Security patches for OnePlus 3 Kernel (Marshmallow)

arch/arm64/kernel/setup.c

@@ -353,9 +353,10 @@ static void __init setup_machine_fdt(phys_addr_t dt_phys)
 	}
 
 	machine_name = of_flat_dt_get_machine_name();
-	dump_stack_set_arch_desc("%s (DT)", machine_name);
-	if (machine_name)
+	if (machine_name) {
+		dump_stack_set_arch_desc("%s (DT)", machine_name);
 		pr_info("Machine: %s\n", machine_name);
+	}
 }
 
 /*

arch/arm64/kernel/sys.c

@@ -50,7 +50,7 @@ asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
  * The sys_call_table array must be 4K aligned to be accessible from
  * kernel/entry.S.
  */
-void *sys_call_table[__NR_syscalls] __aligned(4096) = {
+void * const sys_call_table[__NR_syscalls] __aligned(4096) = {
 	[0 ... __NR_syscalls - 1] = sys_ni_syscall,
 #include <asm/unistd.h>
 };

arch/arm64/kernel/vdso/vdso.S

@@ -21,9 +21,8 @@
 #include <linux/const.h>
 #include <asm/page.h>
 
-	__PAGE_ALIGNED_DATA
-
 	.globl vdso_start, vdso_end
+	.section .rodata
 	.balign PAGE_SIZE
 vdso_start:
 	.incbin "arch/arm64/kernel/vdso/vdso.so"

block/blk-mq.c

@@ -1127,9 +1127,9 @@ static struct request *blk_mq_map_request(struct request_queue *q,
 		hctx = alloc_data.hctx;
 	}
 
-	hctx->queued++;
-	data->hctx = hctx;
-	data->ctx = ctx;
+	data->hctx = alloc_data.hctx;
+	data->ctx = alloc_data.ctx;
+	data->hctx->queued++;
 	return rq;
 }
 

drivers/base/regmap/regmap-swr.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2015-2016, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -68,10 +68,10 @@ static int regmap_swr_raw_multi_reg_write(void *context, const void *data,
 	struct device *dev = context;
 	struct swr_device *swr = to_swr_device(dev);
 	struct regmap *map = dev_get_regmap(dev, NULL);
-	size_t addr_bytes = map->format.reg_bytes;
-	size_t val_bytes = map->format.val_bytes;
-	size_t pad_bytes = map->format.pad_bytes;
-	size_t num_regs = (count / (addr_bytes + val_bytes + pad_bytes));
+	size_t addr_bytes;
+	size_t val_bytes;
+	size_t pad_bytes;
+	size_t num_regs;
 	int i = 0;
 	int ret = 0;
 	u16 *reg;
@@ -83,6 +83,21 @@ static int regmap_swr_raw_multi_reg_write(void *context, const void *data,
 		return -EINVAL;
 	}
 
+	if (map == NULL) {
+		dev_err(dev, "%s: regmap is NULL\n", __func__);
+		return -EINVAL;
+	}
+
+	addr_bytes = map->format.reg_bytes;
+	val_bytes = map->format.val_bytes;
+	pad_bytes = map->format.pad_bytes;
+
+	if (addr_bytes + val_bytes + pad_bytes == 0) {
+		dev_err(dev, "%s: sum of addr, value and pad is 0\n", __func__);
+		return -EINVAL;
+	}
+	num_regs = count / (addr_bytes + val_bytes + pad_bytes);
+
 	reg = kcalloc(num_regs, sizeof(u16), GFP_KERNEL);
 	if (!reg)
 		return -ENOMEM;

drivers/bluetooth/hci_h4.c

@@ -60,7 +60,7 @@ static int h4_open(struct hci_uart *hu)
 {
 	struct h4_struct *h4;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	h4 = kzalloc(sizeof(*h4), GFP_KERNEL);
 	if (!h4)
@@ -77,7 +77,7 @@ static int h4_flush(struct hci_uart *hu)
 {
 	struct h4_struct *h4 = hu->priv;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	skb_queue_purge(&h4->txq);
 
@@ -91,7 +91,7 @@ static int h4_close(struct hci_uart *hu)
 
 	hu->priv = NULL;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	skb_queue_purge(&h4->txq);
 
@@ -108,7 +108,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 {
 	struct h4_struct *h4 = hu->priv;
 
