summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2016-06-22fix infoleak in rtnetlinkandroid-6.0.1_r0.110android-mediatek-sprout-3.10-marshmallow-mr2kangjie
the stack object “map” has a total size of 32 bytes. Its last 4 bytes are padding generated by compiler. These padding bytes are not initialized and sent out via “nla_put” Bug: 28620102 Change-Id: I13da380c6fe8abca49e3cf9f05293c02b44d2e5e Signed-off-by: kangjie <kangjielu@gmail.com>
2016-06-22USB: usbfs: fix potential infoleak in devioKangjie Lu
The stack object “ci” has a total size of 8 bytes. Its last 3 bytes are padding bytes which are not initialized and leaked to userland via “copy_to_user”. Bug: 28619695 Change-Id: I170754d659d0891c075f85211b5e3970b114f097 Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2016-06-22UPSTREAM: ALSA: timer: Fix race among timer ioctlsTakashi Iwai
ALSA timer ioctls have an open race and this may lead to a use-after-free of timer instance object. A simplistic fix is to make each ioctl exclusive. We have already tread_sem for controlling the tread, and extend this as a global mutex to be applied to each ioctl. The downside is, of course, the worse concurrency. But these ioctls aren't to be parallel accessible, in anyway, so it should be fine to serialize there. Bug: 28694392 Change-Id: I1ac52f1cba5e7408fd88c8fc1c30ca2e83967ebb Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit af368027a49a751d6ff4ee9e3f9961f35bb4fede)
2016-06-22UPSTREAM: usbnet: cleanup after bind() in probe()Oliver Neukum
Bug: 28744625 In case bind() works, but a later error forces bailing in probe() in error cases work and a timer may be scheduled. They must be killed. This fixes an error case related to the double free reported in http://www.spinics.net/lists/netdev/msg367669.html and needs to go on top of Linus' fix to cdc-ncm. (cherry picked from commit 1666984c8625b3db19a9abc298931d35ab7bc64b) Change-Id: Idc0313b666a1c149991d315da5529300f405585f Signed-off-by: Oliver Neukum <ONeukum@suse.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Yueyao (Nathan) Zhu <yueyao@google.com>
2016-06-22net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfromAl Viro
Bug: 28759139 Change-Id: I561a14b514d714838ef539a94275b117d7f475f4 Cc: stable@vger.kernel.org # v3.19 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: David S. Miller <davem@davemloft.net>
2016-06-22UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_tinterruptKangjie Lu
The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Bug: 28980217 Change-Id: I2bef279bbaa1f20ea831d364b3a4a09a27f07025 Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit e4ec8cc8039a7063e24204299b462bd1383184a5)
2016-06-22UPSTREAM: ALSA: timer: Fix leak in events via snd_timer_user_ccallbackKangjie Lu
The stack object “r1” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Bug: 28980217 Change-Id: Iff69ca708e0022ce9301efae798798b9bfcf9e25 Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit 9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6)
2016-06-22UPSTREAM: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMSKangjie Lu
The stack object “tread” has a total size of 32 bytes. Its field “event” and “val” both contain 4 bytes padding. These 8 bytes padding bytes are sent to user without being initialized. Signed-off-by: Kangjie Lu <kjlu@gatech.edu> Signed-off-by: Takashi Iwai <tiwai@suse.de> Signed-off-by: Siqi Lin <siqilin@google.com> (cherry picked from commit cec8f96e49d9be372fdb0c3836dcf31ec71e457e) Bug: 28980557 Change-Id: Ib66cfcc1e36025255d7f518f3df2c39a21858886
2016-06-17Fix "Security Vulnerability - Kernel info leak vuln of mtk wifi driver" issueyang-cy.chen
Problem: user input parameter without validation Solution: add boundary check MTK internal tracking ID:ALPS02751738 Bug num:29141147 Change-Id: I5880fadfeed65365ec98fb3b377f95c25f12a05e Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 9aec39a79a8c29f6694d91479d539580a98693d3)
2016-06-08Don't show empty tag stats for unprivileged uidsandroid-6.0.1_r0.100Mohamad Ayyash
BUG: 27577101 BUG: 27532522 Change-Id: I890831a72e5ad4485fdf30e51a146712b18052ed Signed-off-by: Mohamad Ayyash <mkayyash@google.com
2016-05-23Fix "Security Vulnerability - kernel info leak ddp_drv.c" issueyang-cy.chen
