mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2025-09-18 03:34:50 -04:00
Overhaul CVE patches
This commit is contained in:
Tad
parent
ce59045163
commit
92a0187dfb
907 changed files with 301921 additions and 3819 deletions
|
|
@ -1,52 +0,0 @@
|
|||
From 42627c94cf8c189332a6f5bfdd465ea662777911 Mon Sep 17 00:00:00 2001
|
||||
From: Harsh Sahu <hsahu@codeaurora.org>
|
||||
Date: Thu, 13 Apr 2017 15:38:46 -0700
|
||||
Subject: msm: mdss: fix race condition during mdp debugfs release
|
||||
|
||||
Fix race condition in the release of the mdp debugfs functions
|
||||
panel_debug_base_release and mdss_debug_base_release by adding
|
||||
the lock for unpreempted freeing of the buffer so that multiple
|
||||
concurrent processes cannot affect the release which can possibly
|
||||
lead to use-after-free operation on the buffer.
|
||||
|
||||
Change-Id: I9586081b65ae2eb0e7f6e30c606ee748ae9ef7e8
|
||||
Signed-off-by: Harsh Sahu <hsahu@codeaurora.org>
|
||||
---
|
||||
drivers/video/msm/mdss/mdss_debug.c | 4 ++++
|
||||
1 file changed, 4 insertions(+)
|
||||
|
||||
diff --git a/drivers/video/msm/mdss/mdss_debug.c b/drivers/video/msm/mdss/mdss_debug.c
|
||||
index 920babf..78bfe50 100644
|
||||
--- a/drivers/video/msm/mdss/mdss_debug.c
|
||||
+++ b/drivers/video/msm/mdss/mdss_debug.c
|
||||
@@ -57,11 +57,13 @@ static int panel_debug_base_open(struct inode *inode, struct file *file)
|
||||
static int panel_debug_base_release(struct inode *inode, struct file *file)
|
||||
{
|
||||
struct mdss_debug_base *dbg = file->private_data;
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
if (dbg && dbg->buf) {
|
||||
kfree(dbg->buf);
|
||||
dbg->buf_len = 0;
|
||||
dbg->buf = NULL;
|
||||
}
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -386,11 +388,13 @@ static int mdss_debug_base_open(struct inode *inode, struct file *file)
|
||||
static int mdss_debug_base_release(struct inode *inode, struct file *file)
|
||||
{
|
||||
struct mdss_debug_base *dbg = file->private_data;
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
if (dbg && dbg->buf) {
|
||||
kfree(dbg->buf);
|
||||
dbg->buf_len = 0;
|
||||
dbg->buf = NULL;
|
||||
}
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
|
|
@ -1,182 +0,0 @@
|
|||
From aa23820b001ab1cfb86b79014e9fc44cd2be9ece Mon Sep 17 00:00:00 2001
|
||||
From: Ingrid Gallardo <ingridg@codeaurora.org>
|
||||
Date: Wed, 1 Mar 2017 12:24:06 -0800
|
||||
Subject: msm: mdss: fix race condition in mdp debugfs
|
||||
|
||||
Fix race condition in mdp debugfs properties
|
||||
during the read and write of the panel and
|
||||
mdp registers. This race condition can cause
|
||||
accessing memory out bounderies.
|
||||
|
||||
Change-Id: I97a90a154237343d4aaf237c11f525bcc2c3a8e3
|
||||
Signed-off-by: Ingrid Gallardo <ingridg@codeaurora.org>
|
||||
Signed-off-by: Nirmal Abraham <nabrah@codeaurora.org>
|
||||
---
|
||||
drivers/video/msm/mdss/mdss_debug.c | 48 ++++++++++++++++++++++++++++++-------
|
||||
1 file changed, 40 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/drivers/video/msm/mdss/mdss_debug.c b/drivers/video/msm/mdss/mdss_debug.c
|
||||
index a95fa43..cedd40cd 100644
|
||||
--- a/drivers/video/msm/mdss/mdss_debug.c
|
||||
+++ b/drivers/video/msm/mdss/mdss_debug.c
|
||||
@@ -1,4 +1,4 @@
|
||||
-/* Copyright (c) 2009-2016, The Linux Foundation. All rights reserved.
|
||||
+/* Copyright (c) 2009-2017, The Linux Foundation. All rights reserved.