-	BT_DBG("hu %p skb %p", hu, skb);
+	BT_DBG("hu %pK skb %pK", hu, skb);
 
 	/* Prepend skb with frame type */
 	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);

drivers/bluetooth/hci_ibs.c

@@ -226,7 +226,7 @@ static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu)
 	struct ibs_struct *ibs = hu->priv;
 	struct hci_ibs_cmd *hci_ibs_packet;
 
-	BT_DBG("hu %p cmd 0x%x", hu, cmd);
+	BT_DBG("hu %pK cmd 0x%x", hu, cmd);
 
 	/* allocate packet */
 	skb = bt_skb_alloc(1, GFP_ATOMIC);
@@ -254,7 +254,7 @@ static void ibs_wq_awake_device(struct work_struct *work)
 	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;
 	unsigned long flags;
 
-	BT_DBG(" %p ", hu);
+	BT_DBG(" %pK ", hu);
 
 	/* Vote for serial clock */
 	ibs_msm_serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
@@ -281,7 +281,7 @@ static void ibs_wq_awake_rx(struct work_struct *work)
 	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;
 	unsigned long flags;
 
-	BT_DBG(" %p ", hu);
+	BT_DBG(" %pK ", hu);
 
 	ibs_msm_serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
 
@@ -309,7 +309,7 @@ static void ibs_wq_serial_rx_clock_vote_off(struct work_struct *work)
 					ws_rx_vote_off);
 	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;
 
-	BT_DBG(" %p ", hu);
+	BT_DBG(" %pK ", hu);
 
 	ibs_msm_serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
 
@@ -321,7 +321,7 @@ static void ibs_wq_serial_tx_clock_vote_off(struct work_struct *work)
 					ws_tx_vote_off);
 	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;
 
-	BT_DBG(" %p ", hu);
+	BT_DBG(" %pK ", hu);
 
 	hci_uart_tx_wakeup(hu);  /* run HCI tx handling unlocked */
 
@@ -337,7 +337,7 @@ static void hci_ibs_tx_idle_timeout(unsigned long arg)
 	struct ibs_struct *ibs = hu->priv;
 	unsigned long flags;
 
-	BT_DBG("hu %p idle timeout in %lu state", hu, ibs->tx_ibs_state);
+	BT_DBG("hu %pK idle timeout in %lu state", hu, ibs->tx_ibs_state);
 
 	spin_lock_irqsave_nested(&ibs->hci_ibs_lock,
 					flags, SINGLE_DEPTH_NESTING);
@@ -371,7 +371,7 @@ static void hci_ibs_wake_retrans_timeout(unsigned long arg)
 	unsigned long flags;
 	unsigned long retransmit = 0;
 
-	BT_DBG("hu %p wake retransmit timeout in %lu state",
+	BT_DBG("hu %pK wake retransmit timeout in %lu state",
 		hu, ibs->tx_ibs_state);
 
 	spin_lock_irqsave_nested(&ibs->hci_ibs_lock,
@@ -404,7 +404,7 @@ static int ibs_open(struct hci_uart *hu)
 {
 	struct ibs_struct *ibs;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	ibs = kzalloc(sizeof(*ibs), GFP_ATOMIC);
 	if (!ibs)
@@ -500,7 +500,7 @@ static int ibs_flush(struct hci_uart *hu)
 {
 	struct ibs_struct *ibs = hu->priv;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	skb_queue_purge(&ibs->tx_wait_q);
 	skb_queue_purge(&ibs->txq);
@@ -513,7 +513,7 @@ static int ibs_close(struct hci_uart *hu)
 {
 	struct ibs_struct *ibs = hu->priv;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	skb_queue_purge(&ibs->tx_wait_q);
 	skb_queue_purge(&ibs->txq);
@@ -542,7 +542,7 @@ static void ibs_device_want_to_wakeup(struct hci_uart *hu)
 	unsigned long flags;
 	struct ibs_struct *ibs = hu->priv;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	/* lock hci_ibs state */
 	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -591,7 +591,7 @@ static void ibs_device_want_to_sleep(struct hci_uart *hu)
 	unsigned long flags;
 	struct ibs_struct *ibs = hu->priv;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	/* lock hci_ibs state */
 	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -627,7 +627,7 @@ static void ibs_device_woke_up(struct hci_uart *hu)
 	struct ibs_struct *ibs = hu->priv;
 	struct sk_buff *skb = NULL;
 
