External snoc qos clock added for 8939 for clients to enable/
disable the clock.

Change-Id: I4083831b2329eadf51866ed3fc9462dbccce2bb7
Signed-off-by: Taniya Das <tdas@codeaurora.org>

Set: CONFIG_ENABLE_LINUX_REG=y
to eliminate module build errors that (silently) break wifi.

Change-Id: Ie1b42f3a5b2e4ecf420233cc9722bb23dcc2970c

Add changes to enable PER based roaming by default.

Change-Id: I15a36cd8797a2455be0f07a016bc75b833826aa4
CRs-Fixed: 1059363

Host should update roam candidate channel list to FW if it finds
more AP in the enviornment after initial connection.

Add changes to update new channel list to FW.

Change-Id: Ie429c2299055570a8955f0642fd02cab3fd8d905
CRs-Fixed: 1055571

DUT should do a full scan if it is not able to find candidate
AP from the roam cache list. This full scan has to be done when
there is significant RSSI change which is configurable via ini.

Add interface changes for config paramer upon which full scan
will be done.

Change-Id: Ifb2acf41eb226f0223515d97ef995eb0bddfeb55
CRs-Fixed: 1059278

DUT should do a full scan if it is not able to find candidate
AP from the roam cache list. This full scan has to be done when
there is significant RSSI change which is configurable via ini.

Add changes for config paramer upon which full scan will be done.

CRs-Fixed: 1059278
Change-Id: Ia7b069f18560bebf3a593510bbd4babb293ea8b5

Current implementation does not require host to send any command
if it decides not to roam or roam in PER based roaming, however
it may cause FW error since FW may start scanning again when host
is trying to roam.

These change will cause FW to go to wait state and FW won't start
scanning again untill it gets a restart event from host after a
PER based roam indication.

Change-Id: I155c3f68719dbea05324f7d39e7c9d356055b7bc
CRs-Fixed: 1060437

In case if CSA is in progress and beacon missed is received
the session is disconnected. Now if STA tries to connect to new
AP and at the same time CSA timer expires then tries to switch
channel. As old session is deleted this switch channel fails
as channel info is invalid. This also leads to LIM state change
and thus the roam command is not removed from active command
list.

To fix this:
 - Ignore beacon miss if CSA is in progress
 - In CSA timer add check to ensure that channel change is for
   current session.

Change-Id: Icbb80394e4870ccae19782ee17e37465020e93f9
CRs-Fixed: 1060378

Release 3.0.11.50

Change-Id: I086d0966c300766d1f53eae473eceafa4c035d24
CRs-Fixed: 688141

The commit of change Id I3e50fdc2f648ace1b6c260e3d579d93d8e546446
removed the support for iw_set_priv.

revert the changes for RSSI.

CRs-Fixed: 1059770
Change-Id: I6dda7b62ae0238faf729cb04310fcd5e3802a12e

Release 3.0.11.51

Change-Id: I13e56dfdf7506bc75e2aa3167bd83a2db37c13fa
CRs-Fixed: 688141

Validate cfg_ini before dereferencing the ini
parameter gEnableRoamDelayStats.

Change-Id: I0b2b78f8838cb1c46c60669b8f327ac18e863e80
CRs-Fixed: 1059205

Validate ssid length before accessing the ssid
if the length exceeds max ssid length then return.

Change-Id: I6902a8a3edf6547cf30d37fe5e435ad4f226ac46
CRs-Fixed: 1059205

PER based roam should have max candidate count as
SIR_PER_ROAM_MAX_CANDIDATE_CNT.

Add changes to correct this.

Change-Id: I172db47322f62b26ad2ef01d4907856b64876ee2
CRs-Fixed: 1061678

If host gets a disconnection event from hdd during association, it
could be possible that it hasn't sent RSO start event yet. During
the disconnection, host will send a RSO stop to FW that can cause
FW to be in inconsistent state.

Add changes to not allow RSO stop if last sent command is RSO stop.

Change-Id: Ib681e056904b19b372a10cdf841c8fc173d2075c
CRs-Fixed: 1062281

It could be possible that host decides not to roam in back to back
iterations, it should send restart command in that case.

