Commit Graph

21860 Commits

Author SHA1 Message Date
Edwin Wong
2bbbc56712 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours am: bc0c22c343 -s ours am: 6c942475ba -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668

Change-Id: I6de7dc34d951e5d6b05dc77757d5911a64ba88d4
2021-07-13 22:17:08 +00:00
Edwin Wong
6c942475ba [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours am: bc0c22c343 -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668

Change-Id: I481b343e5889cddc535c36a28c310f35e2cd4a89
2021-07-13 22:03:13 +00:00
Edwin Wong
bc0c22c343 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668

Change-Id: I957226dd902bd82def0d6498abc1cf5e5c5818dd
2021-07-13 21:44:50 +00:00
Edwin Wong
e17031023f [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668

Change-Id: I60aafc1050107127e9bf481268f43fe5725ce97f
2021-07-13 21:28:31 +00:00
Daniel Cardenas
548b8c48c4 [automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0 am: 5a01e2bac8 am: bbe4dea57b
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957

Change-Id: Id42cf407b9635d68907c6fb35908215903a2fdaa
2021-06-02 23:03:46 +00:00
Edwin Wong
24100c6309 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0 am: edbc9b1984 -s ours am: e45800a874
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923

Change-Id: I6992524dd96ef75b358173b8d45ba7835bedef29
2021-06-02 23:03:37 +00:00
Edwin Wong
c84661b1db Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b am: e0db28bc6c am: 68e65826c0
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307

Change-Id: Ia748c2c17d7fa26fa238d6839f244998207acb6b
2021-06-02 23:03:23 +00:00
chao.meng
107456af4f [automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8 am: 1d251753e7 -s ours am: a635038c52
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060

Change-Id: I04a1f70735112667e32a460877f971f8facc3de3
2021-06-02 23:03:11 +00:00
Treehugger Robot
19785d2519 [automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82 am: 723fe3456f am: de90ba21fd
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162

Change-Id: I687fc536399c32efb656127d80b39bd445ab0d7d
2021-06-02 23:02:45 +00:00
Daniel Cardenas
bbe4dea57b [automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0 am: 5a01e2bac8
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957

Change-Id: Ia41d1c798ae65a20a1ea1127a210c9e3bbfc2d4e
2021-06-02 22:47:52 +00:00
Edwin Wong
e45800a874 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0 am: edbc9b1984 -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923

Change-Id: Iffdccf118a1d0cfdd4dc24512fd0ad0f60d157d4
2021-06-02 22:47:40 +00:00
Edwin Wong
68e65826c0 Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b am: e0db28bc6c
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307

Change-Id: If86318a341d02d19988c1243684378680e89c8bd
2021-06-02 22:47:30 +00:00
chao.meng
a635038c52 [automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8 am: 1d251753e7 -s ours
am skip reason: subject contains skip directive

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060

Change-Id: I0db437d45bc69760f87bf45ff71280bda546dfc2
2021-06-02 22:47:24 +00:00
Treehugger Robot
de90ba21fd [automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82 am: 723fe3456f
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162

Change-Id: Ie4d3b401464424fab27036553962b7173f7c5575
2021-06-02 22:47:15 +00:00
Daniel Cardenas
5a01e2bac8 [automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957

Change-Id: I5accd9ccc4ec99063c2f73f89255c9df034625e7
2021-06-02 22:25:47 +00:00
Edwin Wong
edbc9b1984 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923

Change-Id: I826e294c859e84e8eff9d9247247f17e287868ef
2021-06-02 22:25:40 +00:00
Edwin Wong
e0db28bc6c Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307

Change-Id: I12994ecda8c80cb3caf6c442810f0823a4453d07
2021-06-02 22:25:26 +00:00
chao.meng
1d251753e7 [automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060

Change-Id: I2fb8e04f81e2172b24017ec3b6cf9f3dbbaf5adc
2021-06-02 22:25:21 +00:00
Treehugger Robot
723fe3456f [automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162

Change-Id: I8af0c06fa7ad3b7c97c95ad25e4cf42f04e831af
2021-06-02 22:25:12 +00:00
Daniel Cardenas
b19ec800c0 [automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957

Change-Id: Ifd09169a35dce4ff77871cf40014eda19bcd3487
2021-06-02 22:04:45 +00:00
Edwin Wong
83f2db8fc0 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923

Change-Id: I305e3d5ec027e9bf0802704aecdaf08bc9da6e2c
2021-06-02 22:04:34 +00:00
Edwin Wong
425466627b Fix potential decrypt src pointer overflow. am: c9b5693c7f
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307

Change-Id: I2e57da4ac02939aecb9cc06eff639e17bd4e46e0
2021-06-02 22:04:23 +00:00
chao.meng
ad6c07e4c8 [automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours
am skip reason: subject contains skip directive

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060

Change-Id: I7fcf9ec936de79b8a670991b3b89c27aa2752f17
2021-06-02 22:04:18 +00:00
Treehugger Robot
09936c8c82 [automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours
am skip reason: skipped by user pateljay

Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162

Change-Id: I530e31e29b4e2f5fafa4d25ad52bd5e196e3c9b1
2021-06-02 22:03:53 +00:00
Alisher Alikhodjaev
14162741e7 Merge "Out of bounds read in hal_core_initialized" into rvc-qpr-dev 2021-04-30 23:55:46 +00:00
Steven Moreland
da947d5127 audio HAL - fix UAFs am: 7283cbe8cb am: e227bfd15c am: facfee6382
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414

