diff --git a/Patches/Linux_CVEs/CVE-2015-0569/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2015-0569/prima/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0569/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2015-0569/prima/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0569/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2015-0569/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0569/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2015-0569/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0570/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2015-0570/prima/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0570/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2015-0570/prima/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0570/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2015-0570/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0570/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2015-0570/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0003.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0003.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0003.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0003.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0004.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0004.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0004.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0004.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0005.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0005.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0005.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0005.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0006.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0006.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0006.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0006.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0007.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0007.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0007.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0007.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0008.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0008.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0008.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0008.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0009.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0009.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0009.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0009.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0010.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0010.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0010.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0010.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0011.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0011.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0011.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0011.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0012.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0012.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0012.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0012.patch diff --git a/Patches/Linux_CVEs/CVE-2015-0571/ANY/0013.patch b/Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0013.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2015-0571/ANY/0013.patch rename to Patches/Linux_CVEs/CVE-2015-0571/qcacld-2.0/0013.patch diff --git a/Patches/Linux_CVEs/CVE-2016-0806/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-0806/ANY/0001.patch deleted file mode 100644 index 62f61cfc..00000000 --- a/Patches/Linux_CVEs/CVE-2016-0806/ANY/0001.patch +++ /dev/null @@ -1,6585 +0,0 @@ - - - -kernel/msm-3.10 - Unnamed repository - - - - - - - - -
-
-
- -
-
-
-
- - - - -
-summaryrefslogtreecommitdiffstats
- - - -
-
-
- - - - - - - - - - - - -
AgeCommit message (Expand)AuthorFilesLines
2016-04-13qcacld 2.0: Validate ioctls for valid input lengthMahesh A Saptasagar1-11/+49
2016-03-23qcacld 2.0: Validate WPA and RSN IE for valid lengthMahesh A Saptasagar1-8/+31
2016-03-23wlan:Check priviledge permissionMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permissionMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permissionMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permissionHanumantha Reddy Pothula1-0/+7
2016-03-23wlan:Check priviledge permissionMukul Sharma1-1/+8
2016-03-23wlan:Check priviledge permissionMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permissionMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permission before processingMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permission before processingMukul Sharma1-0/+7
2016-03-23wlan:Check priviledge permission before processingMukul Sharma1-0/+6
- -
- - diff --git a/Patches/Linux_CVEs/CVE-2016-0806/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-0806/ANY/0002.patch deleted file mode 100644 index c4fcbaad..00000000 --- a/Patches/Linux_CVEs/CVE-2016-0806/ANY/0002.patch +++ /dev/null @@ -1,6589 +0,0 @@ - - - -kernel/msm-3.10 - Unnamed repository - - - - - - - - -
-
-
- -
-
-
-
- - - - -
-summaryrefslogtreecommitdiffstats
- - - -
-
-
- - - - - - - - - - - - - - - - -
AgeCommit message (Expand)AuthorFilesLines
2015-11-02wlan:Check priviledge permission for SET_CHANNEL_RANGEAmarnath Hullur Subramanyam1-0/+7
2015-10-29wlan:Check priviledge permission for SET_CHANNEL_RANGEAmarnath Hullur Subramanyam1-0/+7
2015-10-29wlan: ensure permission for WLAN_FTM_PRIV_SET_CHAR_GET_NONEAmarnath Hullur Subramanyam1-0/+7
2015-10-29wlan:Check priviledge permission for SET_VAR_INTS_GETNONE IOCTLAmarnath Hullur Subramanyam1-0/+5
2015-10-29wlan:Check priviledge permission for SET_THREE_INT_GET_NONEAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission for CLEAR_MCBC_FILTER IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission for SET_POWER_PARAMS IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission for SET_BAND_CONFIG IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission for QCSAP_IOCTL_DISASSOC_STAAmarnath Hullur Subramanyam1-0/+7
2015-10-29wlan:Check priviledge permission for QCSAP_IOCTL_SETWPSIEAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission before processing SET_PACKET_FILTER IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission before processing SET_CHAR_GET_NONE IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29wlan:Check priviledge permission before processing SET_OEM_DATA_REQ IOCTLAmarnath Hullur Subramanyam1-0/+6
2015-10-29qcacld 2.0: Validate ioctls for valid input lengthAmarnath Hullur Subramanyam1-14/+48
2015-10-29qcacld 2.0: Address buffer overflow due to invalid lengthAmarnath Hullur Subramanyam1-0/+3
2015-10-28qcacld 2.0: Validate WPA and RSN IE for valid lengthAmarnath Hullur Subramanyam1-10/+27
- -
- - diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0001.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0001.patch new file mode 100644 index 00000000..db0a3b88 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0001.patch @@ -0,0 +1,41 @@ +From 1fac73337080712109029302599945d1ac36c799 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 09:55:27 -0700 +Subject: wlan:Check priviledge permission before processing + +for SET_OEM_DATA_REQ IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_OEM_DATA_REQ IOCTLs, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I651656fe11d4235232b76c972b5460b57e608449 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_oemdata.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_oemdata.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_oemdata.c +index c796abd..2bbb38f 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_oemdata.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_oemdata.c +@@ -203,6 +203,12 @@ int iw_set_oem_data_req( + hdd_adapter_t *pAdapter = (netdev_priv(dev)); + hdd_wext_state_t *pwextBuf = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter); + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) + { + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0002.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0002.patch new file mode 100644 index 00000000..83db5256 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0002.patch @@ -0,0 +1,42 @@ +From e9dcd5aa01734b019c793220531e4ef1d82959f8 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 10:06:03 -0700 +Subject: wlan:Check priviledge permission before processing + +for SET_CHAR_GET_NONE IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_CHAR_GET_NONE IOCTLs, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: Iccf25a9d1f1a7c13d3aaf2fc4bd3aebba740dbb2 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 964ed65..5e03595 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -3864,6 +3864,13 @@ static int iw_setchar_getnone(struct net_device *dev, struct iw_request_info *in + hdd_config_t *pConfig = pHddCtx->cfg_ini; + #endif /* WLAN_FEATURE_VOWIFI */ + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s: Received length %d", __func__, wrqu->data.length); + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, "%s: Received data %s", __func__, (char*)wrqu->data.pointer); + +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0003.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0003.patch new file mode 100644 index 00000000..01eb45b2 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0003.patch @@ -0,0 +1,42 @@ +From fd13b59e5a75b761f68fe34f09df1dce7a49acc2 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 10:11:40 -0700 +Subject: wlan:Check priviledge permission before processing + +for SET_PACKET_FILTER IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_PACKET_FILTER IOCTL, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I1edc65ee26c5e3e4260e0f6546434b0137493396 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 5e03595..6a806f4 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -5834,6 +5834,13 @@ static int iw_set_packet_filter_params(struct net_device *dev, struct iw_request + hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev); + tpPacketFilterCfg pRequest = (tpPacketFilterCfg)wrqu->data.pointer; + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + return wlan_hdd_set_filter(WLAN_HDD_GET_CTX(pAdapter), pRequest, pAdapter->sessionId); + } + #endif +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0004.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0004.patch new file mode 100644 index 00000000..76ca4267 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0004.patch @@ -0,0 +1,42 @@ +From fbb8f120ee729d47869f0bebe5bc31e83bcf2876 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 10:28:36 -0700 +Subject: wlan:Check priviledge permission + +for SET_VAR_INTS_GETNONE IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_VAR_INTS_GETNONE, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: Ia2465433aab6366160a167a62ca03e0ba720bcdb +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 6a806f4..9b41a5e 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -4508,6 +4508,13 @@ int iw_set_var_ints_getnone(struct net_device *dev, struct iw_request_info *info + int cmd = 0; + int staId = 0; + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + hddLog(LOG1, "%s: Received length %d", __func__, wrqu->data.length); + + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0005.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0005.patch new file mode 100644 index 00000000..9dcb2242 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0005.patch @@ -0,0 +1,42 @@ +From 518fd80981eefa9715e0851260b2c7aeb86551d7 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 10:34:06 -0700 +Subject: wlan:Check priviledge permission + +for QCSAP_IOCTL_SETWPSIE + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing QCSAP_IOCTL_SETWPSIE IOCTL, +making sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I66acff95d6151b32f1cb3c36a164e1de021e1e30 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +index 45c6f78..7598b99 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -2147,6 +2147,13 @@ static int iw_softap_setwpsie(struct net_device *dev, + u_int16_t length; + ENTER(); + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if(!wrqu->data.length) + return 0; + +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0006.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0006.patch new file mode 100644 index 00000000..711c3224 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0006.patch @@ -0,0 +1,44 @@ +From 86fd66a451b2549f990b71013220e0a3f46b5a00 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 10:41:41 -0700 +Subject: wlan:Check priviledge permission + +for QCSAP_IOCTL_DISASSOC_STA + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing QCSAP_IOCTL_DISASSOC_STA IOCTL, +making sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I7928789c0ce94a2b81495064496766b9e62d6ed8 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +index 7598b99..005c193 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -1338,7 +1338,14 @@ static iw_softap_disassoc_sta(struct net_device *dev, + { + hdd_adapter_t *pHostapdAdapter = (netdev_priv(dev)); + v_U8_t *peerMacAddr; +- ++ ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + ENTER(); + /* iwpriv tool or framework calls this ioctl with + * data passed in extra (less than 16 octets); +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0007.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0007.patch new file mode 100644 index 00000000..168843a4 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0007.patch @@ -0,0 +1,42 @@ +From 4a75c965d2505ca2490a365a27309cc9dd68b2d1 Mon Sep 17 00:00:00 2001 +From: Hanumantha Reddy Pothula +Date: Thu, 17 Mar 2016 10:54:37 -0700 +Subject: wlan:Check priviledge permission + +for SET_THREE_INT_GET_NONE + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_THREE_INT_GET_NONE IOCTL, +making sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I8661872786adfb5492da505ba3960e62064ddd7e +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 9b41a5e..1288bd0 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -4049,6 +4049,13 @@ int iw_set_three_ints_getnone(struct net_device *dev, struct iw_request_info *in + int sub_cmd = value[0]; + int ret = 0; + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) + { + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0008.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0008.patch new file mode 100644 index 00000000..a1c03826 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0008.patch @@ -0,0 +1,42 @@ +From ede034fd604a9cdb20eb7accdaec4a8e70ffac41 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 16:55:17 -0700 +Subject: wlan:Check priviledge permission + +for SET_BAND_CONFIG IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_BAND_CONFIG IOCTL, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I34e9d91f778b09eb73881aed5c6e3a10cbbd208c +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 1288bd0..7add243 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -6499,6 +6499,13 @@ static int iw_set_band_config(struct net_device *dev, + tANI_U8 *ptr = (tANI_U8*)wrqu->data.pointer; + int ret = 0; + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,"%s: ", __func__); + + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0009.