linux-toradex.git, branch tegra-l4t-r21.6 Linux kernel for Apalis and Colibri modules Bluetooth: Properly check L2CAP config option output buffer length 2017-10-03T14:10:26+00:00 Ben Seri ben@armis.com 2017-09-13T08:34:32+00:00 b271e8fa67a6d9c4600274a25636cfe00fdd1b68 Validate the output buffer length for L2CAP config requests and responses to avoid overflowing the stack buffer used for building the option blocks. Bug 1989825 Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122 Cc: stable@vger.kernel.org Signed-off-by: Ben Seri <ben@armis.com> Signed-off-by: Marcel Holtmann <marcel@holtmann.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Bibek Basu <bbasu@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1558952 (cherry picked from commit c005032a3ffe77437f6ebc704af377fc9bc46279) Reviewed-on: https://git-master.nvidia.com/r/1570529 Reviewed-by: Matthew Pedro <mapedro@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com> Tested-by: Winnie Hsu <whsu@nvidia.com> 
Validate the output buffer length for L2CAP config requests and responses
to avoid overflowing the stack buffer used for building the option blocks.

Bug 1989825

Change-Id: Id158ece2176c4ac339a7232dfde8c47ce2241122
Cc: stable@vger.kernel.org
Signed-off-by: Ben Seri <ben@armis.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1558952
(cherry picked from commit c005032a3ffe77437f6ebc704af377fc9bc46279)
Reviewed-on: https://git-master.nvidia.com/r/1570529
Reviewed-by: Matthew Pedro <mapedro@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
Tested-by: Winnie Hsu <whsu@nvidia.com>
gpu: nvgpu: Remove IOCTL FREE_OBJ_CTX 2017-07-26T18:27:09+00:00 Debarshi Dutta ddutta@nvidia.com 2017-06-21T10:45:09+00:00 2db040946ff8340485b2b33fe5a46f3166fa96f6 We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context being only partially available, and can lead to use-after-free. Bug 1885775 Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649 Signed-off-by: Debarshi Dutta <ddutta@nvidia.com> Reviewed-on: https://git-master.nvidia.com/r/1506479 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> 
We have never used the IOCTL FREE_OBJ_CTX. Using it leads to context being
only partially available, and can lead to use-after-free.

Bug 1885775

Change-Id: I9d2b632ab79760f8186d02e0f35861b3a6aae649
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
Reviewed-on: https://git-master.nvidia.com/r/1506479
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
video: tegra: nvmap: fix nvmap create handle vulnerability 2017-07-26T18:25:50+00:00 Krishna Reddy vdumpa@nvidia.com 2016-11-04T19:45:53+00:00 481eb890d4c989e61a998dca11797a3035f1b1de Handle the race condition between malicious fd close and copy_to_user error, which can create use after free condition. This is fixed by deferring the fd install, which eliminates the race that leads to use after free condition. Fixing Google Bug 32160775. Bug 1835857 Change-Id: I337807e4360661beced8f9e1155c47b66607b8df Signed-off-by: Krishna Reddy <vdumpa@nvidia.com> Reviewed-on: http://git-master/r/1248391 Reviewed-on: https://git-master.nvidia.com/r/1512958 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com> 
Handle the race condition between malicious fd close and
copy_to_user error, which can create use after free condition.
This is fixed by deferring the fd install, which eliminates
the race that leads to use after free condition.
Fixing Google Bug 32160775.

Bug 1835857

Change-Id: I337807e4360661beced8f9e1155c47b66607b8df
Signed-off-by: Krishna Reddy <vdumpa@nvidia.com>
Reviewed-on: http://git-master/r/1248391
Reviewed-on: https://git-master.nvidia.com/r/1512958
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
video: tegra: dsi: Set max limit for reading panel 2017-06-29T23:44:03+00:00 Pavan Kunapuli pkunapuli@nvidia.com 2017-03-16T14:02:06+00:00 54c1cc0aa58a97e18563c6d996d5dde741055ddd In the debugfs support for reading panel registers, max payload needs to be limited to the buff array size to avoid stack corruption. Bug 1873360 Change-Id: Ibee7bd81027d2669297942c09b905f1dd3bb09ee Signed-off-by: Pavan Kunapuli <pkunapuli@nvidia.com> Signed-off-by: sakets <sakets@nvidia.com> Reviewed-on: https://git-master/r/1507653 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> 
In the debugfs support for reading panel registers, max payload
needs to be limited to the buff array size to avoid stack corruption.

