CK3 Patchset
ashmem: avoid deadlock between read and mmap calls

Avoid holding ashmem_mutex across code that can page fault.  Page faults
grab the mmap_sem for the process, which are also held by mmap calls
prior to calling ashmem_mmap, which locks ashmem_mutex.  The reversed
order of locking between the two can deadlock.

The calls that can page fault are read() and the ASHMEM_SET_NAME and
ASHMEM_GET_NAME ioctls.  Move the code that accesses userspace pages
outside the ashmem_mutex.

Bug: 9261835
Change-Id: If1322e981d29c889a56cdc9dfcbc6df2729a45e9
Signed-off-by: Todd Poynor <toddpoynor@google.com>
msm: kgsl: Detect and avoid malformed ioctl codes

Because we were using _IO_NR, one could construct a malformed ioctl
code that would avoid allocating memory yet go to a function that
expected that memory. Still use _IO_NR to index the array of ioctls,
but check that the full values match before jumping to the helper
function.

CRs-fixed: 385592
Orig-Change-Id: Ic0dedbaded469035bd0a2bb0f20fecb2a3045ca5
Signed-off-by: Jordan Crouse <jcrouse@codeaurora.org>

CVE-2012-4222:
Several integer overflows in the processing of DIAG ioctl system call
parameters allow a locally installed application to conduct denial of
service (DoS) attacks or possibly execute arbitrary code in kernel
context.
https://www.codeaurora.org/projects/security-advisories/multiple-issues-diagkgsl-system-call-handling-cve-2012-4220-cve-2012

Change-Id: Ida8c46a7fd400e7756c785d268e76a4344462a98
msm: msm_fb: remove mmio access through mmap

Disable access to mm io and add
appropriate range checks to ensure valid accesses
through framebuffer mmap. This prevents illegal
access into memory.

CRs-Fixed: 474706
Orig-Change-Id: If25166f2732433ef967e99c716440030b567aae9
Signed-off-by: Manoj Rao <manojraj@codeaurora.org>

Integer overflow in range check when mapping framebuffer memory (CVE-2013-2596).
https://www.codeaurora.org/projects/security-advisories/integer-overflow-range-check-when-mapping-framebuffer-memory-cve-2013-2596

Change-Id: Icd5506adff62f34df7297cc32c586f81dd60a16c
mm: ashmem: Add cache clean and invalidate ioctls for ashmem

Change-Id: I9475feb06c961cb8b27b434eaf3b54d2666331d4
Orig-Change-Id: Idc120f9f869c1a68e5f012327aa7f599ac065fce
CRs-fixed: 291124
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>
mm: ashmem: Make sure vma is valid while flushing

Ensure that the vma that the ashmem region is tied to
is valid before flushing and hold the mm semaphore so
that the vma does not get destroyed from under while
it's being flushed.

Change-Id: I5216aa3a4fa983f97909c1132d12abe777f60530
CRs-Fixed: 326685
Orig-Change-Id: I86320ffe9e6570e6ffa7dda68ab26be7aed86afd
Signed-off-by: Shubhraprakash Das <sadas@codeaurora.org>