Commit Graph

649935 Commits

Author SHA1 Message Date
yao liu
ad4b155b3c dv: osd icon display colored dots at 720p50hz [1/2]
PD#SWPL-14463

Problem:
dv vertical potch is small

Solution:
increase vpotch from 0x30 to 0x38

Verify:
verify on sm1 720p.

Change-Id: Iebf6708f62a8b8c2a32accf9ef721b4d12fa2370
Signed-off-by: yao liu <yao.liu@amlogic.com>
2019-09-28 23:33:44 -07:00
Evoke Zhang
4bf1e907ee amvecm: add viu2 vsync support for gamma [1/1]
PD#SWPL-14450

Problem:
gamma can't support viu2 vsync

Solution:
add viu2 vsync support for gamma

Verify:
u202

Change-Id: I5f490b254f58a130451ff69a456c218e6e4dcc94
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>
2019-09-28 20:06:54 -07:00
Brian Zhu
2b9c1c05ba vpp: use the correct sr0 max width [1/1]
PD#SWPL-14306

Problem:
When sr0 v scaler is enabled or not, the sr0 max width
is incorrectly.

Solution:
Using the correct sr0 max width.

Verify:
Verified by u212

Change-Id: Id5e0b66f0878676536be0e0970fe8f26419b978c
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
2019-09-28 18:36:57 -07:00
Bichao Zheng
03a3cb46a6 irblaster: meson: fix Coverity errors [1/2]
PD#SWPL-13973

Problem:
irblaster Coverity errors.

Solution:
1. Properly release resources.
2. Fix return value type.

Verify:
test pass on g12a_u200_v1

Change-Id: I50054ba3ac9f02aeeaa005b7823416b1c4c9a196
Signed-off-by: Bichao Zheng <bichao.zheng@amlogic.com>
2019-09-27 04:58:28 -07:00
baocheng sun
302a65f334 ion: ion_sync_for_device use swiotlb_dma_ops not dummy_dma_ops [1/1]
PD#OTT-5276

Problem:
CTS EncodeDecodeTest failed. Ion sync ioctrl was
forwarded to a dummy implementation. So cached dma buffer
syncing between device and driver was inconsistent occasionally.

Solution:
Changed the dummy_dma_ops to swiotbl_dma_ops when ion_sync_for_device

Verify:
franklin, hertz

Change-Id: I16863bba6c3fe16b9c3b2b410ade6e45c9e74826
Signed-off-by: baocheng sun <baocheng.sun@amlogic.com>
2019-09-27 04:56:53 -07:00
shuanglong.wang
05d4ef2228 video: clear omx_pts_set_index when session switch [1/1]
PD#SWPL-13597

Problem:
av diff over 200ms after seek when test AL1 ep sync

Solution:
clear omx_pts_set_index when session switch that new playback, drop
old index, new index will update asap when set_omx_pts invoked.

Verify:
verify by skb nts

Change-Id: I5f46338d46524ceb9a4e907cf9db07ff2e373a08
Signed-off-by: shuanglong.wang <shuanglong.wang@amlogic.com>
2019-09-27 04:50:06 -07:00
Jianxin Pan
5a4b7851ca Merge "vad: enable tm2 vad wakeup [2/2]" into amlogic-4.9-dev 2019-09-27 04:49:00 -07:00
yao liu
3969e3a6fd dv: dolby tv core need bitmatch [1/1]
PD#SWPL-6655

Problem:
tm2 tvcore not bitmatch

Solution:
1.Config VIU_VD1_FMT_CTRL for tm2
2.Config DIAG_CTRL, CRC_CTRL and CM_CRC reg for tm2
3.Config DOLBY_PATH_CTRL for tm2

Verify:
Verified on tm2

Change-Id: I56a086c498ed4d3bf2f43a4639c79546072d586b
Signed-off-by: yao liu <yao.liu@amlogic.com>
2019-09-27 03:39:05 -07:00
Brian Zhu
190492f6a9 vpp: improve the csc and dv switch flow and policy [1/1]
PD#SWPL-13990

Problem:
There are some conflicts between csc and dv module switching.
Can not switch to SDR->DV when HDR core is working on SDR->SDR mode.

Solution:
1. Improve the switching policy. DV and csc will use same on.
2. add mute operation under dv mode.