|
||||
*
|
||||
* This program is free software; you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License version 2 and
|
||||
@@ -39,6 +39,8 @@
|
||||
#define PANEL_CMD_MIN_TX_COUNT 2
|
||||
#define PANEL_DATA_NODE_LEN 80
|
||||
|
||||
+static DEFINE_MUTEX(mdss_debug_lock);
|
||||
+
|
||||
static char panel_reg[2] = {DEFAULT_READ_PANEL_POWER_MODE_REG, 0x00};
|
||||
|
||||
static int panel_debug_base_open(struct inode *inode, struct file *file)
|
||||
@@ -88,8 +90,10 @@ static ssize_t panel_debug_base_offset_write(struct file *file,
|
||||
if (cnt > (dbg->max_offset - off))
|
||||
cnt = dbg->max_offset - off;
|
||||
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
dbg->off = off;
|
||||
dbg->cnt = cnt;
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
|
||||
pr_debug("offset=%x cnt=%d\n", off, cnt);
|
||||
|
||||
@@ -109,15 +113,21 @@ static ssize_t panel_debug_base_offset_read(struct file *file,
|
||||
if (*ppos)
|
||||
return 0; /* the end */
|
||||
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
len = snprintf(buf, sizeof(buf), "0x%02zx %zx\n", dbg->off, dbg->cnt);
|
||||
- if (len < 0 || len >= sizeof(buf))
|
||||
+ if (len < 0 || len >= sizeof(buf)) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- if ((count < sizeof(buf)) || copy_to_user(buff, buf, len))
|
||||
+ if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return -EFAULT;
|
||||
+ }
|
||||
|
||||
*ppos += len; /* increase offset */
|
||||
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return len;
|
||||
}
|
||||
|
||||
@@ -206,11 +216,16 @@ static ssize_t panel_debug_base_reg_read(struct file *file,
|
||||
if (!dbg)
|
||||
return -ENODEV;
|
||||
|
||||
- if (!dbg->cnt)
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
+ if (!dbg->cnt) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- if (*ppos)
|
||||
+ if (*ppos) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0; /* the end */
|
||||
+ }
|
||||
|
||||
/* '0x' + 2 digit + blank = 5 bytes for each number */
|
||||
reg_buf_len = (dbg->cnt * PANEL_REG_FORMAT_LEN)
|
||||
@@ -251,11 +266,13 @@ static ssize_t panel_debug_base_reg_read(struct file *file,
|
||||
kfree(panel_reg_buf);
|
||||
|
||||
*ppos += len; /* increase offset */
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return len;
|
||||
|
||||
read_reg_fail:
|
||||
kfree(rx_buf);
|
||||
kfree(panel_reg_buf);
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return rc;
|
||||
}
|
||||
|
||||
@@ -386,8 +403,10 @@ static ssize_t mdss_debug_base_offset_write(struct file *file,
|
||||
if (cnt > (dbg->max_offset - off))
|
||||
cnt = dbg->max_offset - off;
|
||||
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
dbg->off = off;
|
||||
dbg->cnt = cnt;
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
|
||||
pr_debug("offset=%x cnt=%x\n", off, cnt);
|
||||
|
||||
@@ -407,15 +426,21 @@ static ssize_t mdss_debug_base_offset_read(struct file *file,
|
||||
if (*ppos)
|
||||
return 0; /* the end */
|
||||
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
len = snprintf(buf, sizeof(buf), "0x%08zx %zx\n", dbg->off, dbg->cnt);
|
||||
- if (len < 0 || len >= sizeof(buf))
|
||||
+ if (len < 0 || len >= sizeof(buf)) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0;
|
||||
+ }
|
||||
|
||||
- if ((count < sizeof(buf)) || copy_to_user(buff, buf, len))
|
||||
+ if ((count < sizeof(buf)) || copy_to_user(buff, buf, len)) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return -EFAULT;
|
||||
+ }
|
||||
|
||||
*ppos += len; /* increase offset */
|
||||
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return len;
|
||||
}
|
||||
|
||||
@@ -472,6 +497,8 @@ static ssize_t mdss_debug_base_reg_read(struct file *file,
|
||||
return -ENODEV;
|
||||
}
|
||||
|
||||
+ mutex_lock(&mdss_debug_lock);
|
||||
+
|
||||
if (!dbg->buf) {
|
||||
char dump_buf[64];
|
||||
char *ptr;
|
||||
@@ -483,6 +510,7 @@ static ssize_t mdss_debug_base_reg_read(struct file *file,
|
||||
|
||||
if (!dbg->buf) {
|
||||
pr_err("not enough memory to hold reg dump\n");
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
@@ -513,17 +541,21 @@ static ssize_t mdss_debug_base_reg_read(struct file *file,
|
||||
dbg->buf_len = tot;
|
||||
}
|
||||
|
||||
- if (*ppos >= dbg->buf_len)
|
||||
+ if (*ppos >= dbg->buf_len) {
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return 0; /* done reading */
|
||||
+ }
|
||||
|
||||
len = min(count, dbg->buf_len - (size_t) *ppos);
|
||||
if (copy_to_user(user_buf, dbg->buf + *ppos, len)) {
|
||||
pr_err("failed to copy to user\n");
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return -EFAULT;
|
||||
}
|
||||
|
||||
*ppos += len; /* increase offset */
|
||||
|
||||
+ mutex_unlock(&mdss_debug_lock);
|
||||
return len;
|
||||
}
|
||||
|
||||
--
|
||||
cgit v1.1
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue