Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 667b452

Browse files
samueldrsamueldr
committed
Import amazon-austin tree from FireOS 5.3.7.0 (Fire_7_7th_Gen-5.3.7.0-20191211.tar.bz2)
1 parent 7a4de89 commit 667b452

File tree

6 files changed

+107
-14
lines changed

6 files changed

+107
-14
lines changed

‎drivers/media/usb/uvc/uvc_driver.c‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -957,11 +957,19 @@ static int uvc_parse_standard_control(struct uvc_device *dev,
957957
return -EINVAL;
958958
}
959959

960-
/* Make sure the terminal type MSB is not null, otherwise it
961-
* could be confused with a unit.
960+
/*
961+
* Reject invalid terminal types that would cause issues:
962+
*
963+
* - The high byte must be non-zero, otherwise it would be
964+
* confused with a unit.
965+
*
966+
* - Bit 15 must be 0, as we use it internally as a terminal
967+
* direction flag.
968+
*
969+
* Other unknown types are accepted.
962970
*/
963971
type = get_unaligned_le16(&buffer[4]);
964-
if ((type & 0xff00) == 0) {
972+
if ((type & 0x7f00) == 0 || (type & 0x8000) != 0) {
965973
uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol "
966974
"interface %d INPUT_TERMINAL %d has invalid "
967975
"type 0x%04x, skipping\n", udev->devnum,

‎drivers/misc/mediatek/connectivity/conn_soc/common/linux/pub/stp_chrdev_bt.c‎

Lines changed: 49 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
/*
22
* Copyright (C) 2011-2014 MediaTek Inc.
3-
*
4-
* This program is free software: you can redistribute it and/or modify it under the terms of the
3+
*
4+
* This program is free software: you can redistribute it and/or modify it under the terms of the
55
* GNU General Public License version 2 as published by the Free Software Foundation.
6-
*
7-
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
6+
*
7+
* This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY;
88
* without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
99
* See the GNU General Public License for more details.
1010
*
@@ -161,6 +161,8 @@ ssize_t BT_write(struct file *filp, const char __user *buf, size_t count, loff_t
161161
{
162162
int retval = 0;
163163
int written = 0;
164+
int len = 0;
165+
164166
down(&wr_mtx);
165167

166168
BT_DBG_FUNC("%s: count %zd pos %lld\n", __func__, count, *f_pos);
@@ -176,7 +178,7 @@ ssize_t BT_write(struct file *filp, const char __user *buf, size_t count, loff_t
176178
retval = -99;
177179
BT_INFO_FUNC("MT662x reset Write: end\n");
178180
}
179-
goto OUT;
181+
goto OUT;
180182
}
181183

182184
if (count > 0)
@@ -189,6 +191,45 @@ ssize_t BT_write(struct file *filp, const char __user *buf, size_t count, loff_t
189191
}
190192
//printk("%02x ", val);
191193

194+
/* Get length by parsing the frame
195+
For more information of frame format,
196+
please refer the BT spec
197+
*/
198+
switch (o_buf[0]) {
199+
case 0x01:
200+
/* HCI command, type = 0x01
201+
Type(8b) OpCode(16b) length(8b)
202+
Head length = 1 + 2 + 1
203+
*/
204+
len = o_buf[3] + 4;
205+
break;
206+
case 0x02:
207+
/* ACL data, type = 0x02
208+
Type(8b) handle+flag(16b) length(16b)
209+
Head length = 1 + 2 + 2
210+
*/
211+
len = (o_buf[3] | (o_buf[4] << 8)) + 5;
212+
break;
213+
case 0x03:
214+
/* SCO data, type = 0x03
215+
Type(8b) handle+flag(16b) length(8b)
216+
Head length = 1 + 2 + 1
217+
*/
218+
len = o_buf[3] + 4;
219+
break;
220+
default:
221+
BT_ERR_FUNC("type is %d\n", o_buf[0]);
222+
retval = -EFAULT;
223+
goto OUT;
224+
}
225+
226+
/* check frame length is valid */
227+
if (len != copy_size) {
228+
BT_ERR_FUNC("length error %d:%d\n", len, copy_size);
229+
retval = -EFAULT;
230+
goto OUT;
231+
}
232+
192233
written = mtk_wcn_stp_send_data(&o_buf[0], copy_size, BT_TASK_INDX);
193234
if(0 == written)
194235
{
@@ -488,7 +529,7 @@ static void BT_exit(void)
488529
}
489530

490531
#ifdef MTK_WCN_REMOVE_KERNEL_MODULE
491-
532+
492533
int mtk_wcn_stpbt_drv_init(void)
493534
{
494535
return BT_init();
@@ -504,10 +545,10 @@ void mtk_wcn_stpbt_drv_exit (void)
504545
EXPORT_SYMBOL(mtk_wcn_stpbt_drv_init);
505546
EXPORT_SYMBOL(mtk_wcn_stpbt_drv_exit);
506547
#else
507-
548+
508549
module_init(BT_init);
509550
module_exit(BT_exit);
510551

511-
552+
512553
#endif
513554

‎drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/common/wlan_oid.c‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7809,7 +7809,12 @@ wlanoidSetDisassociate (
78097809
prAdapter->fgIsRadioOff = TRUE;
78107810
#endif
78117811

