Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

msm: sps: Update debug message format specifier 

Restrict printing of kernel virtual addresses in SPS driver.

In debug prints, handles to bam device structures may be printed
as integers. As these handles are obtained by casting pointer
to bam device structures to integer, they can reveal addresses
of the structures to attackers.

Cast the handles in debug prints to pointers, printed with with %pK,
which hides these values if kptr_restrict is set (default on Android).

Change-Id: Idd28c7d11a06113605f7428a4cfc2505c1ae0073
Signed-off-by: Jishnu Prakash <jprakash@codeaurora.org>
This commit is contained in:
Jishnu Prakash 2019-03-13 18:12:26 +05:30 committed by syphyr
parent ddea3574a6
commit 8345bca8c7
5 changed files with 50 additions and 41 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
drivers/platform/msm/sps/sps.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2018, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2019, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -658,7 +658,8 @@ int sps_get_bam_debug_info(unsigned long dev, u32 option, u32 para,
/* Search for the target BAM device */
bam = sps_h2bam(dev);
if (bam == NULL) {
pr_err("sps:Can't find any BAM with handle 0x%lx.", dev);
pr_err("sps:Can't find any BAM with handle 0x%pK.",
(void *)dev);
mutex_unlock(&sps->lock);
return SPS_ERROR;
}
@ -1193,7 +1194,7 @@ struct sps_bam *sps_h2bam(unsigned long h)
{
struct sps_bam *bam;
SPS_DBG1(sps, "sps:%s: BAM handle:0x%lx.", __func__, h);
SPS_DBG1(sps, "sps:%s: BAM handle:0x%pK.", __func__, (void *)h);
if (h == SPS_DEV_HANDLE_MEM || h == SPS_DEV_HANDLE_INVALID)
return NULL;
@ -1203,7 +1204,7 @@ struct sps_bam *sps_h2bam(unsigned long h)
return bam;
}
SPS_ERR(sps, "sps:Can't find BAM device for handle 0x%lx.", h);
SPS_ERR(sps, "sps:Can't find BAM device for handle 0x%pK.", (void *)h);
return NULL;
}
@ -1308,16 +1309,17 @@ int sps_connect(struct sps_pipe *h, struct sps_connect *connect)
bam = sps_h2bam(dev);
if (bam == NULL) {
SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%lx", dev);
SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%pK",
(void *)dev);
result = SPS_ERROR;
goto exit_err;
}
mutex_lock(&bam->lock);
SPS_DBG2(bam, "sps:sps_connect: bam %pa src 0x%lx dest 0x%lx mode %s",
SPS_DBG2(bam, "sps:sps_connect: bam %pa src 0x%pK dest 0x%pK mode %s",
BAM_ID(bam),
connect->source,
connect->destination,
(void *)connect->source,
(void *)connect->destination,
connect->mode == SPS_MODE_SRC ? "SRC" : "DEST");
/* Allocate resources for the specified connection */
@ -1381,10 +1383,10 @@ int sps_disconnect(struct sps_pipe *h)
}
SPS_DBG2(bam,
"sps:sps_disconnect: bam %pa src 0x%lx dest 0x%lx mode %s",
"sps:sps_disconnect: bam %pa src 0x%pK dest 0x%pK mode %s",
BAM_ID(bam),
pipe->connect.source,
pipe->connect.destination,
(void *)pipe->connect.source,
(void *)pipe->connect.destination,
pipe->connect.mode == SPS_MODE_SRC ? "SRC" : "DEST");
result = SPS_ERROR;
@ -1780,7 +1782,8 @@ int sps_device_reset(unsigned long dev)
/* Search for the target BAM device */
bam = sps_h2bam(dev);
if (bam == NULL) {
SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%lx", dev);
SPS_ERR(sps, "sps:Invalid BAM device handle: 0x%pK",
(void *)dev);
result = SPS_ERROR;
goto exit_err;
}
@ -1791,7 +1794,8 @@ int sps_device_reset(unsigned long dev)
result = sps_bam_reset(bam);
mutex_unlock(&bam->lock);
if (result) {
SPS_ERR(sps, "sps:Fail to reset BAM device: 0x%lx", dev);
SPS_ERR(sps, "sps:Fail to reset BAM device: 0x%pK",
(void *)dev);
goto exit_err;
}