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0009.patch new file mode 100644 index 00000000..ad265a8a --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0009.patch @@ -0,0 +1,42 @@ +From aaf7476fa7fdc8d1865f20217c7c57ce561e03f7 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 17:00:41 -0700 +Subject: wlan:Check priviledge permission + +for SET_POWER_PARAMS IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_POWER_PARAMS IOCTL, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: Iaab3d55c2acc75f65d6daf5998713cc9ff92a32c +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 7add243..85d881a 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -6529,6 +6529,13 @@ static int iw_set_power_params_priv(struct net_device *dev, + struct iw_request_info *info, + union iwreq_data *wrqu, char *extra) + { ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, + "Set power params Private"); + return iw_set_power_params(dev,info,wrqu,extra,0); +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0010.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0010.patch new file mode 100644 index 00000000..8a69b78c --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0010.patch @@ -0,0 +1,42 @@ +From 973503f0d411e13e01fa10c5ea802dcb8a12cf85 Mon Sep 17 00:00:00 2001 +From: Mukul Sharma +Date: Thu, 17 Mar 2016 17:03:19 -0700 +Subject: wlan:Check priviledge permission + +for CLEAR_MCBC_FILTER IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing CLEAR_MCBC_FILTER IOCTL, making +sure user task has right permission to process the command. + +Bug: 27104184 +Change-Id: I2332845fa6793dc63b6f397a9ebf53d37a52a7c7 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 85d881a..558fc1b 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -5306,6 +5306,13 @@ static int iw_clear_dynamic_mcbc_filter(struct net_device *dev, + tpSirWlanSetRxpFilters wlanRxpFilterParam; + hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: ", __func__); + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + //Reset the filter to INI value as we have to clear the dynamic filter + pHddCtx->configuredMcastBcastFilter = pHddCtx->cfg_ini->mcastBcastFilterSetting; + +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0011.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0011.patch new file mode 100644 index 00000000..4813af33 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0011.patch @@ -0,0 +1,117 @@ +From 34953f9f66d9cd36616c5271a7d285b31d9142c2 Mon Sep 17 00:00:00 2001 +From: Mahesh A Saptasagar +Date: Thu, 17 Mar 2016 17:15:02 -0700 +Subject: qcacld 2.0: Validate WPA and RSN IE for valid length + +prima to qcacld-2.0 propagation + +Return failure to applications if genie ioctl is invoked to configure +WPS/WPA/RSN IEs with arguments of improper length. + +Bug: 27104184 +Change-Id: I31e288db41e14b24be0e430afed3a5e360da1370 +Signed-off-by: Yuan Lin +--- + drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 39 +++++++++++++++++----- + 1 file changed, 31 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +index 558fc1b..095aa9d 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +@@ -1531,9 +1531,10 @@ static int iw_set_genie(struct net_device *dev, + char *extra) + { + hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev); +- hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter); +- u_int8_t *genie; +- v_U16_t remLen; ++ hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter); ++ u_int8_t *genie; ++ v_U16_t remLen; ++ int ret = 0; + + ENTER(); + if(!wrqu->data.length) { +@@ -1570,7 +1571,10 @@ static int iw_set_genie(struct net_device *dev, + { + case IE_EID_VENDOR: + if ((IE_LEN_SIZE+IE_EID_SIZE+IE_VENDOR_OUI_SIZE) > eLen) /* should have at least OUI */ +- return -EINVAL; ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + + if (0 == memcmp(&genie[0], "\x00\x50\xf2\x04", 4)) + { +@@ -1583,7 +1587,8 @@ static int iw_set_genie(struct net_device *dev, + hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " + "Need bigger buffer space\n"); + VOS_ASSERT(0); +- return -ENOMEM; ++ ret = -EINVAL; ++ goto exit; + } + // save to Additional IE ; it should be accumulated to handle WPS IE + other IE + memcpy( pWextState->genIE.addIEdata + curGenIELen, genie - 2, eLen + 2); +@@ -1592,6 +1597,14 @@ static int iw_set_genie(struct net_device *dev, + else if (0 == memcmp(&genie[0], "\x00\x50\xf2", 3)) + { + hddLog (VOS_TRACE_LEVEL_INFO, "%s Set WPA IE (len %d)",__func__, eLen + 2); ++ if ((eLen + 2) > (sizeof(pWextState->WPARSNIE))) ++ { ++ hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " ++ "Need bigger buffer space"); ++ ret = -EINVAL; ++ VOS_ASSERT(0); ++ goto exit; ++ } + memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN ); + memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2)); + pWextState->roamProfile.pWPAReqIE = pWextState->WPARSNIE; +@@ -1608,7 +1621,8 @@ static int iw_set_genie(struct net_device *dev, + hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " + "Need bigger buffer space\n"); + VOS_ASSERT(0); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto exit; + } + // save to Additional IE ; it should be accumulated to handle WPS IE + other IE + memcpy( pWextState->genIE.addIEdata + curGenIELen, genie - 2, eLen + 2); +@@ -1617,6 +1631,14 @@ static int iw_set_genie(struct net_device *dev, + break; + case DOT11F_EID_RSN: + hddLog (LOG1, "%s Set RSN IE (len %d)",__func__, eLen+2); ++ if ((eLen + 2) > (sizeof(pWextState->WPARSNIE))) ++ { ++ hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " ++ "Need bigger buffer space"); ++ ret = -EINVAL; ++ VOS_ASSERT(0); ++ goto exit; ++ } + memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN ); + memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2)); + pWextState->roamProfile.pRSNReqIE = pWextState->WPARSNIE; +@@ -1625,13 +1647,14 @@ static int iw_set_genie(struct net_device *dev, + + default: + hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, elementId); +- return 0; ++ goto exit; + } + genie += eLen; + remLen -= eLen; + } ++ exit: + EXIT(); +- return 0; ++ return ret; + } + + static int iw_get_genie(struct net_device *dev, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/prima/0012.patch b/Patches/Linux_CVEs/CVE-2016-0806/prima/0012.patch new file mode 100644 index 00000000..cf20c78b --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/prima/0012.patch @@ -0,0 +1,189 @@ +From 72d3908cc1bcb075015f1b86001f4292ac41d38a Mon Sep 17 00:00:00 2001 +From: Mahesh A Saptasagar +Date: Wed, 13 Apr 2016 09:19:31 -0700 +Subject: qcacld 2.0: Validate ioctls for valid input length prima to + qcacld-2.0 propagation + +Return failure to applications if ioctl is invoked with arguments +of improper length. + +Bug: 27104184 +Change-Id: I4459c5f39ca9c7a852772913578bd2122cb73879 +--- + .../staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c | 60 ++++++++++++++++++---- + 1 file changed, 49 insertions(+), 11 deletions(-) + +diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +index 005c193..9441a2a 100644 +--- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -2151,7 +2151,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + u_int8_t *pos; + tpSap_WPSIE pSap_WPSIe; + u_int8_t WPSIeType; +- u_int16_t length; ++ u_int16_t length; ++ int ret = 0; + ENTER(); + + if (!capable(CAP_NET_ADMIN)) +@@ -2183,8 +2184,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + case DOT11F_EID_WPA: + if (wps_genie[1] < 2 + 4) + { +- vos_mem_free(pSap_WPSIe); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) + { +@@ -2242,6 +2243,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > sizeof(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E)) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E, pos, length); + pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_UUIDE_PRESENT; + pos += length; +@@ -2256,8 +2262,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + + default: + hddLog (LOGW, "UNKNOWN TLV in WPS IE(%x)\n", (*pos<<8 | *(pos+1))); +- vos_mem_free(pSap_WPSIe); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + } + } +@@ -2269,8 +2275,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + + default: + hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, wps_genie[0]); +- vos_mem_free(pSap_WPSIe); +- return 0; ++ ret = -EINVAL; ++ goto exit; + } + } + else if( wps_genie[0] == eQC_WPS_PROBE_RSP_IE) +@@ -2282,8 +2288,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + case DOT11F_EID_WPA: + if (wps_genie[1] < 2 + 4) + { +- vos_mem_free(pSap_WPSIe); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) + { +@@ -2347,6 +2353,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_UUIDE_PRESENT; + pos += length; +@@ -2356,6 +2367,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.num_name = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MANUFACTURE_PRESENT; +@@ -2366,6 +2382,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNAME_PRESENT; +@@ -2375,6 +2396,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNUMBER_PRESENT; +@@ -2384,6 +2410,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_SERIALNUMBER_PRESENT; +@@ -2394,7 +2425,6 @@ static int iw_softap_setwpsie(struct net_device *dev, + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceCategory = (*pos<<8 | *(pos+1)); + hddLog(LOG1, "primary dev category: %d\n", pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceCategory); + pos += 2; +- + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.PrimaryDeviceOUI, pos, HDD_WPS_DEVICE_OUI_LEN); + hddLog(LOG1, "primary dev oui: %02x, %02x, %02x, %02x\n", pos[0], pos[1], pos[2], pos[3]); + pos += 4; +@@ -2407,6 +2437,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text, pos, length); + pos += length; +@@ -2438,6 +2473,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + } // switch + } + halStatus = WLANSAP_Set_WpsIe(pVosContext, pSap_WPSIe); ++ if (halStatus != eHAL_STATUS_SUCCESS) ++ ret = -EINVAL; + pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter); + if( pHostapdState->bCommit && WPSIeType == eQC_WPS_PROBE_RSP_IE) + { +@@ -2446,9 +2483,10 @@ static int iw_softap_setwpsie(struct net_device *dev, + WLANSAP_Update_WpsIe ( pVosContext ); + } + ++ exit: + vos_mem_free(pSap_WPSIe); + EXIT(); +- return halStatus; ++ return ret; + } + + static int iw_softap_stopbss(struct net_device *dev, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0013.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0013.patch new file mode 100644 index 00000000..b255b265 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0013.patch @@ -0,0 +1,120 @@ +From 055561f40f2baa5cdd74f952be55b61a3907279a Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 16:56:58 -0700 +Subject: qcacld 2.0: Validate WPA and RSN IE for valid length + +prima to qcacld-2.0 propagation + +Return failure to applications if genie ioctl is invoked to configure +WPS/WPA/RSN IEs with arguments of improper length. + +CRs-Fixed: 931451 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + .../qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 37 ++++++++++++++++------ + 1 file changed, 27 insertions(+), 10 deletions(-) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 38a13fa..93136df 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -2270,11 +2270,12 @@ static int iw_set_genie(struct net_device *dev, + union iwreq_data *wrqu, + char *extra) + { +- hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev); ++ hdd_adapter_t *pAdapter = WLAN_HDD_GET_PRIV_PTR(dev); + hdd_wext_state_t *pWextState = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter); + u_int8_t *genie = NULL; + u_int8_t *base_genie = NULL; + v_U16_t remLen; ++ int ret = 0; + + ENTER(); + +@@ -2324,8 +2325,8 @@ static int iw_set_genie(struct net_device *dev, + case IE_EID_VENDOR: + if ((IE_LEN_SIZE+IE_EID_SIZE+IE_VENDOR_OUI_SIZE) > eLen) /* should have at least OUI */ + { +- kfree(base_genie); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + + if (0 == memcmp(&genie[0], "\x00\x50\xf2\x04", 4)) +@@ -2339,8 +2340,8 @@ static int iw_set_genie(struct net_device *dev, + hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " + "Need bigger buffer space"); + VOS_ASSERT(0); +- kfree(base_genie); +- return -ENOMEM; ++ ret = -EINVAL; ++ goto exit; + } + // save to Additional IE ; it should be accumulated to handle WPS IE + other IE + memcpy( pWextState->genIE.addIEdata + curGenIELen, genie - 2, eLen + 2); +@@ -2349,6 +2350,14 @@ static int iw_set_genie(struct net_device *dev, + else if (0 == memcmp(&genie[0], "\x00\x50\xf2", 3)) + { + hddLog (VOS_TRACE_LEVEL_INFO, "%s Set WPA IE (len %d)",__func__, eLen + 2); ++ if ((eLen + 2) > (sizeof(pWextState->WPARSNIE))) ++ { ++ hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " ++ "Need bigger buffer space"); ++ ret = -EINVAL; ++ VOS_ASSERT(0); ++ goto exit; ++ } + memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN ); + memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2)); + pWextState->roamProfile.pWPAReqIE = pWextState->WPARSNIE; +@@ -2365,8 +2374,8 @@ static int iw_set_genie(struct net_device *dev, + hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " + "Need bigger buffer space"); + VOS_ASSERT(0); +- kfree(base_genie); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto exit; + } + // save to Additional IE ; it should be accumulated to handle WPS IE + other IE + memcpy( pWextState->genIE.addIEdata + curGenIELen, genie - 2, eLen + 2); +@@ -2375,6 +2384,14 @@ static int iw_set_genie(struct net_device *dev, + break; + case DOT11F_EID_RSN: + hddLog (LOG1, "%s Set RSN IE (len %d)",__func__, eLen+2); ++ if ((eLen + 2) > (sizeof(pWextState->WPARSNIE))) ++ { ++ hddLog(VOS_TRACE_LEVEL_FATAL, "Cannot accommodate genIE. " ++ "Need bigger buffer space"); ++ ret = -EINVAL; ++ VOS_ASSERT(0); ++ goto exit; ++ } + memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN ); + memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2)); + pWextState->roamProfile.pRSNReqIE = pWextState->WPARSNIE; +@@ -2383,15 +2400,15 @@ static int iw_set_genie(struct net_device *dev, + + default: + hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, elementId); +- kfree(base_genie); +- return 0; ++ goto exit; + } + genie += eLen; + remLen -= eLen; + } ++exit: + EXIT(); + kfree(base_genie); +- return 0; ++ return ret; + } + + static int iw_get_genie(struct net_device *dev, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0014.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0014.patch new file mode 100644 index 00000000..dd9724e2 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0014.patch @@ -0,0 +1,36 @@ +From f31e58289c8ebded58ffe1d4709e2f878765b0a6 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 17:38:59 -0700 +Subject: qcacld 2.0: Address buffer overflow due to invalid length + +prima to qcacld-2.0 propagation + +Check for valid length before copying the packet filter data from +userspace buffer to kernel space buffer to avoid buffer overflow +issue. + +CRs-Fixed: 930533 +Git-commit: a079d716b5481223f0166c644e9ec7c75a31b02c +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 93136df..0b1ee24 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -8376,6 +8376,9 @@ int wlan_hdd_set_filter(hdd_context_t *pHddCtx, tpPacketFilterCfg pRequest, + + hddLog(VOS_TRACE_LEVEL_INFO, "Data Offset %d Data Len %d", + pRequest->paramsData[i].dataOffset, pRequest->paramsData[i].dataLength); ++ if ((sizeof(packetFilterSetReq.paramsData[i].compareData)) < ++ (pRequest->paramsData[i].dataLength)) ++ return -EINVAL; + + memcpy(&packetFilterSetReq.paramsData[i].compareData, + pRequest->paramsData[i].compareData, pRequest->paramsData[i].dataLength); +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0015.