Skip to content

Commit 78a9928

Browse files
raymanfxraymanfx
authored
Merge pull request #4 from Zennoe/master
Add 3.4 kernel folder with patches
2 parents b3b499c + 192bafe commit 78a9928

28 files changed

+4907
-0
lines changed

‎patches/3.4/CVE-2015-8943.patch

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
From 8ee577ed10d44d5f05e11bb60d9b0d8679bcb614 Mon Sep 17 00:00:00 2001
2+
From: Jayant Shekhar <[email protected]>
3+
Date: Tue, 20 Jan 2015 16:12:43 +0530
4+
Subject: [PATCH] msm: mdss: Unmap only when buffer was mapped
5+
6+
Currently buffer is unmapped if iommu is attached.
7+
This can lead to potential unmap issues if wrong
8+
addresses are sent and are tried to unmap without
9+
mapping. Hence ensure unmap is done only when
10+
buffer is mapped.
11+
12+
Change-Id: I6d7f1eb1e951cd314a4c3c35551c87930af5118e
13+
Signed-off-by: Jayant Shekhar <[email protected]>
14+
---
15+
drivers/video/msm/mdss/mdss_mdp.h | 1 +
16+
drivers/video/msm/mdss/mdss_mdp_util.c | 4 +++-
17+
2 files changed, 4 insertions(+), 1 deletion(-)
18+
19+
diff --git a/drivers/video/msm/mdss/mdss_mdp.h b/drivers/video/msm/mdss/mdss_mdp.h
20+
index 00b0cebc04b..6c65a1e62b0 100644
21+
--- a/drivers/video/msm/mdss/mdss_mdp.h
22+
+++ b/drivers/video/msm/mdss/mdss_mdp.h
23+
@@ -300,6 +300,7 @@ struct mdss_mdp_img_data {
24+
u32 len;
25+
u32 flags;
26+
int p_need;
27+
+ bool mapped;
28+
struct file *srcp_file;
29+
struct ion_handle *srcp_ihdl;
30+
};
31+
diff --git a/drivers/video/msm/mdss/mdss_mdp_util.c b/drivers/video/msm/mdss/mdss_mdp_util.c
32+
index 0b1a154a225..d25b1b65cc4 100644
33+
--- a/drivers/video/msm/mdss/mdss_mdp_util.c
34+
+++ b/drivers/video/msm/mdss/mdss_mdp_util.c
35+
@@ -522,7 +522,7 @@ int mdss_mdp_put_img(struct mdss_mdp_img_data *data)
36+
pr_err("invalid ion client\n");
37+
return -ENOMEM;
38+
} else {
39+
- if (is_mdss_iommu_attached()) {
40+
+ if (data->mapped) {
41+
int domain;
42+
if (data->flags & MDP_SECURE_OVERLAY_SESSION)
43+
domain = MDSS_IOMMU_DOMAIN_SECURE;
44+
@@ -535,6 +535,7 @@ int mdss_mdp_put_img(struct mdss_mdp_img_data *data)
45+
msm_ion_unsecure_buffer(iclient,
46+
data->srcp_ihdl);
47+
}
48+
+ data->mapped = false;
49+
}
50+
ion_free(iclient, data->srcp_ihdl);
51+
data->srcp_ihdl = NULL;
52+
@@ -613,6 +614,7 @@ int mdss_mdp_get_img(struct msmfb_data *img, struct mdss_mdp_img_data *data)
53+
if (ret && (domain == MDSS_IOMMU_DOMAIN_SECURE))
54+
msm_ion_unsecure_buffer(iclient,
55+
data->srcp_ihdl);
56+
+ data->mapped = true;
57+
} else {
58+
ret = ion_phys(iclient, data->srcp_ihdl, start,
59+
(size_t *) len);