Problem: user input parameter without validation Solution: Remove legacy code to prevent buffer overflow Bug num:28402240 Change-Id: I0772591b083cfcae83143d15143e77bf8e5e899e Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit a8a18e931e3772d1bef10ec0b4611aa25831f0c0)
2016-05-23Fix "Security Vulnerability - arbitrary address write ddp_drv.c" issueyang-cy.chen
Problem: user input parameter without validation Solution: Remove legacy code to prevent buffer overflow Bug num:28402341 Change-Id: I87a008dbf734c583685577ab9f38bbad0fd49c50 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 76884c3948a5896c7d724a6852e9f8d1403fa9d0)
2016-05-19Fix "buffer overflow in Mediatek HWMON driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter Solution: Add boundary protection to prevent buffer overflow Bug num:28174490 Change-Id: Ib2b26a31dc22fbccb01c52ea30ab3d70ada2f09c Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 33370592f9b9c50be21d375229b2710904de928a)
2016-05-19Fix "Buffer overflow in Mediatek WIFI driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter Solution: Add boundary protection to prevent buffer overflow Bug num:28175522 Change-Id: Id3cdc5b073e88d5e31884e58026d51848852f9db Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit f341365df14fc82fc778b64f954d572bc1590694)
2016-05-19Fix "Reading /proc Entries Causes Linux Kernel Crashes, Infoleak, and ↵yang-cy.chen
Possible LPE" issue Problem: The declaration of the function of drivers is not compatible the (*read)() function type declared in kernel header Solution: 1.Remove unused code of mtkfb_size,emifreq_debug,emifreq_state 2.Change to use correct type of read function for isp_reg,camio_reg,sysram,sysram_flag Bug num:28346752: Change-Id: If54b8d7054edaf681e7093531ccd92c3280e24eb Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-05-16Fix "arbitrary write-zero in mtkfb_ioctl() of Mediatek driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter to cause arbitrary write-zero. Solution: remove unused code from driver Bug num:28175025,28175027 Change-Id: Ie78f1ebb204ccb12696529c7350152e069ead728 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit c811910368f393068b343ebdcb6d515dc33cd710)
2016-05-12Fix "stack overflow in Mediatek WIFI driver" issueyang-cy.chen
Problem: Lack of boundary check of user input parameter before copy_from_user. Solution: Remove defect code by deleting unused code to prevent security concern Bug num:28169363 Change-Id: I7ca5b660537d0982f0daea7ee5f122b0beb7b0a7 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-05-11Fix "arbitrary read vulnerability in vcodec_unlocked_ioctl() of Mediatek ↵yang-cy.chen
driver" issue Problem: lack of boundary check of user input parameter before get_cpu_load(). Solution: remove defect code since not using in this platform Bug num:28174833 Change-Id: I052a2330daa041349a808dc7fcd8c4835c8a9616 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-05-11Fix "stack overflow in Mediatek Thermal driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter before copy_from_user. Solution: Add boundary protection to prevent buffer overflow Bug num:28332766 Change-Id: If2c38689078e7e3e0666fc2cf6d672b0e39d877c Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-05-11Fix "stack overflow in Mediatek Thermal driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter before copy_from_user. Solution: Add boundary protection to prevent buffer overflow Bug num:28333002 Change-Id: I8364a6cbf69527d4b2f2fa7874c8c01720febd5d Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-05-11Fix "buffer overflow in mt3326_gps_write() of Mediatek driver" issueyang-cy.chen
Problem: lack of boundary check of user input parameter before copy_from_user. Solution: Add boundary protection to prevent buffer overflow Bug num:28174914 Change-Id: Ieb439cba0ed9c9304b14a319515472eb09dc17dd Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-04-25Fix "[Security Vulnerability] Battery:potential buffer overflow" issueyang-cy.chen
Problem: potential buffer overflow through copy_from_user. Solution: Explicitly copy one byte since only need one byte data. Bug num:28085222 Change-Id: I097d433f70267ddbaad1b08dfbdd9505467d300c Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 78aae38e1ec91b758317450c308a4cfd31bda3d3)
2016-04-20Fix "[Security Vulnerability] Thermal:potential buffer overflow" issueandroid-6.0.1_r0.86yang-cy.chen
Problem: lack of boundary check of user input parameter before copy_from_user. Solution: Add boundary protection to prevent buffer overflow Bug num:28085410 Change-Id: I178730c373ed3eab3e197b10362c987df659e4c3 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit e2c408685e93f73ca16b9d5bc23a186f258a1617)
2016-03-24pipe: iovec: Fix OOB read in pipe_read()android-6.0.1_r0.75Jeff Vander Stoep
Previous upstream *stable* fix 14f81062 was incomplete. A local process can trigger a system crash with an OOB read on buf. This occurs when the state of buf gets out of sync. After an error in pipe_iov_copy_to_user() read_pipe may exit having updated buf->offset but not buf->len. Upon retrying pipe_read() while in pipe_iov_copy_to_user() *remaining will be larger than the space left after buf->offset e.g. *remaing = PAGE_SIZE, buf->len = PAGE_SIZE, buf->offset = 0x300. This is fixed by not updating the state of buf->offset until after the full copy is completed, similar to how pipe_write() is implemented. For stable kernels < 3.16. Bug: 27721803 Change-Id: Iefffbcc6cfd159dba69c31bcd98c6d5c1f21ff2e Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
2016-03-23UPSTREAM: ALSA: timer: Harden slave timer list handlingTakashi Iwai
A slave timer instance might be still accessible in a racy way while operating the master instance as it lacks of locking. Since the master operation is mostly protected with timer->lock, we should cope with it while changing the slave instance, too. Also, some linked lists (active_list and ack_list) of slave instances aren't unlinked immediately at stopping or closing, and this may lead to unexpected accesses. This patch tries to address these issues. It adds spin lock of timer->lock (either from master or slave, which is equivalent) in a few places. For avoiding a deadlock, we ensure that the global slave_active_lock is always locked at first before each timer lock. Also, ack and active_list of slave instances are properly unlinked at snd_timer_stop() and snd_timer_close(). Last but not least, remove the superfluous call of _snd_timer_stop() at removing slave links. This is a noop, and calling it may confuse readers wrt locking. Further cleanup will follow in a later patch. Actually we've got reports of use-after-free by syzkaller fuzzer, and this hopefully fixes these issues. Reported-by: Dmitry Vyukov <dvyukov@google.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> (cherry picked from commit b5a663aa426f4884c71cd8580adae73f33570f0d) Signed-off-by: Ben Zhang <benzh@chromium.org> BUG=b:26636060 TEST=Build and boot Ryu Change-Id: I02ec39c7a51d8b2b7948af899811d1bcd4ba8c02 Reviewed-on: https://chromium-review.googlesource.com/329044 Commit-Ready: Ben Zhang <benzh@chromium.org> Tested-by: Ben Zhang <benzh@chromium.org> Reviewed-by: Andrew Bresticker <abrestic@chromium.org>
2016-03-22Security vulnerability in Mediatek Wifi driveryang-cy.chen
Problem: Security vulnerability of directly using user space pointer in kernel space Solution: Using copy_from_user and boundary protection to prevent such issue in kernel Bug num:27677942 Change-Id: I410171377fda5b841523d4b5a35d53baee2d35ab Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-03-22Security vulnerability in Mediatek WIFI driveryang-cy.chen
Problem: No boundary protection of the copy length when call copy_from_user() Solution: add boundary check to prevent buffer overflow Bug num:27549705 Change-Id: I31fc82c3328d017ca9d7c6232a9699538ff3a398 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2016-03-17pipe: iovec: Fix memory corruption when retrying atomic copy as non-atomicandroid-6.0.1_r0.56Ben Hutchings
pipe_iov_copy_{from,to}_user() may be tried twice with the same iovec, the first time atomically and the second time not. The second attempt needs to continue from the iovec position, pipe buffer offset and remaining length where the first attempt failed, but currently the pipe buffer offset and remaining length are reset. This will corrupt the piped data (possibly also leading to an information leak between processes) and may also corrupt kernel memory. This was fixed upstream by commits f0d1bec9d58d ("new helper: copy_page_from_iter()") and 637b58c2887e ("switch pipe_read() to copy_page_to_iter()"), but those aren't suitable for stable. This fix for older kernel versions was made by Seth Jennings for RHEL and I have extracted it from their update. CVE-2015-1805 Bug: 27275324 Change-Id: I459adb9076fcd50ff1f1c557089c4e421b036ec4 References: https://bugzilla.redhat.com/show_bug.cgi?id=1202855 Signed-off-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 85c34d007116f8a8aafb173966a605fb03532f45)
2016-02-26UPSTREAM: include/linux/poison.h: fix LIST_POISON{1,2} offsetandroid-6.0.1_r0.36Vasily Kulikov
(cherry pick from commit 8a5e5e02fc83aaf67053ab53b359af08c6c49aaf) Poison pointer values should be small enough to find a room in non-mmap'able/hardly-mmap'able space. E.g. on x86 "poison pointer space" is located starting from 0x0. Given unprivileged users cannot mmap anything below mmap_min_addr, it should be safe to use poison pointers lower than mmap_min_addr. The current poison pointer values of LIST_POISON{1,2} might be too big for mmap_min_addr values equal or less than 1 MB (common case, e.g. Ubuntu uses only 0x10000). There is little point to use such a big value given the "poison pointer space" below 1 MB is not yet exhausted. Changing it to a smaller value solves the problem for small mmap_min_addr setups. The values are suggested by Solar Designer: http://www.openwall.com/lists/oss-security/2015/05/02/6 Signed-off-by: Vasily Kulikov <segoon@openwall.com> Cc: Solar Designer <solar@openwall.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Bug: 26429468 Bug: 26186802 Bug: 26429658 Bug: 26428990 Bug: 26429465 Bug: 26429464 Change-Id: I28bddf3d76b3f16a7b46a391cd2af851718fdb75
2016-01-21UPSTREAM: KEYS: Fix keyring ref leak in join_session_keyring()android-6.0.1_r0.26android-mediatek-sprout-3.10-marshmallow-mr1Yevgeny Pats
(cherry pick from commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2) This fixes CVE-2016-0728. If a thread is asked to join as a session keyring the keyring that's already set as its session, we leak a keyring reference. This can be tested with the following program: #include <stddef.h> #include <stdio.h> #include <sys/types.h> #include <keyutils.h> int main(int argc, const char *argv[]) { int i = 0; key_serial_t serial; serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } if (keyctl(KEYCTL_SETPERM, serial, KEY_POS_ALL | KEY_USR_ALL) < 0) { perror("keyctl"); return -1; } for (i = 0; i < 100; i++) { serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING, "leaked-keyring"); if (serial < 0) { perror("keyctl"); return -1; } } return 0; } If, after the program has run, there something like the following line in /proc/keys: 3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty with a usage count of 100 * the number of times the program has been run, then the kernel is malfunctioning. If leaked-keyring has zero usages or has been garbage collected, then the problem is fixed. Reported-by: Yevgeny Pats <yevgeny@perception-point.io> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Don Zickus <dzickus@redhat.com> Acked-by: Prarit Bhargava <prarit@redhat.com> Acked-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Change-Id: I10177a58a7b3178eda95017557edaa7298594d06
2016-01-21BACKPORT: pagemap: do not leak physical addresses to non-privileged userspaceKirill A. Shutemov
(cherry pick from commit ab676b7d6fbf4b294bf198fb27ade5b0e865c7ce) As pointed by recent post[1] on exploiting DRAM physical imperfection, /proc/PID/pagemap exposes sensitive information which can be used to do attacks. This disallows anybody without CAP_SYS_ADMIN to read the pagemap. [1] http://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html [ Eventually we might want to do anything more finegrained, but for now this is the simple model. - Linus ] Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Acked-by: Konstantin Khlebnikov <khlebnikov@openvz.org> Acked-by: Andy Lutomirski <luto@amacapital.net> Cc: Pavel Emelyanov <xemul@parallels.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Mark Seaborn <mseaborn@chromium.org> Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Mark Salyzyn <salyzyn@google.com> Bug: 25739721 Change-Id: I5582c993dbeb0b7287e6d41b57e494d123d33083
