xavi/android_kernel_m2note/drivers, branch ng-7.1.2

Bluetooth: hci_uart: check for missing tty operations

2019-09-11T12:26:36+00:00

commit b36a1552d7319bbfd5cf7f08726c23c5c66d4f73 upstream. Certain ttys operations (pty_unix98_ops) lack tiocmget() and tiocmset() functions which are called by the certain HCI UART protocols (hci_ath, hci_bcm, hci_intel, hci_mrvl, hci_qca) via hci_uart_set_flow_control() or directly. This leads to an execution at NULL and can be triggered by an unprivileged user. Fix this by adding a helper function and a check for the missing tty operations in the protocols code. This fixes CVE-2019-10207. The Fixes: lines list commits where calls to tiocm[gs]et() or hci_uart_set_flow_control() were added to the HCI UART protocols. Change-Id: Ia8a38211661570912e9969262af239c021a13d5f Link: https://syzkaller.appspot.com/bug?id=1b42faa2848963564a5b1b7f8c837ea7b55ffa50 Reported-by: syzbot+79337b501d6aa974d0f6@syzkaller.appspotmail.com Fixes: b3190df62861 ("Bluetooth: Support for Atheros AR300x serial chip") Fixes: 118612fb9165 ("Bluetooth: hci_bcm: Add suspend/resume PM functions") Fixes: ff2895592f0f ("Bluetooth: hci_intel: Add Intel baudrate configuration support") Fixes: 162f812f23ba ("Bluetooth: hci_uart: Add Marvell support") Fixes: fa9ad876b8e0 ("Bluetooth: hci_qca: Add support for Qualcomm Bluetooth chip wcn3990") Signed-off-by: Vladis Dronov Signed-off-by: Marcel Holtmann Reviewed-by: Yu-Chen, Cho Tested-by: Yu-Chen, Cho Signed-off-by: Linus Torvalds [bwh: Backported to 3.16: - Only hci_ath is affected - There is no serdev support] Signed-off-by: Ben Hutchings

Security Patch: mt_idle: avoid sscanf heap overflow

2019-08-01T16:12:49+00:00

[Detail] To add buffer size limitation in sscanf(%s) M-ALPS03353869 CVE-2017-0827 BUG:65994220 Change-Id: Icebd9e86ca533dcd5425ed89c0488a64ed921f75 Signed-off-by: Piazza Lo Signed-off-by: Moyster

(CR) ALPS03957020(For_mt6737m_35_n1_alps-mp-n1.mp1-V1_P118)

