discussion/CVE-2016-5349.txt at master · cm12-amami/discussion · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
#1
[qseecomi.h]
__packed struct qseecom_client_send_data_64bit_ireq : does not exist
__packed struct qseecom_qteec_64bit_ireq            : does not exist
__packed struct qseecom_client_send_fsm_key_req     : does not exist

Note: all 64bit stuff does not exist and is not relevant


[qseecom.c]
static int qseecom_scm_call2
   : does not exist - see comment on 'qseecom_scm_call'

static int __qseecom_send_cmd
   : - all 64bit stuff does not apply and is omitted
   : - 'void *cmd_buf = NULL;' declaration was needed to be backported
   : - the 'if (qseecom.qsee_version < QSEE_VERSION_40) {' is always
   :   omitted, as the 64bit stuff is not relevant, so ONLY the code
   :   for the lower version is patched

static int __qseecom_update_cmd_buf
   : in this coding release, the respective request variable is 'cmd_req',
   : and not 'req' as in the patchfile code

static int __qseecom_update_cmd_buf_64
   : does not exist (64bit)

static int __qseecom_update_qteec_req_buf
   : does not exist

static int __qseecom_qteec_issue_cmd
   : does not exist

static int qseecom_qteec_invoke_modfd_cmd
   : does not exist

static int qseecom_qteec_request_cancellation
   : does not exist

static void __qseecom_clean_data_sglistinfo
   : backport was needed, as this func did not exist yet

long qseecom_ioctl
   : only one switch/case condition to be patched

static int qseecom_check_whitelist_feature
   : - again, the if-statement 'qseecom.qsee_version < QSEE_VERSION_40'
   :   is not implemented, as we don't have 64bit stuff
   : - the command call is 'ret = scm_call(' and not 'ret = qseecom_scm_call('
   :   'qseecom_scm_call' is a wrapper performing an if-statement for the 64bit
   :   stuff and either calls 'scm_call' (which is always relevant for us) or
   :   'qseecom_scm_call2' (see above, that's why we don't need it at all) for
   :   64bit


#2
[qseecom.c]
Patch is straight forward
>> Note that commit #4 reverts this commit!


#3
[qseecom.c]
Patch is straight forward
>> Note that commit #4 reverts this commit!


#4
[qseecom.c]

static int qseecom_scm_call2
   : does not exist, see above

static int __qseecom_qseos_fail_return_resp_tz
   : does not exist

static int __qseecom_process_incomplete_cmd
   : again, w/o 64bit stuff and version IF statement

static int __qseecom_reentrancy_process_incomplete_cmd
   : does not exist

static int __qseecom_update_cmd_buf
   : in this coding release, the respective request variable is 'cmd_req',
   : and not 'req' as in the patchfile code

static int __qseecom_update_cmd_buf_64
   : does not exist

[qseecomi.h]
__packed struct qseecom_client_listener_data_64bit_irsp : Not created/patched (64bit)