Updates to crash driver from Dave Anderson

1 files changed, 95 insertions, 0 deletions

diff --git a/crash-driver.patch b/crash-driver.patch
index a622d2fc5..2b05554b7 100644
--- a/crash-driver.patch
+++ b/crash-driver.patch
@@ -508,3 +508,98 @@ index 0000000..25ab986
 -- 
 2.9.2
 
+From 7523c19e1d22fbabeaeae9520c16a78202c0eefe Mon Sep 17 00:00:00 2001
+From: Fedora Kernel Team <kernel-team@fedoraproject.org>
+Date: Tue, 20 Sep 2016 19:39:46 +0200
+Subject: [PATCH] Update of crash driver to handle CONFIG_HARDENED_USERCOPY and
+ to restrict the supported architectures.
+
+---
+ drivers/char/Kconfig |  1 +
+ drivers/char/crash.c | 33 ++++++++++++++++++++++++++++++---
+ 2 files changed, 31 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
+index 99b99d5..be6a3ae 100644
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -6,6 +6,7 @@ menu "Character devices"
+ 
+ config CRASH
+ 	tristate "Crash Utility memory driver"
++	depends on X86_32 || X86_64 || ARM || ARM64 || PPC64 || S390
+ 
+ source "drivers/tty/Kconfig"
+ 
+diff --git a/drivers/char/crash.c b/drivers/char/crash.c
+index 085378a..0258bf8 100644
+--- a/drivers/char/crash.c
++++ b/drivers/char/crash.c
+@@ -32,7 +32,7 @@
+ #include <asm/types.h>
+ #include <asm/crash-driver.h>
+ 
+-#define CRASH_VERSION   "1.0"
++#define CRASH_VERSION   "1.2"
+ 
+ /*
+  *  These are the file operation functions that allow crash utility
+@@ -66,6 +66,7 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)
+ 	struct page *page;
+ 	u64 offset;
+ 	ssize_t read;
++	char *buffer = file->private_data;
+ 
+ 	offset = *poff;
+ 	if (offset >> PAGE_SHIFT != (offset+count-1) >> PAGE_SHIFT)
+@@ -74,8 +75,12 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)
+ 	vaddr = map_virtual(offset, &page);
+ 	if (!vaddr)
+ 		return -EFAULT;
+-
+-	if (copy_to_user(buf, vaddr, count)) {
++	/*
++	 * Use bounce buffer to bypass the CONFIG_HARDENED_USERCOPY
++	 * kernel text restriction.
++	*/
++	memcpy(buffer, (char *)vaddr, count);
++	if (copy_to_user(buf, buffer, count)) {
+ 		unmap_virtual(page);
+ 		return -EFAULT;
+ 	}
+@@ -86,10 +91,32 @@ crash_read(struct file *file, char *buf, size_t count, loff_t *poff)
+ 	return read;
+ }
+ 
++static int
++crash_open(struct inode * inode, struct file * filp)
++{
++	if (!capable(CAP_SYS_RAWIO))
++		return -EPERM;
++
++	filp->private_data = (void *)__get_free_page(GFP_KERNEL);
++	if (!filp->private_data)
++		return -ENOMEM;
++
++	return 0;
++}
++
++static int
++crash_release(struct inode *inode, struct file *filp)
++{
++	free_pages((unsigned long)filp->private_data, 0);
++	return 0;
++}
++
+ static struct file_operations crash_fops = {
+ 	.owner = THIS_MODULE,
+ 	.llseek = crash_llseek,
+ 	.read = crash_read,
++	.open = crash_open,
++	.release = crash_release,
+ };
+ 
+ static struct miscdevice crash_dev = {
+-- 
+2.9.3
+