DivestOS/Patches/Linux_CVEs/CVE-2017-0445/ANY/0002.patch

From 367e64520dba1652d8f6d0ac1ebda3cab0f9e374 Mon Sep 17 00:00:00 2001
From: Andrew Chant <achant@google.com>
Date: Tue, 6 Dec 2016 17:03:07 -0800
Subject: [PATCH] input: synaptics_dsx: remove update sysfs entries

Remove sysfs entrypoints to fw_update module.
Also fixes request_firmware firmware update path.

BUG: 32769717
Change-Id: Iab7ff456288a18be71636b84c8e3008390c0d872
Signed-off-by: Andrew Chant <achant@google.com>
---
 .../touchscreen/synaptics_dsx_htc_2.6/Kconfig      | 10 ++++
 .../synaptics_dsx_fw_update.c                      | 53 ++++++++++++++++++++--
 2 files changed, 60 insertions(+), 3 deletions(-)

diff --git a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/Kconfig b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/Kconfig
index 30c64910d7dd5..60f536c8ee150 100644
--- a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/Kconfig
+++ b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/Kconfig
@@ -59,6 +59,16 @@ config TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_HTC_v26
 	  To compile this driver as a module, choose M here: the
 	  module will be called synaptics_dsx_fw_update.
 
+config TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
+	bool "Synaptics DSX firmware update sysfs attributes"
+	depends on TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_HTC_v26
+	help
+	  Say Y here to enable support for sysfs attributes for
+	  performing firmware update in a development environment.
+	  This does not affect the core or other subsystem attributes.
+
+	  If unsure, say N.
+
 config TOUCHSCREEN_SYNAPTICS_DSX_TEST_REPORTING_HTC_v26
 	tristate "Synaptics DSX v2.6 test reporting module"
 	depends on TOUCHSCREEN_SYNAPTICS_DSX_CORE_HTC_v26
diff --git a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_fw_update.c
index f7d5dbdd69b53..aff460c13f257 100644
--- a/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_fw_update.c
+++ b/drivers/input/touchscreen/synaptics_dsx_htc_2.6/synaptics_dsx_fw_update.c
@@ -140,6 +140,7 @@ static int fwu_do_reflash(void);
 
 static int fwu_recovery_check_status(void);
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static ssize_t fwu_sysfs_show_image(struct file *data_file,
 		struct kobject *kobj, struct bin_attribute *attributes,
 		char *buf, loff_t pos, size_t count);
@@ -192,6 +193,7 @@ static ssize_t fwu_sysfs_guest_code_block_count_show(struct device *dev,
 
 static ssize_t fwu_sysfs_write_guest_code_store(struct device *dev,
 		struct device_attribute *attr, const char *buf, size_t count);
+#endif
 
 enum f34_version {
 	F34_V0 = 0,
@@ -708,6 +710,7 @@ struct synaptics_rmi4_fwu_handle {
 #endif
 };
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static struct bin_attribute dev_attr_data = {
 	.attr = {
 		.name = "data",
@@ -765,11 +768,15 @@ static struct device_attribute attrs[] = {
 			synaptics_rmi4_show_error,
 			fwu_sysfs_write_guest_code_store),
 };
+#endif
 
 static struct synaptics_rmi4_fwu_handle *fwu;
 
 DECLARE_COMPLETION(fwu_remove_complete);
+
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 DEFINE_MUTEX(fwu_sysfs_mutex);
+#endif
 
 /* Check offset + size <= bound.  true if in bounds, false otherwise. */
 static bool in_bounds(unsigned long offset, unsigned long size,
@@ -923,6 +930,7 @@ static int fwu_f51_force_data_init(void)
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_allocate_read_config_buf(unsigned int count)
 {
 	struct synaptics_rmi4_data *rmi4_data = fwu->rmi4_data;
@@ -942,6 +950,7 @@ static int fwu_allocate_read_config_buf(unsigned int count)
 
 	return 0;
 }
+#endif
 
 static void fwu_compare_partition_tables(void)
 {
@@ -2471,6 +2480,7 @@ static int fwu_write_f34_blocks(unsigned char *block_ptr,
 	return retval;
 }
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_read_f34_v7_blocks(unsigned short block_cnt,
 		unsigned char command)
 {
@@ -2624,6 +2634,7 @@ static int fwu_read_f34_blocks(unsigned short block_cnt, unsigned char cmd)
 