2019-07-20T11:05:20+00:00

Patch Type: Customer Request CR ID: ALPS03957020 Severity: Description: [Patch Request] [PMS] mt, Project: mt6737M_35_N1, SW Version: alps-mp-n1.mp1-V1N/A Associated Files: device/mt/mt6737m_35_n1/ProjectConfig.mk Patch Type: Customer Request CR ID: ALPS03913671 Severity: Critical Description: [Google Security P***h][CVE_2018_9369]EoP Vulnerability i***ootloader (Device Specific) [[Title fo***ustomer]] [Google Security P***h][CVE_2018_9369]EoP Vulnerability i***ootloader (Device Specific) [[Problem Description]] [Google Security P***h][CVE_2018_9369]EoP Vulnerability i***ootloader (Device Specific) [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2018_9369]EoP Vulnerability i***ootloader (Device Specific) [[問題現象]] [Google Security P***h][CVE_2018_9369]EoP Vulnerability i***ootloader (Device Specific) [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: vendor/mediatek/proprietary/bootable/bootloader/lk/app/mt_boot/fastboot.c Patch Type: Customer Request CR ID: ALPS03913728 Severity: Critical Description: [Google Security P***h][CVE_2018_9394]EoP Vulnerability in P2P (Device Specific) [[Title fo***ustomer]] [Google Security P***h][CVE_2018_9394]EoP Vulnerability in P2P (Device Specific) [[Problem Description]] [Google Security P***h][CVE_2018_9394]EoP Vulnerability in P2P (Device Specific) [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2018_9394]EoP Vulnerability in P2P (Device Specific) [[問題現象]] [Google Security P***h][CVE_2018_9394]EoP Vulnerability in P2P (Device Specific) [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: kernel-3.18/drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/gl_p2p.c Patch Type: Customer Request CR ID: ALPS03913732 Severity: Critical Description: [Google Security P***h][CVE_2018_9396]EoP Vulnerability in C*** (Device Specific) [[Title fo***ustomer]] [Google Security P***h][CVE_2018_9396]EoP Vulnerability in C*** (Device Specific) [[Problem Description]] [Google Security P***h][CVE_2018_9396]EoP Vulnerability in C*** (Device Specific) [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2018_9396]EoP Vulnerability in C*** (Device Specific) [[問題現象]] [Google Security P***h][CVE_2018_9396]EoP Vulnerability in C*** (Device Specific) [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: kernel-3.18/drivers/misc/mediatek/eccci/port_rpc.c Patch Type: Customer Request CR ID: ALPS03921114 Severity: Critical Description: [IMS ***erface][version#0x68][AP] Added support fo***ountry-specific ur***o***o call response [[Title fo***ustomer]] IMS ***erface to support country-specific URN [[Problem Description]] Added support for IMS ***erface mo_call_c*** to country-specific URN which I***tack may send to MD side. [[Potential Impa*** of the solution]] Emergency call fun***ionality possible to implement as per ***PP and operator requirement. [[Modules to be verified after taking p***h]] VDM, VoLTE UA [[問題標題]] IMS ***erface to support country-specific URN [[問題現象]] Added support for IMS ***erface mo_call_c*** to country-specific URN which I***tack may send to MD side. [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) Emergency call fun***ionality possible to implement as per ***PP and operator requirement. [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) VDM, VoLTE UAN/A Associated Files: vendor/mt/libs/volte_imcb/arm/volte_imcb vendor/mt/libs/volte_stack/arm/volte_stack vendor/mt/libs/volte_ua/arm/volte_ua Change-Id: I0b947e82a40c6d2f7f63069ea73023cd61056223

(CR) ALPS03877842(For_mt6737m_35_n1_alps-mp-n1.mp1-V1_P113)

