dm crypt: fix access beyond the end of allocated space

commit d49ec52ff6ddcda178fc2476a109cf1bd1fa19ed upstream.

The DM crypt target accesses memory beyond allocated space resulting in
a crash on 32 bit x86 systems.

This bug is very old (it dates back to 2.6.25 commit 3a7f6c990ad04 "dm
crypt: use async crypto").  However, this bug was masked by the fact
that kmalloc rounds the size up to the next power of two.  This bug
wasn't exposed until 3.17-rc1 commit 298a9fa08a ("dm crypt: use per-bio
data").  By switching to using per-bio data there was no longer any
padding beyond the end of a dm-crypt allocated memory block.

To minimize allocation overhead dm-crypt puts several structures into one
block allocated with kmalloc.  The block holds struct ablkcipher_request,
cipher-specific scratch pad (crypto_ablkcipher_reqsize(any_tfm(cc))),
struct dm_crypt_request and an initialization vector.

The variable dmreq_start is set to offset of struct dm_crypt_request
within this memory block.  dm-crypt allocates the block with this size:
cc->dmreq_start + sizeof(struct dm_crypt_request) + cc->iv_size.

When accessing the initialization vector, dm-crypt uses the function
iv_of_dmreq, which performs this calculation: ALIGN((unsigned long)(dmreq
+ 1), crypto_ablkcipher_alignmask(any_tfm(cc)) + 1).

dm-crypt allocated "cc->iv_size" bytes beyond the end of dm_crypt_request
structure.  However, when dm-crypt accesses the initialization vector, it
takes a pointer to the end of dm_crypt_request, aligns it, and then uses
it as the initialization vector.  If the end of dm_crypt_request is not
aligned on a crypto_ablkcipher_alignmask(any_tfm(cc)) boundary the
alignment causes the initialization vector to point beyond the allocated
space.

Fix this bug by calculating the variable iv_size_padding and adding it
to the allocated size.

Also correct the alignment of dm_crypt_request.  struct dm_crypt_request
is specific to dm-crypt (it isn't used by the crypto subsystem at all),
so it is aligned on __alignof__(struct dm_crypt_request).

Also align per_bio_data_size on ARCH_KMALLOC_MINALIGN, so that it is
aligned as if the block was allocated with kmalloc.

Reported-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Tested-by: Milan Broz <gmazyland@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
[lizf: Backported by Mikulas]
Signed-off-by: Zefan Li <lizefan@huawei.com>
ext4: propagate errors up to ext4_find_entry()'s callers
ext4: avoid trying to kfree an ERR_PTR pointer
perf: Handle compat ioctl

commit b3f207855f57b9c8f43a547a801340bb5cbc59e5 upstream.

When running a 32-bit userspace on a 64-bit kernel (eg. i386
application on x86_64 kernel or 32-bit arm userspace on arm64
kernel) some of the perf ioctls must be treated with special
care, as they have a pointer size encoded in the command.

For example, PERF_EVENT_IOC_ID in 32-bit world will be encoded
as 0x80042407, but 64-bit kernel will expect 0x80082407. In
result the ioctl will fail returning -ENOTTY.

This patch solves the problem by adding code fixing up the
size as compat_ioctl file operation.

Reported-by: Drew Richardson <drew.richardson@arm.com>
Signed-off-by: Pawel Moll <pawel.moll@arm.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Link: http://lkml.kernel.org/r/1402671812-9078-1-git-send-email-pawel.moll@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: David Ahern <dsahern@gmail.com>
[lizf: Backported to 3.4 by David Ahern]
Signed-off-by: Zefan Li <lizefan@huawei.com>
    nl80211: clear skb cb before passing to netlink
msm: smd_pkt: Remove hexdump of  userspace read/write buffers

Dumping userspace read/write buffers without first copying the data may
lead to a kernel panic if the buffer is unmapped after the buffer has
been validated but before the VFS call returns.

Remove the debug code to print the data using userspace buffers.

CRs-Fixed: 730626
Change-Id: I95c0d751121812fd5d5f30e2b4ee221b1fc36083
Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org>
Signed-off-by: Eric Holmberg <eholmber@codeaurora.org>
msm: mdss: Remove check for play count on VIG pipe for CSC

The play count will not be reset to 0 in static screen case.
However, we still need to reset the CSC setup because the
registers would be reset.

Change-Id: Id2f6d9317b4da561ec31b6454166704493880b81
CRs-Fixed: 716190
Signed-off-by: Benet Clark <benetc@codeaurora.org>
msm_rmnet_sdio: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: Ic26bea1ddf9570a4970fc8c4373b066aa385e427
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm_rmnet: Fix potential memory corruption

Usage of legacy string manipulation function sprintf could lead to
memory corruption as the number of bytes to be written to the
destination is not bounded. Replace sprintf with snprintf where the
number of bytes to be written is explicitly specified.