Bug 1873360

Change-Id: Ibee7bd81027d2669297942c09b905f1dd3bb09ee
Signed-off-by: Pavan Kunapuli <pkunapuli@nvidia.com>
Signed-off-by: sakets <sakets@nvidia.com>
Reviewed-on: https://git-master/r/1507653
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
video: tegra: nvmap: fix information leak in pin/unpin 2017-06-21T23:52:34+00:00 Sri Krishna chowdary schowdary@nvidia.com 2017-03-03T05:14:08+00:00 d45c4c5cae287106a349c4f85d12c45920147fb0 When the NVMAP_IOC_PIN_MULT_32 and NVMAP_IOC_UNPIN_MULT_32 are called it is possible that the op.addr is not initialized. This can cause write to some random address thus causing corruption. This patch fixes Google Bug 31668540 bug 1832092 Change-Id: I4d12d1a6c777131ba1fa2a753ea640861f8e82a6 Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com> Reviewed-on: http://git-master/r/1314406 (cherry picked from commit da0c43534bb61e2e0849e297d389517d5e4ed168) Reviewed-on: http://git-master/r/1504673 GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com> 
When the NVMAP_IOC_PIN_MULT_32 and NVMAP_IOC_UNPIN_MULT_32 are
called it is possible that the op.addr is not initialized. This
can cause write to some random address thus causing corruption.

This patch fixes Google Bug 31668540

bug 1832092

Change-Id: I4d12d1a6c777131ba1fa2a753ea640861f8e82a6
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Reviewed-on: http://git-master/r/1314406
(cherry picked from commit da0c43534bb61e2e0849e297d389517d5e4ed168)
Reviewed-on: http://git-master/r/1504673
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
media: tegra: nvavp: Fix UAF issue. 2017-06-20T18:14:33+00:00 Jitendra Kumar jitendrak@nvidia.com 2016-10-27T08:35:00+00:00 707cd5f568f3521090d31dec663f54d7fca08347 Use locking to protect generated fd, so that it can't be freed before channel open completes. Also add null value checks in release call. CVE-2016-8449 (A-31798848) Bug 1830023 Bug 1849492 Change-Id: Ie6e2b29c7132fdfdff6b0bfa75440bd43afffd5f Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1285817 (cherry picked from commit 2ff0fdedfd65f269359d6540df4662e958681aa7) Reviewed-on: http://git-master/r/1299505 (cherry picked from commit ea1af2ce5a746bda36205357c9e0adaf527026bb) Reviewed-on: http://git-master/r/1489467 (cherry picked from commit 89559abb25f82dc333eafa26391be0a50d6e9e0a) Reviewed-on: http://git-master/r/1504674 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Tested-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com> 
Use locking to protect generated fd, so that it can't be
freed before channel open completes. Also add null value checks
in release call.

CVE-2016-8449 (A-31798848)
Bug 1830023
Bug 1849492

Change-Id: Ie6e2b29c7132fdfdff6b0bfa75440bd43afffd5f
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1285817
(cherry picked from commit 2ff0fdedfd65f269359d6540df4662e958681aa7)
Reviewed-on: http://git-master/r/1299505
(cherry picked from commit ea1af2ce5a746bda36205357c9e0adaf527026bb)
Reviewed-on: http://git-master/r/1489467
(cherry picked from commit 89559abb25f82dc333eafa26391be0a50d6e9e0a)
Reviewed-on: http://git-master/r/1504674
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Tested-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
gpu: nvgpu: Fix pgsz_idx used in gk20a_vm_alloc_space() 2017-06-16T18:23:02+00:00 Alex Waterman alexw@nvidia.com 2016-11-30T22:12:25+00:00 ec9ac25833e9e5972b1dcbfc2f9140259dc71393 Use the correct page size index for pgsz_idx in gk20a_vm_alloc_space(). Previously the page size itself was used, not the page size index. Bug 1837624 Change-Id: I652f5af5321c1c49dc8eb170d3f92f00c23d2b6f Signed-off-by: Alex Waterman <alexw@nvidia.com> (cherry picked from commit fd13e0e1c4e397335c24497a0f92c85934d6185f) Reviewed-on: http://git-master/r/1503371 Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com> Reviewed-by: Winnie Hsu <whsu@nvidia.com> 
Use the correct page size index for pgsz_idx in gk20a_vm_alloc_space().
Previously the page size itself was used, not the page size index.