2019-07-20T11:03:14+00:00

Patch Type: Customer Request CR ID: ALPS03877842 Severity: Description: [Patch Request] [PMS] mt, Project: mt6737M_35_N1, SW Version: alps-mp-n1.mp1-V1N/A Associated Files: device/mt/mt6737m_35_n1/ProjectConfig.mk vendor/mt/libs/libmtk-art-runtime/arm/libmtk-art-runtime.a Patch Type: Customer Request CR ID: ALPS03683903 Severity: Critical Description: [Buganizer]Security Vulnerability Issue 70515752 - [An***d GO Pen***ing] Mediatek Preloader Allows Arbitrary Peripheral Memory Reads and Writes [[Title fo***ustomer]] [Buganizer]Security Vulnerability Issue 70515752 - [An***d GO Pen***ing] Mediatek Preloader Allows Arbitrary Peripheral Memory Reads and Writes [[Problem Description]] [Buganizer]Security Vulnerability Issue 70515752 - [An***d GO Pen***ing] Mediatek Preloader Allows Arbitrary Peripheral Memory Reads and Writes [[Potential Impa*** of the solution]] No [[Modules to be verified after taking p***h]] No [[問題標題]] [Buganizer]Security Vulnerability Issue 70515752 - [An***d GO Pen***ing] Mediatek Preloader Allows Arbitrary Peripheral Memory Reads and Writes [[問題現象]] [Buganizer]Security Vulnerability Issue 70515752 - [An***d GO Pen***ing] Mediatek Preloader Allows Arbitrary Peripheral Memory Reads and Writes [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) No [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoN/A Associated Files: vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/core/download.c vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/core/inc/download.h vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/drivers/inc/mt6735.h vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/security/inc/sec_region.h vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/security/sec_region.c Patch Type: Customer Request CR ID: ALPS03693488 Severity: Critical Description: [Buganizer]Security Vulnerability Issue 70515281 - [An***d GO Pen***ing] Mediatek Preloader ¡§Download Mode¡¨ Memory Corruption [[Title fo***ustomer]] [Buganizer]Security Vulnerability Issue 70515281 - [An***d GO Pen***ing] Mediatek Preloader Download Mode Memory Corruption [[Problem Description]] [Buganizer]Security Vulnerability Issue 70515281 - [An***d GO Pen***ing] Mediatek Preloader Download Mode Memory Corruption [[Potential Impa*** of the solution]] no [[Modules to be verified after taking p***h]] boot [[問題標題]] [Buganizer]Security Vulnerability Issue 70515281 - [An***d GO Pen***ing] Mediatek Preloader Download Mode Memory Corruption [[問題現象]] [Buganizer]Security Vulnerability Issue 70515281 - [An***d GO Pen***ing] Mediatek Preloader Download Mode Memory Corruption [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) no [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) bootN/A Associated Files: vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/link_descriptor.ld vendor/mediatek/proprietary/bootable/bootloader/preloader/platform/mt6735/src/core/partition.c Patch Type: Customer Request CR ID: ALPS03740330 Severity: Critical Description: [Buganizer]Security Vulnerability Issue 71867247 - [An***d GO Pen***ing] - Remo***emory Corruption in Mediatek WiFi TLDS Frame Parser [[Title fo***ustomer]] [Buganizer]Security Vulnerability Issue 71867247 - [An***d GO Pen***ing] - Remo***emory Corruption in Mediatek WiFi TLDS Frame Parser [[Problem Description]] [Buganizer]Security Vulnerability Issue 71867247 - [An***d GO Pen***ing] - Remo***emory Corruption in Mediatek WiFi TLDS Frame Parser [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Buganizer]Security Vulnerability Issue 71867247 - [An***d GO Pen***ing] - Remo***emory Corruption in Mediatek WiFi TLDS Frame Parser [[問題現象]] [Buganizer]Security Vulnerability Issue 71867247 - [An***d GO Pen***ing] - Remo***emory Corruption in Mediatek WiFi TLDS Frame Parser [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: kernel-3.18/drivers/misc/mediatek/connectivity/wlan/gen2/mgmt/tdls.c Patch Type: Customer Request CR ID: ALPS03862169 Severity: Critical Description: [Google Security P***h][CVE_2017_13311]EoP Vulnerability in ProcessStats [[Title fo***ustomer]] [Google Security P***h][CVE_2017_13311]EoP Vulnerability in ProcessStats [[Problem Description]] [Google Security P***h][CVE_2017_13311]EoP Vulnerability in ProcessStats [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2017_13311]EoP Vulnerability in ProcessStats [[問題現象]] [Google Security P***h][CVE_2017_13311]EoP Vulnerability in ProcessStats [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: frameworks/base/core/java/com/android/internal/app/procstats/SparseMappingTable.java Patch Type: Customer Request CR ID: ALPS03862180 Severity: Critical Description: [Google Security P***h][CVE_2017_13316]ID Vulnerability in Speech recognizer [[Title fo***ustomer]] [Google Security P***h][CVE_2017_13316]ID Vulnerability in Speech recognizer [[Problem Description]] [Google Security P***h][CVE_2017_13316]ID Vulnerability in Speech recognizer [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2017_13316]ID Vulnerability in Speech recognizer [[問題現象]] [Google Security P***h][CVE_2017_13316]ID Vulnerability in Speech recognizer [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: frameworks/base/core/java/android/content/PermissionChecker.java frameworks/base/core/java/android/speech/RecognitionService.java Patch Type: Customer Request CR ID: ALPS03862195 Severity: Critical Description: [Google Security P***h][CVE_2017_13319]ID/DoS Vulnerability in MP3 codec [[Title fo***ustomer]] [Google Security P***h][CVE_2017_13319]ID/DoS Vulnerability in MP3 codec [[Problem Description]] [Google Security P***h][CVE_2017_13319]ID/DoS Vulnerability in MP3 codec [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2017_13319]ID/DoS Vulnerability in MP3 codec [[問題現象]] [Google Security P***h][CVE_2017_13319]ID/DoS Vulnerability in MP3 codec [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: frameworks/av/media/libstagefright/codecs/mp3dec/src/pvmp3_decode_header.cpp Patch Type: Customer Request CR ID: ALPS03862206 Severity: Critical Description: [Google Security P***h][CVE_2017_16643]ID Vulnerability in USB driver (Device Specific) [[Title fo***ustomer]] [Google Security P***h][CVE_2017_16643]ID Vulnerability in USB driver (Device Specific) [[Problem Description]] [Google Security P***h][CVE_2017_16643]ID Vulnerability in USB driver (Device Specific) [[Potential Impa*** of the solution]] None [[Modules to be verified after taking p***h]] None [[問題標題]] [Google Security P***h][CVE_2017_16643]ID Vulnerability in USB driver (Device Specific) [[問題現象]] [Google Security P***h][CVE_2017_16643]ID Vulnerability in USB driver (Device Specific) [[解法可能帶來的影響]] (請填寫於此行下方，並描述如果合入這個p***h可能會有什麼trade off的改變，如perfo******e降低、UI改變等等) None [[建議驗證模塊]] (請填寫於此行下方，並建議客戶合了此p***h後要驗證哪些module或feature) NoneN/A Associated Files: kernel-3.18/drivers/input/tablet/gtco.c Change-Id: I584cb0ab7b367a80b61730adea475093ca98f3f4

