812312 Commits

Author SHA1 Message Date
Martin KaFai Lau
9186c74235 bpf: btf: Ensure the member->offset is in the right order
This patch ensures the member->offset of a struct
is in the correct order (i.e the later member's offset cannot
go backward).

The current "pahole -J" BTF encoder does not generate something
like this.  However, checking this can ensure future encoder
will not violate this.

Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
dbb90c0fb1 bpf: btf: Clean up BTF_INT_BITS() in uapi btf.h
This patch shrinks the BTF_INT_BITS() mask.  The current
btf_int_check_meta() ensures the nr_bits of an integer
cannot exceed 64.  Hence, it is mostly an uapi cleanup.

The actual btf usage (i.e. seq_show()) is also modified
to use u8 instead of u16.  The verification (e.g. btf_int_check_meta())
path stays as is to deal with invalid BTF situation.

Fixes: 69b693f0aefa ("bpf: btf: Introduce BPF Type Format (BTF)")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Okash Khawaja
d71dba3a50 bpf: btf: Fix bitfield extraction for big endian
When extracting bitfield from a number, btf_int_bits_seq_show() builds
a mask and accesses least significant byte of the number in a way
specific to little-endian. This patch fixes that by checking endianness
of the machine and then shifting left and right the unneeded bits.

Thanks to Martin Lau for the help in navigating potential pitfalls when
dealing with endianess and for the final solution.

Fixes: b00b8daec828 ("bpf: btf: Add pretty print capability for data with BTF type info")
Signed-off-by: Okash Khawaja <osk@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
c77bbc8ea6 bpf: btf: Ensure t->type == 0 for BTF_KIND_FWD
The t->type in BTF_KIND_FWD is not used.  It must be 0.
This patch ensures that and also adds a test case in test_btf.c

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
7c91077981 bpf: btf: Check array t->size
This patch ensures array's t->size is 0.

The array size is decided by its individual elem's size and the
number of elements.  Hence, t->size is not used and
it must be 0.

A test case is added to test_btf.c

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Arnd Bergmann
0ac0cf41ba bpf: btf: avoid -Wreturn-type warning
gcc warns about a noreturn function possibly returning in
some configurations:

kernel/bpf/btf.c: In function 'env_type_is_resolve_sink':
kernel/bpf/btf.c:729:1: error: control reaches end of non-void function [-Werror=return-type]

Using BUG() instead of BUG_ON() avoids that warning and otherwise
does the exact same thing.

Fixes: eb3f595dab40 ("bpf: btf: Validate type reference")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
30c671fcf1 bpf: btf: Avoid variable length array
Sparse warning:
kernel/bpf/btf.c:1985:34: warning: Variable length array is used.

This patch directly uses ARRAY_SIZE().

Fixes: f80442a4cd18 ("bpf: btf: Change how section is supported in btf_header")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
99d6fc1429 bpf: btf: Remove unused bits from uapi/linux/btf.h
This patch does the followings:
1. Limit BTF_MAX_TYPES and BTF_MAX_NAME_OFFSET to 64k.  We can
   raise it later.

2. Remove the BTF_TYPE_PARENT and BTF_STR_TBL_ELF_ID.  They are
   currently encoded at the highest bit of a u32.
   It is because the current use case does not require supporting
   parent type (i.e type_id referring to a type in another BTF file).
   It also does not support referring to a string in ELF.

   The BTF_TYPE_PARENT and BTF_STR_TBL_ELF_ID checks are replaced
   by BTF_TYPE_ID_CHECK and BTF_STR_OFFSET_CHECK which are
   defined in btf.c instead of uapi/linux/btf.h.

3. Limit the BTF_INFO_KIND from 5 bits to 4 bits which is enough.
   There is unused bits headroom if we ever needed it later.

4. The root bit in BTF_INFO is also removed because it is not
   used in the current use case.

5. Remove BTF_INT_VARARGS since func type is not supported now.
   The BTF_INT_ENCODING is limited to 4 bits instead of 8 bits.

The above can be added back later because the verifier
ensures the unused bits are zeros.

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
e7bc168e32 bpf: btf: Check array->index_type
Instead of ingoring the array->index_type field.  Enforce that
it must be a BTF_KIND_INT in size 1/2/4/8 bytes.