Verify:
Verified on AC211

Change-Id: I4d59328fc34228a0ef5275d22643932c4dfe00b0
Signed-off-by: Brian Zhu <brian.zhu@amlogic.com>
2019-09-27 02:33:29 -07:00
Bencheng Jing
87952ccbc7 amvecm: add lc enable/disable in pc mode [1/1]
PD#SWPL-12580

Problem:
pcmode can not disable lc

Solution:
add lc enable/disable in pc mode

Verify:
verified by tl1

Change-Id: Ie8f7ff84549cd42efef550ecd7adf6d959ff5a4f
Signed-off-by: Bencheng Jing <bencheng.jing@amlogic.com>
2019-09-27 00:52:38 -07:00
Lei Yang
701aca8b44 hdmirx: add repeater22 [1/1]
PD#SWPL-12503

Problem:
TM2 cannot support repeater22

Solution:
add repreater2.2

Verify:
TM2

Change-Id: Idda626632641939dccab79bf3d958e8f2c462c82
Signed-off-by: Lei Yang <lei.yang@amlogic.com>
2019-09-26 22:28:40 -07:00
yao liu
f598590ee9 dv: osd icon display colored dots at 720p [1/1]
PD#SWPL-14463

Problem:
OSD hold line changed from 4 to 8, dv vertical
potch should be adjusted accordingly.

Solution:
increase vpotch from 0x20 to 0x30.

Verify:
verify on sm1 720p.

Change-Id: I33779829cb80ce34c5596081a7591278e214d347
Signed-off-by: yao liu <yao.liu@amlogic.com>
2019-09-26 20:01:11 -07:00
yunhua.wei
69e605f9f4 audio: change spdif input audio stuttering [1/1]
PD#SH-1182

Problem:
change spdif input audio stuttering

Solution:
Change the log level from pr_info to pr_debug

Verify:
A113D

Change-Id: I44eb6d4453dddff7a1e8e4e2345603aa292ba161
Signed-off-by: yunhua.wei <yunhua.wei@amlogic.com>
2019-09-26 02:22:45 -07:00
Xiaoming Sui
489ff08e61 avsync: tsync: fix avsync issues when dtv play [2/2]
PD#TV-10253

Problem:
PD#TV-10253, SWPL-12816
dtv play when pcr is invalid, avsync is lost sometimes.

Solution:
add some specific marginal checks.

Verify:
X301

Change-Id: I2115bc934cd87d8a93c77180f4f37f1d23fa23ba
Signed-off-by: Xiaoming Sui <xiaoming.sui@amlogic.com>
2019-09-26 02:21:10 -07:00
yicheng shen
4053400a71 hdmirx: fix hdcp2.2 request_mem_region fail issue [1/1]
PD#SWPL-14563

Problem:
hdcp_rx22 passed a wrong HPI address to hdmirx driver,
and cause HPI address request_mem_region fail

Solution:
Use the correct HPI address when request_mem_region called.

Verify:
TL1

Change-Id: I80bd6323ae4959edf3c792758568c581024536bb
Signed-off-by: yicheng shen <yicheng.shen@amlogic.com>
2019-09-26 02:18:14 -07:00
Jihong Sui
a72a97b1d2 deinterlace: pq: mtn use different setting for 480i [1/1]
PD#SWPL-14550

Problem:
deinterlance1-Chapter#1 in sony test pattern,
the "ok" display abnormal.

Solution:
from yanling(VLSI), bencheng.jing
change mxcmbY from 1 to 3;
add combing_bias_motion_setting and
combing_very_motion_setting for 480i;

Verify:
x301

Change-Id: Ida2b432af80a2bd5937f13b3f7a4a030b9b0cfaa
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-26 02:10:37 -07:00
qi duan
7a9b205857 eth: compatible internal phy enet efuse map for some chip [1/1]
PD#SWPL-14596

Problem:
some g12a chip,efuse map for enet is diff
So need compatible for these chip

Solution:
read valid bit from valid block,not data block

Verify:
verified by tl1 and g12a

Change-Id: I564209d865cbc2ff1151df07d06593b12ea225d8
Signed-off-by: qi duan <qi.duan@amlogic.com>
2019-09-25 06:35:28 -07:00
changqing.gao
497ac48890 iomap: fix coverity errors [1/1]
PD#SWPL-13972

Problem:
iomap Coverity errors.