 	return retval;
 }
+#endif
 
 static int fwu_get_image_firmware_id(unsigned int *fw_id)
 {
@@ -2645,7 +2656,7 @@ static int fwu_get_image_firmware_id(unsigned int *fw_id)
 		}
 
 		strptr += 2;
-		firmware_id = kzalloc(MAX_FIRMWARE_ID_LEN, GFP_KERNEL);
+		firmware_id = kzalloc(MAX_FIRMWARE_ID_LEN + 1, GFP_KERNEL);
 		if (!firmware_id) {
 			dev_err(rmi4_data->pdev->dev.parent,
 					"%s: Failed to alloc mem for firmware_id\n",
@@ -3032,6 +3043,7 @@ static int fwu_check_ui_configuration_size(void)
 	return 0;
 }
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_check_dp_configuration_size(void)
 {
 	unsigned short block_count;
@@ -3065,6 +3077,7 @@ static int fwu_check_pm_configuration_size(void)
 
 	return 0;
 }
+#endif
 
 #ifndef SYNA_SIMPLE_UPDATE
 static int fwu_check_bl_configuration_size(void)
@@ -3085,6 +3098,7 @@ static int fwu_check_bl_configuration_size(void)
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_check_guest_code_size(void)
 {
 	unsigned short block_count;
@@ -3100,6 +3114,7 @@ static int fwu_check_guest_code_size(void)
 
 	return 0;
 }
+#endif
 
 static int fwu_erase_configuration(void)
 {
@@ -3199,6 +3214,7 @@ static int fwu_erase_utility_parameter(void)
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_erase_guest_code(void)
 {
 	int retval;
@@ -3222,6 +3238,7 @@ static int fwu_erase_guest_code(void)
 
 	return 0;
 }
+#endif
 
 static int fwu_erase_all(void)
 {
@@ -3275,7 +3292,7 @@ static int fwu_erase_all(void)
 
 #ifndef SYNA_SIMPLE_UPDATE
 	if (fwu->flash_properties.has_disp_config &&
-			fwu->img.contains_disp_config) {		
+			fwu->img.contains_disp_config) {
 		fwu->config_area = DP_CONFIG_AREA;
 		retval = fwu_erase_configuration();
 		if (retval < 0)
@@ -3424,6 +3441,7 @@ static int fwu_write_ui_configuration(void)
 	return fwu_write_configuration();
 }
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_write_dp_configuration(void)
 {
 	fwu->config_area = DP_CONFIG_AREA;
@@ -3443,6 +3461,7 @@ static int fwu_write_pm_configuration(void)
 
 	return fwu_write_configuration();
 }
+#endif
 
 #ifndef SYNA_SIMPLE_UPDATE
 static int fwu_write_flash_configuration(void)
@@ -3476,6 +3495,7 @@ static int fwu_write_flash_configuration(void)
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_write_guest_code(void)
 {
 	int retval;
@@ -3490,6 +3510,7 @@ static int fwu_write_guest_code(void)
 
 	return 0;
 }
+#endif
 
 static int fwu_write_lockdown(void)
 {
@@ -3998,6 +4019,7 @@ static int fwu_do_reflash(void)
 	return retval;
 }
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_do_read_config(void)
 {
 	int retval;
@@ -4076,6 +4098,7 @@ static int fwu_do_read_config(void)
 
 	return retval;
 }
+#endif
 
 static int fwu_do_lockdown_v7(void)
 {
@@ -4212,6 +4235,7 @@ static int fwu_do_restore_f51_cal_data(void)
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_start_write_guest_code(void)
 {
 	int retval;
@@ -4417,6 +4441,7 @@ static int fwu_start_write_config(void)
 
 	return retval;
 }
+#endif
 
 static int fwu_start_reflash(void)
 {
@@ -4472,6 +4497,7 @@ static int fwu_start_reflash(void)
 				"%s: Firmware image size = %d\n",
 				__func__, (unsigned int)fw_entry->size);
 		fwu->image = fw_entry->data;
+		fwu->image_size = fw_entry->size;
 	}
 