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
8ea41acf37 bpf: btf: Change how section is supported in btf_header
There are currently unused section descriptions in the btf_header.  Those
sections are here to support future BTF use cases.  For example, the
func section (func_off) is to support function signature (e.g. the BPF
prog function signature).

Instead of spelling out all potential sections up-front in the btf_header.
This patch makes changes to btf_header such that extending it (e.g. adding
a section) is possible later.  The unused ones can be removed for now and
they can be added back later.

This patch:
1. adds a hdr_len to the btf_header.  It will allow adding
sections (and other info like parent_label and parent_name)
later.  The check is similar to the existing bpf_attr.
If a user passes in a longer hdr_len, the kernel
ensures the extra tailing bytes are 0.

2. allows the section order in the BTF object to be
different from its sec_off order in btf_header.

3. each sec_off is followed by a sec_len.  It must not have gap or
overlapping among sections.

The string section is ensured to be at the end due to the 4 bytes
alignment requirement of the type section.

The above changes will allow enough flexibility to
add new sections (and other info) to the btf_header later.

This patch also removes an unnecessary !err check
at the end of btf_parse().

Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
55562c32df bpf: Fix compiler warning on info.map_ids for 32bit platform
This patch uses u64_to_user_ptr() to cast info.map_ids to a userspace ptr.
It also tags the user_map_ids with '__user' for sparse check.

Fixes: cb4d2b3f03d8 ("bpf: Add name, load_time, uid and map_ids to bpf_prog_info")
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:39 -03:00
Martin KaFai Lau
937e41cb2e bpf: btf: Avoid WARN_ON when CONFIG_REFCOUNT_FULL=y
If CONFIG_REFCOUNT_FULL=y, refcount_inc() WARN when refcount is 0.
When creating a new btf, the initial btf->refcnt is 0 and
triggered the following:

[   34.855452] refcount_t: increment on 0; use-after-free.
[   34.856252] WARNING: CPU: 6 PID: 1857 at lib/refcount.c:153 refcount_inc+0x26/0x30
....
[   34.868809] Call Trace:
[   34.869168]  btf_new_fd+0x1af6/0x24d0
[   34.869645]  ? btf_type_seq_show+0x200/0x200
[   34.870212]  ? lock_acquire+0x3b0/0x3b0
[   34.870726]  ? security_capable+0x54/0x90
[   34.871247]  __x64_sys_bpf+0x1b2/0x310
[   34.871761]  ? __ia32_sys_bpf+0x310/0x310
[   34.872285]  ? bad_area_access_error+0x310/0x310
[   34.872894]  do_syscall_64+0x95/0x3f0

This patch uses refcount_set() instead.

Reported-by: Yonghong Song <yhs@fb.com>
Tested-by: Yonghong Song <yhs@fb.com>
Change-Id: I61918a383eb08dd8fb9320dadd1f0e616f68af1b
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
9aa08f2762 BACKPORT: bpf: btf: Clean up btf.h in uapi
This patch cleans up btf.h in uapi:
1) Rename "name" to "name_off" to better reflect it is an offset to the
   string section instead of a char array.
2) Remove unused value BTF_FLAGS_COMPR and BTF_MAGIC_SWAP

Suggested-by: Daniel Borkmann <daniel@iogearbox.net>
Change-Id: I480706c7a099a26b52b050f1e51e3408eabfed20
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
d0eb16b6be bpf: btf: Add BPF_OBJ_GET_INFO_BY_FD support to BTF fd
This patch adds BPF_OBJ_GET_INFO_BY_FD support to BTF fd.
The original BTF data, which was used to create the BTF fd during
the earlier BPF_BTF_LOAD call, will be returned.

The userspace is expected to allocate buffer
to info.info and the buffer size is set to info.info_len before
calling BPF_OBJ_GET_INFO_BY_FD.

The original BTF data is copied to the userspace buffer (info.info).
Only upto the user's specified info.info_len will be copied.

The original BTF data size is set to info.info_len.  The userspace
needs to check if it is bigger than its allocated buffer size.
If it is, the userspace should realloc with the kernel-returned
info.info_len and call the BPF_OBJ_GET_INFO_BY_FD again.