Solution:
1. remove verbose code.
2. check return value.

Verify:
test pass on tm2_ab301_v1

Change-Id: Ib8c2baaae63d3c6454ffa45a0c353a6dd9de0787
Signed-off-by: changqing.gao <changqing.gao@amlogic.com>
2019-09-25 00:48:42 -07:00
Jihong Sui
5e99ea4bad deinterlace: pq: fix combing_fix_en can not change [1/1]
PD#SWPL-11557

Problem:
Some scenes flicker badly, such as the roof

Solution:
The modification requirements come from,
yanling(VLSI), bencheng.jing
a. patch 62052:
need change mtn parameter back to old for local 1080i;
b. patch 71464:
need fix combing_fix_en can not change;

Verify:
x301

Change-Id: I3e067930f0e4dea9f300e888a6ee3f96caf987fb
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-25 00:20:18 -07:00
robin zhu
1ab6a1e347 video: dv: DV SDK, DRM infoframe in GBR order [1/1]
PD#SWPL-13874

Problem:
DV sdk test, for sdr/hdr/dv to hdr cases
DRM infoframe primaries in GBR order

Solution:
DV enable, send primaries in RGB order

Verify:
None

Change-Id: I0229179592203aba5e2a388a572b0061fa21a48f
Signed-off-by: robin zhu <robin.zhu@amlogic.com>
2019-09-24 23:40:27 -07:00
Hang Cheng
58d38e67f0 hdmitx: force to update glitch time after hdcp22 unmux [1/1]
PD#SWPL-11894

Problem:
glitch time in bl31 may not be updated after hdcp22 unmux,
because get hdcp auth result function in bl31 will not be
called after hdcp mode set to 0. In a result, the glitch
hdcp22 result may take place of the actual hdcp22 auth
status after mode change, and feedback to systemcontrol
to clear/set video mute by wrong

Solution:
force to update glitch time after hdcp22 unmux

Verify:
U200/g12a

Change-Id: I497ead5f8f5c46959560ffc0c8702acca1a3f46c
Signed-off-by: Hang Cheng <hang.cheng@amlogic.com>
2019-09-24 23:39:48 -07:00
jinrong.liao
8a9bf8a4d7 dts: add county and langurage prop for gva [1/1]
PD#SH-875

Problem:
add county and langurage prop via unifykey for gva

Solution:
add county and langurage prop via unifykey for gva

Verify:
S420

Change-Id: Icf5f7c3f44d93fbcaf2be3410e0c04289549c555
Signed-off-by: jinrong.liao <jinrong.liao@amlogic.com>
2019-09-24 22:20:14 -07:00
Evoke Zhang
7c9260f4ca tvafe: update 0x125 setting for tl1 av ntsc-m/pali [1/1]
PD#SWPL-14271

Problem:
av pali green block dark in colorbar left bottom corner

Solution:
update 0x125 setting for tl1 av ntsc-m/pali

Verify:
x301

Change-Id: Icb759a39c1265ac043b888b55f3ccaf12661cafe
Signed-off-by: Evoke Zhang <evoke.zhang@amlogic.com>
2019-09-24 19:12:29 -07:00
Qiufang Dai
bbe1f0fa30 freeze: add IRQF_NO_SUSPEND for ir irq flag for avoid wakeup by any IR key
PD#TV-10438

Problem:
system can be wake up by any IR key

Solution:
Add IRQF_NO_SUSPEND to avoid IR interrupt being seen as wakeup source IRQ
When IR irq check current key is power key, then send pm_wakeup_event()

Verify:
X32A0-T972

Change-Id: I753fe15f859480954bb569f2da3d3e0dd93c29e3
Signed-off-by: Qiufang Dai <qiufang.dai@amlogic.com>
2019-09-24 18:45:06 -07:00
Tao Zeng
ddf6fce977 ramdump: not set sticky register if ramdump disabled [1/1]
PD#TV-1924

Problem:
Sticky register which control compress in bl2z will always be set
if ramdump driver probed.