CRs-fixed: 672202
Change-Id: I1788d655f048124c6b7cccee4345d8239743ada8
Signed-off-by: Subash Abhinov Kasiviswanathan <subashab@codeaurora.org>
msm: mdss: call wait4comp before wb kickoff

when wfd is tear down, HW still fetch the address of buffer queue
which was already released and while cancelling the buffer cause the
iommu page fault. Call wait4comp before kickoff is called to avoid
iommu page fault.

Change-Id: Ia597b395e13072374cfe3d5fa8216363946bff16
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
msm: vidc: Refactor OCMEM alloc, set, unset and free
mm: prevent MIGRATE_ISOLATE pages entering other free lists

It is observed that, during a CMA allocation,
test_pages_isolated() fails sometimes.
In low memory situations, this results in continuous
failures of CMA allocations.
When testing for isolation, test_pages_isolated finds
that some pages are allocated, which were available on
pcp list when start_isolate_page_range marked the
pageblock as MIGRATE_ISOLATE. These pages, though
marked as isolated in the respective pageblock, are
moved to non-isolate freelists while being drained.
This results in these pages being allocated from other
paths while a contig allocation is in progress. In
certain cases, these pages get allocated from the
migrate_pages() of current alloc_contig_range() itself.

In the function free_pcppages_bulk(), when a page is
moved to buddy, the migrate list is picked based on
page_private. In the case of CMA pages, which were on
pcp list during start_isolate_page_range, page_private
will point to MIGRATE_CMA, and the pageblock migrate
type can be MIGRATE_ISOLATE. This results in these pages
being moved to cma freelist, rather than isolate freelist,
inside free_pcppages_bulk. This means they can get allocated.

If cma pages are never allowed to enter pcp lists, we
will not hit this issue. This is partly done by
free_hot_cold_page(), where we prevent cma pages
entering pcp. But cma pages can still get on pcp lists
through rmqueue_bulk. Preventing cma pages enter pcp
via rmqueue_bulk, can result in underutilization of
CMA pages for non-contiguous allocations, as rmqueue_bulk
is the frequent path for order 0 allocations.

CRs-fixed:720761
Change-Id: I01b12e6455c75519f1dce5d31467123cb1eb54b7
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
qseecom: fix secure app loading failure by kernel mode qseecom client

Make a change to fix secure app loading failure due to premature
kzfree() from __qseecom_load_fw(), when kernel mode qseecom client
tries to load app.

CRs-fixed: 694541

Change-Id: I1ac39ee885c12e08e863d976321dda2380ace852
Signed-off-by: William Clark <wclark@codeaurora.org>
ASoC: msm: qdsp6v2: fix rtac command failure

In rtac driver, while sending PP_Params for ADM copp
to DSP, token needs to be port_id whereas coppid is used.
Replace it with port_id to avoid failure in command
and timeout issue.

Change-Id: I77ab13ea14e8d6c25514bdeed24db37ef8113a75
Signed-off-by: Laxminath Kasam <lkasam@codeaurora.org>
ASoC: msm: Add bounds checking to ADM get params

Add additional bounds checking to ADM get params.
Validate that all buffer sizes are valid before
dereferencing.

Change-Id: If7c7a5ae6a56812e9c4a11a38c9bdc78f42d09f3
Signed-off-by: Ben Romberger <bromberg@codeaurora.org>
net: ipv6: ping: Use socket mark in routing lookup

[net-next commit bf439b3154ce49d81a79b14f9fab18af99018ae2]

Change-Id: I8356e9132088c75d4510021c6e4c2641d772087a
Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Git-commit: a5d5c168c37e0ab30ba07b2c79c7cba9615f4e87
Git-repo: https://android.googlesource.com/kernel/common.git
Signed-off-by: Ian Maund <imaund@codeaurora.org>
msm: mdp: Validate input arguments from user space

Fully verify the input arguments from user client are safe
to use.

Change-Id: Ie14332443b187951009c63ebfb78456dcd9ba60f
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
ASoC: pcm: update the start-up sequence for playback

Codec should be started before the adsp to ensure that there is no data
loss during playback.Current sequence enables the adsp first followed by
codec.This change updates the sequence prevent any playback data loss.

Change-Id: Iaf01d153f41a2f94d302ae7f4c1c98b1361dd24f
Signed-off-by: Gopikrishnaiah Anandan <agopik@codeaurora.org>
msm: camera: Fix CCI I2C write fail to write for reg addr 0x00

Allow CCI I2C write to 0x00 addressed register in data queue.

Change-Id: I6f3844c95fd6e6d258326e410826da0ee3c27bda
Signed-off-by: Lokesh Kumar Aakulu <lkumar@codeaurora.org>
USB: gadget: f_rndis: Add check before queuing notification available

There is a chance that rndis_response_available() and unbind() race each
other due to which request's buffer might have freed and could cause
accessing freed buffer pointer. Hence add check before accessing buffer
pointer of USB request for interrupt endpoint.

CRs-fixed: 731323
Change-Id: I2082e54cbdc28817651e75e8e8ed13d0ee61a6d5
Signed-off-by: Vijayavardhan Vennapusa <vvreddy@codeaurora.org>