DivestOS/Patches/Linux_CVEs/CVE-2017-0524/ANY/0002.patch

From 0ab30d91fb178c5967753343029581983a4e9b67 Mon Sep 17 00:00:00 2001
From: Andrew Chant <achant@google.com>
Date: Fri, 13 Jan 2017 13:33:57 -0800
Subject: [PATCH] input: synaptics_dsx: protect tmpbuf allocation.

Protect tmpbuf from concurrent access by mutex.

BUG: 33555878
BUG: 33002026
Change-Id: Ia986a34647d5825946594ea17a5cd6fa0abb115f
Signed-off-by: Andrew Chant <achant@google.com>
---
 .../synaptics_dsx25/synaptics_dsx_rmi_dev.c        | 33 +++++++++++++++-------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
index 87abf86cdc6b4..018c621c0cfeb 100644
--- a/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
+++ b/drivers/input/touchscreen/synaptics_dsx25/synaptics_dsx_rmi_dev.c
@@ -483,16 +483,21 @@ static ssize_t rmidev_read(struct file *filp, char __user *buf,
 		return -EBADF;
 	}
 
-	if (count == 0)
-		return 0;
+	mutex_lock(&(dev_data->file_mutex));
 
+	if (*f_pos > REG_ADDR_LIMIT) {
+		retval = -EFAULT;
+		goto clean_up;
+	}
 	if (count > (REG_ADDR_LIMIT - *f_pos))
 		count = REG_ADDR_LIMIT - *f_pos;
+	if (count == 0) {
+		retval = 0;
+		goto clean_up;
+	}
 
 	rmidev_allocate_buffer(count);
 
-	mutex_lock(&(dev_data->file_mutex));
-
 	retval = synaptics_rmi4_reg_read(rmidev->rmi4_data,
 			*f_pos,
 			rmidev->tmpbuf,
@@ -530,18 +535,25 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
 		return -EBADF;
 	}
 
-	if (count == 0)
-		return 0;
+	mutex_lock(&(dev_data->file_mutex));
 
+	if (*f_pos > REG_ADDR_LIMIT) {
+		retval = -EFAULT;
+		goto unlock;
+	}
 	if (count > (REG_ADDR_LIMIT - *f_pos))
 		count = REG_ADDR_LIMIT - *f_pos;
+	if (count == 0) {
+		retval = 0;
+		goto unlock;
+	}
 
 	rmidev_allocate_buffer(count);
 
-	if (copy_from_user(rmidev->tmpbuf, buf, count))
-		return -EFAULT;
-
-	mutex_lock(&(dev_data->file_mutex));
+	if (copy_from_user(rmidev->tmpbuf, buf, count)) {
+		retval = -EFAULT;
+		goto unlock;
+	}
 
 	retval = synaptics_rmi4_reg_write(rmidev->rmi4_data,
 			*f_pos,
@@ -550,6 +562,7 @@ static ssize_t rmidev_write(struct file *filp, const char __user *buf,
 	if (retval >= 0)
 		*f_pos += retval;
 
+unlock:
 	mutex_unlock(&(dev_data->file_mutex));
 
 	return retval;