DivestOS/Patches/Linux_CVEs/CVE-2016-3892/ANY/0001.patch

From dd40cc2bd210dd7a4dd649e8f79add2bbeda2bd5 Mon Sep 17 00:00:00 2001
From: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
Date: Wed, 15 Jun 2016 09:46:21 -0700
Subject: spmi: prevent showing the address of spmidev

Creating devices with the address of the container spmidev is not
indicative of the actual hardware device it represents.

Instead use an unique id to indicate the device it represents.

CRs-Fixed: 1024197
Change-Id: Id18e2a19f4fa1249901a3f275defa8f589270d69
Signed-off-by: Abhijeet Dharmapurikar <adharmap@codeaurora.org>
---
 drivers/spmi/spmi.c  | 18 +++++++++++++++---
 include/linux/spmi.h |  6 +++++-
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c
index f5e49c8..1a1bae9 100644
--- a/drivers/spmi/spmi.c
+++ b/drivers/spmi/spmi.c
@@ -32,6 +32,7 @@ struct spmii_boardinfo {
 static DEFINE_MUTEX(board_lock);
 static LIST_HEAD(board_list);
 static DEFINE_IDR(ctrl_idr);
+static DEFINE_IDA(spmi_devid_ida);
 static struct device_type spmi_dev_type;
 static struct device_type spmi_ctrl_type;
 
@@ -229,22 +230,32 @@ int spmi_add_device(struct spmi_device *spmidev)
 {
 	int rc;
 	struct device *dev = get_valid_device(spmidev);
+	int id;
 
 	if (!dev) {
 		pr_err("invalid SPMI device\n");
 		return -EINVAL;
 	}
 
+	id = ida_simple_get(&spmi_devid_ida, 0, 0, GFP_KERNEL);
+	if (id < 0) {
+		pr_err("No id available status = %d\n", id);
+		return id;
+	}
+
 	/* Set the device name */
-	dev_set_name(dev, "%s-%p", spmidev->name, spmidev);
+	spmidev->id = id;
+	dev_set_name(dev, "%s-%d", spmidev->name, spmidev->id);
 
 	/* Device may be bound to an active driver when this returns */
 	rc = device_add(dev);
 
-	if (rc < 0)
+	if (rc < 0) {
+		ida_simple_remove(&spmi_devid_ida, spmidev->id);
 		dev_err(dev, "Can't add %s, status %d\n", dev_name(dev), rc);
-	else
+	} else {
 		dev_dbg(dev, "device %s registered\n", dev_name(dev));
+	}
 
 	return rc;
 }
@@ -292,6 +303,7 @@ EXPORT_SYMBOL_GPL(spmi_new_device);
 void spmi_remove_device(struct spmi_device *spmi_dev)
 {
 	device_unregister(&spmi_dev->dev);
+	ida_simple_remove(&spmi_devid_ida, spmi_dev->id);
 }
 EXPORT_SYMBOL_GPL(spmi_remove_device);
 
diff --git a/include/linux/spmi.h b/include/linux/spmi.h
index b581de8..5a8525d 100644
--- a/include/linux/spmi.h
+++ b/include/linux/spmi.h
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2014 The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -120,6 +120,9 @@ struct spmi_resource {
  *  @dev_node: array of SPMI resources when used with spmi-dev-container.
  *  @num_dev_node: number of device_node structures.
  *  @sid: Slave Identifier.
+ *  @id: Unique identifier to differentiate from other spmi devices with
+ *       possibly same name.
+ *
  */
 struct spmi_device {
 	struct device		dev;
@@ -129,6 +132,7 @@ struct spmi_device {
 	struct spmi_resource	*dev_node;
 	u32			num_dev_node;
 	u8			sid;
+	int			id;
 };
 #define to_spmi_device(d) container_of(d, struct spmi_device, dev)
 
-- 
cgit v1.1