Change-Id: Ibbd2966eb0e59b1ab9cbc56f92a0512cb804483a
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
274acc4648 BACKPORT: bpf: btf: Add BPF_BTF_LOAD command
This patch adds a BPF_BTF_LOAD command which
1) loads and verifies the BTF (implemented in earlier patches)
2) returns a BTF fd to userspace.  In the next patch, the
   BTF fd can be specified during BPF_MAP_CREATE.

It currently limits to CAP_SYS_ADMIN.

Change-Id: Id826446740838918cc317c75d0ccb6038842e933
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
486c2a8be6 bpf: btf: Add pretty print capability for data with BTF type info
This patch adds pretty print capability for data with BTF type info.
The current usage is to allow pretty print for a BPF map.

The next few patches will allow a read() on a pinned map with BTF
type info for its key and value.

This patch uses the seq_printf() infra.

Change-Id: I4c459c09688af606883e504bedd3794b616da01d
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
4f2cd833e9 bpf: btf: Check members of struct/union
This patch checks a few things of struct's members:

1) It has a valid size (e.g. a "const void" is invalid)
2) A member's size (+ its member's offset) does not exceed
   the containing struct's size.
3) The member's offset satisfies the alignment requirement

The above can only be done after the needs_resolve member's type
is resolved.  Hence, the above is done together in
btf_struct_resolve().

Each possible member's type (e.g. int, enum, modifier...) implements
the check_member() ops which will be called from btf_struct_resolve().

Change-Id: I24f9e39dd689125a8fcd41895982a2c92035e5fb
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
a20afbc3d5 bpf: btf: Validate type reference
After collecting all btf_type in the first pass in an earlier patch,
the second pass (in this patch) can validate the reference types
(e.g. the referring type does exist and it does not refer to itself).

While checking the reference type, it also gathers other information (e.g.
the size of an array).  This info will be useful in checking the
struct's members in a later patch.  They will also be useful in doing
pretty print later.

Change-Id: I86bf4691edd7b0114b8148cd77a77d1896fb2091
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Tim Zimmermann
d63ada96c2 bpf: Update logging functions to work with BTF
* Based on 430e68d10b,
  77d2e05abd
  and a2a7d57010

Change-Id: I27e2c804726078646ca9beda31cbae2a745dfd47
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
b1f30ebe50 BACKPORT: bpf: btf: Introduce BPF Type Format (BTF)
This patch introduces BPF type Format (BTF).

BTF (BPF Type Format) is the meta data format which describes
the data types of BPF program/map.  Hence, it basically focus
on the C programming language which the modern BPF is primary
using.  The first use case is to provide a generic pretty print
capability for a BPF map.

BTF has its root from CTF (Compact C-Type format).  To simplify
the handling of BTF data, BTF removes the differences between
small and big type/struct-member.  Hence, BTF consistently uses u32
instead of supporting both "one u16" and "two u32 (+padding)" in
describing type and struct-member.

It also raises the number of types (and functions) limit
from 0x7fff to 0x7fffffff.

Due to the above changes,  the format is not compatible to CTF.
Hence, BTF starts with a new BTF_MAGIC and version number.

This patch does the first verification pass to the BTF.  The first
pass checks:
1. meta-data size (e.g. It does not go beyond the total btf's size)
2. name_offset is valid
3. Each BTF_KIND (e.g. int, enum, struct....) does its
   own check of its meta-data.

Some other checks, like checking a struct's member is referring
to a valid type, can only be done in the second pass.  The second
verification pass will be implemented in the next patch.

Change-Id: Ic3a57709c16c02059438f5b1b85ccc94466f2db3
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Martin KaFai Lau
b191beed27 BACKPORT: bpf: Rename bpf_verifer_log
bpf_verifer_log =>
bpf_verifier_log

Change-Id: If356de35e8dff3c7d7733cf70f5cbfd1db615d30
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Alexei Starovoitov <ast@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Jakub Kicinski
3648bf0a7b BACKPORT: bpf: encapsulate verifier log state into a structure
Put the loose log_* variables into a structure.  This will make
it simpler to remove the global verifier state in following patches.