Change-Id: I50df59e828d44606c2fca8dc44830b5def4f9670
2021-04-26 22:46:24 +00:00
Steven Moreland
facfee6382 audio HAL - fix UAFs am: 7283cbe8cb am: e227bfd15c
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414

Change-Id: I5b80e2810ef7c4010496687934d93685057d4c82
2021-04-26 22:31:02 +00:00
Steven Moreland
e227bfd15c audio HAL - fix UAFs am: 7283cbe8cb
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414

Change-Id: I975f17cc4c76755b4da89f7782dab18f2e0f36b4
2021-04-26 22:07:21 +00:00
Steven Moreland
7283cbe8cb audio HAL - fix UAFs
Bug: 185259758
Test: N/A
Change-Id: I5ec70b098a00746108e10ab39e966607d78c84ae
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
(cherry picked from commit a8ac7cf706)
2021-04-16 18:36:09 +00:00
Alisher Alikhodjaev
35f34f4d01 Out of bounds read in hal_core_initialized
Bug: 176446340
Test: build and run
Change-Id: I02f93750e590b2384f79580dd7c06fc06f46a4ca
2021-04-15 19:12:52 -07:00
Edwin Wong
041e19dd25 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311 am: c7c4045f14 -s ours am: 09d70a56f4
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: I8bca8f892023177f641f2afd725a2155fd2237ef
2021-04-06 23:47:35 +00:00
Edwin Wong
db639ecf17 [automerger skipped] [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3 am: be8d2c6ebb -s ours am: 21f97ec264
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: Ia253d97d385ff379972eb112b6c76a038167929d
2021-04-06 23:47:32 +00:00
Edwin Wong
09d70a56f4 [automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311 am: c7c4045f14 -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: Ic106b0e8d0d109dbf986c50cc97b93386c12427e
2021-04-06 23:27:22 +00:00
Edwin Wong
21f97ec264 [automerger skipped] [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3 am: be8d2c6ebb -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: Ide0c8906230f88e4d3d8d8fdf434ca0223315532
2021-04-06 23:27:19 +00:00
Edwin Wong
c7c4045f14 Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: Ida94a5318e928a10b9c6348ef46faeb92b5f3254
2021-04-06 23:06:29 +00:00
Edwin Wong
be8d2c6ebb [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186

Change-Id: Ida447099c859dced6cd88744bc7ac2ba7c54188d
2021-04-06 23:06:28 +00:00
Edwin Wong
91a4fcb311 Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev 2021-04-06 22:27:14 +00:00
Edwin Wong
05d2bd5975 Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into rvc-dev am: 8e96e47c73
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13812193

Change-Id: I7cef0f328ce49e592f0bed6f48900517810ce198
2021-04-06 21:49:17 +00:00
Edwin Wong
6effd16a8b [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: a4e76aab23
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13812193

Change-Id: I59565fec934a5be32b5c5f32b6586965a7d9a932
2021-04-06 21:49:14 +00:00
Edwin Wong
8e96e47c73 Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into rvc-dev 2021-04-06 21:06:40 +00:00
Edwin Wong
2179627078 Merge "Fix potential decrypt destPtr overflow." into rvc-dev am: fc62c64de1
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13467452

Change-Id: If4aacd71d59955f315174047dda61e4dbd1e7e9a
2021-04-05 21:56:38 +00:00
Edwin Wong
fc62c64de1 Merge "Fix potential decrypt destPtr overflow." into rvc-dev 2021-04-05 21:22:06 +00:00
Edwin Wong
a4e76aab23 [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability.
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.

SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.

The crash was reproduced on the device before the fix.
Verified the test passes after the fix.

Test: sts
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176495665_sts64

Bug: 176495665
Bug: 176444161
Change-Id: I4c83c44873eef960b654f387a3574fcad49c41a9
2021-04-02 21:50:49 +00:00
TreeHugger Robot
229e07f9b9 Merge "Camera: Fix double-free in removeCamera" into rvc-qpr-dev 2021-03-12 17:50:13 +00:00
Hao Chen
a216f7fade Merge "Gracefully stop the GeneratorHub worker thread in destructor" into rvc-qpr-dev 2021-03-10 23:12:55 +00:00
Edwin Wong
31227a39a6 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef am: 739cc2cc9a -s ours am: eca5c71820
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Id5821c5d547e34b8cfc97476a0190f82c846292a
2021-03-10 21:13:54 +00:00
Edwin Wong
eca5c71820 [automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef am: 739cc2cc9a -s ours
am skip reason: subject contains skip directive

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: Ie7fedb2ce5e454c7216ff74fe878b193d0b67a85
2021-03-10 20:56:24 +00:00
Edwin Wong
739cc2cc9a [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212

MUST ONLY BE SUBMITTED BY AUTOMERGER

Change-Id: I43e854331e0b99158a81819a8541c05bcab5b358
2021-03-10 20:12:36 +00:00
Edwin Wong
0dc3f03835 Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev 2021-03-10 19:00:01 +00:00
Edwin Wong
9fcd4886a3 [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability.
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.

SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.

The crash was reproduced on the device before the fix.
Verified the test passes after the fix.

Test: sts
  sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665

Test: push to device with target_hwasan-userdebug build
  adb shell /data/local/tmp/Bug-176495665_sts64

Bug: 176495665
Bug: 176444161
Change-Id: I3ec33cd444183f40ee76bec4c88dec0dac859cd3
2021-03-08 23:27:38 -08:00