-	BT_DBG("hu %p", hu);
+	BT_DBG("hu %pK", hu);
 
 	/* lock hci_ibs state */
 	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -672,7 +672,7 @@ static int ibs_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 	unsigned long flags = 0;
 	struct ibs_struct *ibs = hu->priv;
 
-	BT_DBG("hu %p skb %p", hu, skb);
+	BT_DBG("hu %pK skb %pK", hu, skb);
 
 	/* Prepend skb with frame type */
 	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
@@ -752,7 +752,7 @@ static int ibs_recv(struct hci_uart *hu, void *data, int count)
 	struct hci_sco_hdr   *sh;
 	register int len, type, dlen;
 
-	BT_DBG("hu %p count %d rx_state %ld rx_count %ld",
+	BT_DBG("hu %pK count %d rx_state %ld rx_count %ld",
 			hu, count, ibs->rx_state, ibs->rx_count);
 
 	ptr = data;

drivers/bluetooth/hci_ldisc.c

@@ -154,7 +154,7 @@ static void hci_uart_write_work(struct work_struct *work)
 	struct hci_dev *hdev = hu->hdev;
 	struct sk_buff *skb;
 
-	BT_DBG("hu %p hdev %p tty %p", hu, hdev, tty);
+	BT_DBG("hu %pK hdev %pK tty %pK", hu, hdev, tty);
 
 	/* REVISIT: should we cope with bad skbs or ->write() returning
 	 * and error value ?
@@ -219,7 +219,7 @@ int hci_uart_init_ready(struct hci_uart *hu)
 /* Initialize device */
 static int hci_uart_open(struct hci_dev *hdev)
 {
-	BT_DBG("%s %p", hdev->name, hdev);
+	BT_DBG("%s %pK", hdev->name, hdev);
 
 	/* Nothing to do for UART driver */
 
@@ -234,7 +234,7 @@ static int hci_uart_flush(struct hci_dev *hdev)
 	struct hci_uart *hu  = hci_get_drvdata(hdev);
 	struct tty_struct *tty = hu->tty;
 
-	BT_DBG("hdev %p tty %p", hdev, tty);
+	BT_DBG("hdev %pK tty %pK", hdev, tty);
 
 	if (hu->tx_skb) {
 		kfree_skb(hu->tx_skb); hu->tx_skb = NULL;
@@ -253,7 +253,7 @@ static int hci_uart_flush(struct hci_dev *hdev)
 /* Close device */
 static int hci_uart_close(struct hci_dev *hdev)
 {
-	BT_DBG("hdev %p", hdev);
+	BT_DBG("hdev %pK", hdev);
 
 	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
 		return 0;
@@ -294,7 +294,7 @@ static int hci_uart_tty_open(struct tty_struct *tty)
 {
 	struct hci_uart *hu;
 
-	BT_DBG("tty %p", tty);
+	BT_DBG("tty %pK", tty);
 
 	/* Error if the tty has no write op instead of leaving an exploitable
 	   hole */
@@ -339,7 +339,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
 	struct hci_uart *hu = (void *)tty->disc_data;
 	struct hci_dev *hdev;
 
-	BT_DBG("tty %p", tty);
+	BT_DBG("tty %pK", tty);
 
 	/* Detach from the tty */
 	tty->disc_data = NULL;

drivers/char/adsprpc.c

@@ -2051,9 +2051,15 @@ static int fastrpc_cb_legacy_probe(struct device *dev)
 			&disable_htw);
 	VERIFY(err, !arm_iommu_attach_device(first_sess->dev,
 					first_sess->smmu.mapping));
+	if (err)
+		goto bail;
+	VERIFY(err, (sids_size/sizeof(unsigned int)) <= NUM_SESSIONS);
 	if (err)
 		goto bail;
 	for (i = 0; i < sids_size/sizeof(unsigned int); i++) {
+		VERIFY(err, chan->sesscount < NUM_SESSIONS);
+		if (err)
+			goto bail;
 		sess = &chan->session[chan->sesscount];
 		sess->smmu.cb = sids[i];
 		sess->dev = first_sess->dev;