‎patches/3.4/CVE-2015-8944.patch

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
From 465a6856bafc2f627753596c60894b0ec40310f2 Mon Sep 17 00:00:00 2001
2+
From: Biswajit Paul <[email protected]>
3+
Date: Mon, 9 Feb 2015 15:21:12 -0800
4+
Subject: [PATCH] kernel: Restrict permissions of /proc/iomem.
5+
6+
The permissions of /proc/iomem currently are -r--r--r--. Everyone can
7+
see its content. As iomem contains information about the physical memory
8+
content of the device, restrict the information only to root.
9+
10+
Change-Id: If0be35c3fac5274151bea87b738a48e6ec0ae891
11+
CRs-Fixed: 786116
12+
Signed-off-by: Biswajit Paul <[email protected]>
13+
Signed-off-by: Avijit Kanti Das <[email protected]>
14+
---
15+
kernel/resource.c | 2 +-
16+
1 file changed, 1 insertion(+), 1 deletion(-)
17+
18+
diff --git a/kernel/resource.c b/kernel/resource.c
19+
index 7203c06273a..e9ba0770ec3 100644
20+
--- a/kernel/resource.c
21+
+++ b/kernel/resource.c
22+
@@ -142,7 +142,7 @@ static const struct file_operations proc_iomem_operations = {
23+
static int __init ioresources_init(void)
24+
{
25+
proc_create("ioports", 0, NULL, &proc_ioports_operations);
26+
- proc_create("iomem", 0, NULL, &proc_iomem_operations);
27+
+ proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
28+
return 0;
29+
}
30+
__initcall(ioresources_init);

‎patches/3.4/CVE-2015-8955.patch

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
From 0bbcfb08a2e3a6d5fe83c1e58fca23d01fd88a21 Mon Sep 17 00:00:00 2001
2+
From: "Suzuki K. Poulose" <[email protected]>
3+
Date: Tue, 17 Mar 2015 18:14:58 +0000
4+
Subject: [PATCH] ARM: perf: reject groups spanning multiple hardware PMUs
5+
6+
The perf core implicitly rejects events spanning multiple HW PMUs, as in
7+
these cases the event->ctx will differ. However this validation is
8+
performed after pmu::event_init() is called in perf_init_event(), and
9+
thus pmu::event_init() may be called with a group leader from a
10+
different HW PMU.
11+
12+
The ARM PMU driver does not take this fact into account, and when
13+
validating groups assumes that it can call to_arm_pmu(event->pmu) for
14+
any HW event. When the event in question is from another HW PMU this is
15+
wrong, and results in dereferencing garbage.
16+
17+
This patch updates the ARM PMU driver to first test for and reject
18+
events from other PMUs, moving the to_arm_pmu and related logic after
19+
this test. Fixes a crash triggered by perf_fuzzer on Linux-4.0-rc2, with
20+
a CCI PMU present:
21+
22+
---
23+
CPU: 0 PID: 1527 Comm: perf_fuzzer Not tainted 4.0.0-rc2 #57
24+
Hardware name: ARM-Versatile Express
25+
task: bd8484c0 ti: be676000 task.ti: be676000
26+
PC is at 0xbf1bbc90
27+
LR is at validate_event+0x34/0x5c
28+
pc : [<bf1bbc90>] lr : [<80016060>] psr: 00000013
29+
...
30+
[<80016060>] (validate_event) from [<80016198>] (validate_group+0x28/0x90)
31+
[<80016198>] (validate_group) from [<80016398>] (armpmu_event_init+0x150/0x218)
32+
[<80016398>] (armpmu_event_init) from [<800882e4>] (perf_try_init_event+0x30/0x48)
33+
[<800882e4>] (perf_try_init_event) from [<8008f544>] (perf_init_event+0x5c/0xf4)
34+
[<8008f544>] (perf_init_event) from [<8008f8a8>] (perf_event_alloc+0x2cc/0x35c)
35+
[<8008f8a8>] (perf_event_alloc) from [<8009015c>] (SyS_perf_event_open+0x498/0xa70)
36+
[<8009015c>] (SyS_perf_event_open) from [<8000e420>] (ret_fast_syscall+0x0/0x34)
37+
Code: bf1be000 bf1bb380 802a2664 00000000 (00000002)
38+
---[ end trace 01aff0ff00926a0a ]---
39+
40+
Also cleans up the code to use the arm_pmu only when we know that
41+
we are dealing with an arm pmu event.
42+
43+
Change-Id: I890a2a685d1ecd462287f19907c3de8bedee2c70
44+
Cc: Will Deacon <[email protected]>
45+
Acked-by: Mark Rutland <[email protected]>
46+
Acked-by: Peter Ziljstra (Intel) <[email protected]>
47+
Signed-off-by: Suzuki K. Poulose <[email protected]>
48+
Signed-off-by: Will Deacon <[email protected]>
49+
---
50+
arch/arm/kernel/perf_event.c | 24 ++++++++++++++++++------
51+
1 file changed, 18 insertions(+), 6 deletions(-)
52+
53+
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
54+
index 5989418ca04..15d45df3fd3 100644
55+
--- a/arch/arm/kernel/perf_event.c
56+
+++ b/arch/arm/kernel/perf_event.c
57+
@@ -343,19 +343,31 @@ out:
58+
}
59+
60+
static int
61+
-validate_event(struct pmu_hw_events *hw_events,
62+
+validate_event(struct pmu *pmu, struct pmu_hw_events *hw_events,
63+
struct perf_event *event)
64+
{
65+
- struct arm_pmu *armpmu = to_arm_pmu(event->pmu);
66+
+ struct arm_pmu *armpmu;
67+
struct hw_perf_event fake_event = event->hw;
68+
struct pmu *leader_pmu = event->group_leader->pmu;
69+
70+
if (is_software_event(event))
71+
return 1;
72+
73+
- if (event->pmu != leader_pmu || event->state <= PERF_EVENT_STATE_OFF)
74+
+ /*
75+
+ * Reject groups spanning multiple HW PMUs (e.g. CPU + CCI). The
76+
+ * core perf code won't check that the pmu->ctx == leader->ctx
77+
+ * until after pmu->event_init(event).
78+
+ */
79+
+ if (event->pmu != pmu)
80+
+ return 0;
81+
+
82+
+ if (event->pmu != leader_pmu || event->state < PERF_EVENT_STATE_OFF)
83+
+ return 1;
84+
+
85+
+ if (event->state == PERF_EVENT_STATE_OFF && !event->attr.enable_on_exec)
86+
return 1;
87+
88+
+ armpmu = to_arm_pmu(event->pmu);
89+
return armpmu->get_event_idx(hw_events, &fake_event) >= 0;
90+
}
91+
92+
@@ -373,15 +385,15 @@ validate_group(struct perf_event *event)
93+
memset(fake_used_mask, 0, sizeof(fake_used_mask));
94+
fake_pmu.used_mask = fake_used_mask;
95+
96+
- if (!validate_event(&fake_pmu, leader))
97+
+ if (!validate_event(event->pmu, &fake_pmu, leader))
98+
return -EINVAL;
99+
100+
list_for_each_entry(sibling, &leader->sibling_list, group_entry) {
101+
- if (!validate_event(&fake_pmu, sibling))
102+
+ if (!validate_event(event->pmu, &fake_pmu, sibling))
103+
return -EINVAL;
104+
}
105+
106+
- if (!validate_event(&fake_pmu, event))
107+
+ if (!validate_event(event->pmu, &fake_pmu, event))
108+
return -EINVAL;
109+
110+
return 0;
111+
--
112+
2.13.3
113+

