Skip to content

Commit 192bafe

Browse files
ZenNoeZenNoe
authored
Add files via upload
1 parent d3752ba commit 192bafe

File tree

3 files changed

+680
-0
lines changed

3 files changed

+680
-0
lines changed

‎patches/3.4/CVE-2016-10289.patch

+83
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
From 413bcc259f0cf49b838dec8a6fdcaf7b9bfd663a Mon Sep 17 00:00:00 2001
2+
From: Zhen Kong <[email protected]>
3+
Date: Tue, 31 Jan 2017 12:07:10 -0800
4+
Subject: [PATCH] crypto: msm: check length before copying to buf in
5+
_debug_stats_read
6+
7+
Make sure that `len` is not larger than `count` before copying data
8+
to userspace `buf` in _debug_stats_read().
9+
10+
Change-Id: Ibea429889629916424f0e0a6e07c475f13de32c3
11+
Signed-off-by: Zhen Kong <[email protected]>
12+
---
13+
drivers/crypto/msm/ota_crypto.c | 8 ++++----
14+
drivers/crypto/msm/qcedev.c | 4 ++--
15+
drivers/crypto/msm/qcrypto.c | 6 +++---
16+
3 files changed, 9 insertions(+), 9 deletions(-)
17+
18+
diff --git a/drivers/crypto/msm/ota_crypto.c b/drivers/crypto/msm/ota_crypto.c
19+
index 6ecf5b2b4cce..3f73c0b594d2 100644
20+
--- a/drivers/crypto/msm/ota_crypto.c
21+
+++ b/drivers/crypto/msm/ota_crypto.c
22+
@@ -1,4 +1,4 @@
23+
-/* Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
24+
+/* Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
25+
*
26+
* This program is free software; you can redistribute it and/or modify
27+
* it under the terms of the GNU General Public License version 2 and
28+
@@ -743,9 +743,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
29+
int rc = -EINVAL;
30+
int len;
31+
32+
- len = _disp_stats();
33+
-
34+
- rc = simple_read_from_buffer((void __user *) buf, len,
35+
+ len = _disp_stats(qcota);
36+
+ if (len <= count)
37+
+ rc = simple_read_from_buffer((void __user *) buf, len,
38+
ppos, (void *) _debug_read_buf, len);
39+
40+
return rc;
41+
diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c
42+
index 2c3eae74e2e8..e9dddaa377ea 100644
43+
--- a/drivers/crypto/msm/qcedev.c
44+
+++ b/drivers/crypto/msm/qcedev.c
45+
@@ -2236,9 +2236,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
46+
47+
len = _disp_stats(qcedev);
48+
49+
- rc = simple_read_from_buffer((void __user *) buf, len,
50+
+ if (len <= count)
51+
+ rc = simple_read_from_buffer((void __user *) buf, len,
52+
ppos, (void *) _debug_read_buf, len);
53+
-
54+
return rc;
55+
}
56+
57+
diff --git a/drivers/crypto/msm/qcrypto.c b/drivers/crypto/msm/qcrypto.c
58+
index eb4cb3a8a775..1bb06ea15cae 100644
59+
--- a/drivers/crypto/msm/qcrypto.c
60+
+++ b/drivers/crypto/msm/qcrypto.c
61+
@@ -1,6 +1,6 @@
62+
/* Qualcomm Crypto driver
63+
*
64+
- * Copyright (c) 2010-2014, The Linux Foundation. All rights reserved.
65+
+ * Copyright (c) 2010-2017, The Linux Foundation. All rights reserved.
66+
*
67+
* This program is free software; you can redistribute it and/or modify
68+
* it under the terms of the GNU General Public License version 2 and
69+
@@ -4771,9 +4771,9 @@ static ssize_t _debug_stats_read(struct file *file, char __user *buf,
70+
71+
len = _disp_stats(qcrypto);
72+
73+
- rc = simple_read_from_buffer((void __user *) buf, len,
74+
+ if (len <= count)
75+
+ rc = simple_read_from_buffer((void __user *) buf, len,
76+
ppos, (void *) _debug_read_buf, len);
77+
-
78+
return rc;
79+
}
80+
81+
--
82+
2.13.3
83+

