DivestOS/Patches/Linux_CVEs/CVE-2017-0523/4.4/0002.patch

From 2c7b4349b858398caf0ae146e87554c3502d20a5 Mon Sep 17 00:00:00 2001
From: Hamad Kadmany <hkadmany@codeaurora.org>
Date: Sun, 18 Dec 2016 15:03:11 +0200
Subject: wil6210: Block write ioctl to the card by default

The ability to write to the card is used for debug purposes.
The ability is disabled by default to prevent misuse of
this functionality.

CRs-Fixed: 1096945
Change-Id: I8fc3f646a0127ec705239be6a7de858a4f805acc
Signed-off-by: Hamad Kadmany <hkadmany@codeaurora.org>
---
 drivers/net/wireless/ath/wil6210/Kconfig | 11 +++++++++++
 drivers/net/wireless/ath/wil6210/ioctl.c |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
index 9e3961c..8f0bde5 100644
--- a/drivers/net/wireless/ath/wil6210/Kconfig
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -41,6 +41,17 @@ config WIL6210_TRACING
 
 	  If unsure, say Y to make it easier to debug problems.
 
+config WIL6210_WRITE_IOCTL
+	bool "wil6210 write ioctl to the device"
+	depends on WIL6210
+	default n
+	---help---
+	  Say Y here to allow write-access from user-space to
+	  the device memory through ioctl. This is useful for
+	  debugging purposes only.
+
+	  If unsure, say N.
+
 config WIL6210_PLATFORM_MSM
 	bool "wil6210 MSM platform specific support"
 	depends on WIL6210
diff --git a/drivers/net/wireless/ath/wil6210/ioctl.c b/drivers/net/wireless/ath/wil6210/ioctl.c
index 47058ccc..bbdd232 100644
--- a/drivers/net/wireless/ath/wil6210/ioctl.c
+++ b/drivers/net/wireless/ath/wil6210/ioctl.c
@@ -87,10 +87,12 @@ static int wil_ioc_memio_dword(struct wil6210_priv *wil, void __user *data)
 		io.val = readl(a);
 		need_copy = true;
 		break;
+#if defined(CONFIG_WIL6210_WRITE_IOCTL)
 	case wil_mmio_write:
 		writel(io.val, a);
 		wmb(); /* make sure write propagated to HW */
 		break;
+#endif
 	default:
 		wil_err(wil, "Unsupported operation, op = 0x%08x\n", io.op);
 		return -EINVAL;
@@ -147,6 +149,7 @@ static int wil_ioc_memio_block(struct wil6210_priv *wil, void __user *data)
 			goto out_free;
 		}
 		break;
+#if defined(CONFIG_WIL6210_WRITE_IOCTL)
 	case wil_mmio_write:
 		if (copy_from_user(block, io.block, io.size)) {
 			rc = -EFAULT;
@@ -156,6 +159,7 @@ static int wil_ioc_memio_block(struct wil6210_priv *wil, void __user *data)
 		wmb(); /* make sure write propagated to HW */
 		wil_hex_dump_ioctl("Write ", block, io.size);
 		break;
+#endif
 	default:
 		wil_err(wil, "Unsupported operation, op = 0x%08x\n", io.op);
 		rc = -EINVAL;
-- 
cgit v1.1