GitLab

Merge security-next into mnc-mr1 @ 75dfdc8a for August 2016.1

BUG: 27577101
BUG: 27532522
Change-Id: I890831a72e5ad4485fdf30e51a146712b18052ed
Signed-off-by: Mohamad Ayyash <mkayyash@google.com
Signed-off-by: Patrick Tjin <pattjin@google.com>

Validate pointers send from user space and pointers
embedded within the mesasge sent from user space.

Bug: 28769920
Change-Id: I1be54924ef3d301908af6e8d4e6506f2aa7f6428
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Gilad Avidov <giladavidov@google.com>

Validate the caller is the right type for the IOCTL being
issued and inputs are valid.

Bug: 28747998
Change-Id: Iad71f0f5ed4d53c5d011bd55cdf74ec053d09af5
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Bug: 28748271
Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Bug: 28804057
Change-Id: I431511a92ab2cccbc2daebc0cf76cc3872689a97
Signed-off-by: Zhen Kong <zkong@codeaurora.org>

The overflow check is required to ensure that user space data
in kernel may not go beyond buffer boundary.

Bug: 28751152
Change-Id: I79b7e5f875fadcaeceb05f9163ae3666d4b6b7e1
CRs-Fixed: 563086
Signed-off-by: Mohammad Johny Shaik <mjshai@codeaurora.org>

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Bug: 28749708

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>

Add check in order to fix possible integer underflow
during HDLC encoding which may lead to buffer
overflow. Also added check for packet length to
avoid buffer overflow.

Bug: 28767796
Change-Id: Ic91b5ee629066f013022ea139b4a23ec661aa77a
Signed-off-by: Mohit Aggarwal <maggarwa@codeaurora.org>
Signed-off-by: Yuan Lin <yualin@google.com>

The permissions of /proc/iomem currently are -r--r--r--. Everyone can
see its content. As iomem contains information about the physical memory
content of the device, restrict the information only to root.

Change-Id: If0be35c3fac5274151bea87b738a48e6ec0ae891
bug: 28814213
CRs-Fixed: 786116
Signed-off-by: Biswajit Paul <biswajitpaul@codeaurora.org>
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>

This change fixes several incorrect or missing array index bound checks.

Bug: 28814502
Change-Id: Icd96555c01330ec11e94c6173d8df1973fe39c33
Signed-off-by: Petar Sivenov <psiven@codeaurora.org>

Since commit 6a1c5312

 the user writeable TLS register was zeroed to
prevent it from being used as a covert channel between two tasks.

There are more and more applications coming to Windows RT,
Wine could support them, but mostly they expect to have
the thread environment block (TEB) in TPIDRURW.

This patch preserves that register per thread instead of clearing it.
Unlike the TPIDRURO, which is already switched, the TPIDRURW
can be updated from userspace so needs careful treatment in the case that we
modify TPIDRURW and call fork(). To avoid this we must always read
TPIDRURW in copy_thread.

Change-Id: Ib1e25be7b9faa846ba5335aad2574e21a1246066
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Jonathan Austin <jonathan.austin@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: a4780adeefd042482f624f5e0d577bf9cdcbb760
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


[joonwoop@codeaurora.org: fixed merge conflict]
CRs-fixed: 561044
Signed-off-by: Joonwoo Park <joonwoop@codeaurora.org>
Bug: 28749743

snd_compr_tstamp is initialized using aggregate initialization
that does not zero out the padded bytes. Initialize timestamp
structure to zero using memset to avoid this.

Bug: 28770164
CRs-Fixed: 568717
Change-Id: I7a7d188705161f06201f1a1f2945bb6acd633d5d
Signed-off-by: Krishnankutty Kolathappilly <kkolat@codeaurora.org>

At certain point in diag driver there can be integer underflow
thus can lead to memory leak. Added a safeguard for that.

Bug: 28750726
Change-Id: I8cc6a8336cd2c5c88c49748c0be2df1696894f2b
Signed-off-by: Yuan Lin <yualin@google.com>

Check for invalid parameters passed in user invocation
and validate the return values using appropriate macros.