‎patches/3.4/CVE-2016-3934.patch

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
From a131535aa0918d334ed09c151cd6dc868f8f876c Mon Sep 17 00:00:00 2001
2+
From: Vasko Kalanoski <[email protected]>
3+
Date: Tue, 3 Feb 2015 13:17:44 +0200
4+
Subject: [PATCH] msm: camera: restructure data handling to be more robust
5+
6+
add dynamic array allocation instead of static to prevent
7+
stack overflow.
8+
9+
Change-Id: I01d225a4bc1c74606475adc5eb8eb76048c24eb7
10+
Signed-off-by: Vasko Kalanoski <[email protected]>
11+
---
12+
.../msm/camera_v2/sensor/io/msm_camera_cci_i2c.c | 23 +++++++++++++++++-----
13+
1 file changed, 18 insertions(+), 5 deletions(-)
14+
15+
diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c
16+
index 1f9f5ad3ab28..7819532cc644 100644
17+
--- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c
18+
+++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c
19+
@@ -148,17 +148,29 @@ int32_t msm_camera_cci_i2c_write_seq(struct msm_camera_i2c_client *client,
20+
int32_t rc = -EFAULT;
21+
uint8_t i = 0;
22+
struct msm_camera_cci_ctrl cci_ctrl;
23+
- struct msm_camera_i2c_reg_array reg_conf_tbl[num_byte];
24+
+ struct msm_camera_i2c_reg_array *reg_conf_tbl = NULL;
25+
26+
if ((client->addr_type != MSM_CAMERA_I2C_BYTE_ADDR
27+
&& client->addr_type != MSM_CAMERA_I2C_WORD_ADDR)
28+
|| num_byte == 0)
29+
return rc;
30+
31+
+ if (num_byte > I2C_SEQ_REG_DATA_MAX) {
32+
+ pr_err("%s: num_byte=%d clamped to max supported %d\n",
33+
+ __func__, num_byte, I2C_SEQ_REG_DATA_MAX);
34+
+ return rc;
35+
+ }
36+
+
37+
S_I2C_DBG("%s reg addr = 0x%x num bytes: %d\n",
38+
- __func__, addr, num_byte);
39+
- memset(reg_conf_tbl, 0,
40+
- num_byte * sizeof(struct msm_camera_i2c_reg_array));
41+
+ __func__, addr, num_byte);
42+
+
43+
+ reg_conf_tbl = kzalloc(num_byte *
44+
+ (sizeof(struct msm_camera_i2c_reg_array)), GFP_KERNEL);
45+
+ if (!reg_conf_tbl) {
46+
+ pr_err("%s:%d no memory\n", __func__, __LINE__);
47+
+ return -ENOMEM;
48+
+ }
49+
+
50+
#if defined(CONFIG_MACH_MSM8226_E7WIFI) || defined(CONFIG_MACH_MSM8226_E8WIFI)
51+
for (i = 0; i < num_byte; i++) {
52+
reg_conf_tbl[i].reg_addr = addr+i;
53+
@@ -172,7 +184,6 @@ int32_t msm_camera_cci_i2c_write_seq(struct msm_camera_i2c_client *client,
54+
reg_conf_tbl[i].delay = 0;
55+
}
56+
#endif
57+
- cci_ctrl.cmd = MSM_CCI_I2C_WRITE_SEQ;
58+
cci_ctrl.cci_info = client->cci_client;
59+
cci_ctrl.cfg.cci_i2c_write_cfg.reg_setting = reg_conf_tbl;
60+
cci_ctrl.cfg.cci_i2c_write_cfg.data_type = MSM_CAMERA_I2C_BYTE_DATA;
61+
@@ -182,6 +193,8 @@ int32_t msm_camera_cci_i2c_write_seq(struct msm_camera_i2c_client *client,
62+
core, ioctl, VIDIOC_MSM_CCI_CFG, &cci_ctrl);
63+
CDBG("%s line %d rc = %d\n", __func__, __LINE__, rc);
64+
rc = cci_ctrl.status;
65+
+ kfree(reg_conf_tbl);
66+
+ reg_conf_tbl = NULL;
67+
return rc;
68+
}
69+
70+
--
71+
2.13.3
72+

0 commit comments

Comments
 (0)