Add changes to allow back to back RSO restart command.

Change-Id: Iccf749c68c8595657beed771e610e43239767f1d
CRs-Fixed: 1062859

Currently status code is mapped same as reason code which results
in wrong status code mapping. Fix this by adding appropriate status
code.

Change-Id: I75a66601c33b4e93fcac674415f38d5a8184c8f3
CRs-Fixed: 1062308

Release 3.0.11.52

Change-Id: Ie5d09c89d68dc9257129d8722ff0027ef172c30e
CRs-Fixed: 688141

The csr roam state is moved to joined after connection but on
receiving disconnect the state is not changed.

Fix it by moving csr roam state to idle state after disconnect
done indication

Change-Id: Ic31a2d8a0d68eaf0f4d8c6456344c78d4635f161
CRs-Fixed: 1058611

Fix static code analysis error in WLANTL_updatePERStats API.

Change-Id: I060b5ee77c1e404ef96d8f1837f40889bfcd3b80
CRs-Fixed: 1059876

RSO update is a valid command after RSO restart.
Add changes to allow RSO update after RSO restart.

CRs-Fixed: 1062859
Change-Id: I0922a0338ef7d05ae121b551aa077940b67f18d4

Release 3.0.11.53

Change-Id: I4b3929680672774fb24d90dc43c8b19edd74e49f
CRs-Fixed: 688141

Fix NULL pointer dereference,array bound overflow,
uninitialized accses and Suspicious dereference of pointer.

Change-Id: Ic0d4be5aab4fc6c66e9aff90dc13fd38ddb579b5
CRs-Fixed: 1061646

Release 3.0.11.54

Change-Id: I46af5e45c543218330308b16eb1d52e764968479
CRs-Fixed: 688141

1. In ROC callback wlan_hdd_remain_on_channel_callback(), if ROC timer
is not stopped before freeing the ROC context, trigger kernel panic
by invoking BUG_ON.

2. Also if the ROC context is still valid even before allocating a new
ROC context, trigger the kernel panic.

CRs-Fixed: 1050402
Change-Id: I2eefcdd61fd51dad06970b9547c99ad521a95a71

If driver post dump message to firmware and SSR has also started
in driver, firmware might not send response for dump command.
If firmware response doesn't come in 10 sec, driver issue VOS_BUG.
Fix this issue by not issuing VOS_BUG is SSR is already in progress.

Change-Id: I57fedee170727b011bd2e5daee35095f4fa77b29
CRs-Fixed: 1063426

Error logs in OEM DATA REQ are causing MC thread stuck and
eventually crash.

To fix remove these unnecessary error logs.

Change-Id: I1b4572d8ce92d24601ea1a1cd27e65dd15942b46
CRs-Fixed: 1064513

Release 3.0.11.55

Change-Id: Idb1ea5b91a7b81c89a8c2eba75af3665acf41be9
CRs-Fixed: 688141

This reverts commit Ie429c2299055570a8955f0642fd02cab3fd8d905.

If related Fw changes are not present, updation of cached list
may cause firmware assert, add changes to revert this change.

CRs-Fixed: 1065710
Change-Id: I1d061635f5a08a8f35516cb350185bda10cd5d7f

Add changes to disable PER based roam by default.

CRs-Fixed: 1065710
Change-Id: I89da55f8b5eed2a662acf4b830df5c5263ccd5fb

The "remainInPowerActiveTillDHCP" flag allows cfg80211 layer to
control BMPS and it should not be modified by SME/CSR.

SME/CSR use remainInPowerActiveTillDHCP to block BMPS till set key
is not completed. Due to this cfg80211 layer is not in full
control of BMPS.

To fix this add a new variable to block BMPS until set key is
done and let remainInPowerActiveTillDHCP be be controlled by
cfg80211 layer based on whether DHCP in progress or not.

Change-Id: I48315893a881d8da4db79a8b9366525617e8c898
CRs-Fixed: 1072635

Release 3.0.11.59

Change-Id: I50d341728693ff53ad58aec38875ae9b047ee5e7
CRs-Fixed: 688141

qcacld-2.0 to prima propagation

In case of multiple bssid, PE should prepare probe response
template from ssid string of PE session instead of configuration
string, which may contain other BSS's ssid info.

Add changes to update probe response template from PE session.

Change-Id: I0c593b37264db37a5a7704d339c4863c8222592a
CRs-fixed: 723095

Release 3.0.11.60

Change-Id: I5bc168a08bc094e16c402bdbff052bf0b7fdedf4
CRs-Fixed: 688141

Add gActiveMaxChannelTimeBtcSCO and gActiveMinChannelTimeBtcSCO
params in INI file to control the scan dwell time during BTC SCO
call.

These params will be used when scan is compromised due to SCO call.

Change-Id: Iaf203489ae7984008779e4d32aa2d0ea9a217513
CRs-Fixed: 1073668

Remove frequently seen unnecessary error logs in kmesg from
driver.

Change-Id: I752f46d8dc0480ef14e9cba33033f80b22bc40be
CRs-Fixed: 1072216

Release 3.0.11.61

Change-Id: I4f60eaebaed02af2d9b438cb5e55c26166056ffb
CRs-Fixed: 688141

The mode on files created on the lower fs should
not be affected by the umask of the calling
task's fs_struct. Instead, we create a copy
and modify it as needed. This also lets us avoid
the string shenanigans around .nomedia files.

Bug: 27992761
Change-Id: Ia3a6e56c24c6e19b3b01c1827e46403bb71c2f4c
Signed-off-by: Daniel Rosenberg <drosen@google.com>

This fixes a bug where the first lookup of a
file or folder created under a different view
would not be case insensitive. It will now
search through for a case insensitive match
if the initial lookup fails.

Bug:28024488
Change-Id: I4ff9ce297b9f2f9864b47540e740fd491c545229
Signed-off-by: Daniel Rosenberg <drosen@google.com>

Iterating over d_subdirs requires taking d_lock. Switched
hashmap guard over to a spinlock to use within the loop.
Several places were taking unneeded locks.

Change-Id: I9fdcab279009005bf28536247d11e13babab0b93
Signed-off-by: Daniel Rosenberg <drosen@google.com>

Adding packages to the package list and moving files
takes a large amount of locks, and is currently a
heavy operation. This adds a 'top' field to the
inode_info, which points to the inode for the top
most directory whose owner you would like to match.

On permission checks and get_attr, we look up the
owner based on the information at top. When we change
a package mapping, we need only modify the information
in the corresponding top inode_info's. When renaming,
we must ensure top is set correctly in all children.
This happens when an app specific folder gets moved
outside of the folder for that app.

Change-Id: Ib749c60b568e9a45a46f8ceed985c1338246ec6c
Signed-off-by: Daniel Rosenberg <drosen@google.com>

Unfortunately we record PIDs in audit records using a variety of
methods despite the correct way being the use of task_tgid_nr().
This patch converts all of these callers, except for the case of
AUDIT_SET in audit_receive_msg() (see the comment in the code).

Reported-by: Jeff Vander Stoep <jeffv@google.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

Bug: 28952093

(cherry picked from commit fa2bea2f5cca5b8d4a3e5520d2e8c0ede67ac108)
Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Change-Id: I36508a25c957f5108299e68a3b0f627c94eb27eb

There is a use-after-free problem in the ion driver.
This is caused by a race condition in the ion_ioctl()
function.

A handle has ref count of 1 and two tasks on different
cpus calls ION_IOC_FREE simultaneously.

cpu 0                                   cpu 1
-------------------------------------------------------
ion_handle_get_by_id()
(ref == 2)
                            ion_handle_get_by_id()
                            (ref == 3)

ion_free()
(ref == 2)

ion_handle_put()
(ref == 1)

                            ion_free()
                            (ref == 0 so ion_handle_destroy() is
                            called
                            and the handle is freed.)

                            ion_handle_put() is called and it
                            decreases the slub's next free pointer

The problem is detected as an unaligned access in the
spin lock functions since it uses load exclusive
 instruction. In some cases it corrupts the slub's
free pointer which causes a mis-aligned access to the
next free pointer.(kmalloc returns a pointer like
ffffc0745b4580aa). And it causes lots of other
hard-to-debug problems.

This symptom is caused since the first member in the
ion_handle structure is the reference count and the
ion driver decrements the reference after it has been
freed.

To fix this problem client->lock mutex is extended
to protect all the codes that uses the handle.

Signed-off-by: Eun Taik Lee <eun.taik.lee@samsung.com>
Reviewed-by: Laura Abbott <labbott@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 9590232bb4f4cc824f3425a6e1349afbe6d6d2b7)
bug: 31568617
Change-Id: I4ea2be0cad3305c4e196126a02e2ab7108ef0976

Signed-off-by: Jann Horn <jann@thejh.net>
Reviewed-by: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(cherry picked from commit b7f76ea2ef6739ee484a165ffbac98deb855d3d3)

Test: Builds.
Change-Id: Ic38fff7625569b7743519cf1a68722771dca8d04
Signed-off-by: Jorge Lucangeli Obes <jorgelo@google.com>

(cherry picked from commit 6b7339f4c31ad69c8e9c0b2859276e22cf72176d)

Reading page fault handler code I've noticed that under right
circumstances kernel would map anonymous pages into file mappings: if
the VMA doesn't have vm_ops->fault() and the VMA wasn't fully populated
on ->mmap(), kernel would handle page fault to not populated pte with
do_anonymous_page().

Let's change page fault handler to use do_anonymous_page() only on
anonymous VMA (->vm_ops == NULL) and make sure that the VMA is not
shared.

For file mappings without vm_ops->fault() or shred VMA without vm_ops,
page fault on pte_none() entry would lead to SIGBUS.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Willy Tarreau <w@1wt.eu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Change-Id: I451f90075ddf0c3592543e4fe30eed4c38348d49
Bug: 32460277

Verifying the i2c table index value before accessing
the i2c table to avoid memory corruption issues.
CRs-Fixed: 1065916

Change-Id: I0e31c22f90006f27a77cd420288334b8355cee95
Signed-off-by: Sureshnaidu Laveti <lsuresh@codeaurora.org>
Signed-off-by: Suman Mukherjee <sumam@codeaurora.org>

As read/write get access to ion memory region as well, it's
necessary to lock them when ion memory is about to be added/freed
to avoid racing cases.

CRs-Fixed: 1071809
Change-Id: I436ead23c93384961b38ca99b9312a40c50ad03a
Signed-off-by: Walter Yang <yandongy@codeaurora.org>

for printing kernel pointers which should be hidden from unprivileged
users, use %pK which evaluates whether kptr_restrict is set.

CRs-Fixed: 987021
Change-Id: Ie49eee9478f4657cfb2a994ba60da1ec4c356339
Signed-off-by: Abhijit Kulkarni <kabhijit@codeaurora.org>
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>

Bug: 30400942
Change-Id: I19fa5bf6e5c66b532b842180b2cf0ae04ddca337
Signed-off-by: Daniel Rosenberg <drosen@google.com>

The format specifier %p can leak kernel addresses
while not valuing the kptr_restrict system settings.
Use %pK instead of %p, which also evaluates whether
kptr_restrict is set.

Bug: 31796940
Change-Id: Ia2946d6b493126d68281f97778faf578247f088e
Signed-off-by: Min Chong <mchong@google.com>

The format specifier %p can leak kernel addresses
while not valuing the kptr_restrict system settings.
Use %pK instead of %p, which also evaluates whether
kptr_restrict is set.

Bug: 31802656
Change-Id: I74e83192e0379586469edba3c7579a1cd75cf3c0
Signed-off-by: Min Chong <mchong@google.com>

In ping_common_sendmsg(), when len < icmph_len, memcpy_fromiovec()
will access invalid memory because msg->msg_iov only has 1 element
and memcpy_fromiovec() attempts to increment it. KASAN report:

BUG: KASAN: stack-out-of-bounds in memcpy_fromiovec+0x60/0x114 at addr ffffffc071077da0
Read of size 8 by task trinity-c2/9623
page:ffffffbe034b9a08 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x0()
page dumped because: kasan: bad access detected
CPU: 0 PID: 9623 Comm: trinity-c2 Tainted: G    BU         3.18.0-dirty #15
Hardware name: Google Tegra210 Smaug Rev 1,3+ (DT)
Call trace:
[<ffffffc000209c98>] dump_backtrace+0x0/0x1ac arch/arm64/kernel/traps.c:90
[<ffffffc000209e54>] show_stack+0x10/0x1c arch/arm64/kernel/traps.c:171
[<     inline     >] __dump_stack lib/dump_stack.c:15
[<ffffffc000f18dc4>] dump_stack+0x7c/0xd0 lib/dump_stack.c:50
[<     inline     >] print_address_description mm/kasan/report.c:147
[<     inline     >] kasan_report_error mm/kasan/report.c:236
[<ffffffc000373dcc>] kasan_report+0x380/0x4b8 mm/kasan/report.c:259
[<     inline     >] check_memory_region mm/kasan/kasan.c:264
[<ffffffc00037352c>] __asan_load8+0x20/0x70 mm/kasan/kasan.c:507
[<ffffffc0005b9624>] memcpy_fromiovec+0x5c/0x114 lib/iovec.c:15
[<     inline     >] memcpy_from_msg include/linux/skbuff.h:2667
[<ffffffc000ddeba0>] ping_common_sendmsg+0x50/0x108 net/ipv4/ping.c:674
[<ffffffc000dded30>] ping_v4_sendmsg+0xd8/0x698 net/ipv4/ping.c:714
[<ffffffc000dc91dc>] inet_sendmsg+0xe0/0x12c net/ipv4/af_inet.c:749
[<     inline     >] __sock_sendmsg_nosec net/socket.c:624
[<     inline     >] __sock_sendmsg net/socket.c:632
[<ffffffc000cab61c>] sock_sendmsg+0x124/0x164 net/socket.c:643
[<     inline     >] SYSC_sendto net/socket.c:1797
[<ffffffc000cad270>] SyS_sendto+0x178/0x1d8 net/socket.c:1761
Memory state around the buggy address:
 ffffffc071077c80: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 f1 f1
 ffffffc071077d00: f1 f1 04 f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2
>ffffffc071077d80: f2 f2 00 00 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00
                               ^
 ffffffc071077e00: 00 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
 ffffffc071077e80: 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00

Bug: 31349935
Change-Id: Ib7385fc26dfe7e07e9bab42a10ff65a37cbaab54
Signed-off-by: Siqi Lin <siqilin@google.com>

Verify that unsigned int value will not become negative before cast to
signed int.

Bug: 31651010
Change-Id: I548a200f678762042617f11100b6966a405a3920

A series of characters between '0' and '9' with a length more than
MAX_FIRMWARE_ID_LEN causes a heap buffer overflow. This is
mitigated by performing a bounds check.

Bug: 31911920
Signed-off-by: Min Chong <mchong@google.com>
Change-Id: Iaefe92df2610153f2d3e2caa58322ae82cb5b7c2

Bug: 31495231
Change-Id: Iebc150f6bc939b56e021424ee44fb30ce8d732fd

Bug: 31494725
Change-Id: I10a0c2aae883dfaa6c235c38689a704064557008

When packet_set_ring creates a ring buffer it will initialize a
struct timer_list if the packet version is TPACKET_V3. This value
can then be raced by a different thread calling setsockopt to
set the version to TPACKET_V1 before packet_set_ring has finished.

This leads to a use-after-free on a function pointer in the
struct timer_list when the socket is closed as the previously
initialized timer will not be deleted.

The bug is fixed by taking lock_sock(sk) in packet_setsockopt when
changing the packet version while also taking the lock at the start
of packet_set_ring.

Change-Id: Ia3b0f38f71b568cd4fd7335a42c2c4f0429ab756
Fixes: f6fb8f1 ("af-packet: TPACKET_V3 flexible buffer implementation.")
Signed-off-by: Philip Pettersson <philip.pettersson@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>