Bug: 28767593
Change-Id: I9a067f2ab151084b46e9d4d5fb945320a27bb7ba
Signed-off-by: Yuan Lin <yualin@google.com>

Added bounds check to user input num_streams at several location,
without checking a position outside array could be dereferenced

Bug: 28749629
Change-Id: I6e82d8b51e4ec6772316c7daef243240c029db96
Signed-off-by: Jim Rasche <jrasche@codeaurora.org>

I2C command length is of 11 bytes, it includes 10 bytes of data and
1 byte of WR command. Use 11 bytes char array to create command.

Bug: 28770207
Signed-off-by: Rajesh Bondugula <rajeshb@codeaurora.org>
Change-Id: I5292f238d612810a514b6a8bba9e70e07eb2627f

Some security vulnerabilities were found.
To fix them, additional verifications of some input parameters
are required.

bug: 28814690
CRs-Fixed: 554575, 554560, 555030
Change-Id: Ie87a433bcda89c3e462cfd511c168e8306056020
Signed-off-by: Baruch Eruchimovitch <baruche@codeaurora.org>

Diag driver holds on to the socket process task structure even
after signaling the process to exit. This patch clears the internal
handle after signaling.

bug: 28803962
Change-Id: I642fb595fc2caebc6f2f5419efed4fb560e4e4db
Signed-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>

and bound check for msm_isp_set_src_state

Bug: 28749803
Change-Id: Ibc686f64229552160c2f65f672ba8c97ef520443

The index of used stats register is derived from a stream handle least
significant byte and thus can be up to 255. However the stats registers
are up to 8 depending of the target. Thus a bound check is done before
use of the received stats register index value.

Bug: 28749728
Change-Id: I23f1add81eb8e0844103a3a3f59f4e4c2af14ffd

Add a check for the stats index MAX using
MSM_ISP_STATS_MAX before accessing stream info
using that index to avoid any invalid memory access.

Bug: 28749728
Change-Id: I29d9b62cec045598645fbc0e6e62c500eb74bb97

The value csi_lane_mask which is uint16_t is controllable from userspace.
The while loop can loop for 2^16 - 1, Hence extract the required
bit combination from the userspace argument, used it for further
processing.

Bug: 28749721
CRs-Fixed: 511976
Change-Id: I80b0fe7ac273352503d9705510f05debe6cbb10a
Signed-off-by: Lakshmi Narayana Kalavala <lkalaval@codeaurora.org>

Added checks for DCI request packets to be greater than the minimum
packet length. We would drop the request and print an error otherwise.

CRs-Fixed: 483310

Bug: 28767589
Change-Id: Ib7a713be3d6f5a6e0ec3ac280aebd800058447c7
Signed-off-by: Ravi Aravamudhan <aravamud@codeaurora.org>
Signed-off-by: Yuan Lin <yualin@google.com>

At certain point in diag driver there can be integer overflow
thus can lead to memory leak. Added a safegaurd for it.

Bug: 28769912
Change-Id: Ib7070218b9ea7a1b9efca02b4c456ad9501085cd
Signed-off-by: Katish Paran <kparan@codeaurora.org>
Signed-off-by: Yuan Lin <yualin@google.com>

Upper and lower bound checks are enforced for num_cid
which is passed from userspace with lower as 1 and
max of 16.

Bug: 28747684
Change-Id: Ic5456289cb2f2b4ea17610a7672eb2c5225b7954
Signed-off-by: Hariram Purushothaman <hpurus@codeaurora.org>

At certain point in diag driver there can be integer underflow
and thus can lead to memory leak. Bound checks are placed to
ensure correct behavior of condition statements.

Bug: 28768146
Change-Id: I87b57a8b5f32886ada7725f1e8c97cc93de112ec
Signed-off-by: Katish Paran <kparan@codeaurora.org>
Signed-off-by: Yuan Lin <yualin@google.com>

A bounds check has to be done for r/g/b stages variables
to avoid undetermined behaviour.

Bug: 28398884
Change-Id: Ibdc96e79b36cf188d4b5c42d8e2d9ece8e9ace8a
Signed-off-by: Raghavendra Ambadas <rambad@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

struct media_link_desc is copy_to_user'ed as the return value of
MEDIA_IOC_ENUM_LINKS. When copying, the driver is omitting to initialise
the reserved fields.  This commit fixes that by initialising the
reserved fields to 0.