mm/oom_kill: squashed reverts to a stable state

2019-07-18T22:08:32+00:00

Revert "mm, oom: fix use-after-free in oom_kill_process" This reverts commit e1bebdeedb497f03d426c85a89c3807c7e75268d. Signed-off-by: Corinna Vinschen Revert "mm,oom: make oom_killer_disable() killable" This reverts commit 65a7400a432639aa8d5e572f30687fbca204b6f8. Signed-off-by: Corinna Vinschen Revert "mm: oom_kill: don't ignore oom score on exiting tasks" This reverts commit d60dae46b27a8f381e4a7ad9dde870faa49fa5f1. Signed-off-by: Corinna Vinschen Revert "mm/oom_kill.c: avoid attempting to kill init sharing same memory" This reverts commit 10773c0325259d6640b93c0694b5598ddf84939f. Signed-off-by: Corinna Vinschen Revert "CHROMIUM: DROP: mm/oom_kill: Double-check before killing a child in our place" This reverts commit 2bdd9a2042a0e12d96c545773d9d8038c920f813. Revert "mm/oom_kill: fix the wrong task->mm == mm checks in oom_kill_process()" This reverts commit 419a313435b31821e4d045ca4b7ea1cc5fa02035. Signed-off-by: Corinna Vinschen Revert "mm/oom_kill: cleanup the "kill sharing same memory" loop" This reverts commit afda78c6de38f9f66eba0955153b380d540d8276. Revert "mm/oom_kill: remove the wrong fatal_signal_pending() check in oom_kill_process()" This reverts commit acde9c2ace298b249c06ec5b0b971c333449dc09. Signed-off-by: Corinna Vinschen Revert "mm, oom: remove task_lock protecting comm printing" This reverts commit 9a9ca142d250ec9de1215284857f4528c6ddb080. Signed-off-by: Corinna Vinschen Revert "mm/oom_kill.c: suppress unnecessary "sharing same memory" message" This reverts commit 1aa2960f7c70d65b1481f805ac73b988faff6747. Signed-off-by: Corinna Vinschen Revert "mm/oom_kill.c: reverse the order of setting TIF_MEMDIE and sending SIGKILL" This reverts commit f028aedfcfd2e2bb98921b98d3ae183387ab8fed. Revert "mm, oom: remove unnecessary variable" This reverts commit 54b0b58224146d68a11bccb5e64683ab3029373a. Revert "mm/oom_kill.c: print points as unsigned int" This reverts commit 603f975a6d4f0b56c7f6df7889ef2a704eca94a3. Signed-off-by: Corinna Vinschen Revert "mm: oom_kill: simplify OOM killer locking" This reverts commit 7951a52ed35d162063fa08b27894e302fd716ccd. Revert "mm: oom_kill: remove unnecessary locking in exit_oom_victim()" This reverts commit f0739b25ac884682865d6aae7485e79489107bfb. Revert "mm: oom_kill: generalize OOM progress waitqueue" This reverts commit eb4b1243c72ba0b392bbe05dbf9f91959f70eb18. Revert "mm: oom_kill: switch test-and-clear of known TIF_MEMDIE to clear" This reverts commit e611f16275c3642cb8a6345ff2470926fef52110. Revert "mm: oom_kill: clean up victim marking and exiting interfaces" This reverts commit c6fada01b9370e3d7603b4ad8c26b56759174667. Revert "mm: oom_kill: remove unnecessary locking in oom_enable()" This reverts commit 5dd152d7351b3805f59b2b1f624722ab2f3c5fd8. Revert "oom, PM: make OOM detection in the freezer path raceless" This reverts commit 5fc5b1ddee5404a7629dd7045f54eaf8941bc11c.

