Merge branch android-msm-sunfish-4.14-android13-qpr2 (android-13.0.0_…

…r0.71)

Signed-off-by: engstk <[email protected]>

drivers/char/diag/diag_dci.c

@@ -1979,12 +1979,13 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 {
 	int ret = DIAG_DCI_TABLE_ERR;
 	int common_cmd = 0, header_len = 0;
+	int req_tag = 0;
 	struct diag_pkt_header_t *header = NULL;
 	unsigned char *temp = buf;
 	unsigned char *req_buf = NULL;
 	uint8_t retry_count = 0, max_retries = 3;
 	uint32_t read_len = 0, req_len = len;
-	struct dci_pkt_req_entry_t *req_entry = NULL;
+	struct dci_pkt_req_entry_t *req_entry = NULL, *test_entry = NULL;
 	struct diag_dci_client_tbl *dci_entry = NULL;
 	struct dci_pkt_req_t req_hdr;
 	struct diag_cmd_reg_t *reg_item;
@@ -2088,21 +2089,22 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 		mutex_unlock(&driver->dci_mutex);
 		return DIAG_DCI_NO_REG;
 	}
+	req_tag = req_entry->tag;
 	mutex_unlock(&driver->dci_mutex);
 
 	/*
 	 * If the client has registered for remote data, route the packet to the
 	 * remote processor
 	 */
 	if (dci_entry->client_info.token > 0) {
-		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_entry->tag,
+		ret = diag_send_dci_pkt_remote(req_buf, req_len, req_tag,
 					       dci_entry->client_info.token);
 		return ret;
 	}
 
 	/* Check if it is a dedicated Apps command */
 	ret = diag_dci_process_apps_pkt(header, req_buf, req_len,
-					req_entry->tag, header_len);
+					req_tag, header_len);
 	if ((ret == DIAG_DCI_NO_ERROR && !common_cmd) || ret < 0)
 		return ret;
 
@@ -2126,9 +2128,12 @@ static int diag_process_dci_pkt_rsp(unsigned char *buf, int len)
 		reg_item = container_of(temp_entry, struct diag_cmd_reg_t,
 								entry);
 		mutex_lock(&driver->dci_mutex);
-		if (req_entry)
+		test_entry = diag_dci_get_request_entry(req_tag);
+		if (test_entry)
 			ret = diag_send_dci_pkt(reg_item, req_buf, req_len,
-					req_entry->tag);
+					test_entry->tag);
+		else
+			ret = -EIO;
 		mutex_unlock(&driver->dci_mutex);
 	} else {
 		DIAG_LOG(DIAG_DEBUG_DCI, "Command not found: %02x %02x %02x\n",

drivers/gpu/msm/kgsl.c

@@ -1,5 +1,5 @@
 /* Copyright (c) 2008-2021, The Linux Foundation. All rights reserved.
- * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
+ * Copyright (c) 2022-2023, Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -2451,6 +2451,15 @@ static int kgsl_setup_anon_useraddr(struct kgsl_pagetable *pagetable,
 }
 
 #ifdef CONFIG_DMA_SHARED_BUFFER
+static int match_file(const void *p, struct file *file, unsigned int fd)
+{
+	/*
+	 * We must return fd + 1 because iterate_fd stops searching on
+	 * non-zero return, but 0 is a valid fd.
+	 */
+	return (p == file) ? (fd + 1) : 0;
+}
+
 static void _setup_cache_mode(struct kgsl_mem_entry *entry,
 		struct vm_area_struct *vma)
 {
@@ -2488,6 +2497,8 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device,
 	vma = find_vma(current->mm, hostptr);
 
 	if (vma && vma->vm_file) {
+		int fd;
+
 		ret = check_vma_flags(vma, entry->memdesc.flags);
 		if (ret) {
 			up_read(&current->mm->mmap_sem);
@@ -2503,13 +2514,27 @@ static int kgsl_setup_dmabuf_useraddr(struct kgsl_device *device,
 			return -EFAULT;
 		}
 
-		/*
-		 * Take a refcount because dma_buf_put() decrements the
-		 * refcount
-		 */
-		get_file(vma->vm_file);
-
-		dmabuf = vma->vm_file->private_data;
+		/* Look for the fd that matches this vma file */
+		fd = iterate_fd(current->files, 0, match_file, vma->vm_file);
+		if (fd) {
+			dmabuf = dma_buf_get(fd - 1);
+			if (IS_ERR(dmabuf)) {
+				up_read(&current->mm->mmap_sem);
+				return PTR_ERR(dmabuf);
+			}
+			/*
+			 * It is possible that the fd obtained from iterate_fd
+			 * was closed before passing the fd to dma_buf_get().
+			 * Hence dmabuf returned by dma_buf_get() could be
+			 * different from vma->vm_file->private_data. Return
+			 * failure if this happens.
+			 */
+			if (dmabuf != vma->vm_file->private_data) {
+				dma_buf_put(dmabuf);
+				up_read(&current->mm->mmap_sem);
+				return -EBADF;
+			}
+		}
 	}
 
 	if (IS_ERR_OR_NULL(dmabuf)) {

drivers/gpu/msm/kgsl_pool.c

@@ -1,4 +1,5 @@
 /* Copyright (c) 2016-2017, 2019-2020, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2023 Qualcomm Innovation Center, Inc. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -83,6 +84,15 @@ _kgsl_pool_zero_page(struct page *p, unsigned int pool_order)
 static void
 _kgsl_pool_add_page(struct kgsl_page_pool *pool, struct page *p)
 {
+	/*
+	 * Sanity check to make sure we don't re-pool a page that
+	 * somebody else has a reference to.
+	 */
+	if (WARN_ON_ONCE(unlikely(page_count(p) > 1))) {
+		__free_pages(p, pool->pool_order);
+		return;
+	}
+
 	_kgsl_pool_zero_page(p, pool->pool_order);
 
 	spin_lock(&pool->list_lock);

drivers/media/dvb-core/dmxdev.c

@@ -3674,6 +3674,11 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
 	if (mutex_lock_interruptible(&dmxdev->mutex))
 		return -ERESTARTSYS;
 
+	if (dmxdev->exit) {
+		mutex_unlock(&dmxdev->mutex);
+		return -ENODEV;
+	}
+
 	for (i = 0; i < dmxdev->filternum; i++)
 		if (dmxdev->filter[i].state == DMXDEV_STATE_FREE)
 			break;
@@ -4904,7 +4909,10 @@ EXPORT_SYMBOL(dvb_dmxdev_init);
 
 void dvb_dmxdev_release(struct dmxdev *dmxdev)
 {
+	mutex_lock(&dmxdev->mutex);
 	dmxdev->exit = 1;
+	mutex_unlock(&dmxdev->mutex);
+
 	if (dmxdev->dvbdev->users > 1) {
 		wait_event(dmxdev->dvbdev->wait_queue,
 				dmxdev->dvbdev->users == 1);