‎patches/3.4/CVE-2016-0774.patch

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
From f6447b2c1c4846d61c8d5cbc9d9586f2408880e4 Mon Sep 17 00:00:00 2001
2+
From: Jeff Vander Stoep <[email protected]>
3+
Date: Wed, 23 Mar 2016 15:32:14 -0700
4+
Subject: [PATCH] pipe: iovec: Fix OOB read in pipe_read()
5+
6+
Previous upstream *stable* fix 14f81062 was incomplete.
7+
8+
A local process can trigger a system crash with an OOB read on buf.
9+
This occurs when the state of buf gets out of sync. After an error in
10+
pipe_iov_copy_to_user() read_pipe may exit having updated buf->offset
11+
but not buf->len. Upon retrying pipe_read() while in
12+
pipe_iov_copy_to_user() *remaining will be larger than the space left
13+
after buf->offset e.g. *remaing = PAGE_SIZE, buf->len = PAGE_SIZE,
14+
buf->offset = 0x300.
15+
16+
This is fixed by not updating the state of buf->offset until after the
17+
full copy is completed, similar to how pipe_write() is implemented.
18+
19+
For stable kernels < 3.16.
20+
21+
Bug: 27721803
22+
Change-Id: Iefffbcc6cfd159dba69c31bcd98c6d5c1f21ff2e
23+
Signed-off-by: Jeff Vander Stoep <[email protected]>
24+
---
25+
fs/pipe.c | 6 ++++--
26+
1 file changed, 4 insertions(+), 2 deletions(-)
27+
28+
diff --git a/fs/pipe.c b/fs/pipe.c
29+
index edd1c636bf1..c1ddb284357 100644
30+
--- a/fs/pipe.c
31+
+++ b/fs/pipe.c
32+
@@ -395,7 +395,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
33+
const struct pipe_buf_operations *ops = buf->ops;
34+
void *addr;
35+
size_t chars = buf->len, remaining;
36+
- int error, atomic;
37+
+ int error, atomic, offset;
38+
39+
if (chars > total_len)
40+
chars = total_len;
41+
@@ -409,9 +409,10 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
42+
43+
atomic = !iov_fault_in_pages_write(iov, chars);
44+
remaining = chars;
45+
+ offset = buf->offset;
46+
redo:
47+
addr = ops->map(pipe, buf, atomic);
48+
- error = pipe_iov_copy_to_user(iov, addr, &buf->offset,
49+
+ error = pipe_iov_copy_to_user(iov, addr, &offset,
50+
&remaining, atomic);
51+
ops->unmap(pipe, buf, addr);
52+
if (unlikely(error)) {
53+
@@ -427,6 +428,7 @@ pipe_read(struct kiocb *iocb, const struct iovec *_iov,
54+
break;
55+
}
56+
ret += chars;
57+
+ buf->offset += chars;
58+
buf->len -= chars;
59+
60+
/* Was it a packet buffer? Clean up and exit */

