Edwin Wong
2bbbc56712
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours am: bc0c22c343 -s ours am: 6c942475ba -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668
Change-Id: I6de7dc34d951e5d6b05dc77757d5911a64ba88d4
2021-07-13 22:17:08 +00:00
Edwin Wong
6c942475ba
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours am: bc0c22c343 -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668
Change-Id: I481b343e5889cddc535c36a28c310f35e2cd4a89
2021-07-13 22:03:13 +00:00
Edwin Wong
bc0c22c343
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours am: e17031023f -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668
Change-Id: I957226dd902bd82def0d6498abc1cf5e5c5818dd
2021-07-13 21:44:50 +00:00
Edwin Wong
e17031023f
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev am: 0dc3f03835 -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13459668
Change-Id: I60aafc1050107127e9bf481268f43fe5725ce97f
2021-07-13 21:28:31 +00:00
Daniel Cardenas
548b8c48c4
[automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0 am: 5a01e2bac8 am: bbe4dea57b
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957
Change-Id: Id42cf407b9635d68907c6fb35908215903a2fdaa
2021-06-02 23:03:46 +00:00
Edwin Wong
24100c6309
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0 am: edbc9b1984 -s ours am: e45800a874
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923
Change-Id: I6992524dd96ef75b358173b8d45ba7835bedef29
2021-06-02 23:03:37 +00:00
Edwin Wong
c84661b1db
Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b am: e0db28bc6c am: 68e65826c0
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307
Change-Id: Ia748c2c17d7fa26fa238d6839f244998207acb6b
2021-06-02 23:03:23 +00:00
chao.meng
107456af4f
[automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8 am: 1d251753e7 -s ours am: a635038c52
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060
Change-Id: I04a1f70735112667e32a460877f971f8facc3de3
2021-06-02 23:03:11 +00:00
Treehugger Robot
19785d2519
[automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82 am: 723fe3456f am: de90ba21fd
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162
Change-Id: I687fc536399c32efb656127d80b39bd445ab0d7d
2021-06-02 23:02:45 +00:00
Daniel Cardenas
bbe4dea57b
[automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0 am: 5a01e2bac8
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957
Change-Id: Ia41d1c798ae65a20a1ea1127a210c9e3bbfc2d4e
2021-06-02 22:47:52 +00:00
Edwin Wong
e45800a874
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0 am: edbc9b1984 -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923
Change-Id: Iffdccf118a1d0cfdd4dc24512fd0ad0f60d157d4
2021-06-02 22:47:40 +00:00
Edwin Wong
68e65826c0
Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b am: e0db28bc6c
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307
Change-Id: If86318a341d02d19988c1243684378680e89c8bd
2021-06-02 22:47:30 +00:00
chao.meng
a635038c52
[automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8 am: 1d251753e7 -s ours
...
am skip reason: subject contains skip directive
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060
Change-Id: I0db437d45bc69760f87bf45ff71280bda546dfc2
2021-06-02 22:47:24 +00:00
Treehugger Robot
de90ba21fd
[automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82 am: 723fe3456f
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162
Change-Id: Ie4d3b401464424fab27036553962b7173f7c5575
2021-06-02 22:47:15 +00:00
Daniel Cardenas
5a01e2bac8
[automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5 am: b19ec800c0
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957
Change-Id: I5accd9ccc4ec99063c2f73f89255c9df034625e7
2021-06-02 22:25:47 +00:00
Edwin Wong
edbc9b1984
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours am: 83f2db8fc0
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923
Change-Id: I826e294c859e84e8eff9d9247247f17e287868ef
2021-06-02 22:25:40 +00:00
Edwin Wong
e0db28bc6c
Fix potential decrypt src pointer overflow. am: c9b5693c7f am: 425466627b
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307
Change-Id: I12994ecda8c80cb3caf6c442810f0823a4453d07
2021-06-02 22:25:26 +00:00
chao.meng
1d251753e7
[automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours am: ad6c07e4c8
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060
Change-Id: I2fb8e04f81e2172b24017ec3b6cf9f3dbbaf5adc
2021-06-02 22:25:21 +00:00
Treehugger Robot
723fe3456f
[automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours am: 09936c8c82
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162
Change-Id: I8af0c06fa7ad3b7c97c95ad25e4cf42f04e831af
2021-06-02 22:25:12 +00:00
Daniel Cardenas
b19ec800c0
[automerger skipped] Increase default timeout for changeStateIdletoExecute() from 100ms to 400ms am: c476ff3857 -s ours am: fd44461bd5
...