24
drivers/platform/msm/sps/sps_bam.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2015, 2017, 2019, The Linux Foundation.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -866,8 +867,8 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
else
iova = bam_pipe->connect.source_iova;
SPS_DBG2(dev,
"sps:BAM %pa pipe %d uses IOVA 0x%lx.\n",
BAM_ID(dev), pipe_index, iova);
"sps:BAM %pa pipe %d uses IOVA 0x%pK.\n",
BAM_ID(dev), pipe_index, (void *)iova);
hw_params.peer_phys_addr = (u32)iova;
} else {
hw_params.peer_phys_addr = peer_bam->props.phys_addr;
@ -889,9 +890,9 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
hw_params.data_base =
(phys_addr_t)bam_pipe->connect.data.iova;
SPS_DBG2(dev,
"sps:BAM %pa pipe %d uses IOVA 0x%lx for data FIFO.\n",
"sps:BAM %pa pipe %d uses IOVA 0x%pK for data FIFO.\n",
BAM_ID(dev), pipe_index,
bam_pipe->connect.data.iova);
(void *)(bam_pipe->connect.data.iova));
} else {
hw_params.data_base = map->data.phys_base;
}
@ -942,9 +943,9 @@ int sps_bam_pipe_connect(struct sps_pipe *bam_pipe,
hw_params.desc_base =
(phys_addr_t)bam_pipe->connect.desc.iova;
SPS_DBG2(dev,
"sps:BAM %pa pipe %d uses IOVA 0x%lx for desc FIFO.\n",
"sps:BAM %pa pipe %d uses IOVA 0x%pK for desc FIFO.\n",
BAM_ID(dev), pipe_index,
bam_pipe->connect.desc.iova);
(void *)(bam_pipe->connect.desc.iova));
} else {
hw_params.desc_base = map->desc.phys_base;
}
@ -1378,8 +1379,9 @@ int sps_bam_pipe_transfer_one(struct sps_bam *dev,
u32 next_write;
static int show_recom;
SPS_DBG(dev, "sps:BAM %pa pipe %d addr 0x%x size 0x%x flags 0x%x\n",
BAM_ID(dev), pipe_index, addr, size, flags);
SPS_DBG(dev, "sps:BAM %pa pipe %d addr 0x%pK size 0x%x flags 0x%x\n",
BAM_ID(dev), pipe_index,
(void *)(long)addr, size, flags);
/* Is this a BAM-to-BAM or satellite connection? */
if ((pipe->state & (BAM_STATE_BAM2BAM | BAM_STATE_REMOTE))) {
@ -1890,8 +1892,8 @@ static void pipe_handler_eot(struct sps_bam *dev, struct sps_pipe *pipe)
user = &pipe->sys.user_ptrs[offset / sizeof(struct sps_iovec)];
for (;;) {
SPS_DBG(dev,
"sps:%s; pipe index:%d; iovec addr:0x%x; size:0x%x; flags:0x%x.\n",
__func__, pipe->pipe_index, cache->addr,
"sps:%s; pipe index:%d; iovec addr:0x%pK; size:0x%x; flags:0x%x.\n",
__func__, pipe->pipe_index, (void *)(long)cache->addr,
cache->size, cache->flags);
/*

12
drivers/platform/msm/sps/sps_dma.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2011-2013, 2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2013, 2015, 2019 The Linux Foundation.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -380,7 +381,7 @@ int sps_dma_device_de_init(unsigned long h)
dev = sps_dma_find_device(h);
if (dev == NULL) {
SPS_ERR(sps, "sps:BAM-DMA: not registered: %lx", h);
SPS_ERR(sps, "sps:BAM-DMA: not registered: %pK", (void *)h);
result = SPS_ERROR;
goto exit_err;
}
@ -546,8 +547,8 @@ int sps_alloc_dma_chan(const struct sps_alloc_dma_chan *alloc,
dev = sps_dma_find_device(alloc->dev);
if (dev == NULL) {
SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %lx",
alloc->dev);
SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %pK",
(void *)alloc->dev);
goto exit_err;
}
@ -620,7 +621,8 @@ int sps_free_dma_chan(struct sps_dma_chan *chan)
dev = sps_dma_find_device(chan->dev);
if (dev == NULL) {
SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %lx", chan->dev);
SPS_ERR(sps, "sps:BAM-DMA: invalid BAM handle: %pK",
(void *)chan->dev);
result = SPS_ERROR;
goto exit_err;
}