 	retval = fwu_parse_image_info();
@@ -4691,6 +4717,7 @@ static int fwu_recovery_check_status(void)
 	return 0;
 }
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static int fwu_recovery_erase_completion(void)
 {
 	int retval;
@@ -4965,6 +4992,7 @@ static int fwu_start_recovery(void)
 
 	return retval;
 }
+#endif
 
 #ifdef HTC_FEATURE
 static int fwu_do_write_config(uint8_t *config_data)
@@ -5219,8 +5247,10 @@ static void fwu_startup_fw_update_work(struct work_struct *work)
 	}
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	/* Prevent sysfs operations during initial update. */
 	mutex_lock(&fwu_sysfs_mutex);
+#endif
 
 #ifdef HTC_FEATURE
 	wake_lock(&fwu->fwu_wake_lock);
@@ -5236,11 +5266,14 @@ static void fwu_startup_fw_update_work(struct work_struct *work)
 #else
 	synaptics_fw_updater(NULL);
 #endif
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	mutex_unlock(&fwu_sysfs_mutex);
+#endif
 	return;
 }
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 static ssize_t fwu_sysfs_show_image(struct file *data_file,
 		struct kobject *kobj, struct bin_attribute *attributes,
 		char *buf, loff_t pos, size_t count)
@@ -5674,6 +5707,7 @@ static ssize_t fwu_sysfs_write_guest_code_store(struct device *dev,
 	mutex_unlock(&fwu_sysfs_mutex);
 	return retval;
 }
+#endif
 
 static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data,
 		unsigned char intr_mask)
@@ -5690,7 +5724,9 @@ static void synaptics_rmi4_fwu_attn(struct synaptics_rmi4_data *rmi4_data,
 static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)
 {
 	int retval;
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	unsigned char attr_count;
+#endif
 	struct pdt_properties pdt_props;
 
 	if (fwu) {
@@ -5758,6 +5794,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)
 	fwu->do_lockdown = DO_LOCKDOWN;
 	fwu->initialized = true;
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	retval = sysfs_create_bin_file(&rmi4_data->input_dev->dev.kobj,
 			&dev_attr_data);
 	if (retval < 0) {
@@ -5778,6 +5815,7 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)
 			goto exit_remove_attrs;
 		}
 	}
+#endif
 
 #ifdef DO_STARTUP_FW_UPDATE
 #ifdef HTC_FEATURE
@@ -5800,13 +5838,19 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)
 
 	return 0;
 
+#if defined(CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26) || \
+	defined(F51_DISCRETE_FORCE)
 exit_remove_attrs:
+#endif
+
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	for (attr_count--; attr_count >= 0; attr_count--) {
 		sysfs_remove_file(&rmi4_data->input_dev->dev.kobj,
 				&attrs[attr_count].attr);
 	}
 
 	sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data);
+#endif
 
 exit_free_mem:
 	kfree(fwu->image_name);
@@ -5821,8 +5865,9 @@ static int synaptics_rmi4_fwu_init(struct synaptics_rmi4_data *rmi4_data)
 
 static void synaptics_rmi4_fwu_remove(struct synaptics_rmi4_data *rmi4_data)
 {
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	unsigned char attr_count;
-
+#endif
 	if (!fwu)
 		goto exit;
 
@@ -5835,12 +5880,14 @@ static void synaptics_rmi4_fwu_remove(struct synaptics_rmi4_data *rmi4_data)
 #endif
 #endif
 
+#ifdef CONFIG_TOUCHSCREEN_SYNAPTICS_DSX_FW_UPDATE_SYSFS_HTC_v26
 	for (attr_count = 0; attr_count < ARRAY_SIZE(attrs); attr_count++) {
 		sysfs_remove_file(&rmi4_data->input_dev->dev.kobj,
 				&attrs[attr_count].attr);
 	}
 
 	sysfs_remove_bin_file(&rmi4_data->input_dev->dev.kobj, &dev_attr_data);
+#endif
 
 #ifdef F51_DISCRETE_FORCE
 	kfree(fwu->cal_data);