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1508957
Change-Id: Ifd09169a35dce4ff77871cf40014eda19bcd3487
2021-06-02 22:04:45 +00:00
Edwin Wong
83f2db8fc0
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt srcPtr overflow. am: 072cdf233c -s ours am: b64b770489 -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13423923
Change-Id: I305e3d5ec027e9bf0802704aecdaf08bc9da6e2c
2021-06-02 22:04:34 +00:00
Edwin Wong
425466627b
Fix potential decrypt src pointer overflow. am: c9b5693c7f
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13412307
Change-Id: I2e57da4ac02939aecb9cc06eff639e17bd4e46e0
2021-06-02 22:04:23 +00:00
chao.meng
ad6c07e4c8
[automerger skipped] DO NOT MERGE Add sleep(3) after stopSupplicant when VtsHalWifiSupplicant am: ca07893589 -s ours am: 8adb4f6581 -s ours
...
am skip reason: subject contains skip directive
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1478060
Change-Id: I7fcf9ec936de79b8a670991b3b89c27aa2752f17
2021-06-02 22:04:18 +00:00
Treehugger Robot
09936c8c82
[automerger skipped] Merge "vts: wifi: softap and p2p are optional feature per CDD" into pie-vts-dev am: a5f27a462e am: 866ba26264 -s ours
...
am skip reason: skipped by user pateljay
Original change: https://android-review.googlesource.com/c/platform/hardware/interfaces/+/1322162
Change-Id: I530e31e29b4e2f5fafa4d25ad52bd5e196e3c9b1
2021-06-02 22:03:53 +00:00
Alisher Alikhodjaev
14162741e7
Merge "Out of bounds read in hal_core_initialized" into rvc-qpr-dev
2021-04-30 23:55:46 +00:00
Steven Moreland
da947d5127
audio HAL - fix UAFs am: 7283cbe8cb am: e227bfd15c am: facfee6382
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414
Change-Id: I50df59e828d44606c2fca8dc44830b5def4f9670
2021-04-26 22:46:24 +00:00
Steven Moreland
facfee6382
audio HAL - fix UAFs am: 7283cbe8cb am: e227bfd15c
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414
Change-Id: I5b80e2810ef7c4010496687934d93685057d4c82
2021-04-26 22:31:02 +00:00
Steven Moreland
e227bfd15c
audio HAL - fix UAFs am: 7283cbe8cb
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/14212414
Change-Id: I975f17cc4c76755b4da89f7782dab18f2e0f36b4
2021-04-26 22:07:21 +00:00
Steven Moreland
7283cbe8cb
audio HAL - fix UAFs
...
Bug: 185259758
Test: N/A
Change-Id: I5ec70b098a00746108e10ab39e966607d78c84ae
Merged-In: I5ec70b098a00746108e10ab39e966607d78c84ae
(cherry picked from commit a8ac7cf706 )
2021-04-16 18:36:09 +00:00
Alisher Alikhodjaev
35f34f4d01
Out of bounds read in hal_core_initialized
...
