DivestOS/Patches/Linux_CVEs/CVE-2016-8480/4.4/0003.patch

56 lines
1.9 KiB
Diff
Raw Normal View History

2017-11-07 17:32:46 -05:00
From 420d51e0733e72830fa591f1e67f5a40ce11dc51 Mon Sep 17 00:00:00 2001
From: Zhen Kong <zkong@codeaurora.org>
Date: Fri, 4 Nov 2016 17:35:19 -0700
Subject: qseecom: remove entry from qseecom_registered_app_list
In an error handling case, the QSEECOM_IOCTL_LOAD_APP_REQ ioctl
freed the entry for new TA, but didn't removed it from
qseecom_registered_app_list. Make change to remove it.
Change-Id: Id681fbf3c923027d3db875d506cbe3f971919a8d
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
---
drivers/misc/qseecom.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c
2017-11-07 17:32:46 -05:00
index 3402a1b..249a76b 100644
--- a/drivers/misc/qseecom.c
+++ b/drivers/misc/qseecom.c
2017-11-07 17:32:46 -05:00
@@ -2071,6 +2071,7 @@ static int qseecom_load_app(struct qseecom_dev_handle *data, void __user *argp)
struct qseecom_load_app_64bit_ireq load_req_64bit;
void *cmd_buf = NULL;
size_t cmd_len;
+ bool first_time = false;
/* Copy the relevant information needed for loading the image */
if (copy_from_user(&load_img_req,
2017-11-07 17:32:46 -05:00
@@ -2142,6 +2143,7 @@ static int qseecom_load_app(struct qseecom_dev_handle *data, void __user *argp)
&qseecom.registered_app_list_lock, flags);
ret = 0;
} else {
+ first_time = true;
pr_warn("App (%s) does'nt exist, loading apps for first time\n",
(char *)(load_img_req.img_name));
/* Get the handle of the shared fd */
2017-11-07 17:32:46 -05:00
@@ -2273,8 +2275,15 @@ static int qseecom_load_app(struct qseecom_dev_handle *data, void __user *argp)
load_img_req.app_id = app_id;
if (copy_to_user(argp, &load_img_req, sizeof(load_img_req))) {
pr_err("copy_to_user failed\n");
- kzfree(entry);
ret = -EFAULT;
+ if (first_time == true) {
+ spin_lock_irqsave(
+ &qseecom.registered_app_list_lock, flags);
+ list_del(&entry->list);
+ spin_unlock_irqrestore(
+ &qseecom.registered_app_list_lock, flags);
+ kzfree(entry);
+ }
}
loadapp_err:
--
cgit v1.1