Solution:
If ramdump is disabled by envrioment under uboot. sticky register
should not set for not enter compress under bl2z

Verify:
x301

Change-Id: I1f41c98cebf7957f0dc214046e6d011e08c326de
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
2019-09-23 23:29:07 -07:00
shaochan.liu
2822376c87 lcd: add lcd_init_level to control lcd display [2/2]
PD#TV-9856

Problem:
need change display driver for cool boot to enter
kernel stage freeze mode

Solution:
add lcd_panel_ctrl to control lcd display

Verify:
t962x2-x301

Change-Id: I8b58ab0a0f87c49791af7dddf7b05db37f7ad716
Signed-off-by: shaochan.liu <shaochan.liu@amlogic.com>
2019-09-23 19:45:09 -07:00
Cao Jian
3ed69ef88f picdec: fix no scale mode, frame stretch [1/1]
PD#SWPL-14477

Problem:
the picture is rotated 90 degrees,
stretching left and right

Solution:
modify conditions for frame width or height
equal to screen width or height

Verify:
verify by g12b-w400

Change-Id: I0ca9cc255b202306562bee69726400c697f3b053
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2019-09-23 05:57:47 -07:00
he.he
92fe4708d7 usb: xHCI host not responding to stop endpoint command [1/1]
PD#SWPL-14053

Problem:
Read and write simultaneously on two disks on a hub,
and then the XHCI controller would halted.

Solution:
Set the GUCTL1 BIT 17 to 1 for disable park mode.

Verify:
test pass on u200, ODROID-N2

Change-Id: I007804fa6b97a103da4a05be12c1193b9dd422cb
Signed-off-by: he.he <he.he@amlogic.com>
2019-09-23 04:46:29 -07:00
Xingyu Chen
0ff6f7544d iio: adc: coverity defect cleanup [1/1]
PD#SWPL-13967

Problem:
unchecked return value of regmap_write

Solution:
to check the return value

Verify:
test pass on g12a

Change-Id: Ibb45e36d7c24f0e0ea8b14da75e887321ee5b791
Signed-off-by: Xingyu Chen <xingyu.chen@amlogic.com>
2019-09-23 02:05:38 -07:00
Jihong Sui
a0bbd9d53c deinterlace: fix suspend di cause undefined instruction [1/1]
PD#SWPL-14418

Problem:
DI issue causes platform crash to restart
when do DTV 2s channel switch+15s suspend

Solution:
use active_flg to protect tasklet_schedule

Verify:
tl1

Change-Id: I91028a039d8b1799b131a953bef4877f70a2f697
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-22 23:18:49 -07:00
Rui Wang
a7884835b7 video: fix video axis no changes when enable hold video [1/1]
PD#TV-10251

Problem:
PE190005-1038 press the OK button switching to
the ATV channel, the screen is not full screen.

Solution:
After the video property changes, if the hold video
is enabled, the current frame needs to be refreshed.

Verify:
Verified with X301

Change-Id: I05cb7255147b1950cb6b9d5813148a9ce0aa6e66
Signed-off-by: Rui Wang <rui.wang@amlogic.com>
2019-09-22 22:38:01 -07:00
yao liu
de231b4084 dv: display abnormal when seeking [1/1]
PD#SWPL-13834

Problem:
Dropping dv frame triggers parser_matedata which updates
the new_dovi_setting. Before rendering the first frame,
keep frame is displayed. However, keep frame requires
toggle, which updates the dovi_setting from new_dovi_setting,
causing color error in keep frame

Solution:
Dropping frame don't update new_dovi_setting

Verify:
passed on sm1

Change-Id: I1c73ba6f7d192066e3d5f9439ccbedc6d610d6eb
Signed-off-by: yao liu <yao.liu@amlogic.com>
2019-09-22 18:30:27 -07:00
Bencheng Jing
485ae37b25 amvecm: fix pure black scene adjust contrast affected brightness [1/1]
PD#SWPL-14319

Problem:
adjust the contrast in full range

Solution:
change to limit range

Verify:
verified by tl1

Change-Id: Icfa3c128c2943e30f2710dad5181c1d85dd32095
Signed-off-by: Bencheng Jing <bencheng.jing@amlogic.com>
2019-09-20 04:54:17 -07:00
nengwen.chen
3340a5483b atv_demod: fix first sound carrier output in nicam system [1/1]
PD#TV-9972

Problem:
first sound carrier no output in nicam system.

Solution:
1.fix first sound carrier output in nicam system.