Bug: 176446340
Test: build and run
Change-Id: I02f93750e590b2384f79580dd7c06fc06f46a4ca
2021-04-15 19:12:52 -07:00
Edwin Wong
041e19dd25
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311 am: c7c4045f14 -s ours am: 09d70a56f4
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: I8bca8f892023177f641f2afd725a2155fd2237ef
2021-04-06 23:47:35 +00:00
Edwin Wong
db639ecf17
[automerger skipped] [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3 am: be8d2c6ebb -s ours am: 21f97ec264
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: Ia253d97d385ff379972eb112b6c76a038167929d
2021-04-06 23:47:32 +00:00
Edwin Wong
09d70a56f4
[automerger skipped] Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311 am: c7c4045f14 -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: Ic106b0e8d0d109dbf986c50cc97b93386c12427e
2021-04-06 23:27:22 +00:00
Edwin Wong
21f97ec264
[automerger skipped] [RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3 am: be8d2c6ebb -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: Ide0c8906230f88e4d3d8d8fdf434ca0223315532
2021-04-06 23:27:19 +00:00
Edwin Wong
c7c4045f14
Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev am: 91a4fcb311
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: Ida94a5318e928a10b9c6348ef46faeb92b5f3254
2021-04-06 23:06:29 +00:00
Edwin Wong
be8d2c6ebb
[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: 9fcd4886a3
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13499186
Change-Id: Ida447099c859dced6cd88744bc7ac2ba7c54188d
2021-04-06 23:06:28 +00:00
Edwin Wong
91a4fcb311
Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into qt-dev
2021-04-06 22:27:14 +00:00
Edwin Wong
05d2bd5975
Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into rvc-dev am: 8e96e47c73
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13812193
Change-Id: I7cef0f328ce49e592f0bed6f48900517810ce198
2021-04-06 21:49:17 +00:00
Edwin Wong
6effd16a8b
[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability. am: a4e76aab23
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13812193
Change-Id: I59565fec934a5be32b5c5f32b6586965a7d9a932
2021-04-06 21:49:14 +00:00
Edwin Wong
8e96e47c73
Merge "[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability." into rvc-dev
2021-04-06 21:06:40 +00:00
Edwin Wong
2179627078
Merge "Fix potential decrypt destPtr overflow." into rvc-dev am: fc62c64de1
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13467452
Change-Id: If4aacd71d59955f315174047dda61e4dbd1e7e9a
2021-04-05 21:56:38 +00:00
Edwin Wong
fc62c64de1
Merge "Fix potential decrypt destPtr overflow." into rvc-dev
2021-04-05 21:22:06 +00:00
Edwin Wong
a4e76aab23
[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability.
...
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.
SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.
The crash was reproduced on the device before the fix.
Verified the test passes after the fix.
Test: sts
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-176495665_sts64
Bug: 176495665
Bug: 176444161
Change-Id: I4c83c44873eef960b654f387a3574fcad49c41a9
2021-04-02 21:50:49 +00:00
TreeHugger Robot
229e07f9b9
Merge "Camera: Fix double-free in removeCamera" into rvc-qpr-dev
2021-03-12 17:50:13 +00:00
Hao Chen
a216f7fade
Merge "Gracefully stop the GeneratorHub worker thread in destructor" into rvc-qpr-dev
2021-03-10 23:12:55 +00:00
Edwin Wong
31227a39a6
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef am: 739cc2cc9a -s ours am: eca5c71820
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Id5821c5d547e34b8cfc97476a0190f82c846292a
2021-03-10 21:13:54 +00:00
Edwin Wong
eca5c71820
[automerger skipped] [RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef am: 739cc2cc9a -s ours
...
am skip reason: subject contains skip directive
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: Ie7fedb2ce5e454c7216ff74fe878b193d0b67a85
2021-03-10 20:56:24 +00:00
Edwin Wong
739cc2cc9a
[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow. am: a6e551feef
...
Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/interfaces/+/13474212
MUST ONLY BE SUBMITTED BY AUTOMERGER
Change-Id: I43e854331e0b99158a81819a8541c05bcab5b358
2021-03-10 20:12:36 +00:00
Edwin Wong
0dc3f03835
Merge "[RESTRICT AUTOMERGE] Fix potential decrypt destPtr overflow." into pi-dev
2021-03-10 19:00:01 +00:00
Edwin Wong
9fcd4886a3
[RESTRICT AUTOMERGE] Fix CryptoPlugin use after free vulnerability.
...
The shared memory buffer used by srcPtr can be freed by another
thread because it is not protected by a mutex. Subsequently,
a use after free AIGABRT can occur in a race condition.
SafetyNet logging is not added to avoid log spamming. The
mutex lock is called to setup for decryption, which is
called frequently.
The crash was reproduced on the device before the fix.
Verified the test passes after the fix.
Test: sts
sts-tradefed run sts-engbuild-no-spl-lock -m StsHostTestCases --test android.security.sts.Bug_176495665#testPocBug_176495665
Test: push to device with target_hwasan-userdebug build
adb shell /data/local/tmp/Bug-176495665_sts64
Bug: 176495665
Bug: 176444161
Change-Id: I3ec33cd444183f40ee76bec4c88dec0dac859cd3
2021-03-08 23:27:38 -08:00