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0015.patch new file mode 100644 index 00000000..45549451 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0015.patch @@ -0,0 +1,188 @@ +From 255dd931573beb3afca15909f483f26db22a5c98 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 20:58:02 -0700 +Subject: qcacld 2.0: Validate ioctls for valid input length + +prima to qcacld-2.0 propagation + +Return failure to applications if ioctl is invoked with arguments +of improper length. + +CRs-Fixed: 930542 +Git-commit: 8bd73c3452ab22ba9bdbaac5ab12de2ed25fcb9d +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + .../qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c | 62 +++++++++++++++++----- + 1 file changed, 48 insertions(+), 14 deletions(-) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +index 1f56db2..51ee547 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -3880,6 +3880,7 @@ static int iw_softap_setwpsie(struct net_device *dev, + u_int8_t WPSIeType; + u_int16_t length; + struct iw_point s_priv_data; ++ int ret = 0; + + ENTER(); + +@@ -3925,9 +3926,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + case DOT11F_EID_WPA: + if (wps_genie[1] < 2 + 4) + { +- vos_mem_free(pSap_WPSIe); +- kfree(fwps_genie); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) + { +@@ -3985,6 +3985,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > sizeof(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E)) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSBeaconIE.UUID_E, pos, length); + pSap_WPSIe->sapwpsie.sapWPSBeaconIE.FieldPresent |= WPS_BEACON_UUIDE_PRESENT; + pos += length; +@@ -3999,9 +4004,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + + default: + hddLog (LOGW, "UNKNOWN TLV in WPS IE(%x)", (*pos<<8 | *(pos+1))); +- vos_mem_free(pSap_WPSIe); +- kfree(fwps_genie); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + } + } +@@ -4013,9 +4017,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + + default: + hddLog (LOGE, "%s Set UNKNOWN IE %X",__func__, wps_genie[0]); +- vos_mem_free(pSap_WPSIe); +- kfree(fwps_genie); +- return 0; ++ ret = -EINVAL; ++ goto exit; + } + } + else if( wps_genie[0] == eQC_WPS_PROBE_RSP_IE) +@@ -4027,9 +4030,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + case DOT11F_EID_WPA: + if (wps_genie[1] < 2 + 4) + { +- vos_mem_free(pSap_WPSIe); +- kfree(fwps_genie); +- return -EINVAL; ++ ret = -EINVAL; ++ goto exit; + } + else if (memcmp(&wps_genie[2], "\x00\x50\xf2\x04", 4) == 0) + { +@@ -4093,6 +4095,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.UUID_E, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_UUIDE_PRESENT; + pos += length; +@@ -4102,6 +4109,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.num_name = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.Manufacture.name, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MANUFACTURE_PRESENT; +@@ -4112,6 +4124,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelName.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNAME_PRESENT; +@@ -4121,6 +4138,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.ModelNumber.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_MODELNUMBER_PRESENT; +@@ -4130,6 +4152,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.SerialNumber.text, pos, length); + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.FieldPresent |= WPS_PROBRSP_SERIALNUMBER_PRESENT; +@@ -4153,6 +4180,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + pos += 2; + length = *pos<<8 | *(pos+1); + pos += 2; ++ if (length > (sizeof(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text))) ++ { ++ ret = -EINVAL; ++ goto exit; ++ } + pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.num_text = length; + vos_mem_copy(pSap_WPSIe->sapwpsie.sapWPSProbeRspIE.DeviceName.text, pos, length); + pos += length; +@@ -4189,6 +4221,8 @@ static int iw_softap_setwpsie(struct net_device *dev, + #else + halStatus = WLANSAP_Set_WpsIe(pVosContext, pSap_WPSIe); + #endif ++ if (halStatus != eHAL_STATUS_SUCCESS) ++ ret = -EINVAL; + pHostapdState = WLAN_HDD_GET_HOSTAP_STATE_PTR(pHostapdAdapter); + if( pHostapdState->bCommit && WPSIeType == eQC_WPS_PROBE_RSP_IE) + { +@@ -4200,11 +4234,11 @@ static int iw_softap_setwpsie(struct net_device *dev, + WLANSAP_Update_WpsIe ( pVosContext ); + #endif + } +- ++exit: + vos_mem_free(pSap_WPSIe); + kfree(fwps_genie); + EXIT(); +- return halStatus; ++ return ret; + } + + static int iw_softap_stopbss(struct net_device *dev, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0016.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0016.patch new file mode 100644 index 00000000..3ed18cba --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0016.patch @@ -0,0 +1,41 @@ +From d4b451bd06ad53ed785cbda4272c54788b1537d4 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 20:59:45 -0700 +Subject: wlan:Check priviledge permission before processing SET_OEM_DATA_REQ + IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_OEM_DATA_REQ IOCTLs, making +sure user task has right permission to process the command. + +CRs-Fixed: 930549 +Git-commit: 6feb2faf80a05940618aa2eef2b62e4e2e54f148 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c +index dbec0fc..26d0b5f 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_oemdata.c +@@ -189,6 +189,12 @@ int iw_set_oem_data_req( + hdd_adapter_t *pAdapter = (netdev_priv(dev)); + hdd_wext_state_t *pwextBuf = WLAN_HDD_GET_WEXT_STATE_PTR(pAdapter); + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) + { + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0017.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0017.patch new file mode 100644 index 00000000..a1afccc9 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0017.patch @@ -0,0 +1,41 @@ +From 2882941530cbf804e280f235f7f8d76179a423fe Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:03:01 -0700 +Subject: wlan:Check priviledge permission before processing SET_CHAR_GET_NONE + IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_CHAR_GET_NONE IOCTLs, making +sure user task has right permission to process the command. + +CRs-Fixed: 930935 +Git-commit: 0e53a89bfe0dbb50e0dde9a6960d274386247cd9 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 0b1ee24..88d75c1 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -6200,6 +6200,12 @@ static int iw_setchar_getnone(struct net_device *dev, struct iw_request_info *in + return -EBUSY; + } + ++ if (!capable(CAP_NET_ADMIN)){ ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + /* helper function to get iwreq_data with compat handling. */ + if (hdd_priv_get_data(&s_priv_data, wrqu)) { + return -EINVAL; +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0018.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0018.patch new file mode 100644 index 00000000..b370fb21 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0018.patch @@ -0,0 +1,41 @@ +From 825827ab2aa271f23f48aa683046a3aa3f7fe90e Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:04:10 -0700 +Subject: wlan:Check priviledge permission before processing SET_PACKET_FILTER + IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_PACKET_FILTER IOCTL, making +sure user task has right permission to process the command. + +CRs-Fixed: 930937 +Git-commit: 88ce639e7a0bba852f193b6f53b7ca1926a09b02 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 88d75c1..09d7288 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -8720,6 +8720,12 @@ static int iw_set_packet_filter_params(struct net_device *dev, + int ret; + struct iw_point s_priv_data; + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if (hdd_priv_get_data(&s_priv_data, wrqu)) { + return -EINVAL; + } +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0019.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0019.patch new file mode 100644 index 00000000..39b3431e --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0019.patch @@ -0,0 +1,40 @@ +From 27d3007a7635ccca7ae9bfb98c89724652dcbc3b Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:05:26 -0700 +Subject: wlan:Check priviledge permission for QCSAP_IOCTL_SETWPSIE + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing QCSAP_IOCTL_SETWPSIE IOCTL, +making sure user task has right permission to process the command. + +CRs-Fixed: 930944 +Git-commit: 2905578424256be07e6b9d8c63bb83d40cc52a71 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +index 51ee547..77b4124 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -3884,6 +3884,12 @@ static int iw_softap_setwpsie(struct net_device *dev, + + ENTER(); + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + /* helper function to get iwreq_data with compat handling. */ + if (hdd_priv_get_data(&s_priv_data, wrqu)) { + return -EINVAL; +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0020.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0020.patch new file mode 100644 index 00000000..d707171c --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0020.patch @@ -0,0 +1,41 @@ +From 89c3372735486a2f7f6b35298fcf246e7e177ac0 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:06:39 -0700 +Subject: wlan:Check priviledge permission for QCSAP_IOCTL_DISASSOC_STA + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing QCSAP_IOCTL_DISASSOC_STA IOCTL, +making sure user task has right permission to process the command. + +CRs-Fixed: 930946 +Git-commit: be62ecde85228b91c66fb047e27d25132f56bd0d +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +index 77b4124..b95a853 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -3243,6 +3243,13 @@ static iw_softap_disassoc_sta(struct net_device *dev, + struct tagCsrDelStaParams delStaParams; + + ENTER(); ++ ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + /* iwpriv tool or framework calls this ioctl with + * data passed in extra (less than 16 octets); + */ +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0021.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0021.patch new file mode 100644 index 00000000..2da030ed --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0021.patch @@ -0,0 +1,40 @@ +From e2addf5aa2c7dfc537c2b80d8cc1cb5640346535 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:07:47 -0700 +Subject: wlan:Check priviledge permission for SET_BAND_CONFIG IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_BAND_CONFIG IOCTL, making +sure user task has right permission to process the command. + +CRs-Fixed: 930952 +Git-commit: 6642bccf3ed8cba176dee7d4bbc21fc4580efb7b +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 09d7288..1cbdf32 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -9417,6 +9417,12 @@ static int iw_set_band_config(struct net_device *dev, + return -EBUSY; + } + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + return hdd_setBand(dev, value[0]); + } + +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0022.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0022.patch new file mode 100644 index 00000000..57d4597a --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0022.patch @@ -0,0 +1,40 @@ +From e474427496ccb784878e10978f25b6e85de68850 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:10:14 -0700 +Subject: wlan:Check priviledge permission for SET_POWER_PARAMS IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_POWER_PARAMS IOCTL, making +sure user task has right permission to process the command. + +CRs-Fixed: 930953 +Git-commit: 6665a9697b404acf4d2e7d52d9c2b19512c9b239 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 1cbdf32..841ed4c 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -9434,6 +9434,12 @@ static int iw_set_power_params_priv(struct net_device *dev, + char *ptr; + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO, + "Set power params Private"); ++ ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } + /* ODD number is used for set, copy data using copy_from_user */ + ptr = mem_alloc_copy_from_user_helper(wrqu->data.pointer, + wrqu->data.length); +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0023.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0023.patch new file mode 100644 index 00000000..c3e37212 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0023.patch @@ -0,0 +1,40 @@ +From 967f88782e93809cfb27a60b82a3a069d2a52fc4 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:12:55 -0700 +Subject: wlan:Check priviledge permission for CLEAR_MCBC_FILTER IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing CLEAR_MCBC_FILTER IOCTL, making +sure user task has right permission to process the command. + +CRs-Fixed: 930954 +Git-commit: 9eeafd788f53cc37c169b299f91ca9c558b228f9 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 841ed4c..fc8c917 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -8143,6 +8143,12 @@ static int iw_clear_dynamic_mcbc_filter(struct net_device *dev, + tpSirWlanSetRxpFilters wlanRxpFilterParam; + hddLog(VOS_TRACE_LEVEL_INFO_HIGH, "%s: ", __func__); + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + //Reset the filter to INI value as we have to clear the dynamic filter + pHddCtx->configuredMcastBcastFilter = pHddCtx->cfg_ini->mcastBcastFilterSetting; + +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0024.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0024.patch new file mode 100644 index 00000000..3e094bf9 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0024.patch @@ -0,0 +1,40 @@ +From 2f7ecc8b88843b3b53bd7d2328f0d53f3794f456 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:17:28 -0700 +Subject: wlan:Check priviledge permission for SET_THREE_INT_GET_NONE + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_THREE_INT_GET_NONE IOCTL, +making sure user task has right permission to process the command. + +CRs-Fixed: 930948 +Git-commit: aaeeed43f9597631982835481c7cf2621f6455f0 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index fc8c917..51b52f3 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -6846,6 +6846,12 @@ int iw_set_three_ints_getnone(struct net_device *dev, + return -EBUSY; + } + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + switch(sub_cmd) { + + case WE_SET_WLAN_DBG: +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0025.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0025.patch new file mode 100644 index 00000000..76f0bb5b --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0025.patch @@ -0,0 +1,39 @@ +From 9fd4483e08349eb1570c42da8acbac33e70a6e02 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:23:09 -0700 +Subject: wlan:Check priviledge permission for SET_VAR_INTS_GETNONE IOCTL + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_VAR_INTS_GETNONE, making +sure user task has right permission to process the command. + +CRs-Fixed: 930942 +Git-commit: 0858d21caf17d56f8d2353590c1ec245073222e0 +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 51b52f3..ba9d0ff 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -7520,6 +7520,11 @@ static int __iw_set_var_ints_getnone(struct net_device *dev, + int staId = 0; + struct iw_point s_priv_data; + ++ if (!capable(CAP_NET_ADMIN)) { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } + /* helper function to get iwreq_data with compat handling. */ + if (hdd_priv_get_data(&s_priv_data, wrqu)) { + return -EINVAL; +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0026.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0026.patch new file mode 100644 index 00000000..45000280 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0026.patch @@ -0,0 +1,44 @@ +From fb3616763bd5909e86cddd19f3569a26b4f93f49 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:25:21 -0700 +Subject: wlan: ensure permission for WLAN_FTM_PRIV_SET_CHAR_GET_NONE + +prima to qcacld-2.0 propagation. + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. Hence, +in driver, before processing WLAN_FTM_PRIV_SET_CHAR_GET_NONE, +making sure user task has right permission to process the command. + +CRs-Fixed: 930837 +Git-commit: c4928591bbcd131f10f6ea337a4bd6ee3e141c2a +Git-repo: https://www.codeaurora.org/cgit/quic/la/platform/vendor/qcom-opensource/wlan/prima/ +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index ba9d0ff..31205f3 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -6193,6 +6193,13 @@ static int iw_setchar_getnone(struct net_device *dev, struct iw_request_info *in + #endif /* WLAN_FEATURE_VOWIFI */ + struct iw_point s_priv_data; + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + if ((WLAN_HDD_GET_CTX(pAdapter))->isLogpInProgress) + { + VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_FATAL, +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0027.