ashmem_mmap(?, vma = 0xC5D64210) <---- Acquire ashmem_mutex
-015|mmap_region(file = 0xDF8E2C00, addr = 1772974080, len = 233472,
-015|flags = 57,
-016|sys_mmap_pgoff(addr = 0, len = 230400, prot = 3, flags = 1, fd =
-016|157, pgoff
-017|ret_fast_syscall(asm)
-->|exception
-018|NUR:0x40097508(asm)
---|end of frame

Avoid this deadlock by using mutex_trylock in ashmem_shrink; if the mutex
is already held, do not attempt to shrink.

Cc: Greg KH 
Cc: Android Kernel Team 
Reported-by: Matt Wagantall 
Reported-by: Syed Rameez Mustafa 
Reported-by: Osvaldo Banuelos 
Reported-by: Subbaraman Narayanamurthy 
Signed-off-by: Laura Abbott 
[jstultz: Minor commit message tweaks]
Signed-off-by: John Stultz 
Signed-off-by: Greg Kroah-Hartman 
Cc: Arnd Bergmann 
Signed-off-by: Ben Hutchings

staging: rtl8188eu: fix HighestRate check in odm_ARFBRefresh_8188E()

2019-12-19T15:57:51+00:00

commit 22d67a01d8d89552b989c9651419824bb4111200 upstream.

It's incorrect to compare HighestRate with 0x0b twice in the following
manner "if (HighestRate > 0x0b) ... else if (HighestRate > 0x0b) ...". The
"else if" branch is constantly false. The second comparision should be
with 0x03 according to the max_rate_idx in ODM_RAInfo_Init().

Cc: Michael Straube 
Signed-off-by: Denis Efremov 
Acked-by: Larry Finger 
Link: https://lore.kernel.org/r/20190926073138.12109-1-efremov@linux.com
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust filename, indentation]
Signed-off-by: Ben Hutchings

ANDROID: binder: remove waitqueue when thread exits.

2019-12-10T18:01:28+00:00

commit f5cb779ba16334b45ba8946d6bfa6d9834d1527f upstream.

binder_poll() passes the thread->wait waitqueue that
can be slept on for work. When a thread that uses
epoll explicitly exits using BINDER_THREAD_EXIT,
the waitqueue is freed, but it is never removed
from the corresponding epoll data structure. When
the process subsequently exits, the epoll cleanup
code tries to access the waitlist, which results in
a use-after-free.

Prevent this by using POLLFREE when the thread exits.

Signed-off-by: Martijn Coenen 
Reported-by: syzbot 
[backport BINDER_LOOPER_STATE_POLL logic as well]
Signed-off-by: Mattias Nissler 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings