Watch
1
Fork
You've already forked kernel_a52xq
0
mirror of https://github.com/a52xq-dev/kernel.git synced 2026-10-18 21:58:11 +07:00
Android kernel source for the Galaxy A52 5G (a52xq)
  • C 98.1%
  • Assembly 1.2%
  • Makefile 0.3%
  • Shell 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Vincent Whitchurch 09ca2d2681 spi: spi-loopback-test: Fix out-of-bounds read
[ Upstream commit 837ba18dfcd4db21ad58107c65bfe89753aa56d7 ]

The "tx/rx-transfer - crossing PAGE_SIZE" test always fails when
len=131071 and rx_offset >= 5:

 spi-loopback-test spi0.0: Running test tx/rx-transfer - crossing PAGE_SIZE
 ...
   with iteration values: len = 131071, tx_off = 0, rx_off = 3
   with iteration values: len = 131071, tx_off = 0, rx_off = 4
   with iteration values: len = 131071, tx_off = 0, rx_off = 5
 loopback strangeness - rx changed outside of allowed range at: ...a4321000
   spi_msg@ffffffd5a4157690
     frame_length:  131071
     actual_length: 131071
     spi_transfer@ffffffd5a41576f8
       len:    131071
       tx_buf: ffffffd5a4340ffc

Note that rx_offset > 3 can only occur if the SPI controller driver sets
->dma_alignment to a higher value than 4, so most SPI controller drivers
are not affect.

The allocated Rx buffer is of size SPI_TEST_MAX_SIZE_PLUS, which is 132
KiB (assuming 4 KiB pages).  This test uses an initial offset into the
rx_buf of PAGE_SIZE - 4, and a len of 131071, so the range expected to
be written in this transfer ends at (4096 - 4) + 5 + 131071 == 132 KiB,
which is also the end of the allocated buffer.  But the code which
verifies the content of the buffer reads a byte beyond the allocated
buffer and spuriously fails because this out-of-bounds read doesn't
return the expected value.

Fix this by using ITERATE_LEN instead of ITERATE_MAX_LEN to avoid
testing sizes which cause out-of-bounds reads.

Signed-off-by: Vincent Whitchurch <vincent.whitchurch@axis.com>
Link: https://lore.kernel.org/r/20200902132341.7079-1-vincent.whitchurch@axis.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-09-23 12:10:58 +02:00
arch ARM: dts: vfxxx: Add syscon compatible with OCOTP 2020-09-17 13:45:30 +02:00
block block: ensure bdi->io_pages is always initialized 2020-09-12 13:40:22 +02:00
certs export.h: remove VMLINUX_SYMBOL() and VMLINUX_SYMBOL_STR() 2018-08-22 23:21:44 +09:00
crypto crypto: af_alg - fix use-after-free in af_alg_accept() due to bh_lock_sock() 2020-07-09 09:37:10 +02:00
Documentation affs: fix basic permission bits to actually work 2020-09-09 19:04:30 +02:00
drivers spi: spi-loopback-test: Fix out-of-bounds read 2020-09-23 12:10:58 +02:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:21:29 +01:00
fs NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall 2020-09-23 12:10:57 +02:00
include irqchip/eznps: Fix build error for !ARC700 builds 2020-09-17 13:45:25 +02:00
init printk: queue wake_up_klogd irq_work only if per-CPU areas are ready 2020-07-22 09:32:13 +02:00
ipc ipc/util.c: sysvipc_find_ipc() incorrectly updates position index 2020-05-20 08:18:40 +02:00
kernel gcov: add support for GCC 10.1 2020-09-17 13:45:31 +02:00
lib test_kmod: avoid potential double free in trigger_config_run_type() 2020-08-21 11:05:38 +02:00
LICENSES LICENSES: Remove CC-BY-SA-4.0 license text 2018-10-18 11:28:50 +02:00
mm mm/hugetlb: fix a race between hugetlb sysctl handlers 2020-09-09 19:04:32 +02:00
net net: handle the return value of pskb_carve_frag_list() correctly 2020-09-23 12:10:57 +02:00
samples samples: bpf: Fix build error 2020-06-03 08:19:31 +02:00
scripts checkpatch: fix the usage of capture group ( ... ) 2020-09-09 19:04:32 +02:00
security Smack: prevent underflow in smk_set_cipso() 2020-08-19 08:14:59 +02:00
sound ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled 2020-09-17 13:45:26 +02:00
tools perf jevents: Fix suspicious code in fixregex() 2020-09-09 19:04:27 +02:00
usr initramfs: restore default compression behavior 2020-04-13 10:44:59 +02:00
virt KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set 2020-08-26 10:31:07 +02:00
.clang-format clang-format: Set IndentWrappedFunctionNames false 2018-08-01 18:38:51 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.get_maintainer.ignore Add hch to .get_maintainer.ignore 2015-08-21 14:30:10 -07:00
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore Kbuild updates for v4.17 (2nd) 2018-04-15 17:21:30 -07:00
.mailmap libnvdimm-for-4.19_misc 2018-08-25 18:13:10 -07:00
COPYING COPYING: use the new text with points to the license files 2018-03-23 12:41:45 -06:00
CREDITS 9p: remove Ron Minnich from MAINTAINERS 2018-08-17 16:20:26 -07:00
Kbuild Kbuild updates for v4.15 2017-11-17 17:45:29 -08:00
Kconfig kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt 2018-08-02 08:06:55 +09:00
MAINTAINERS MAINTAINERS: Update drm/i915 bug filing URL 2020-02-28 16:38:49 +01:00
Makefile Linux 4.19.146 2020-09-17 13:45:31 +02:00
README Docs: Added a pointer to the formatted docs to README 2018-03-21 09:02:53 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.