Change-Id: I8a84b6acfd50596f0d80339ea01db220070cbdc8
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Daniel Borkmann
375e466318 BACKPORT: bpf: add skb_load_bytes_relative helper
This adds a small BPF helper similar to bpf_skb_load_bytes() that
is able to load relative to mac/net header offset from the skb's
linear data. Compared to bpf_skb_load_bytes(), it takes a fifth
argument namely start_header, which is either BPF_HDR_START_MAC
or BPF_HDR_START_NET. This allows for a more flexible alternative
compared to LD_ABS/LD_IND with negative offset. It's enabled for
tc BPF programs as well as sock filter program types where it's
mainly useful in reuseport programs to ease access to lower header
data.

Reference: https://lists.iovisor.org/pipermail/iovisor-dev/2017-March/000698.html
Change-Id: I8edf5b01aa2cc08876fb579437816838339bf798
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
2025-01-13 14:37:38 -03:00
Simao Gomes Viana
29921b0a8b headers_install: Rename sigaction definition
After the "Avoid multiple definitions of sigaction." change in bionic,
we ought to modify our kernel headers to make sure that sigaction struct
is not present in uapi headers.

Change-Id: I9d668467a74aa2f5ea2e1ae15b6b6a5f546f47ff
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:50:57 -03:00
Chung-Hsien Hsu
2e66880b86 nl80211: Add WPA3 definition for SAE authentication
Add definition of WPA version 3 for SAE authentication.

Change-Id: I19ca34b8965168f011cc1352eba420f2d54b0258
Signed-off-by: Chung-Hsien Hsu <stanley.hsu@cypress.com>
Signed-off-by: Chi-Hsien Lin <chi-hsien.lin@cypress.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:50:40 -03:00
Isaac J. Manjarres
83a2387ca1 msm: ion: Relocate MSM ION header directly to include/uapi/linux
Instead of using a symlink to point to the MSM ION header,
place it directly in the include/uapi/linux path.

[cyberknight777: Backport to msm-4.14]

Change-Id: Id2a91adb4bdfc2c03e8eb535882734603ccd0f94
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Jprimero15 <jprimero15@aospa.co>
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:50:26 -03:00
Richard Raya
9988447bd5 build.sh: Do not append KSU to localversion
Change-Id: I5dac9e3348dd7c1bafda797f35038d341e85a8de
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:31:27 -03:00
John Galt
12290e8a8b Revert "mm: process reclaim: vmpressure based process reclaim"
- This reverts commit 7964b3ce47f0d87fbbb1cfdd1fb4aadb620133dd as QCOM vmpressure driven process reclaim is redundant compared to Linux PPR which meets userspace dependencies.

Change-Id: I46782f69c57febed99002681ee268fa4a3111d59
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:30:58 -03:00
Cyber Knight
06425a87ef Revert "lowmemorykiller: Introduce sysfs node for ALMK and PPR adj threshold"
- This reverts commit f326985b26c272b4a9bcc250e7cf6af28b7c3398 as it does not meet userspace dependencies.

Change-Id: I8aaefeea7cc3dcab1d4a8c94723be238616c9474
Signed-off-by: Cyber Knight <cyberknight755@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2025-01-04 19:30:55 -03:00
Richard Raya
3863eb9f33 f2fs: Tune intervals
Following: [init.rc: Tune F2FS and dirty writeout policy for modern devices]
3f0e715129

Change-Id: I34fe1c76e874f42d52a3a87381421b21f2e5ade5
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:58:29 -03:00
Angelo G. Del Regno
a8d7b20544 msm: gsi: Correctly allocate memory for copy_from_user
Copying from user to a global variable inside the driver is
unsafe and insecure: allocate and free the memory used for
copying from userspace in the functions doing it.

This also has the good side effect of solving a build failure
when the kernel is built with GCC >=4.9

Change-Id: I96d0e74fa73939883079cf2b3308dbfa7de6a453
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:58:19 -03:00
MarijnS95
deef0312bc msm: ipa3: Correct smallest ipa3_write string to 1
The smallest string that this function deals with is "1", which is of
size 1. Correct the if to allow this case.

Change-Id: Iaa68bcc452a3428d4752e5c34c98d0bd2e926c5a
Signed-off-by: MarijnS95 <marijns95@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:58:11 -03:00
Angelo G. Del Regno
adfe392f74 msm: ipa: Correctly allocate memory for copy_from_user
Copying from user to a global variable inside the driver is
unsafe and insecure: allocate and free the memory used for
copying from userspace in the functions doing it.