10
drivers/platform/msm/sps/sps_mem.c
View File

@ -1,4 +1,4 @@
/* Copyright (c) 2011-2013, 2015, 2017, The Linux Foundation.
/* Copyright (c) 2011-2013, 2015, 2017, 2019, The Linux Foundation.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
@ -75,8 +75,8 @@ phys_addr_t sps_mem_alloc_io(u32 bytes)
return SPS_ADDR_INVALID;
}
SPS_DBG3(sps, "sps:sps_mem_alloc_io.phys=%pa.virt=0x%lx.size=0x%x.",
&phys_addr, virt_addr, bytes);
SPS_DBG3(sps, "sps:sps_mem_alloc_io.phys=%pa.virt=0x%pK.size=0x%x.",
&phys_addr, (void *)virt_addr, bytes);
return phys_addr;
}
@ -92,8 +92,8 @@ void sps_mem_free_io(phys_addr_t phys_addr, u32 bytes)
iomem_offset = phys_addr - iomem_phys;
virt_addr = (uintptr_t) iomem_virt + iomem_offset;
SPS_DBG3(sps, "sps:sps_mem_free_io.phys=%pa.virt=0x%lx.size=0x%x.",
&phys_addr, virt_addr, bytes);
SPS_DBG3(sps, "sps:sps_mem_free_io.phys=%pa.virt=0x%pK.size=0x%x.",
&phys_addr, (void *)virt_addr, bytes);
gen_pool_free(pool, virt_addr, bytes);
total_free += bytes;

15
drivers/platform/msm/sps/sps_rm.c
View File

@ -1,4 +1,5 @@
/* Copyright (c) 2011-2015, 2017, The Linux Foundation. All rights reserved.
/* Copyright (c) 2011-2015, 2017, 2019, The Linux Foundation.
* All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -380,8 +381,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe)
map->src.bam = sps_h2bam(map->src.dev);
if (map->src.bam == NULL) {
if (map->src.dev != SPS_DEV_HANDLE_MEM) {
SPS_ERR(sps, "sps:Invalid BAM handle: %pa",
&map->src.dev);
SPS_ERR(sps, "sps:Invalid BAM handle: %pK",
(void *)(&map->src.dev));
goto exit_err;
}
map->src.pipe_index = SPS_BAM_PIPE_INVALID;
@ -389,8 +390,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe)
map->dest.bam = sps_h2bam(map->dest.dev);
if (map->dest.bam == NULL) {
if (map->dest.dev != SPS_DEV_HANDLE_MEM) {
SPS_ERR(sps, "sps:Invalid BAM handle: %pa",
&map->dest.dev);
SPS_ERR(sps, "sps:Invalid BAM handle: %pK",
(void *)(&map->dest.dev));
goto exit_err;
}
map->dest.pipe_index = SPS_BAM_PIPE_INVALID;
@ -399,8 +400,8 @@ static struct sps_connection *sps_rm_create(struct sps_pipe *pipe)
/* Check the BAM device for the pipe */
if ((dir == SPS_MODE_SRC && map->src.bam == NULL) ||
(dir != SPS_MODE_SRC && map->dest.bam == NULL)) {
SPS_ERR(sps, "sps:Invalid BAM endpt: dir %d src %pa dest %pa",
dir, &map->src.dev, &map->dest.dev);
SPS_ERR(sps, "sps:Invalid BAM endpt: dir %d src %pK dest %pK",
dir, (void *)(&map->src.dev), (void *)(&map->dest.dev));
goto exit_err;
}