Verify:
Verified by TL1.

Change-Id: Ib89b6a5300a1ebeb9e61bbb3acb6356e2abab08f
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>
2019-09-20 04:48:14 -07:00
Jihong Sui
eba8feda63 deinterlace: vpp: change mc update flow [1/1]
PD#SWPL-14142

Problem:
display abnormal after play 1 hour.
this is because rdma can't been called in two thread.
mc update bit in hw timer, this causes pps's register
to be set incorrectly.

Solution:
call mc update function in video.c

Verify:
txlx

Change-Id: I750aa5c242a1077691f82c3b2361ee46b3202313
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-20 04:46:49 -07:00
Jihong Sui
55ba0d911f deinterlace: optimize reset/light unreg flow [1/1]
PD#SWPL-14059

Problem:
video stuck after reset or light unreg.

Solution:
optimize reset/light unreg flow

Verify:
G12A

Change-Id: I982ef4ee618a25d0b562f70b5e7df0fad2d87278
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-20 04:46:27 -07:00
Jihong Sui
6c7d8691a1 deinterlace: delete reg_req_flag_irq to avoid failed reg. [1/1]
PD#SWPL-14260

Problem:
variable reg_req_flag_irq is redundant and
it has a probability of causing error reg.

Solution:
delete this variable.

Verify:
tl1

Change-Id: I807f32789acdf4b8e0fea88f9786a301638460ff
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-20 02:05:37 -07:00
yao liu
b07a2080c9 dv: display green when hotplug hdmi after boot [1/1]
PD#SWPL-14323

Problem:
Kernel and uboot is not sync: When kernel startup
without hdmi,dolby_vision_on is not set to true
even if dv is on in uboot. This lead to dv core
can't turn off when bypass dv in sdr->sdr case.

Solution:
Regardless of connecting to hdmi, as long as uboot
turn on dv, set dolby_vision_on up

Verify:
verify on sm1

Change-Id: I704c833c0b099637ea08b255b6cd380199ea0148
Signed-off-by: yao liu <yao.liu@amlogic.com>
2019-09-20 00:19:59 -07:00
Tao Zeng
89fd94cefb vmap: fix wrong mmu setting in check sp funciton [1/1]
PD#TV-9668

Problem:
If sp address is in linear mapping range, check_sp_fault_again
function in vmap fault handler will still map a new page for it.
This will cause some data in R/W section polluted.

Solution:
Avoid map page if sp is in linear range.

Verify:
TL1 x301

Change-Id: I0e02a2048b586854c528cd3eeafb725751b9dc82
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
2019-09-19 19:46:28 -07:00
Tao Zeng
bd353a10b3 event: restore watch point after cpu pm event [1/1]
PD#TV-9668

Problem:
After cpu idle enabled, watch point event register will be cleared
if cpu exit pm(idle). This will cause watch point can't work.

Solution:
re-enable watch point after cpu exit pm(idle)

Verify:
TL1

Change-Id: I4fc2002eaabecd4c5e60a5916bc29e0107882bec
Signed-off-by: Tao Zeng <tao.zeng@amlogic.com>
2019-09-19 19:45:53 -07:00
Xing Wang
86e4b1053c audio: auge: fix kcontrol chip info [1/1]
PD#SWPL-14331

Problem:
mixer "HDMI ARC Source" crashes when bootup

Solution:
fix kcontrol chip info

Verify:
x301

Change-Id: I2f2d66acbbd4092a5cbbe4c108d5ae928f0f0ccc
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
2019-09-19 03:25:25 -07:00
Cao Jian
4e35ecf389 osd: modify VPP_OSD_SC_DUMMY_DATA alpha conditions [1/1]
PD#SWPL-14256

Problem:
When ATV Mode has no signal
the bright line interference at the bottom
if freescale height is set to vinfo height

Solution:
modify VPP_OSD_SC_DUMMY_DATA alpha value

Verify:
verified on txlx-r311

Change-Id: I48bbb1be533a88e8b3c622550a0a2e8c07f2a863
Signed-off-by: Cao Jian <jian.cao@amlogic.com>
2019-09-19 01:48:30 -07:00
nengwen.chen
b7bcb2bd68 atv_demod: remove 44.25 repeat try signal [1/1]
PD#TV-10334

Problem:
1.remove 44.25MHz repeat try signal.

Solution:
1.remove 44.25MHz repeat try signal.

Verify:
Verified by x301

Change-Id: I76608f76885f555dfa5849e8e9016757736c2de8
Signed-off-by: nengwen.chen <nengwen.chen@amlogic.com>
2019-09-19 01:20:36 -07:00
Xihai Zhu
9585477b0d amvecm: add addr protect for register program [1/1]
PD#SWPL-14333

Problem:
invalid address is allowed for register program
which cause kernel panic

Solution:
add protection, programming on invalid addr will
be terminated

Verify:
tl1

Change-Id: I44bedec256ee5c386b53188fb2d8e40ae8c3f553
Signed-off-by: Xihai Zhu <xihai.zhu@amlogic.com>
2019-09-18 20:48:11 -07:00
Qianggui Song
82d71fb81e ir: fix coverity unchecked return value issue [1/1]
PD#SWPL-13969

Problem:
In sysfs.c, return value of class_register is not checked.

Solution:
check return value of class_register

Verify:
local coverity check

Change-Id: If8deb3e388e784650e4812257143c3ac919c2d9a
Signed-off-by: Qianggui Song <qianggui.song@amlogic.com>
2019-09-18 03:34:04 -07:00
Xing Wang
df04c0675a audio: auge: add eARC_TX/ARC_TX driver for tm2 [1/1]
PD#SWPL-12654

Problem:
eARCTX/ARCTX function for tm2

Solution:
add eARCTX/ARCTX driver for tm2
add extcon for earc tx connection
optimize eARC RX with regmap

Verify:
ab311

Change-Id: I61f44950af9e200f698372ad4f17457785a6255a
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
2019-09-18 16:49:58 +08:00
Xing Wang
140240ecb4 audio: update eARC_RX/ARC_RX driver [1/1]
PD#SWPL-6863

Problem:
eARCRX/ARCRX function for sm1/tm2

Solution:
add eARCRX/ARCRX driver for sm1/tm2
plug in/out HDMI cable, notify user space current attended type

Verify:
tested on ac200, ab311

Change-Id: I0332723ef9c9d45f7797df38a7077561fddb13bf
Signed-off-by: Xing Wang <xing.wang@amlogic.com>
2019-09-18 01:36:52 -07:00
Wenfeng Guo
292c315e42 deinterlace: fix bright edge at the top when beans falling [1/1]
PD#SWPL-8980

Problem:
bright edge at the top when beans falling

Solution:
revert the setting of top two lines do weave to Feijun's suggestions

Verify:
TL1

Change-Id: I314e0d23e4e7c00939bd0203cd821144274fbf9e
Signed-off-by: Wenfeng Guo <wenfeng.guo@amlogic.com>
2019-09-18 00:40:28 -07:00
Jihong Sui
ab4677495e deinterlace: fix blend setting err [1/1]
PD#SWPL-8980

Problem:
0x170d[16] can't set;

Solution:
Correct logic errors according to Feijun's suggestions

Verify:
TL1

Change-Id: If1ba9494d49b5614aac7571c3ee0e6ddb3fb6245
Signed-off-by: Jihong Sui <jihong.sui@amlogic.com>
2019-09-18 00:36:40 -07:00
Todd Kjos
25723698d7 RAVENPLAT 2652: RAVEN - Android Security Bulletin - September 2019-09 - Kernel components binder driver - CVE-2019-2181 [1/]
PD#OTT-5999

[Problem]
In binder_transaction of binder.c, there is a possible out of bounds
write due to an integer overflow. This could lead to local escalation of
privilege with noadditional execution privileges needed. User interaction
is needed for exploitation.
The fix is designed to check for the integer overflow.

[Solution]
UPSTREAM: binder: check for overflow when alloc for security context

commit 0b0509508b upstream.

When allocating space in the target buffer for the security context,
make sure the extra_buffers_size doesn't overflow. This can only
happen if the given size is invalid, but an overflow can turn it
into a valid size. Fail the transaction if an overflow is detected.

Bug: 130571081
Change-Id: Ibaec652d2073491cc426a4a24004a848348316bf
Signed-off-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Hanjie Lin <hanjie.lin@amlogic.com>
2019-09-17 23:30:30 -07:00