This also has the good side effect of solving a build failure
when the kernel is built with GCC >=4.9

Change-Id: I6c009b555f39d577bdb0321ca7c759bb1013824e
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:58:00 -03:00
danielml
751e08750f ASoC: Fix stub functions declarations
Change-Id: Ia725b0079107af67b3e114a419e346c3d9b26865
Signed-off-by: danielml <daniel@danielml.dev>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:46 -03:00
Meng Wang
09a5126321 ASoC: codecs: Update SOC_SINGLE_SX_TLV to SOC_SINGLE_S8_TLV
Update SOC_SINGLE_SX_TLV to SOC_SINGLE_S8_TLV to make codec
driver compatiable with upstream driver.

Change-Id: I4061b015d715978f3b294ad630f53b64bf66c2b7
Signed-off-by: Meng Wang <mengw@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:34 -03:00
Shalini Manjunatha
99dc9bc583 ASoC: msm-pcm-q6-v2: Add dsp buf check
Fix is to add check for this ADSP returned buf offset + size,
if it is within the available buf size range

Change-Id: I400cc4f5c07164f0a9b405ebea144ea0ae4b6cf2
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:27 -03:00
Laxminath Kasam
f356db9d3c ASoC: msm-pcm-q6-v2: Update copy_to_user to requested buffer size
Avoid copy to user more than requested buffer size
to avoid memory corruption.

Change-Id: Ibf1607f777a358ebd16fd8b8728809afda34eba7
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:21 -03:00
Laxminath Kasam
3603a8088b ASoC: msm-pcm-q6-v2: Update memset for period size
tinycap test can attempt with different size to
read from driver and need to avoid access more
than period size.

Change-Id: Ifa4ddfb086bd83aa981da62e88da3a9395f5aabc
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:17 -03:00
Laxminath Kasam
bd5e12849c ASoC: msm-pcm-q6-v2: Reset the buffer if size is partial or zero
Sometimes during device switch in recording,
observe size 0 is return from DSP due to EOS
handling. For ALSA pcm_read to unblock, buffer
appl_ptr is elapsed without actually updating
the buffer. And userspace copies the stale
data(old buffer) causing issue sometimes.
Reset the buffer for that period_size in
such cases instead of transfer stale data.

Change-Id: I0d3ac133a8d95fad0710586e3e947410a41c9c5a
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:11 -03:00
Soumya Managoli
a1345bf0fd ASoC: msm-pcm-host-voice-v2: Address buffer overflow in hpcm copy
Add check for the max hpcm_buf_node size before copy to avoid
buffer out of bounds issue.

Change-Id: Id647888430ce302359a857ef54d321bee99889bf
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:57:03 -03:00
Shalini Manjunatha
161a471b31 dsp: q6afe: Check for param size before copying
Check for the proper param size before copying,
to avoid buffer overflow.

Change-Id: Ic7fa9b3dd047d8eeba3cea02b99d6bc5b9df8daf
Signed-off-by: Shalini Manjunatha <quic_c_shalma@quicinc.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:56:52 -03:00
Karthikeyan Mani
bd3214aa83 dsp: q6afe: Check for payload size before payload access
Check if payload data is big enough before accessing
the data in it.

Change-Id: I939f205a8cebf6ef4859f81fae5429bca013d540
Signed-off-by: Karthikeyan Mani <kmani@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:56:39 -03:00
siimsek
d05adcaac1 ASoC: wcd_cpe_services: Fix enum-conversion warnings
techpack/audio/asoc/codecs/wcd_cpe_services.c:658:17: error: implicit
conversion from enumeration type 'enum cpe_svc_result' to different
enumeration type 'enum cmi_api_result' [-Werror,-Wenum-conversion]
        notif.result = result;
                     ~ ^~~~~~
techpack/audio/asoc/codecs/wcd_cpe_services.c:1350:8: error: implicit
conversion from enumeration type 'enum cpe_svc_result' to different
enumeration type 'enum cpe_process_result' [-Werror,-Wenum-conversion]
                rc = cpe_send_msg_to_inbox(t_info, 0, m);
                   ~ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2 errors generated.