Bug: 28750150
CRs-Fixed: 570757
Change-Id: I230e2666c0845cc36399518a0f2c94db664382d1
Signed-off-by: Deva Ramasubramanian <dramasub@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

DMA mapping permissions were being derived from pgprot_kernel directly
without using PAGE_KERNEL.  This causes them to be marked with executable
permission, which is not what we want.  Fix this.

Bug: 28803642
Change-Id: Ib40f59f3c569f82409943cf8f9a86a9869d922cc
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Git-commit: 0ea1ec713f04bdfac343c9702b21cd3a7c711826
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


[lauraa@codeaurora.org: dropped functions not in older builds]
Signed-off-by: Laura Abbott <lauraa@codeaurora.org>

memset() the structure ethtool_wolinfo that has padded bytes
but the padded bytes have not been zeroed out.

Bug: 28803952
Change-Id: If3fd2d872a1b1ab9521d937b86a29fc468a8bbfe
Signed-off-by: Avijit Kanti Das <avijitnsec@codeaurora.org>

The function snprintf() do not write more than size bytes (including
the terminating null byte ('\0')). If the output was truncated due
to this limit then the return value is the number of characters
(excluding the terminating null byte) which would have been written
to the final string if enough space had been available. Thus, a
return value of size or more means that the output was truncated.

Bug: 28670333
Change-Id: I2b6c7f8262361046536b55262b3d7c30cb5b282e
Signed-off-by: Yuan Lin <yualin@google.com>

Fix the possible buffer overflow in IE parsing.

Bug: 28668638
Change-Id: I61e3b20276bdf329a1ef64a3189f172b231a3d15
Signed-off-by: Yuan Lin <yualin@google.com>

Before writing to a userspace address, verification
of the validity of user space address is required.

Bug: 28769352
Change-Id: I9141e44a6c11aaf3f4d57c08bb0dd26a7b214f34
CRs-fixed: 556356
Signed-off-by: Deepak Verma <dverma@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

FM radio is not used on flo.

Bug: 28769368
Bug: 28769546
Change-Id: Ice4c4cb66e7ea7b7e34efe125e29377f896e80f1
Signed-off-by: Siqi Lin <siqilin@google.com>

Use copy_from_user kernel api to copy any data from user space
to kernel space.

Bug: 28769546
Change-Id: Ia3b7bb0f98180bd8792c1c18e930cb5609b8dc82
CRs-Fixed: 540320
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

Checking if driver's buffer is large enough to copy
the data from user space.

Bug: 28769546
Change-Id: I7b4eed81cf77ce2973669ce18ccd95a5df397d82
CRs-fixed: 552329
Signed-off-by: Satish Kodishala <skodisha@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

casting a unsigned int into an integer, integer to
unsigned int may cause buffer overflow.

Bug: 28769368
Change-Id: I54be4d4c5470616a59a772c587fe6d5f32575c32
CRs-Fixed: 539008
Signed-off-by: Ayaz Ahmad <aahmad@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

fix to prevent untrusted userspace pointer in actuator kernel
driver to lead DoS

Bug: 28768281
Change-Id: I1b64270deb494530d268539e7b420be5ec79b658
Signed-off-by: Vasko Kalanoski <vaskok@codeaurora.org>
Signed-off-by: Siqi Lin <siqilin@google.com>

ioctl(TIOCGETD) retrieves the line discipline id directly from the
ldisc because the line discipline id (c_line) in termios is untrustworthy;
userspace may have set termios via ioctl(TCSETS*) without actually
changing the line discipline via ioctl(TIOCSETD).

However, directly accessing the current ldisc via tty->ldisc is
unsafe; the ldisc ptr dereferenced may be stale if the line discipline
is changing via ioctl(TIOCSETD) or hangup.

Wait for the line discipline reference (just like read() or write())
to retrieve the "current" line discipline id.

Bug: 28409131

Change-Id: I3f7a539ab31769f0e926d5c79d56bde652fbaf75
Cc: <stable@vger.kernel.org>
Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>