‎patches/3.4/CVE-2016-0805.patch

+55
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
From 1e7cf1e770aa8693452bb6c7dda7f43bfc026bf7 Mon Sep 17 00:00:00 2001
2+
From: Swetha Chikkaboraiah <[email protected]>
3+
Date: Wed, 27 Jan 2016 11:46:54 +0530
4+
Subject: [PATCH] msm: perf: Protect buffer overflow due to malicious user
5+
6+
In function krait_pmu_disable_event, parameter hwc comes from
7+
userspace and is untrusted.The function krait_clearpmu is called
8+
after the function get_krait_evtinfo.
9+
Function get_krait_evtinfo as parameter krait_evt_type variable
10+
which is used to extract the groupcode(reg) which is bound to
11+
KRAIT_MAX_L1_REG (is 3). After validation,one code path modifies
12+
groupcode(reg):If this code path executes, groupcode(reg) can be
13+
3,4, 5, or 6. In krait_clearpmu groupcode used to access array
14+
krait_functions whose size is 3. Since groupcode can be 3,4,5,6
15+
accessing array krait_functions lead to bufferoverlflow.
16+
This change will validate groupcode not to exceed 3 .
17+
18+
Change-Id: I48c92adda137d8a074b4e1a367a468195a810ca1
19+
CRs-fixed: 962450
20+
Signed-off-by: Swetha Chikkaboraiah <[email protected]>
21+
---
22+
arch/arm/kernel/perf_event_msm_krait.c | 8 ++++----
23+
1 file changed, 4 insertions(+), 4 deletions(-)
24+
25+
diff --git a/arch/arm/kernel/perf_event_msm_krait.c b/arch/arm/kernel/perf_event_msm_krait.c
26+
index 1c338f79bab..3f09c4c0754 100644
27+
--- a/arch/arm/kernel/perf_event_msm_krait.c
28+
+++ b/arch/arm/kernel/perf_event_msm_krait.c
29+
@@ -1,5 +1,5 @@
30+
/*
31+
- * Copyright (c) 2011-2012, 2014 The Linux Foundation. All rights reserved.
32+
+ * Copyright (c) 2011-2012, 2014,2016 The Linux Foundation. All rights reserved.
33+
*
34+
* This program is free software; you can redistribute it and/or modify
35+
* it under the terms of the GNU General Public License version 2 and
36+
@@ -219,9 +219,6 @@ static unsigned int get_krait_evtinfo(unsigned int krait_evt_type,
37+
code = (krait_evt_type & 0x00FF0) >> 4;
38+
group = krait_evt_type & 0x0000F;
39+
40+
- if ((group > 3) || (reg > krait_max_l1_reg))
41+
- return -EINVAL;
42+
-
43+
if (prefix != KRAIT_EVT_PREFIX && prefix != KRAIT_VENUMEVT_PREFIX)
44+
return -EINVAL;
45+
46+
@@ -232,6 +229,9 @@ static unsigned int get_krait_evtinfo(unsigned int krait_evt_type,
47+
reg += VENUM_BASE_OFFSET;
48+
}
49+
50+
+ if ((group > 3) || (reg > krait_max_l1_reg))
51+
+ return -EINVAL;
52+
+
53+
evtinfo->group_setval = 0x80000000 | (code << (group * 8));
54+
evtinfo->groupcode = reg;
55+
evtinfo->armv7_evt_type = evt_type_base[evt_index][reg] | group;

0 commit comments

Comments
 (0)