Change-Id: Ib9fce60017066e9c96e79195d7dba9ffb9177148
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:56:30 -03:00
Soumya Managoli
4f44375c05 dsp: q6adm: Resolve mem corruption in adm cb
Conversion of negative "num_modules" var value
will result in max possible unsigned int value
and hence can cause mem corruption when accessed.

Resolve this by assigning the same data type
to "num_modules" var as used in the calling fn.

Change-Id: I4c9d7215b9c7345637e1eb3a1992a41fef71c5cb
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:56:01 -03:00
Soumya Managoli
fbd9928150 ASoC: msm-pcm-q6-v2: Add dsp buf check
Current logic copies user buf size of data
from the avail dsp buf at a given offset.
If this offset returned from DSP in READ_DONE event
goes out of bounds or is corrupted, then it can lead to
out of bounds DSP buffer access, resulting in memory fault.
Fix is to add check for this buf offset, if it is within
the buf size range.

Change-Id: I7753cc6db394704dbb959477150141d42b836bef
Signed-off-by: Soumya Managoli <quic_c_smanag@quicinc.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:56 -03:00
Arian
b395d9793d ASoC: wcd_cpe_core: Fix snprintf size
techpack/audio/asoc/codecs/wcd_cpe_core.c:1981:2: error: 'snprintf' size argument is too large; destination buffer has size 11, but size argument is 13 [-Werror,-Wfortify-source]
        snprintf(proc_name, (sizeof("cpe") + sizeof("_state") +
        ^
1 error generated.

Change-Id: I976c005263f44d7a97f1496304acf28df30232a1
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:50 -03:00
Soumya Managoli
34dedb32a5 ASoC: msm-pcm-routing-v2: Fix overflow error in routing driver
The reg in soc_dapm_mux is 32-bit. The BE DAI ID passed
as shift(to be operated on the reg) may be more than 31,
which may cause overflow.
Set reg field to SND_SOC_NOPM to avoid any DAPM operation
while passing BE IDs in shift_l field and hence avoid overflow.

Change-Id: Ibbbca04c61b7c56eb4c5a7485a4e93dc28a09709
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:40 -03:00
Sultan Alsawaf
f920e63f4c ASoC: msm-pcm-routing-v2: Fix non-blocking if-statement warning
Change-Id: Ia33743c8770dbb3cffe52aa1b57faa3267f37d8f
Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:34 -03:00
Sheenam Monga
005f04c3e7 qcacmn: Fix potential OOB read in util_scan_parse_rnr_ie
Currently, while parsing scan RNR Ie data is moved to
next neighbor_ap_info_field after parsing the current
neighbor_ap_info_field. But in last iteration pointer may
try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2)
bytes are less than sizeof neighbor_ap_info_field and same
is the case with tbtt_length access.

Fix is to add a length check of data + next data size to be parsed
< (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation
of data length only.

CRs-Fixed: 3710080
Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:29 -03:00
Tashfin Shakeer Rhythm
cb2aa5d672 qcacmn: Add void keyword to old-style zero prototype functions
Newer clang builds complain about old-style function declarations
not having any prototype assigned. The missing `void` is triggering
the Wstrict-prototype warns. Explicitly add the `void` keyword to
satisfy the compiler.

This fixes the following warnings:

drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_legacy.c:
1288:34: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_legacy()
                                 ^
                                  void
drivers/staging/qca-wifi-host-cmn/hif/src/ce/ce_service_srng.c:1017:32:
error: a function declaration without a prototype is deprecated in all
versions of C [-Werror,-Wstrict-prototypes]
struct ce_ops *ce_services_srng()
                               ^
                                void
drivers/staging/qca-wifi-host-cmn/target_if/core/src/target_if_main.c:
88:40: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
struct target_if_ctx *target_if_get_ctx()
                                       ^
                                        void
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_extscan_api.c:
103:27: error: a function declaration without a prototype is
deprecated in all versions of C [-Werror,-Wstrict-prototypes]
wlan_extscan_global_deinit()
                          ^
                           void

Change-Id: Ifd95b57d19a25f0932e5de8ec4de2f2c1e7e1259
Signed-off-by: Tashfin Shakeer Rhythm <tashfinshakeerrhythm@gmail.com>
Signed-off-by: Richard Raya <rdxzv.dev@gmail.com>
2024-12-31 01:55:22 -03:00