7812-
return WLAN_STATUS_SUCCESS;
7812+
if (g_fgDisconnectByOid == TRUE)
7813+
DBGLOG(OID, WARN, ("Previous Disassociation not complete!\n"));
7814+
else
7815+
g_fgDisconnectByOid = TRUE;
7816+
7817+
return WLAN_STATUS_PENDING;
78137818
} /* wlanoidSetDisassociate */
78147819

78157820

‎drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/include/mgmt/ais_fsm.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,6 +399,7 @@ typedef struct _AIS_FSM_INFO_T {
399399
* P U B L I C D A T A
400400
********************************************************************************
401401
*/
402+
extern BOOLEAN g_fgDisconnectByOid;
402403

403404
/*******************************************************************************
404405
* P R I V A T E D A T A

‎drivers/misc/mediatek/connectivity/conn_soc/drv_wlan/mt_wifi/wlan/mgmt/ais_fsm.c‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -973,6 +973,7 @@
973973
* P U B L I C D A T A
974974
********************************************************************************
975975
*/
976+
BOOLEAN g_fgDisconnectByOid = FALSE;
976977

977978
/*******************************************************************************
978979
* P R I V A T E D A T A
@@ -4030,11 +4031,13 @@ aisFsmDisconnect (
40304031
)
40314032
{
40324033
P_BSS_INFO_T prAisBssInfo;
4034+
P_GLUE_INFO_T prGlueInfo;
40334035

40344036
ASSERT(prAdapter);
40354037

40364038
DBGLOG(INIT, INFO, ("aisFsmDisconnect\n"));
4037-
prAisBssInfo = &(prAdapter->rWifiVar.arBssInfo[NETWORK_TYPE_AIS_INDEX]);
4039+
prGlueInfo = prAdapter->prGlueInfo;
4040+
prAisBssInfo = &(prAdapter->rWifiVar.arBssInfo[NETWORK_TYPE_AIS_INDEX]);
40384041

40394042
nicPmIndicateBssAbort(prAdapter, NETWORK_TYPE_AIS_INDEX);
40404043

@@ -4125,6 +4128,11 @@ aisFsmDisconnect (
41254128
PARAM_MEDIA_STATE_DISCONNECTED,
41264129
fgDelayIndication);
41274130

4131+
if (g_fgDisconnectByOid) {
4132+
g_fgDisconnectByOid = FALSE;
4133+
DBGLOG(INIT, INFO, ("Disconnect by Oid\n"));
4134+
kalOidComplete(prGlueInfo, FALSE, 0, WLAN_STATUS_SUCCESS);
4135+
}
41284136

41294137
//4 <7> Trigger AIS FSM
41304138
aisFsmSteps(prAdapter, AIS_STATE_IDLE);

‎drivers/misc/mediatek/dispsys/mt8127/ddp_cmdq.c‎

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,30 @@ static int disp_unlock_mutex(int id)
9898
return 0;
9999
}
100100

101+
static long cmdq_verify_command(struct cmdqCommandStruct *command)
102+
{
103+
#define CMDQ_INST_SIZE (2 * sizeof(uint32_t)) /* instruction is 64-bit */
104+
#define CMDQ_MAX_COMMAND_SIZE (0x10000)
105+
/*
106+
* block size must grate than 0
107+
* block size must less than 64k
108+
* each cmdq instruction is 64bit,
109+
* block size must be multiple of 8
110+
*/
111+
if (command->blockSize < (2 * CMDQ_INST_SIZE)
112+
|| (command->blockSize > CMDQ_MAX_COMMAND_SIZE)
113+
|| (command->blockSize % 8 != 0)
114+
) {
115+
/* for userspace command: must ends with EOC+JMP. */
116+
CMDQ_ERR("Command block size invalid! size:%d\n",
117+
command->blockSize);
118+
return -EFAULT;
119+
}
120+
121+
return 0;
122+
}
123+
124+
101125
static long cmdq_proc_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
102126
{
103127
cmdqCommandStruct command = {0};
@@ -130,6 +154,9 @@ static long cmdq_proc_unlocked_ioctl(struct file *file, unsigned int cmd, unsign
130154
command.secData.addrList = NULL;
131155
command.secData.portList = NULL;
132156

157+
if (cmdq_verify_command(&command) != 0)
158+
return -EINVAL;
159+
133160
if (cmdqSubmitTask(&command))
134161
{
135162
CMDQ_ERR("DISP_IOCTL_EXEC_COMMAND: Execute commands failed\n");
@@ -154,7 +181,10 @@ static long cmdq_proc_unlocked_ioctl(struct file *file, unsigned int cmd, unsign
154181
command.secData.portListLength = csParams.metadata.portListLength;
155182
command.secData.addrList = csParams.metadata.addrList;
156183
command.secData.portList = csParams.metadata.portList;
157-
184+
185+
if (cmdq_verify_command(&command) != 0)
186+
return -EINVAL;
187+
158188
if (cmdqSubmitTask(&command))
159189
{
160190
CMDQ_ERR("DISP_IOCTL_EXEC_COMMAND_SECURE: Execute commands failed\n");

0 commit comments

Comments
 (0)