DISP: Printk too much

2019-07-18T20:51:23+00:00

[Detail] Replace DISPMSG() as DISPDBG() to reduce printk log MTK-Commit-Id: d9613f32bb286cea1ce1f4cd87a2af91557643fb Change-Id: I2d072885b6c83113490dc27823c822860ec201a5 Signed-off-by: Elvin Zhang CR-Id:ALPS03499038 Feature:Display Driver

GPU DVFS: fix procfs write KE

2019-07-18T20:05:57+00:00

[Detail] KE always happens when write /proc/gpufreq/gpufreq_fixed_freq by IoFuzz test [Solution] add input freq check MTK-Commit-Id: 74092efbcddc8d1584e56bb81df4722affa0b512 Change-Id: I10525c42e946088d63b8adeb29594f754710747f Signed-off-by: Brian-SY Yang CR-Id: ALPS03519258 Feature: Others (cherry picked from commit bcbce651ad5b50bc7add53f65c0c355a3b932c33) (cherry picked from commit fa8f434d44293d39b89b3b1585ae114fa1f1d549)

masp: fix ioctl: SEC_GET_RANDOM_ID memory check range

2019-07-18T20:01:03+00:00

[Detail] Size of RID is 16 bytes instead of 4 bytes. Instead of using "unsigned int" as input type of _IOR(), a new struct "sec_rid" which is 16 bytes in size is declared and used in order to make memory access permission check range correct. MTK-Commit-Id: 4e1c03ca23666da29bbcd024839de5ad8a3fa143 Change-Id: I892b71fb082b5b2335d29436fee1bc61cf14fc15 Signed-off-by: Chin-Ting Kuo CR-Id: ALPS03523553 Feature: Vulnerability Scan

smi: log only for wrong ioctl

2019-07-18T19:42:50+00:00

[Detail] log only without aee for wrong ioctl MTK-Commit-Id: bb7c3da5b777f7841bf42f3d2b3e2b5f82bc135e Change-Id: I39b4360faeb297f9febefce9c3b3b9885e0c097b Signed-off-by: Jacky Chen CR-Id: ALPS03592077 Feature: smi

vibrator: delete more log

2019-07-18T19:36:00+00:00

[Detail] delete more log [Solution] delete more log MTK-Commit-Id: 1f1494edf8bb600dfede431d102a5fbbaa04816a Change-Id: I6309eb44c76b588ff44dd7f2a937b3e4c5d5e7bb Signed-off-by: Shangbing Hu CR-Id: ALPS02571387 Feature: WiFi Calling Service (cherry picked from commit 93f355c2b37d923cd463bb71e20dc8c7e7596cca) (cherry picked from commit b0e147971dcd0d178a1ee6043dcd49dec5f434e7)