2016-01-15Fix "[Security Vulnerability]mt_wifi IOCTL_GET_STRUCT EOP" issueyang-cy.chen
Problem: prNdisReq->ndisOidContent is in a static allocation of size 0x1000, and prIwReqData->data.length is a usermode controlled unsigned short ,so the copy_from_user results in memory corruption. Solution: Add boundary protection to prevent buffer overflow Bug num:26267358 Change-Id: I70f9d2affb9058e2e80b6b9f8278d538186283d3 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 9c112c7344a2642a6e7ee29ee920900248a29e8a)
2015-11-02mediatek:fix "Kernel vulnerability in /dev/misc-sd" issueandroid-6.0.1_r0.16yang-cy.chen
Problem: Security vulnerability in /dev/misc-sd, and someone can use invalid value through ioctl to get root. Solution: Add boundary protection Bug num:25323711 Change-Id: I3cb499da51ddacf9f6c7073473ff1d80c0428ffc Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 3342bf8ec543ad2df2f32a8eadd03c39ba9c859d)
2015-10-29mediatek:fix Buffer overflow in kernel dcm_state_store()android-6.0.1_r0.6yang-cy.chen
Problem: Buffer overflow in kernel dcm_state_store() ,so that root user can trivially freeze the device by writing a long string to /sys/power/dcm_state. Solution: Restrict the amount of characters to read Bug num:25290712 Change-Id: I7fde0ad6a1011ac97c9c351c91fe982dccdae9d0 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 1187714960b4e65ee1afdb44136e9cff2f5c3b75)
2015-09-18mediatek:adjust usb20 pull-up flowandroid-6.0.0_r0.6android-mediatek-sprout-3.10-marshmallowyang-cy.chen
Problem: USB function will switch back to "Chagring only" from MTP automatically on some PC, and this was caused by UsbDeviceManager can't get USB connect event on time.If response time is more than 1 sec, UsbDeviceMange will switch to default "Chagring only". Solution: Don't do USB power on/off flow when cable already connected with PC. Only need to set/clean MUSB_POWER_SOFT_CONN bit to speed-up PC re-enumeration. Bug num:23576696 Change-Id: I729c34757ccfbcd5259ccd417d3c10c9ad37cbfa Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit dd0cfe8854284436a0747a1dfdf03e50d4b35951)
2015-09-02sprout: defconfig: setting svelte config maxcpus to 2 coresyang-cy.chen
Bug num:23596982 Change-Id: If999ad1d64e91d4fab5091c1252ac7206edf7bd8 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2015-08-28mediatek:Deactivate sensor before event reportedyang-cy.chen
Description: Change the driver to follow SMD definition of below's link, the sensor must be deactivated before the event is reported through the HAL. (https://source.android.com/devices/sensors/report-modes.html#one-shot) Bug num:23206214 Change-Id: Icf62808b153e5013113b0716154de0207e6a4657 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit b84e5aaf213f57327f4edc6d95301d91ef0ca95b)
2015-08-27mediatek: Sprout kernel has exploitable and wrong file openingyang-cy.chen
Problem: Use flip_open to read file from SD card. Solution: Remove defected code since don't use it now. Bug num:23420393 Change-Id: I23c7dfb841311d9f21fef15b5c7a33eee8403e41 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit d7897ff67c9c7b73f1e3d48741e39af40672393a)
2015-08-14Mediatek: Proximity and Ambient sensor CTS failyang-cy.chen
Description: Test Case: CTS Verifier APK, CTS Sensor test item, TestBatchAndFlush Fail at 'SensorTest:WaitForFlush | sensor='cm36283 Proximity sensor' ... and 'SensorTest:WaitForFlush | sensor='cm36283 ambient sensor' ... Note: Before test, QA also should calibrate magnetometer, and ensure no magnetic fieldinterference. Problem: Ambient sensor issue: In stable light environment, raw data is stable output, however, kernel input layer filter the same data to sensor HAL. Proximity sensor issue: In this case, there is not outside object to trigger p-sensor event , so software need to start a timer directly report a faraway event. And the Other reason, sometimes the data reported to android layer before the case call flush(). Solution: make sure proximity timer can run when ps is enabled. Bug num:23005172 Change-Id: I2eb85681420b352d93f8ff722a53dd110d614980 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 962a4186c997f15e72558c421e0e72fd62270474)
2015-08-12mediatek: FM Radio play current(=79.22mA) too highyang-cy.chen
Problem: Using DRAM as playback buffer will block system enter deep idle power mode, and will consume more power during FM playback. Solution: Using SRAM instead of DRAM , and which can enter deep idle power mode for power saving Bug num:23097414 Change-Id: Ida0d97bf63d3bc6e707e823403ac38e071508de1 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com> (cherry picked from commit 92f5ce3794774f00a8cbb7f600dfafaebccc8b4b)
2015-07-23mediatek: ccci: SIM1/SIM2 tests fail on first bootCylen Yao
Problem: SIM1/SIM2 tests fail on first booting after download Bug num: 18905043 Details: At first boot the system need more time to get ready, so modify MD2 boot timeout value from 10 to 30. Change-Id: I1f86e3fd489e5193832129377b80d579c63540c8 Signed-off-by: Cylen Yao <cylen.yao@mediatek.com> (cherry picked from commit 4ef693f7d4a21e8f0e71b6cb9b84f605867c1503)
2015-07-22Build Config for android-mediatek-sprout-3.10-m-devBaligh Uddin
Change-Id: Idc8e0ec601e2931c30289c6e11acecde54529579
2015-07-09ext4 crypto: fix return value for ext4_es_scan()Theodore Ts'o
Between 3.10 and 3.18, the abstraction to scan for objects in the slab cache which can be freed when the system is under memory pressure changed. When I backported the ext4 code from 3.18 to the 3.10 kernel, I didn't get the return value required by the calling conventions for the scan function correct, which could potentially cause the memory reclaimer to loop indefinitely. Change-Id: I1712fedf96fd91c911fb4d019d7ef76f6c4c1808 Signed-off-by: "Theodore Ts'o" <tytso@google.com>
2015-07-01mediatek: fix memory leak of slabtrace toolyang-cy.chen
Problem: Use single_open as the .open function in file_operations and seq_release as the .release function will cause a memory leak. Solution: using single_release as the .release function. Bug num: 22213471 Change-Id: I79c6a77fc74e6c4117751b5b033a2c60b48e5283 Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2015-06-26sprout*_defconfig: remove CONFIG_ANDROID_LOGGER in defconfigsJin Qian
Android logger driver has been removed a few months ago. Change-Id: Ifa01d0bfc6defdd2b7349bd29a05c31145ca09aa
2015-06-21Revert "Revert "sprout: defconfig: svelte limit_mem configuration""Jin Qian
This reverts commit ce37991091215252403ddf765975eb6ca4966114. Change-Id: I48761c6492d4a4409047aa93dcb045babef12250
2015-06-16mediatek:camera sensor log reductionyang-cy.chen
Problem: too many log message Solution: remove camera sensor log Bug num:19851723 Change-Id: I8342b3611910c86a85368b51d1e920169bb5b04a Signed-off-by: yang-cy.chen <yang-cy.chen@mediatek.com>
2015-06-11sprout*_defconfig: Adjust EXT4 config options due to ext4 3.19 meregeJin Qian
Disable EXT3 and enable use EXT4 for EXT2 and EXT3. Disable EXT4 posix_acls Change-Id: I3cc9d2211112acc0bc5276e6ae4e1d0915e275e9
2015-06-11of: add empty of_find_node_by_path() for !OFAlexander Shiyan
Add an empty version of of_find_node_by_path(). This fixes following build error for asoc tree: sound/soc/fsl/fsl_ssi.c: In function 'fsl_ssi_probe': sound/soc/fsl/fsl_ssi.c:1471:2: error: implicit declaration of function 'of_find_node_by_path' [-Werror=implicit-function-declaration] sprop = of_get_property(of_find_node_by_path("/"), "compatible", NULL); Change-Id: I7baac946f86578badaf8d223359878f435fd3d64 Reported-by: Stephen Rothwell <sfr@canb.auug.org.au> Signed-off-by: Alexander Shiyan <shc_work@mail.ru> Signed-off-by: Rob Herring <robh@kernel.org>
2015-06-11Merge branch 'android-3.10' into android-mediatek-sprout-3.10Jin Qian
d0aa434 Merge remote-tracking branch 'ext4-3.19/for-android-3.10-common' into android-3.10 5862c50 cpufreq: Iterate over all the possible cpus to create powerstats. 607437e ext4 crypto: allocate bounce pages using GFP_NOWAIT ... 7449299 net/unix: sk_socket can disappear when state is unlocked 6f4f0dc selinux: enable genfscon labeling for sysfs and pstore files Change-Id: Iaa138b29a77e2699148097b8fd8ed952a3df0398
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-18 00:00:40 +0000