DivestOS/Patches/Linux_CVEs/CVE-2016-6750/0.patch

102 lines
3.8 KiB
Diff

From 34bda711a1c7bc7f9fd7bea3a5be439ed00577e5 Mon Sep 17 00:00:00 2001
From: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
Date: Tue, 16 Aug 2016 11:24:00 -0600
Subject: soc: qcom: smp2p: Fix kernel address leak
Change format string to %pK instead of %p in the debug statements. This
change fixes kernel address leaks from the usage of %p.
CRs-Fixed: 1052825
Change-Id: Ib95f691919a2977f5436cd4c6ac4a002d70dd729
Signed-off-by: Chris Lew <clew@codeaurora.org>
Signed-off-by: Karthikeyan Ramasubramanian <kramasub@codeaurora.org>
---
drivers/gpio/gpio-msm-smp2p.c | 2 +-
drivers/soc/qcom/smp2p.c | 6 +++---
drivers/soc/qcom/smp2p_debug.c | 4 ++--
drivers/soc/qcom/smp2p_test_common.h | 5 +++--
4 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/gpio/gpio-msm-smp2p.c b/drivers/gpio/gpio-msm-smp2p.c
index bde81f0..b426a80 100644
--- a/drivers/gpio/gpio-msm-smp2p.c
+++ b/drivers/gpio/gpio-msm-smp2p.c
@@ -368,7 +368,7 @@ static int smp2p_irq_map(struct irq_domain *domain_ptr, unsigned int virq,
chip = domain_ptr->host_data;
if (!chip) {
- SMP2P_ERR("%s: invalid domain ptr %p\n", __func__, domain_ptr);
+ SMP2P_ERR("%s: invalid domain ptr\n", __func__);
return -ENODEV;
}
diff --git a/drivers/soc/qcom/smp2p.c b/drivers/soc/qcom/smp2p.c
index fc5688b..79b8ffb 100644
--- a/drivers/soc/qcom/smp2p.c
+++ b/drivers/soc/qcom/smp2p.c
@@ -1,6 +1,6 @@
/* drivers/soc/qcom/smp2p.c
*
- * Copyright (c) 2013-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -519,8 +519,8 @@ static void smp2p_find_entry_v1(struct smp2p_smem __iomem *item,
char entry_name[SMP2P_MAX_ENTRY_NAME];
if (!item || !name || !entry_ptr) {
- SMP2P_ERR("%s: invalid arguments %p, %p, %p\n",
- __func__, item, name, entry_ptr);
+ SMP2P_ERR("%s: invalid arguments %d %d %d\n",
+ __func__, !item, !name, !entry_ptr);
return;
}
diff --git a/drivers/soc/qcom/smp2p_debug.c b/drivers/soc/qcom/smp2p_debug.c
index 4deb05a..8d98d07 100644
--- a/drivers/soc/qcom/smp2p_debug.c
+++ b/drivers/soc/qcom/smp2p_debug.c
@@ -1,6 +1,6 @@
/* drivers/soc/qcom/smp2p_debug.c
*
- * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -41,7 +41,7 @@ static void smp2p_int_stats(struct seq_file *s)
pid != SMP2P_REMOTE_MOCK_PROC)
continue;
- seq_printf(s, "| %5s (%d) | %11u | %10u | %10u | %p | %08x |\n",
+ seq_printf(s, "| %5s (%d) | %11u | %10u | %10u | %pK | %08x |\n",
int_cfg[pid].name,
pid, int_cfg[pid].in_int_id,
int_cfg[pid].in_interrupt_count,
diff --git a/drivers/soc/qcom/smp2p_test_common.h b/drivers/soc/qcom/smp2p_test_common.h
index 747a812..3be519b 100644
--- a/drivers/soc/qcom/smp2p_test_common.h
+++ b/drivers/soc/qcom/smp2p_test_common.h
@@ -1,6 +1,6 @@
/* drivers/soc/qcom/smp2p_test_common.h
*
- * Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2013-2014,2016 The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -49,7 +49,8 @@
void *a_tmp = (a); \
void *b_tmp = (b); \
if (!((a_tmp)cmp(b_tmp))) { \
- seq_printf(s, "%s:%d Fail: " #a "(%p) " #cmp " " #b "(%p)\n", \
+ seq_printf(s, "%s:%d Fail: " #a "(%pK) " #cmp \
+ " " #b "(%pK)\n", \
__func__, __LINE__, \
a_tmp, b_tmp); \
failed = 1; \
--
cgit v1.1