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0027.patch new file mode 100644 index 00000000..69f62656 --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0027.patch @@ -0,0 +1,44 @@ +From ca7c085fb70861a55d9d3a46de012a3e0998ca61 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Wed, 28 Oct 2015 21:27:11 -0700 +Subject: wlan:Check priviledge permission for SET_CHANNEL_RANGE + +prima to qcacld-2.0 propagation. + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_CHANNEL_RANGE IOCTL, +making sure user task has right permission to process the command. + +CRs-Fixed: 930555 +Git-commit: bcb1abfd803c6bb98bad35228d7c4f85b754836d +Git-repo: https://www.codeaurora.org/cgit/quic/la/platform/vendor/qcom-opensource/wlan/prima/ +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +index 31205f3..1b8346d0 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_wext.c +@@ -3336,6 +3336,13 @@ static int iw_softap_set_channel_range( struct net_device *dev, + tHalHandle hHal = WLAN_HDD_GET_HAL_CTX(pHostapdAdapter); + hdd_context_t *pHddCtx = WLAN_HDD_GET_CTX(pHostapdAdapter); + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + status = WLANSAP_SetChannelRange(hHal, startChannel, endChannel, band); + + if (VOS_STATUS_SUCCESS != status) +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0028.patch b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0028.patch new file mode 100644 index 00000000..05511eac --- /dev/null +++ b/Patches/Linux_CVEs/CVE-2016-0806/qcacld-2.0/0028.patch @@ -0,0 +1,44 @@ +From f66afdc6840e7647a965487194873826de57e655 Mon Sep 17 00:00:00 2001 +From: Amarnath Hullur Subramanyam +Date: Sun, 1 Nov 2015 23:04:42 -0800 +Subject: wlan:Check priviledge permission for SET_CHANNEL_RANGE + +prima to qcacld-2.0 propagation. + +Kernel assumes all SET IOCTL commands are assigned with even +numbers. But in our WLAN driver, some SET IOCTLS are assigned with +odd numbers. This leads kernel fail to check, for some SET IOCTLs, +whether user has the right permission to do SET operation. +Hence, in driver, before processing SET_CHANNEL_RANGE IOCTL, +making sure user task has right permission to process the command. + +CRs-Fixed: 930555 +Git-commit: bcb1abfd803c6bb98bad35228d7c4f85b754836d +Git-repo: https://www.codeaurora.org/cgit/quic/la/platform/vendor/qcom-opensource/wlan/prima/ +Bug: 25344453 +Signed-off-by: Amarnath Hullur Subramanyam +--- + drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +index b95a853..e534763 100644 +--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c ++++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_hostapd.c +@@ -3339,6 +3339,13 @@ static int iw_softap_set_channel_range(struct net_device *dev, + VOS_STATUS status; + int ret = 0; /* success */ + ++ if (!capable(CAP_NET_ADMIN)) ++ { ++ VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, ++ FL("permission check failed")); ++ return -EPERM; ++ } ++ + status = WLANSAP_SetChannelRange(hHal,startChannel,endChannel,band); + if(status != VOS_STATUS_SUCCESS) + { +-- +cgit v1.1 + diff --git a/Patches/Linux_CVEs/CVE-2016-10235/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-10235/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-10235/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-10235/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-10283/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-10283/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-10283/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-10283/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-10283/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-10283/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-10283/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2016-10283/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2016-2474/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-2474/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-2474/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-2474/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-2474/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-2474/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-2474/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2016-2474/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2016-3797/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-3797/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-3797/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-3797/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-3874/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-3874/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-3874/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-3874/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-3874/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-3874/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-3874/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2016-3874/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2016-3905/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-3905/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-3905/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-3905/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-3907/3.10/0001.patch b/Patches/Linux_CVEs/CVE-2016-3907/3.18/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-3907/3.10/0001.patch rename to Patches/Linux_CVEs/CVE-2016-3907/3.18/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6675/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-6675/prima/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6675/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-6675/prima/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6676/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-6676/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6676/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-6676/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6679/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-6679/prima/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6679/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-6679/prima/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6679/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-6679/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6679/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2016-6679/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6680/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-6680/prima/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6680/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-6680/prima/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-6680/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2016-6680/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-6680/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2016-6680/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8415/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8415/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8415/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8415/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8419/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8419/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8419/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8419/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8420/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8420/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8420/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8420/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8421/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8421/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8421/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8421/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8452/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8452/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8452/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8452/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2016-8476/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2016-8476/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2016-8476/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2016-8476/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0437/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0437/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0437/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0437/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0438/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0438/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0438/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0438/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0439/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0439/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0439/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0439/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0439/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-0439/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0439/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-0439/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0440/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0440/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0440/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0440/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0441/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0441/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0441/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0441/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0441/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-0441/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0441/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-0441/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0442/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0442/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0442/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0442/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0443/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0443/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0443/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0443/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0443/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-0443/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0443/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-0443/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0453/ANY/0003.patch b/Patches/Linux_CVEs/CVE-2017-0453/prima/0003.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0453/ANY/0003.patch rename to Patches/Linux_CVEs/CVE-2017-0453/prima/0003.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0453/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0453/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0453/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0453/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0453/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-0453/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0453/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-0453/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0457/3.10/0001.patch b/Patches/Linux_CVEs/CVE-2017-0457/3.10/0001.patch deleted file mode 100644 index 98cf6c68..00000000 --- a/Patches/Linux_CVEs/CVE-2017-0457/3.10/0001.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 7d87c5cf051c49c7b3bdb8abe4051b0aef41c87d Mon Sep 17 00:00:00 2001 -From: Sathish Ambley -Date: Tue, 13 Dec 2016 15:27:30 -0800 -Subject: msm: ADSPRPC: Buffer length to be copied is truncated - -The buffer length that is being used to allocate gets truncated -due to it being assigned to wrong type causing a much smaller -buffer to be allocated than what is required for copying. - -Change-Id: I30818acd42bd282837c7c7aa16d56d3b95d4dfe7 -Signed-off-by: Sathish Ambley ---- - drivers/char/adsprpc.c | 18 ++++++++++++++---- - 1 file changed, 14 insertions(+), 4 deletions(-) - -diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c -index f505d09..1224843 100644 ---- a/drivers/char/adsprpc.c -+++ b/drivers/char/adsprpc.c -@@ -787,9 +787,9 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, - void *args; - remote_arg_t *pra = ctx->pra; - remote_arg_t *rpra = ctx->rpra; -- ssize_t rlen, used, size; -+ ssize_t rlen, used, size, copylen = 0; - uint32_t sc = ctx->sc, start; -- int i, inh, bufs = 0, err = 0, oix, copylen = 0; -+ int i, inh, bufs = 0, err = 0, oix; - int inbufs = REMOTE_SCALARS_INBUFS(sc); - int outbufs = REMOTE_SCALARS_OUTBUFS(sc); - int cid = ctx->fdata->cid; -@@ -838,13 +838,23 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, - /* calculate len requreed for copying */ - for (oix = 0; oix < inbufs + outbufs; ++oix) { - int i = ctx->overps[oix]->raix; -+ uintptr_t mstart, mend; -+ - if (!pra[i].buf.len) - continue; - if (list[i].num) - continue; - if (ctx->overps[oix]->offset == 0) - copylen = ALIGN(copylen, BALIGN); -- copylen += ctx->overps[oix]->mend - ctx->overps[oix]->mstart; -+ mstart = ctx->overps[oix]->mstart; -+ mend = ctx->overps[oix]->mend; -+ VERIFY(err, (mend - mstart) <= LONG_MAX); -+ if (err) -+ goto bail; -+ copylen += mend - mstart; -+ VERIFY(err, copylen >= 0); -+ if (err) -+ goto bail; - } - - /* alocate new buffer */ -@@ -870,7 +880,7 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx, - /* copy non ion buffers */ - for (oix = 0; oix < inbufs + outbufs; ++oix) { - int i = ctx->overps[oix]->raix; -- int mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; -+ ssize_t mlen = ctx->overps[oix]->mend - ctx->overps[oix]->mstart; - if (!pra[i].buf.len) - continue; - if (list[i].num) --- -cgit v1.1 - diff --git a/Patches/Linux_CVEs/CVE-2017-0461/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0461/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0461/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0461/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0464/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0464/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0464/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0464/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0575/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0575/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0575/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0575/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0584/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0584/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0584/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0584/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-0624/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-0624/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-0624/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-0624/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11002/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11002/prima/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11002/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11002/prima/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11012/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11012/qcacld-3.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11012/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11012/qcacld-3.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11013/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11013/prima/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11013/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11013/prima/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11013/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-11013/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11013/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-11013/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11014/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11014/qcacld-3.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11014/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11014/qcacld-3.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11015/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11015/qcacld-3.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11015/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11015/qcacld-3.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11015/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-11015/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11015/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-11015/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11022/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11022/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11022/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11022/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11022/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-11022/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11022/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-11022/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11035/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-11035/qcacld-2.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11035/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-11035/qcacld-2.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11035/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11035/qcacld-3.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11035/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11035/qcacld-3.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11050/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11050/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11050/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11050/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11051/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11051/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11051/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11051/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11052/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11052/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11052/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11052/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11053/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11053/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11053/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11053/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11054/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11054/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11054/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11054/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11055/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11055/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11055/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11055/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11058/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11058/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11058/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11058/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11060/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11060/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11060/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11060/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11061/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11061/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11061/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11061/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11062/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11062/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11062/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11062/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-11064/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-11064/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-11064/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-11064/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-13080/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-13080/ANY/0001.patch index 3a88a75c..92d3bf73 100644 --- a/Patches/Linux_CVEs/CVE-2017-13080/ANY/0001.patch +++ b/Patches/Linux_CVEs/CVE-2017-13080/ANY/0001.patch @@ -1,4 +1,4 @@ -From fdf7cb4185b60c68e1a75e61691c4afdc15dea0e Mon Sep 17 00:00:00 2001 +From 39fb5459ecd16779e75d76827fb32d15a995f469 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Tue, 5 Sep 2017 14:54:54 +0200 Subject: [PATCH] mac80211: accept key reinstall without changing anything @@ -18,25 +18,25 @@ In case this happens, simply silently accept the new key coming from userspace but don't take any action on it since it's the same key; this keeps the PN replay counters intact. +Change-Id: Id95f656ce3caabd166143cbd562fa4efc2db1385 Signed-off-by: Johannes Berg --- - net/mac80211/key.c | 21 +++++++++++++++++---- - 1 file changed, 17 insertions(+), 4 deletions(-) + net/mac80211/key.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/net/mac80211/key.c b/net/mac80211/key.c -index a98fc2b5e0dc9..ae995c8480db9 100644 +index 5bb600d93d7..cebe30315d9 100644 --- a/net/mac80211/key.c +++ b/net/mac80211/key.c -@@ -4,7 +4,7 @@ +@@ -3,6 +3,7 @@ + * Copyright 2005-2006, Devicescape Software, Inc. * Copyright 2006-2007 Jiri Benc * Copyright 2007-2008 Johannes Berg - * Copyright 2013-2014 Intel Mobile Communications GmbH -- * Copyright 2015 Intel Deutschland GmbH + * Copyright 2015-2017 Intel Deutschland GmbH * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as -@@ -620,9 +620,6 @@ int ieee80211_key_link(struct ieee80211_key *key, +@@ -452,9 +453,6 @@ int ieee80211_key_link(struct ieee80211_key *key, pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; idx = key->conf.keyidx; @@ -44,9 +44,9 @@ index a98fc2b5e0dc9..ae995c8480db9 100644 - key->sdata = sdata; - key->sta = sta; - mutex_lock(&sdata->local->key_mtx); - -@@ -633,6 +630,21 @@ int ieee80211_key_link(struct ieee80211_key *key, + if (sta) { + /* +@@ -491,6 +489,21 @@ int ieee80211_key_link(struct ieee80211_key *key, else old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]); @@ -67,10 +67,10 @@ index a98fc2b5e0dc9..ae995c8480db9 100644 + increment_tailroom_need_count(sdata); - ieee80211_key_replace(sdata, sta, pairwise, old_key, key); -@@ -648,6 +660,7 @@ int ieee80211_key_link(struct ieee80211_key *key, - ret = 0; - } + __ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +@@ -500,6 +513,7 @@ int ieee80211_key_link(struct ieee80211_key *key, + + ret = ieee80211_key_enable_hw_accel(key); + out: mutex_unlock(&sdata->local->key_mtx); diff --git a/Patches/Linux_CVEs/CVE-2017-6424/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-6424/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-6424/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-6424/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-6424/ANY/0002.patch b/Patches/Linux_CVEs/CVE-2017-6424/qcacld-3.0/0002.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-6424/ANY/0002.patch rename to Patches/Linux_CVEs/CVE-2017-6424/qcacld-3.0/0002.patch diff --git a/Patches/Linux_CVEs/CVE-2017-8241/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-8241/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-8241/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-8241/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-8256/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-8256/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-8256/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-8256/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-8270/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-8270/qcacld-3.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-8270/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-8270/qcacld-3.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-9693/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-9693/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-9693/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-9693/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-9694/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-9694/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-9694/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-9694/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-9714/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-9714/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-9714/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-9714/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/CVE-2017-9715/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-9715/ANY/0001.patch deleted file mode 100644 index 03c5244b..00000000 --- a/Patches/Linux_CVEs/CVE-2017-9715/ANY/0001.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 58350a7bcb827c0ac81f0750a62d5c5a8ed3a469 Mon Sep 17 00:00:00 2001 -From: Jeff Johnson -Date: Tue, 6 Jun 2017 08:56:33 -0700 -Subject: qcacld-2.0: Avoid extscan bucket spec overread - -Currently in hdd_extscan_start_fill_bucket_channel_spec() the -QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC attribute is parsed without -specifying a policy. This means that no policy is enforced. -Subsequently the values of the nested attributes are retrieved, but -again without any length limits enforced. This could result in a -buffer overread. -To prevent this issue: -* Parse using the existing policy wlan_hdd_extscan_config_policy -* Update the policy to add missing attributes - -Change-Id: I3b20cb28d1beccd2e804b022b531413ad1edb533 -CRs-Fixed: 2057034 ---- - CORE/HDD/src/wlan_hdd_cfg80211.c | 8 ++++++-- - 1 file changed, 6 insertions(+), 2 deletions(-) - -diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c -index 1f6be81..078b4fd 100644 ---- a/CORE/HDD/src/wlan_hdd_cfg80211.c -+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c -@@ -850,6 +850,9 @@ wlan_hdd_extscan_config_policy[QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_ - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_LOST_AP_SAMPLE_SIZE] = { .type = NLA_U32 }, - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_MIN_BREACHING] = { .type = NLA_U32 }, - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SIGNIFICANT_CHANGE_PARAMS_NUM_AP] = { .type = NLA_U32 }, -+ [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_MAX_PERIOD] = { .type = NLA_U32 }, -+ [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_BASE] = { .type = NLA_U32 }, -+ [QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_STEP_COUNT] = { .type = NLA_U32 }, - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_THRESHOLD_PARAM_SSID] = { .type = NLA_BINARY, - .len = IEEE80211_MAX_SSID_LEN + 1 }, - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_SSID_HOTLIST_PARAMS_LOST_SSID_SAMPLE_SIZE] = { .type = NLA_U32 }, -@@ -3533,8 +3536,9 @@ static int hdd_extscan_start_fill_bucket_channel_spec( - } - - if (nla_parse(bucket, -- QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, -- nla_data(buckets), nla_len(buckets), NULL)) { -+ QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, -+ nla_data(buckets), nla_len(buckets), -+ wlan_hdd_extscan_config_policy)) { - hddLog(LOGE, FL("nla_parse failed")); - return -EINVAL; - } --- -cgit v1.1 - diff --git a/Patches/Linux_CVEs/CVE-2017-9717/ANY/0001.patch b/Patches/Linux_CVEs/CVE-2017-9717/qcacld-2.0/0001.patch similarity index 100% rename from Patches/Linux_CVEs/CVE-2017-9717/ANY/0001.patch rename to Patches/Linux_CVEs/CVE-2017-9717/qcacld-2.0/0001.patch diff --git a/Patches/Linux_CVEs/Kernel_CVE_Patch_List.txt b/Patches/Linux_CVEs/Kernel_CVE_Patch_List.txt index 96047442..7cd129cc 100644 --- a/Patches/Linux_CVEs/Kernel_CVE_Patch_List.txt +++ b/Patches/Linux_CVEs/Kernel_CVE_Patch_List.txt @@ -283,10 +283,10 @@ CVE-2014-9899 CVE-2014-9900 Link - https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=63c317dbee97983004dffdd9f742a20d17150071 CVE-2014-9901 - Link - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=637f0f7931dd7265ac1c250dc2884d6389c66bde + Link - prima - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=637f0f7931dd7265ac1c250dc2884d6389c66bde CVE-2014-9902 - Link - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50 - Link - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50 + Link - prima - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50 + Link - prima - https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50 CVE-2014-9903 Link - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4efbc454ba68def5ef285b26ebfcfdb605b52755 CVE-2014-9904 @@ -301,27 +301,27 @@ CVE-2015-3636 Link - https://github.com/torvalds/linux/commit/a134f083e79f CVE-2015-0569 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a079d716b5481223f0166c644e9ec7c75a31b02c - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=0ffca4f7bca3a8157d8dbaddbcea292c267fb5aa + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a079d716b5481223f0166c644e9ec7c75a31b02c + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=0ffca4f7bca3a8157d8dbaddbcea292c267fb5aa CVE-2015-0570 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=8bd73c3452ab22ba9bdbaac5ab12de2ed25fcb9d - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=606babd474290e84e5a86f94480f62f4a5ff92ac + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=8bd73c3452ab22ba9bdbaac5ab12de2ed25fcb9d + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=606babd474290e84e5a86f94480f62f4a5ff92ac CVE-2015-0571 Pulled - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6feb2faf80a05940618aa2eef2b62e4e2e54f148 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fe4208157c899a5de4d6769d13f6620fc32ebfa9 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0e53a89bfe0dbb50e0dde9a6960d274386247cd9 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=88ce639e7a0bba852f193b6f53b7ca1926a09b02 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0858d21caf17d56f8d2353590c1ec245073222e0 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2905578424256be07e6b9d8c63bb83d40cc52a71 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=be62ecde85228b91c66fb047e27d25132f56bd0d - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=aaeeed43f9597631982835481c7cf2621f6455f0 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6642bccf3ed8cba176dee7d4bbc21fc4580efb7b - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6665a9697b404acf4d2e7d52d9c2b19512c9b239 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9eeafd788f53cc37c169b299f91ca9c558b228f9 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=55bdc6d1c88a100dc4a71bf855b69db522c9b5b5 - Link - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fb9fb202c71547dba648c9b08d97645c6f42ca6e + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6feb2faf80a05940618aa2eef2b62e4e2e54f148 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fe4208157c899a5de4d6769d13f6620fc32ebfa9 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0e53a89bfe0dbb50e0dde9a6960d274386247cd9 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=88ce639e7a0bba852f193b6f53b7ca1926a09b02 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0858d21caf17d56f8d2353590c1ec245073222e0 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2905578424256be07e6b9d8c63bb83d40cc52a71 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=be62ecde85228b91c66fb047e27d25132f56bd0d + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=aaeeed43f9597631982835481c7cf2621f6455f0 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6642bccf3ed8cba176dee7d4bbc21fc4580efb7b + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6665a9697b404acf4d2e7d52d9c2b19512c9b239 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9eeafd788f53cc37c169b299f91ca9c558b228f9 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=55bdc6d1c88a100dc4a71bf855b69db522c9b5b5 + Link - qcacld-2.0 - https://www.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fb9fb202c71547dba648c9b08d97645c6f42ca6e CVE-2015-0572 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61 CVE-2015-0573 @@ -479,9 +479,34 @@ CVE-2016-0805 Pulled Link - https://github.com/android/kernel_msm/commit/b3f0b1f694258b3b3debc5256eec94bb2a9eb454 CVE-2016-0806 - Pulled - Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/log/?h=caf%2Faosp-new%2Fandroid-msm-flo-3.4-marshmallow-mr2&qt=grep&q=27104184 - Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/log/?qt=grep&q=25344453&h=caf%2Faosp-new%2Fandroid-msm-bullhead-3.10-nougat-mr2 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=1fac73337080712109029302599945d1ac36c799 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=e9dcd5aa01734b019c793220531e4ef1d82959f8 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=fd13b59e5a75b761f68fe34f09df1dce7a49acc2 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=fbb8f120ee729d47869f0bebe5bc31e83bcf2876 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=518fd80981eefa9715e0851260b2c7aeb86551d7 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=86fd66a451b2549f990b71013220e0a3f46b5a00 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=4a75c965d2505ca2490a365a27309cc9dd68b2d1 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=ede034fd604a9cdb20eb7accdaec4a8e70ffac41 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=aaf7476fa7fdc8d1865f20217c7c57ce561e03f7 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=973503f0d411e13e01fa10c5ea802dcb8a12cf85 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=34953f9f66d9cd36616c5271a7d285b31d9142c2 + Link - prima - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-flo-3.4-marshmallow-mr2&id=72d3908cc1bcb075015f1b86001f4292ac41d38a + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=055561f40f2baa5cdd74f952be55b61a3907279a + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=f31e58289c8ebded58ffe1d4709e2f878765b0a6 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=255dd931573beb3afca15909f483f26db22a5c98 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=d4b451bd06ad53ed785cbda4272c54788b1537d4 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=2882941530cbf804e280f235f7f8d76179a423fe + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=825827ab2aa271f23f48aa683046a3aa3f7fe90e + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=27d3007a7635ccca7ae9bfb98c89724652dcbc3b + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=89c3372735486a2f7f6b35298fcf246e7e177ac0 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=e2addf5aa2c7dfc537c2b80d8cc1cb5640346535 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=e474427496ccb784878e10978f25b6e85de68850 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=967f88782e93809cfb27a60b82a3a069d2a52fc4 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=2f7ecc8b88843b3b53bd7d2328f0d53f3794f456 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=9fd4483e08349eb1570c42da8acbac33e70a6e02 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=fb3616763bd5909e86cddd19f3569a26b4f93f49 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=ca7c085fb70861a55d9d3a46de012a3e0998ca61 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=caf/aosp-new/android-msm-bullhead-3.10-nougat-mr2&id=f66afdc6840e7647a965487194873826de57e655 CVE-2016-0819 Link - https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=e32c1b1a3d368afe1b09e81b3087ab8810282e93 CVE-2016-0821 @@ -527,12 +552,12 @@ CVE-2016-10234 Link - 3.10 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=c7d7492c1e329fdeb28a7901c4cd634d41a996b1 Link - 3.18 - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=d12370c7f3ecded1867fbd6b70ded35db55cab1d CVE-2016-10235 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5bb0059243515ecdac138cfdb4cee7259bbd0bbc + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5bb0059243515ecdac138cfdb4cee7259bbd0bbc CVE-2016-10236 Link - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=b8199c2b852f1e23c988e10b8fbb8d34c98b4a1c CVE-2016-10283 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=93863644b4547324309613361d70ad9dc91f8dfd - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d60a5839ba987e2c9d365fef950cae0c9ad11010 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=93863644b4547324309613361d70ad9dc91f8dfd + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=d60a5839ba987e2c9d365fef950cae0c9ad11010 CVE-2016-10285 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=67dfd3a65336e0b3f55ee83d6312321dc5f2a6f9 CVE-2016-10286 @@ -573,7 +598,7 @@ CVE-2016-2061 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=79db14ca9f791a14be9376a0340ad3b9b9a4d603 CVE-2016-2062 - Link - https://codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/drivers/gpu/msm/adreno_perfcounter.c?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576 + Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/drivers/gpu/msm/adreno_perfcounter.c?id=27c95b64b2e4b5ff1288cbaa6e353dd803d71576 CVE-2016-2063 Link - https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4 CVE-2016-2064 @@ -639,18 +664,18 @@ CVE-2016-2469 Pulled Link - https://android.googlesource.com/kernel/msm/+/4029268991f478b98b6d37106af8f1f635c0b595 CVE-2016-2470 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=05ce237387c6e1d101bbb4b825e56757576748e6 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=4fd81f97c3eaf42d506aa4f2b496862222c0a89d + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=05ce237387c6e1d101bbb4b825e56757576748e6 + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=4fd81f97c3eaf42d506aa4f2b496862222c0a89d CVE-2016-2471 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=2c8961821b7691a95cbf5ecc6996e8229d6d5303 + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=2c8961821b7691a95cbf5ecc6996e8229d6d5303 CVE-2016-2472 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=464c9c8a984c3a36f63b1625d7ab2a1c9eec9697 + Link - prima - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=464c9c8a984c3a36f63b1625d7ab2a1c9eec9697 CVE-2016-2473 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/CORE/HDD/src/wlan_hdd_wext.c?id=0273cba64b0436d481e09222a631a6acc274b96c + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/CORE/HDD/src/wlan_hdd_wext.c?id=0273cba64b0436d481e09222a631a6acc274b96c CVE-2016-2474 Depends - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=d541aecce07c65fee3ad3a4d900016e4d22f2b3d - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=681c310490e49adc43065d1d11006c5a5dc43568 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=d541aecce07c65fee3ad3a4d900016e4d22f2b3d + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=681c310490e49adc43065d1d11006c5a5dc43568 CVE-2016-2475 Pulled Link - https://android.googlesource.com/kernel/tegra/+/9f0aa0c3fede9abb0b5ccadeca95f848cc791fba @@ -666,7 +691,7 @@ CVE-2016-2488 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=91ea960b91250eca57d8fbdb8aafa11d80695d46 CVE-2016-2498 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=1d23dacdbd6b3a2b59b952f2fa3a578f9d15f60f + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=1d23dacdbd6b3a2b59b952f2fa3a578f9d15f60f CVE-2016-2501 Link - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=0ee6c6f748e840c266fe26ed3c89d6bd7e3c9d4e CVE-2016-2502 @@ -736,9 +761,9 @@ CVE-2016-3775 Link - 3.10 - https://github.com/android/kernel_msm/commit/8096090858689395a75bbf696ff8276c3c236b98 Link - 3.18 - https://github.com/android/kernel_msm/commit/b1568c363c54fa3aa98b1cfa7c535115950bec0c CVE-2016-3792 - Link - https://us.codeaurora.org/cgit/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=28d4f0c1f712bffb4aa5b47f06e97d5a9fa06d29 + Link - prima - https://us.codeaurora.org/cgit/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=28d4f0c1f712bffb4aa5b47f06e97d5a9fa06d29 CVE-2016-3797 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fdda9c0af64d6e5cdf006e2d8dd57e655821a962 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=fdda9c0af64d6e5cdf006e2d8dd57e655821a962 CVE-2016-3809 Pulled Link - https://android.googlesource.com/kernel/msm/+/f2152040cb3c13fa846914df1ad44a8a7fd2e935 @@ -774,7 +799,7 @@ CVE-2016-3859 Link - 3.10 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=fe297dc01f7ea95bb1bff25f6fc4257f0ef832ff Link - 3.18 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-3.18.git;a=commit;h=61b419297e13ed9a28e9b880548b2d96d4aa6c0d CVE-2016-3860 - Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/diff/sound/soc/msm/qdsp6v2/audio_calibration.c?id=528976f54be246ec93a71ac53aa4faf3e3791c48 + Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/sound/soc/msm/qdsp6v2/audio_calibration.c?id=528976f54be246ec93a71ac53aa4faf3e3791c48 CVE-2016-3865 Pulled Link - https://github.com/android/kernel_msm/commit/a92e71c20f4e6b2aa94b7614fd494833ea76b8b9 @@ -789,8 +814,8 @@ CVE-2016-3868 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=17014696ce3836c91215b6d6dd82f3befd6e7d4d CVE-2016-3874 Depends - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=50e8f265b3f7926aeb4e49c33f7301ace89faa77 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a3974e61c960aadcc147c3c5704a67309171642d + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=50e8f265b3f7926aeb4e49c33f7301ace89faa77 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a3974e61c960aadcc147c3c5704a67309171642d CVE-2016-3892 Link - https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=dd40cc2bd210dd7a4dd649e8f79add2bbeda2bd5 CVE-2016-3893 @@ -806,12 +831,12 @@ CVE-2016-3903 CVE-2016-3904 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=069683407ca9a820d05c914b57c587bcd3f16a3a CVE-2016-3905 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b5112838eb91b71eded4b5ee37338535784e0aef + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b5112838eb91b71eded4b5ee37338535784e0aef CVE-2016-3906 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b333d32745fec4fb1098ee1a03d4425f3c1b4c2e CVE-2016-3907 Link - 3.10 - https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=744330f4e5d70dce71c4c9e03c5b6a8b59bb0cda - Link - 3.10 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-3.18.git;a=commit;h=289ede9d6bfb46178326ae9ca86033bbd452f269 + Link - 3.18 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-3.18.git;a=commit;h=289ede9d6bfb46178326ae9ca86033bbd452f269 CVE-2016-3931 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e80b88323f9ff0bb0e545f209eec08ec56fca816 CVE-2016-3934 @@ -923,15 +948,15 @@ CVE-2016-6672 Pulled Link - https://github.com/android/kernel_msm/commit/d8649432b96bd361de20168372c10269e88e1258 CVE-2016-6675 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=1353fa0bd0c78427f3ae7d9bde7daeb75bd01d09 + Link - prima - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=1353fa0bd0c78427f3ae7d9bde7daeb75bd01d09 CVE-2016-6676 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6ba9136879232442a182996427e5c88e5a7512a8 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6ba9136879232442a182996427e5c88e5a7512a8 CVE-2016-6679 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=d39345f0abc309959d831d09fcbf1619cc0ae0f5 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f081695446679aa44baa0d00940ea18455eeb4c5 + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=d39345f0abc309959d831d09fcbf1619cc0ae0f5 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f081695446679aa44baa0d00940ea18455eeb4c5 CVE-2016-6680 - Link - https://www.codeaurora.org/gitweb/quic/la/?p=platform/vendor/qcom-opensource/wlan/prima.git;a=commit;h=08ce2a9e1ccdf6081fc1efb47d2edea4f4ad2ecf - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2f2fa073b95d4700de88c0f7558b4a18c13ac552 + Link - prima - https://www.codeaurora.org/gitweb/quic/la/?p=platform/vendor/qcom-opensource/wlan/prima.git;a=commit;h=08ce2a9e1ccdf6081fc1efb47d2edea4f4ad2ecf + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2f2fa073b95d4700de88c0f7558b4a18c13ac552 CVE-2016-6681 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395 CVE-2016-6682 @@ -1085,7 +1110,7 @@ CVE-2016-8413 CVE-2016-8414 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=320970d3da9b091e96746424c44649a91852a846 CVE-2016-8415 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=188e12a816508b11771f362c852782ec9a6f9394 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=188e12a816508b11771f362c852782ec9a6f9394 CVE-2016-8416 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3af5e89426f1c8d4e703d415eff5435b925649f CVE-2016-8417 @@ -1093,11 +1118,11 @@ CVE-2016-8417 CVE-2016-8418 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=8f8066581a8e575a7d57d27f36c4db63f91ca48f CVE-2016-8419 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9ba50d536227666a5b6abd51f2b122675d950488 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=9ba50d536227666a5b6abd51f2b122675d950488 CVE-2016-8420 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c6597e015a7ce5ee71d3725fc55e64fc50923f4e + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c6597e015a7ce5ee71d3725fc55e64fc50923f4e CVE-2016-8421 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=61a5cdb9adc96645583f528ac923e6e59f3abbcb + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=61a5cdb9adc96645583f528ac923e6e59f3abbcb CVE-2016-8434 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.14/commit/?id=3e3866a5fced40ccf9ca442675cf915961efe4d9 CVE-2016-8436 @@ -1108,7 +1133,7 @@ CVE-2016-8444 CVE-2016-8450 Link - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=e909d159ad1998ada853ed35be27c7b6ba241bdb CVE-2016-8452 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=39fa8e972fa1b10dc68a066f4f9432753d8a2526 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=39fa8e972fa1b10dc68a066f4f9432753d8a2526 CVE-2016-8453 Pulled Link - https://github.com/android/kernel_msm/commit/f10f4e420dddc35dfef53965c55ffd5bdec41a45 @@ -1165,7 +1190,7 @@ CVE-2016-8475 Pulled Link - https://github.com/android/kernel_msm/commit/d906945fc287f9df48b99349fea962b921d4d39e CVE-2016-8476 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=bfe8035bce6fec72ed1d064b94529fce8fb09799 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=bfe8035bce6fec72ed1d064b94529fce8fb09799 CVE-2016-8477 Link - 3.10 - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=33c9042e38506b04461fa99e304482bc20923508 Link - 3.18 - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=96145eb5f0631f0e105d47abebc8f940f7621eeb @@ -1239,22 +1264,22 @@ CVE-2017-0436 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ce9db0874906f6aedd80bb28d457eadfe38bdd02 CVE-2017-0437 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 CVE-2017-0438 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 CVE-2017-0439 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=81b6b5538d3227ed4b925fcceedb109abb2a4c61 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ff866a1e9a0f653252b5d5b7eb087374c5bad65d + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=81b6b5538d3227ed4b925fcceedb109abb2a4c61 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ff866a1e9a0f653252b5d5b7eb087374c5bad65d CVE-2017-0440 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=10f0051f7b3b9a7635b0762a8cf102f595f7a268 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=10f0051f7b3b9a7635b0762a8cf102f595f7a268 CVE-2017-0441 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=da87131740351b833f17f05dfa859977bc1e7684 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e578706506f98a4962220066d92d81e853ac7212 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=da87131740351b833f17f05dfa859977bc1e7684 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=e578706506f98a4962220066d92d81e853ac7212 CVE-2017-0442 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1f0b036dc74ccb6e9f0a03a540efdb0876f5ca77 CVE-2017-0443 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f1081e78eff75ca665c662493736b17cb792b46d - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a4c5eefd5dd761445784963f3b6605d24d2bc3af + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f1081e78eff75ca665c662493736b17cb792b46d + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a4c5eefd5dd761445784963f3b6605d24d2bc3af CVE-2017-0444 Pulled Link - https://source.codeaurora.org/quic/la/kernel/tegra/commit/?id=230f280dd4046a227665ff07c9afaa7b9aa1e061 @@ -1281,9 +1306,9 @@ CVE-2017-0452 Pulled Link - https://github.com/android/kernel_msm/commit/4fa7499742c56c7f7064c9dc14c3a34f4be38851 CVE-2017-0453 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=29c4ddb447b2d49409a9d0b93631f84a9d2e922e - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a2959858f428acfca3ca4c61d3c10b446bfe9b60 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=ddf864f37134df0960d337ff16e6f2435b4fe90c + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=29c4ddb447b2d49409a9d0b93631f84a9d2e922e + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=a2959858f428acfca3ca4c61d3c10b446bfe9b60 + Link - prima - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=ddf864f37134df0960d337ff16e6f2435b4fe90c CVE-2017-0454 Link - 3.10 - https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=01f3ad23574c85a060e6add7a20173621b5b2c77 Link - 3.18 - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=484349ebc927b7be6cc9187c6bd71ffb3f4112d1 @@ -1295,7 +1320,6 @@ CVE-2017-0456 CVE-2017-0457 Pulled Link - 3.10 - https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=7d87c5cf051c49c7b3bdb8abe4051b0aef41c87d - Link - 3.10 - https://github.com/android/kernel_msm/commit/6f6ce85df80c31048863cd31349e86277d89ff36 Link - 3.18 - https://github.com/android/kernel_msm/commit/f6e21d2a3778bcbbef7320ffbf31631d76679175 CVE-2017-0458 Link - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=eba46cb98431ba1d7a6bd859f26f6ad03f1bf4d4 @@ -1306,7 +1330,7 @@ CVE-2017-0460 Link - 3.18 - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=8e2e23126709ebffa1bd91e1a6ac77e16714d852 Link - 4.4 - https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=85cccedb0cae0331228cc58fa91d31810018df98 CVE-2017-0461 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ce5d6f84420a2e6ca6aad6b866992970dd313a65 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ce5d6f84420a2e6ca6aad6b866992970dd313a65 CVE-2017-0462 Link - 3.18 - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=eb7b1426279e751b1fc3e86f434dc349945c1ae7 Link - 4.4 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-4.4.git;a=commit;h=9a71e9a686942ae3c491061ab275a3678ee2819a @@ -1314,7 +1338,7 @@ CVE-2017-0463 Link - 3.18 - https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=955bd7e7ac097bdffbadafab90e5378038fefeb2 Link - 4.4 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-4.4.git;a=commit;h=32c229060ca33b816c50eedc136ea2800f9974df CVE-2017-0464 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=051597a4fe19fd1292fb7ea2e627d12d1fd2934f + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=051597a4fe19fd1292fb7ea2e627d12d1fd2934f CVE-2017-0465 Link - https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=3823f0f8d0bbbbd675a42a54691f4051b3c7e544 CVE-2017-0507 @@ -1397,7 +1421,7 @@ CVE-2017-0574 Pulled Link - https://github.com/android/kernel_msm/commit/e55ddf68568a33288d76f5e00c93f8157cb9a632 CVE-2017-0575 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a4f790c140d9813c3af66a9b367b4568e053278a + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=a4f790c140d9813c3af66a9b367b4568e053278a CVE-2017-0576 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=2b09507d78b25637df6879cd2ee2031b208b3532 CVE-2017-0583 @@ -1405,7 +1429,7 @@ CVE-2017-0583 Link - 3.18 - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=452d2ad331d20b19e8a0768c4b6e7fe1b65abe8f CVE-2017-0584 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b83b9057d56c057d1dfca79ae197583a83766245 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b83b9057d56c057d1dfca79ae197583a83766245 CVE-2017-0586 Pulled Link - https://github.com/android/kernel_msm/commit/05bacdc0f9c16c58326a4be9e88afa870cf1024e @@ -1440,7 +1464,7 @@ CVE-2017-0622 Link - 3.18 - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=40efa25345003a96db34effbd23ed39530b3ac10 Link - 4.4 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-4.4.git;a=commit;h=2881d2bbc26ff321fd9e717ad6f968aebd277d22 CVE-2017-0624 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0ac5f6f2f221efb93fc0ddb1fec6487c76d95acd + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=0ac5f6f2f221efb93fc0ddb1fec6487c76d95acd CVE-2017-0626 Link - https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=64551bccab9b5b933757f6256b58f9ca0544f004 CVE-2017-0627 @@ -1579,23 +1603,23 @@ CVE-2017-11001 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=d5d2c9baff89932e822ceae74b1569af07d55f19 CVE-2017-11002 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=64c0865bb0c5a642ba420967b23e0f66e035b300 + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=64c0865bb0c5a642ba420967b23e0f66e035b300 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=825eeb85d4866e362452b18df929a54a7c6111f6 CVE-2017-11012 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=7d0e40d328fa092c36b9585516ed29fc6041be55 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=7d0e40d328fa092c36b9585516ed29fc6041be55 CVE-2017-11013 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=64297e4caffdf6b1a90807bbdb65a66b43582228 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c9f8654b11a1e693022ad7f163b3bc477fea8ce8 + Link - prima - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=64297e4caffdf6b1a90807bbdb65a66b43582228 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c9f8654b11a1e693022ad7f163b3bc477fea8ce8 CVE-2017-11014 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ec58bc99e29d89f8e164954999ef8a45cec21754 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ec58bc99e29d89f8e164954999ef8a45cec21754 CVE-2017-11015 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ec58bc99e29d89f8e164954999ef8a45cec21754 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=1ef6add65a36de6c4da788f776de2b5b5c528d8e + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ec58bc99e29d89f8e164954999ef8a45cec21754 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=1ef6add65a36de6c4da788f776de2b5b5c528d8e CVE-2017-11018 Link - https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=1d718286c4c482502a2c4356cebef28aef2fb01f CVE-2017-11022 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1379bfb6c09ee2ad5969db45c27fb675602b4ed0 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=f41e3dbc92d448d3d56cae5517e41a4bafafdf3f + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1379bfb6c09ee2ad5969db45c27fb675602b4ed0 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=f41e3dbc92d448d3d56cae5517e41a4bafafdf3f CVE-2017-11023 Link - https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=c36e61af0f770125d0061a8d988d0987cc8d116a CVE-2017-11024 @@ -1615,8 +1639,8 @@ CVE-2017-11029 CVE-2017-11032 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=2720294757d0ad5294283c15dc837852f7b2329a CVE-2017-11035 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c5060da3e741577578d66dfadb7922d853da6156 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=cc1896424ae7a346090f601bc69c6ca51d9c3e04 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=c5060da3e741577578d66dfadb7922d853da6156 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=cc1896424ae7a346090f601bc69c6ca51d9c3e04 CVE-2017-11040 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=7a4d0eea0ca0c8a72111ae58d9829be817f102c9 @@ -1627,21 +1651,21 @@ CVE-2017-11048 Pulled Link - https://github.com/android/kernel_msm/commit/a42f6e19316e9e5aaaf8bd2c3bec25fde136dcaa CVE-2017-11050 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=725674586f5bc009ef5175d29eb0fd677e0ef1f2 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=725674586f5bc009ef5175d29eb0fd677e0ef1f2 CVE-2017-11051 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c8f263f0e3b0b6cba38fae9b2330d77f802c51d8 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c8f263f0e3b0b6cba38fae9b2330d77f802c51d8 CVE-2017-11052 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c1ea8487f35d3f4dea574552afda6a1637f98bbb + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=c1ea8487f35d3f4dea574552afda6a1637f98bbb CVE-2017-11053 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=99c00329bc13c526305dc826950c2cc117e6725d + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=99c00329bc13c526305dc826950c2cc117e6725d CVE-2017-11054 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=4d9812973e8b12700afd8c3d6f36a94506ffb6fc + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=4d9812973e8b12700afd8c3d6f36a94506ffb6fc CVE-2017-11055 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=708633ca627031373f5cc3ca2e8994e7d694905a + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=708633ca627031373f5cc3ca2e8994e7d694905a CVE-2017-11056 Pulled Link - https://github.com/android/kernel_msm/commit/d5481967f73c5448b9b2ae528a75faa0b040bc42 @@ -1649,22 +1673,22 @@ CVE-2017-11057 Pulled Link - https://github.com/android/kernel_msm/commit/270bb9351889878dbfc87a6797886cb3caf42430 CVE-2017-11058 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=4d9812973e8b12700afd8c3d6f36a94506ffb6fc + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=4d9812973e8b12700afd8c3d6f36a94506ffb6fc CVE-2017-11059 Pulled Link - https://github.com/android/kernel_msm/commit/be632ce97422dfe533944186e2f4420b87b87ad5 CVE-2017-11060 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=657bb41463b837b2681e1fed310bd97970b09b83 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=657bb41463b837b2681e1fed310bd97970b09b83 CVE-2017-11061 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=e08628a3cfe039bc4bdd7fc66f5ec7a59a97b404 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=e08628a3cfe039bc4bdd7fc66f5ec7a59a97b404 CVE-2017-11062 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=954bdf216ce56a860092fd9549229b036e08c97b + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=954bdf216ce56a860092fd9549229b036e08c97b CVE-2017-11064 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=38d6f16b8583bae6a1881c744ae08d609c99cb7e + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=38d6f16b8583bae6a1881c744ae08d609c99cb7e CVE-2017-11067 Pulled Link - https://github.com/aosp-mirror/kernel_msm/commit/3fabdcba3a09ce8f3cc757bf6240e53421a1e363 @@ -1677,6 +1701,7 @@ CVE-2017-12153 Link - 3.2-3.16 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git/commit/?h=v3.2.94&id=082d8a6a55d2b6583d9e93ac9796efdf4c412658 CVE-2017-13080 Link - https://github.com/torvalds/linux/commit/fdf7cb4185b60c68e1a75e61691c4afdc15dea0e + Link - https://github.com/LineageOS/android_kernel_oneplus_msm8974/commit/39fb5459ecd16779e75d76827fb32d15a995f469.patch CVE-2017-13080-Extra Depends Link - https://github.com/LineageOS/android_kernel_lge_hammerhead/commit/6fef7504fdb639dea2fbc0cbbd10963953f443da @@ -1750,8 +1775,8 @@ CVE-2017-6421 CVE-2017-6423 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0f264f812b61884390b432fdad081a3e995ba768 CVE-2017-6424 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5cc2ac840e36a3342c5194c20b314f0bb95ef7e1 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=4e44b25b26a594aa818 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=5cc2ac840e36a3342c5194c20b314f0bb95ef7e1 + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=4e44b25b26a594aa818 CVE-2017-6425 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=ef86560a21fe1f256f6ba772a195201ff202c657 CVE-2017-6426 @@ -1837,7 +1862,7 @@ CVE-2017-8239 CVE-2017-8240 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=22b8b6608174c1308208d5bc6c143f4998744547 CVE-2017-8241 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=90213394b7efb28fa511b2eaebc1343ae3b54724 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=90213394b7efb28fa511b2eaebc1343ae3b54724 CVE-2017-8242 Link - 3.18 - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6a3b8afdf97e77c0b64005b23fa6d32025d922e5 Link - 4.4 - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-4.4.git;a=commit;h=364643660e49ec22f657d3e624bee2c7b9738d98 @@ -1866,7 +1891,7 @@ CVE-2017-8253 CVE-2017-8254 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=70afce1d9be745005c48fd565c01ce452a565e7e CVE-2017-8256 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=75e1e00d6b3cd4cb89fd5314a60c333aa0b03230 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=75e1e00d6b3cd4cb89fd5314a60c333aa0b03230 CVE-2017-8257 Link - https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=0f19fbd00c6679bbc524f7a6d0fc3d54cfd1c9ae CVE-2017-8258 @@ -1901,7 +1926,7 @@ CVE-2017-8269 Pulled Link - https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=b925d9f76164475abb6f6a557327095156c9b249 CVE-2017-8270 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ff96565f1dbabfeb7fb2c1604f40af768579d9df + Link - qcacld-3.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ff96565f1dbabfeb7fb2c1604f40af768579d9df CVE-2017-8272 Link - 4.4 - https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=a8cb976e7c8f25191728b655e0b38328a6d7d81f CVE-2017-8277 @@ -1965,22 +1990,22 @@ CVE-2017-9691 CVE-2017-9692 Link - https://github.com/android/kernel_msm/commit/7a86f369594a0b6567820b77d441e778e6adb8a7 CVE-2017-9693 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05a5abb21e4d97001f77d344444a3ec2f9c275f9 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=05a5abb21e4d97001f77d344444a3ec2f9c275f9 CVE-2017-9694 - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1e47d44de7bab5500d27f17ae5c4ebebc7d2b4ef + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=1e47d44de7bab5500d27f17ae5c4ebebc7d2b4ef CVE-2017-9697 Link - https://www.codeaurora.org/gitweb/quic/la/?p=kernel/msm-4.4.git;a=commit;h=7e45e3a6c1f6dd46d71fb6824a7cf702d2e79225 CVE-2017-9706 Pulled Link - https://github.com/android/kernel_msm/commit/7489a0a8f68d0f018d0f9df5df157bb20f83b05e CVE-2017-9714 - Link - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=aae237dfbaf8edcf310eeb84b887b20e7e9c0ff3 + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=aae237dfbaf8edcf310eeb84b887b20e7e9c0ff3 CVE-2017-9715 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=58350a7bcb827c0ac81f0750a62d5c5a8ed3a469 + Link qcacld-2.0 -- https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=58350a7bcb827c0ac81f0750a62d5c5a8ed3a469 CVE-2017-9717 Pulled - Link - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=bf7486fb6d82fb9ad02e303b6fdf4061cfc0375d + Link - qcacld-2.0 - https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=bf7486fb6d82fb9ad02e303b6fdf4061cfc0375d CVE-2017-9719 Link - https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=a491499c3490999555b7ccf8ad1a7d6455625807 Link - https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=d815f54f15d765b5e0035a9d208d71567bcaace0 diff --git a/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_amazon_hdx-common.sh b/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_amazon_hdx-common.sh index 9f1cbcbf..ce5d7c22 100644 --- a/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_amazon_hdx-common.sh +++ b/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_amazon_hdx-common.sh @@ -1,53 +1,53 @@ #!