Bug 1837624

Change-Id: I652f5af5321c1c49dc8eb170d3f92f00c23d2b6f
Signed-off-by: Alex Waterman <alexw@nvidia.com>
(cherry picked from commit fd13e0e1c4e397335c24497a0f92c85934d6185f)
Reviewed-on: http://git-master/r/1503371
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Reviewed-by: Winnie Hsu <whsu@nvidia.com>
video: tegra: nvmap: Fix NULL pointer dereference 2017-06-09T18:19:54+00:00 Sri Krishna chowdary schowdary@nvidia.com 2016-12-14T06:28:30+00:00 b4328544835de3fc8215f37668dc97fc21013136 Consider the following case: 1. NVMAP_IOC_CREATE on IOVMM gives a valid fd to user space 2. user space does not call NVMAP_IOC_ALLOC. 3. user space calls a client driver IOCTL which calls dma_buf_map_attachment 4. call to dma_buf_map_attachment propagates till__nvmap_sg_table which has heap_pgalloc as true and tries to access pages[] which has all NULL. 5. Similarly, a dma_buf_kmap() can result in __nvmap_kmap() being called which again results in NULL dereference if pages[] is accessed. A valid __nvmap_sg_table should occur only when h->alloc is true. So, add check for it. bug 1838597 bug 1883708 Change-Id: I400d9d8a94ff1003db207fc9c252b9256d796f60 Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com> Signed-off-by: Debarshi Dutta <ddutta@nvidia.com> (cherry picked from commit 8244d104b7635cb0b26b651b6851498b9a84d7d6) Reviewed-on: http://git-master/r/1489579 Reviewed-by: Automatic_Commit_Validation_User GVS: Gerrit_Virtual_Submit Reviewed-by: Bibek Basu <bbasu@nvidia.com> Tested-by: Bibek Basu <bbasu@nvidia.com> 
Consider the following case:
1. NVMAP_IOC_CREATE on IOVMM gives a valid fd to user space
2. user space does not call NVMAP_IOC_ALLOC.
3. user space calls a client driver IOCTL which calls dma_buf_map_attachment
4. call to dma_buf_map_attachment propagates till__nvmap_sg_table
   which has heap_pgalloc as true and tries to access pages[]
   which has all NULL.
5. Similarly, a dma_buf_kmap() can result in __nvmap_kmap() being called
   which again results in NULL dereference if pages[] is accessed.

A valid __nvmap_sg_table should occur only when h->alloc is true.
So, add check for it.

bug 1838597
bug 1883708

Change-Id: I400d9d8a94ff1003db207fc9c252b9256d796f60
Signed-off-by: Sri Krishna chowdary <schowdary@nvidia.com>
Signed-off-by: Debarshi Dutta <ddutta@nvidia.com>
(cherry picked from commit 8244d104b7635cb0b26b651b6851498b9a84d7d6)
Reviewed-on: http://git-master/r/1489579
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
Tested-by: Bibek Basu <bbasu@nvidia.com>
video: tegra: nvmap: Fix security issue in NVMAP_IOC_PARAM 2017-05-26T21:04:17+00:00 Gagan Grover ggrover@nvidia.com 2016-11-24T11:28:49+00:00 642ec539ddab846143db87673ace653d09c75e05 Initialized the uninitialized variables and handled return status from nvmap_get_handle_param. Bug 1884311 Bug 1820242 Change-Id: I2390c859d2b2af39eaff44749ca64e60920fe944 Signed-off-by: Gagan Grover <ggrover@nvidia.com> Reviewed-on: http://git-master/r/1259560 Reviewed-on: http://git-master/r/1489707 GVS: Gerrit_Virtual_Submit Tested-by: Sumit Gupta <sumitg@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> 
Initialized the uninitialized variables and handled return status
from nvmap_get_handle_param.

Bug 1884311
Bug 1820242

Change-Id: I2390c859d2b2af39eaff44749ca64e60920fe944
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1259560
Reviewed-on: http://git-master/r/1489707
GVS: Gerrit_Virtual_Submit
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>
video: tegra: nvmap: Fix OOB vulnerability 2017-05-25T20:04:22+00:00 Sagar Kadamati skadamati@nvidia.com 2016-12-06T06:08:01+00:00 ea316a2ba8c8504069b73b8782a5ca3e34283a9e Check all pages' parameters before reserve pages. Bug 1883463 Bug 1831426 Bug 200247013 Manual port: http://git-psac/r/9287 (cherry picked from commit 61a05b52b8a17593e2817076b9bf59efdd9268ad) Change-Id: I2f47c385ff8f4a9ca6bf37ee41749bd684ca1a20 Signed-off-by: Xia Yang <xiay@nvidia.com> Signed-off-by: Sagar Kadamati <skadamati@nvidia.com> Reviewed-on: http://git-master/r/1273326 Reviewed-on: http://git-master/r/1488769 GVS: Gerrit_Virtual_Submit Tested-by: Sumit Gupta <sumitg@nvidia.com> Reviewed-by: Bibek Basu <bbasu@nvidia.com> 
Check all pages' parameters before reserve pages.

Bug 1883463
Bug 1831426
Bug 200247013

Manual port: http://git-psac/r/9287

(cherry picked from commit 61a05b52b8a17593e2817076b9bf59efdd9268ad)

Change-Id: I2f47c385ff8f4a9ca6bf37ee41749bd684ca1a20
Signed-off-by: Xia Yang <xiay@nvidia.com>
Signed-off-by: Sagar Kadamati <skadamati@nvidia.com>
Reviewed-on: http://git-master/r/1273326
Reviewed-on: http://git-master/r/1488769
GVS: Gerrit_Virtual_Submit
Tested-by: Sumit Gupta <sumitg@nvidia.com>
Reviewed-by: Bibek Basu <bbasu@nvidia.com>