Merge android13-gs-pixel-5.10-24Q2 into android13-gs-pixel-5.10

SBMerger: 605678113
Change-Id: Ief2225f44d779cd4ffcb3cc8e0cc8e95b90ed125
Signed-off-by: SecurityBot <android-nexus-securitybot@system.gserviceaccount.com>

3 files changed, 19 insertions, 11 deletions

diff --git a/lwis_device.c b/lwis_device.c
index 84815d8..6176184 100644
--- a/lwis_device.c
+++ b/lwis_device.c
@@ -1128,8 +1128,6 @@ int lwis_dev_power_up_locked(struct lwis_device *lwis_dev)
 		}
 	}
 
-	/* Sleeping to make sure all pins are ready to go */
-	usleep_range(2000, 2000);
 	return 0;
 
 	/* Error handling */
diff --git a/lwis_ioctl.c b/lwis_ioctl.c
index cf32a89..0acc115 100644
--- a/lwis_ioctl.c
+++ b/lwis_ioctl.c
@@ -476,7 +476,6 @@ static int cmd_device_enable(struct lwis_client *lwis_client, struct lwis_cmd_pk
 	lwis_dev->enabled++;
 	lwis_client->is_enabled = true;
 	lwis_dev->is_suspended = false;
-	dev_info(lwis_dev->dev, "Device enabled\n");
 exit_locked:
 	mutex_unlock(&lwis_dev->client_lock);
 	header->ret_code = ret;
diff --git a/lwis_periodic_io.c b/lwis_periodic_io.c
index cac5f57..36af3e0 100644
--- a/lwis_periodic_io.c
+++ b/lwis_periodic_io.c
@@ -71,8 +71,8 @@ static enum hrtimer_restart periodic_io_timer_func(struct hrtimer *timer)
 	return HRTIMER_RESTART;
 }
 
-static struct lwis_periodic_io_list *periodic_io_list_find(struct lwis_client *client,
-							   int64_t period_ns)
+static struct lwis_periodic_io_list *periodic_io_list_find_locked(struct lwis_client *client,
+								  int64_t period_ns)
 {
 	struct lwis_periodic_io_list *list;
 	hash_for_each_possible (client->timer_list, list, node, period_ns) {
@@ -119,7 +119,7 @@ static struct lwis_periodic_io_list *periodic_io_list_create_locked(struct lwis_
 static struct lwis_periodic_io_list *
 periodic_io_list_find_or_create_locked(struct lwis_client *client, int64_t period_ns)
 {
-	struct lwis_periodic_io_list *list = periodic_io_list_find(client, period_ns);
+	struct lwis_periodic_io_list *list = periodic_io_list_find_locked(client, period_ns);
 
 	if (list == NULL) {
 		return periodic_io_list_create_locked(client, period_ns);
@@ -189,10 +189,13 @@ static int process_io_entries(struct lwis_client *client,
 		/* Abort if periodic io is deactivated during processing.
 		 * Abort can only apply to <= 1 write entries to prevent partial writes,
 		 * or we just started the process. */
+		spin_lock_irqsave(&client->periodic_io_lock, flags);
 		if (!periodic_io->active && (i == 0 || !periodic_io->contains_multiple_writes)) {
 			resp->error_code = -ECANCELED;
+			spin_unlock_irqrestore(&client->periodic_io_lock, flags);
 			goto event_push;
 		}
+		spin_unlock_irqrestore(&client->periodic_io_lock, flags);
 		entry = &info->io_entries[i];
 		if (entry->type == LWIS_IO_ENTRY_WRITE ||
 		    entry->type == LWIS_IO_ENTRY_WRITE_BATCH ||
@@ -385,9 +388,17 @@ static int prepare_response(struct lwis_client *client, struct lwis_periodic_io
 	for (i = 0; i < info->num_io_entries; ++i) {
 		struct lwis_io_entry *entry = &info->io_entries[i];
 		if (entry->type == LWIS_IO_ENTRY_READ) {
+			/* Check for size_t overflow. */
+			if (read_buf_size + reg_value_bytewidth < read_buf_size) {
+				return -EOVERFLOW;
+			}
 			read_buf_size += reg_value_bytewidth;
 			read_entries++;
 		} else if (entry->type == LWIS_IO_ENTRY_READ_BATCH) {
+			/* Check for size_t overflow when adding user defined size_in_bytes. */
+			if (read_buf_size + entry->rw_batch.size_in_bytes < read_buf_size) {
+				return -EOVERFLOW;
+			}
 			read_buf_size += entry->rw_batch.size_in_bytes;
 			read_entries++;
 		}
@@ -496,8 +507,8 @@ int lwis_periodic_io_submit(struct lwis_client *client, struct lwis_periodic_io
 	/* Initialize but mark io as complete as it is not run yet  */
 	init_completion(&periodic_io->io_done);
 	complete(&periodic_io->io_done);
-	periodic_io->active = true;
 	spin_lock_irqsave(&client->periodic_io_lock, flags);
+	periodic_io->active = true;
 	ret = queue_periodic_io_locked(client, periodic_io);
 	spin_unlock_irqrestore(&client->periodic_io_lock, flags);
 	return ret;
@@ -516,23 +527,23 @@ int lwis_periodic_io_client_flush(struct lwis_client *client)
 	struct lwis_periodic_io_proxy *periodic_cleanup_io_proxy;
 	struct list_head *it_cleanup_period, *it_cleanup_period_tmp;
 
+	spin_lock_irqsave(&client->periodic_io_lock, flags);
 	/* First, cancel all timers */
 	hash_for_each_safe (client->timer_list, i, tmp, it_periodic_io_list, node) {
-		spin_lock_irqsave(&client->periodic_io_lock, flags);
 		list_for_each_safe (it_period, it_period_tmp, &it_periodic_io_list->list) {
 			periodic_io =
 				list_entry(it_period, struct lwis_periodic_io, timer_list_node);
 			periodic_io->active = false;
 		}
-		spin_unlock_irqrestore(&client->periodic_io_lock, flags);
 		it_periodic_io_list->hr_timer_state = LWIS_HRTIMER_INACTIVE;
 		hrtimer_cancel(&it_periodic_io_list->hr_timer);
 	}
+	spin_unlock_irqrestore(&client->periodic_io_lock, flags);
 
 	/* Wait until all workload in process queue are processed */
 	lwis_flush_device_worker(client);
-	spin_lock_irqsave(&client->periodic_io_lock, flags);
 
+	spin_lock_irqsave(&client->periodic_io_lock, flags);
 	/* Cleanup any stale entries remaining after the flush */
 	list_for_each_safe (it_cleanup_period, it_cleanup_period_tmp,
 			    &client->periodic_io_process_queue) {
@@ -557,8 +568,8 @@ int lwis_periodic_io_client_flush(struct lwis_client *client)
 			lwis_periodic_io_free(client->lwis_dev, periodic_io);
 		}
 	}
-
 	spin_unlock_irqrestore(&client->periodic_io_lock, flags);
+
 	return 0;
 }