/bin/bash cd $base"kernel/amazon/hdx-common" -git apply $cvePatches/CVE-2012-6704/ANY/0.patch -git apply $cvePatches/CVE-2014-1739/ANY/0.patch -git apply $cvePatches/CVE-2014-4656/ANY/0.patch -git apply $cvePatches/CVE-2014-7822/3.2-^3.16/0.patch -git apply $cvePatches/CVE-2014-8709/ANY/0.patch -git apply $cvePatches/CVE-2014-9420/3.2-^3.18/1.patch -git apply $cvePatches/CVE-2014-9781/ANY/0.patch -git apply $cvePatches/CVE-2014-9876/3.4/1.patch -git apply $cvePatches/CVE-2014-9880/ANY/0.patch -git apply $cvePatches/CVE-2015-1593/ANY/0.patch -git apply $cvePatches/CVE-2016-10230/ANY/0.patch -git apply $cvePatches/CVE-2016-2185/ANY/0.patch -git apply $cvePatches/CVE-2016-2186/ANY/0.patch -git apply $cvePatches/CVE-2016-2443/ANY/0.patch -git apply $cvePatches/CVE-2016-2488/ANY/0.patch -git apply $cvePatches/CVE-2016-2544/ANY/0.patch -git apply $cvePatches/CVE-2016-3841/3.4/0.patch -git apply $cvePatches/CVE-2016-3893/ANY/0.patch -git apply $cvePatches/CVE-2016-6672/ANY/0.patch -git apply $cvePatches/CVE-2016-6751/ANY/0.patch -git apply $cvePatches/CVE-2016-6753/ANY/0.patch -git apply $cvePatches/CVE-2016-8404/ANY/0.patch -git apply $cvePatches/CVE-2016-8417/ANY/0.patch -git apply $cvePatches/CVE-2016-8444/ANY/0.patch -git apply $cvePatches/CVE-2016-8650/ANY/0.patch -git apply $cvePatches/CVE-2016-9604/ANY/0.patch -git apply $cvePatches/CVE-2016-9793/ANY/0.patch -git apply $cvePatches/CVE-2017-0403/ANY/0.patch -git apply $cvePatches/CVE-2017-0404/ANY/0.patch -git apply $cvePatches/CVE-2017-0611/ANY/0.patch -git apply $cvePatches/CVE-2017-0648/ANY/0.patch -git apply $cvePatches/CVE-2017-0710/ANY/0.patch -git apply $cvePatches/CVE-2017-0751/ANY/0.patch -git apply $cvePatches/CVE-2017-0786/ANY/0.patch -git apply $cvePatches/CVE-2017-10662/ANY/0.patch -git apply $cvePatches/CVE-2017-11000/ANY/0.patch -git apply $cvePatches/CVE-2017-13080/ANY/0.patch -git apply $cvePatches/CVE-2017-13080-Extra/ANY/0.patch -git apply $cvePatches/CVE-2017-13080-Extra/ANY/1.patch -git apply $cvePatches/CVE-2017-15265/ANY/0.patch -git apply $cvePatches/CVE-2017-2671/ANY/0.patch -git apply $cvePatches/CVE-2017-5970/ANY/0.patch -git apply $cvePatches/CVE-2017-6074/ANY/0.patch -git apply $cvePatches/CVE-2017-6345/ANY/0.patch -git apply $cvePatches/CVE-2017-6348/ANY/0.patch -git apply $cvePatches/CVE-2017-6951/ANY/0.patch -git apply $cvePatches/CVE-2017-7487/ANY/0.patch -git apply $cvePatches/CVE-2017-8247/ANY/0.patch -git apply $cvePatches/CVE-2017-8890/3.4/0.patch -git apply $cvePatches/CVE-2017-9242/ANY/0.patch +git apply $cvePatches/CVE-2012-6704/^3.5/0001.patch +git apply $cvePatches/CVE-2014-1739/ANY/0001.patch +git apply $cvePatches/CVE-2014-4656/ANY/0001.patch +git apply $cvePatches/CVE-2014-8709/ANY/0001.patch +git apply $cvePatches/CVE-2014-9420/ANY/0001.patch +git apply $cvePatches/CVE-2014-9781/ANY/0001.patch +git apply $cvePatches/CVE-2014-9880/ANY/0001.patch +git apply $cvePatches/CVE-2015-1593/ANY/0001.patch +git apply $cvePatches/CVE-2015-6640/ANY/0001.patch +git apply $cvePatches/CVE-2016-10230/ANY/0001.patch +git apply $cvePatches/CVE-2016-2185/ANY/0001.patch +git apply $cvePatches/CVE-2016-2186/ANY/0001.patch +git apply $cvePatches/CVE-2016-2443/ANY/0001.patch +git apply $cvePatches/CVE-2016-2488/ANY/0001.patch +git apply $cvePatches/CVE-2016-2544/ANY/0001.patch +git apply $cvePatches/CVE-2016-3857/ANY/0001.patch +git apply $cvePatches/CVE-2016-3892/ANY/0001.patch +git apply $cvePatches/CVE-2016-3893/ANY/0001.patch +git apply $cvePatches/CVE-2016-3894/ANY/0001.patch +git apply $cvePatches/CVE-2016-6672/ANY/0001.patch +git apply $cvePatches/CVE-2016-6751/ANY/0001.patch +git apply $cvePatches/CVE-2016-6753/ANY/0001.patch +git apply $cvePatches/CVE-2016-8404/ANY/0001.patch +git apply $cvePatches/CVE-2016-8417/ANY/0001.patch +git apply $cvePatches/CVE-2016-8444/ANY/0001.patch +git apply $cvePatches/CVE-2016-8650/ANY/0001.patch +git apply $cvePatches/CVE-2016-9604/ANY/0001.patch +git apply $cvePatches/CVE-2016-9793/ANY/0001.patch +git apply $cvePatches/CVE-2016-9794/ANY/0001.patch +git apply $cvePatches/CVE-2017-0404/^3.18/0001.patch +git apply $cvePatches/CVE-2017-0611/ANY/0001.patch +git apply $cvePatches/CVE-2017-0648/ANY/0001.patch +git apply $cvePatches/CVE-2017-0710/ANY/0001.patch +git apply $cvePatches/CVE-2017-0751/ANY/0001.patch +git apply $cvePatches/CVE-2017-0786/ANY/0001.patch +git apply $cvePatches/CVE-2017-11000/ANY/0001.patch +git apply $cvePatches/CVE-2017-11059/ANY/0001.patch +git apply $cvePatches/CVE-2017-13080/ANY/0001.patch +git apply $cvePatches/CVE-2017-15265/^4.14/0001.patch +git apply $cvePatches/CVE-2017-2671/^4.10/0001.patch +git apply $cvePatches/CVE-2017-5970/ANY/0001.patch +git apply $cvePatches/CVE-2017-6074/ANY/0001.patch +git apply $cvePatches/CVE-2017-6345/^4.9/0001.patch +git apply $cvePatches/CVE-2017-6348/^4.9/0001.patch +git apply $cvePatches/CVE-2017-6951/^3.14/0001.patch +git apply $cvePatches/CVE-2017-7187/ANY/0001.patch +git apply $cvePatches/CVE-2017-7487/ANY/0001.patch +git apply $cvePatches/CVE-2017-8247/ANY/0001.patch +git apply $cvePatches/CVE-2017-9242/^4.11/0001.patch +git apply $cvePatches/CVE-2017-9706/ANY/0001.patch cd $base diff --git a/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_motorola_msm8992.sh b/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_motorola_msm8992.sh index f1e79f0d..a5453241 100644 --- a/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_motorola_msm8992.sh +++ b/Scripts/LineageOS-14.1/CVE_Patchers/android_kernel_motorola_msm8992.sh @@ -1,94 +1,89 @@ #!/bin/bash cd $base"kernel/motorola/msm8992" -git apply $cvePatches/CVE-2014-9781/ANY/0.patch -git apply $cvePatches/CVE-2015-8019/3.10/0.patch -git apply $cvePatches/CVE-2016-0758/ANY/0.patch -git apply $cvePatches/CVE-2016-10200/ANY/0.patch -git apply $cvePatches/CVE-2016-10230/ANY/0.patch -git apply $cvePatches/CVE-2016-10231/ANY/1.patch -git apply $cvePatches/CVE-2016-10232/3.10/1.patch -git apply $cvePatches/CVE-2016-10233/3.10/1.patch -git apply $cvePatches/CVE-2016-2063/ANY/0.patch -git apply $cvePatches/CVE-2016-3070/ANY/0.patch -git apply $cvePatches/CVE-2016-3134/3.10/0.patch -git apply $cvePatches/CVE-2016-3672/ANY/0.patch -git apply $cvePatches/CVE-2016-3857/3.10/0.patch -git apply $cvePatches/CVE-2016-3865/ANY/0.patch -git apply $cvePatches/CVE-2016-3865/ANY/1.patch -git apply $cvePatches/CVE-2016-3867/3.10/0.patch -git apply $cvePatches/CVE-2016-3902/ANY/0.patch -git apply $cvePatches/CVE-2016-3907/ANY/0.patch -git apply $cvePatches/CVE-2016-5346/ANY/0.patch -git apply $cvePatches/CVE-2016-5347/ANY/0.patch -git apply $cvePatches/CVE-2016-5853/ANY/0.patch -git apply $cvePatches/CVE-2016-5859/ANY/0.patch -git apply $cvePatches/CVE-2016-5867/ANY/0.patch -git apply $cvePatches/CVE-2016-6672/ANY/0.patch -git apply $cvePatches/CVE-2016-6681/ANY/0.patch -git apply $cvePatches/CVE-2016-6751/ANY/0.patch -git apply $cvePatches/CVE-2016-6753/ANY/0.patch -git apply $cvePatches/CVE-2016-8417/ANY/0.patch -git apply $cvePatches/CVE-2016-8444/ANY/0.patch -git apply $cvePatches/CVE-2016-8479/ANY/0.patch -git apply $cvePatches/CVE-2016-8483/3.10/1.patch -git apply $cvePatches/CVE-2016-8650/ANY/0.patch -git apply $cvePatches/CVE-2016-9604/ANY/0.patch -git apply $cvePatches/CVE-2017-0404/ANY/0.patch -git apply $cvePatches/CVE-2017-0427/3.10/1.patch -git apply $cvePatches/CVE-2017-0436/ANY/0.patch -git apply $cvePatches/CVE-2017-0452/ANY/1.patch -git apply $cvePatches/CVE-2017-0457/3.10/0.patch -git apply $cvePatches/CVE-2017-0457/3.10/1.patch -git apply $cvePatches/CVE-2017-0459/3.10/1.patch -git apply $cvePatches/CVE-2017-0460/3.10/1.patch -git apply $cvePatches/CVE-2017-0463/ANY/0.patch -git apply $cvePatches/CVE-2017-0510/ANY/2.patch -git apply $cvePatches/CVE-2017-0516/ANY/0.patch -git apply $cvePatches/CVE-2017-0523/ANY/0.patch -git apply $cvePatches/CVE-2017-0537/ANY/0.patch -git apply $cvePatches/CVE-2017-0604/ANY/0.patch -git apply $cvePatches/CVE-2017-0606/ANY/0.patch -git apply $cvePatches/CVE-2017-0611/ANY/0.patch -git apply $cvePatches/CVE-2017-0627/ANY/0.patch -git apply $cvePatches/CVE-2017-0631/ANY/0.patch -git apply $cvePatches/CVE-2017-0648/ANY/0.patch -git apply $cvePatches/CVE-2017-0710/ANY/0.patch -git apply $cvePatches/CVE-2017-0746/ANY/0.patch -git apply $cvePatches/CVE-2017-0748/ANY/0.patch -git apply $cvePatches/CVE-2017-0750/ANY/0.patch -git apply $cvePatches/CVE-2017-0751/ANY/0.patch -git apply $cvePatches/CVE-2017-1000365/3.10/0.patch -git apply $cvePatches/CVE-2017-10997/ANY/0.patch -git apply $cvePatches/CVE-2017-10998/3.10/0.patch -git apply $cvePatches/CVE-2017-11048/3.10/0.patch -git apply $cvePatches/CVE-2017-11056/3.10/0.patch -git apply $cvePatches/CVE-2017-11059/3.10/0.patch -git apply $cvePatches/CVE-2017-15265/ANY/0.patch -git apply $cvePatches/CVE-2017-2618/3.10/0.patch -git apply $cvePatches/CVE-2017-2671/ANY/0.patch -git apply $cvePatches/CVE-2017-5669/ANY/0.patch -git apply $cvePatches/CVE-2017-5970/ANY/0.patch -git apply $cvePatches/CVE-2017-6074/ANY/0.patch -git apply $cvePatches/CVE-2017-6345/ANY/0.patch -git apply $cvePatches/CVE-2017-6348/ANY/0.patch -git apply $cvePatches/CVE-2017-6951/ANY/0.patch -git apply $cvePatches/CVE-2017-7369/3.10/0.patch -git apply $cvePatches/CVE-2017-7373/3.10/1.patch -git apply $cvePatches/CVE-2017-7472/ANY/0.patch -git apply $cvePatches/CVE-2017-7487/ANY/0.patch -git apply $cvePatches/CVE-2017-8242/ANY/0.patch -git apply $cvePatches/CVE-2017-8247/ANY/0.patch -git apply $cvePatches/CVE-2017-8251/3.10/0.patch -git apply $cvePatches/CVE-2017-8260/3.10/0.patch -git apply $cvePatches/CVE-2017-8262/3.10/1.patch -git apply $cvePatches/CVE-2017-8265/ANY/0.patch -git apply $cvePatches/CVE-2017-8280/ANY/0.patch -git apply $cvePatches/CVE-2017-9075/ANY/0.patch -git apply $cvePatches/CVE-2017-9242/ANY/0.patch -git apply $cvePatches/CVE-2017-9693/ANY/0.patch -git apply $cvePatches/CVE-2017-9694/ANY/0.patch -git apply $cvePatches/CVE-2017-9720/ANY/0.patch -git apply $cvePatches/CVE-2017-9724/ANY/0.patch -git apply $cvePatches/CVE-2017-9725/ANY/0.patch -git apply $cvePatches/LVT-2017-0003/3.10/0.patch +git apply --whitespace=fix $cvePatches/CVE-2014-9781/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2015-0573/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2015-8019/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2015-8955/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-0758/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-0843/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-10200/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-10230/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-10232/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-2063/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3070/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3857/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3865/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3865/ANY/0002.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3867/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3892/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3894/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3902/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3907/3.10/0002.patch +git apply --whitespace=fix $cvePatches/CVE-2016-3938/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-5853/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-5859/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-5867/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-5868/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-6672/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-6693/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-6696/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-6751/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-6753/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-7913/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-8417/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-8444/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-8477/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-8650/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2016-9604/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0404/^3.18/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0427/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0436/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0452/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0454/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0457/3.10/0002.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0460/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0516/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0537/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0604/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0606/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0610/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0611/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0627/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0631/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0648/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0710/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0746/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0748/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0750/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0751/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-0794/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-1000365/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-10997/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-10998/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-11024/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-11048/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-11056/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-11059/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-15265/^4.14/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-2618/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-2671/^4.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-5669/^4.9/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-5970/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-6074/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-6345/^4.9/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-6348/^4.9/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-6951/^3.14/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-7187/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-7369/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-7472/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-7487/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-8236/3.10/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-8247/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-8261/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-8265/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-8280/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-9075/ANY/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-9242/^4.11/0001.patch +git apply --whitespace=fix $cvePatches/CVE-2017-9724/ANY/0001.patch +git apply --whitespace=fix $cvePatches/LVT-2017-0003/3.10/0001.patch cd $base