Skip to content

Commit

Permalink
msm: camera: Avoid exposing kernel addresses
Browse files Browse the repository at this point in the history 
Usage of %p exposes the kernel addresses, an easy target to
kernel write vulnerabilities. With this patch currently
%pK prints only Zeros as address. If you need actual address
echo 0 > /proc/sys/kernel/kptr_restrict

CRs-Fixed: 987011
Change-Id: I6c79f82376936fc646b723872a96a6694fe47cd9
Signed-off-by: Azam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
  • Loading branch information
@mdmower
Azam Sadiq Pasha Kapatrala Syed authored and mdmower committed Dec 18, 2016
1 parent 9fd878d commit 7fb8faa
Show file tree
Hide file tree
Showing 43 changed files with 295 additions and 295 deletions.
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/gemini/msm_gemini_hw.c
View file
Expand Up @@ -491,7 +491,7 @@ void msm_gemini_io_dump(int size)
int i;
u32 *p = (u32 *) addr;
u32 data;
pr_info("%s: %p %d reg_size %d\n", __func__, addr, size,
pr_info("%s: %pK %d reg_size %d\n", __func__, addr, size,
gemini_region_size);
line_str[0] = '\0';
p_str = line_str;
Expand Down
4 changes: 2 additions & 2 deletions drivers/media/platform/msm/camera_v2/gemini/msm_gemini_sync.c
View file
Expand Up @@ -187,7 +187,7 @@ int msm_gemini_framedone_irq(struct msm_gemini_device *pgmn_dev,
{
int rc = 0;

GMN_DBG("%s:%d] buf_in %p", __func__, __LINE__, buf_in);
GMN_DBG("%s:%d] buf_in %pK", __func__, __LINE__, buf_in);

if (buf_in) {
buf_in->vbuf.framedone_len = buf_in->framedone_len;
Expand Down Expand Up @@ -711,7 +711,7 @@ int __msm_gemini_open(struct msm_gemini_device *pgmn_dev)
return rc;
}

GMN_DBG("%s:%d] platform resources - mem %p, base %p, irq %d\n",
GMN_DBG("%s:%d] platform resources - mem %pK, base %pK, irq %d\n",
__func__, __LINE__,
pgmn_dev->mem, pgmn_dev->base, pgmn_dev->irq);

Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
View file
Expand Up @@ -133,7 +133,7 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr,
ion_import_dma_buf(buf_mgr->client,
v4l2_buf->m.planes[i].m.userptr);
if (IS_ERR_OR_NULL(mapped_info->handle)) {
pr_err("%s: buf has null/error ION handle %p\n",
pr_err("%s: buf has null/error ION handle %pK\n",
__func__, mapped_info->handle);
goto ion_map_error;
}
Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c
View file
Expand Up @@ -1122,7 +1122,7 @@ void msm_camera_io_dump_2(void __iomem *addr, int size)
int i;
u32 *p = (u32 *) addr;
u32 data;
ISP_DBG("%s: %p %d\n", __func__, addr, size);
ISP_DBG("%s: %pK %d\n", __func__, addr, size);
line_str[0] = '\0';
p_str = line_str;
for (i = 0; i < size/4; i++) {
Expand Down
8 changes: 4 additions & 4 deletions drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c
View file
Expand Up @@ -263,14 +263,14 @@ static int msm_isp_get_max_clk_rate(struct vfe_device *vfe_dev, long *rate)
long round_rate = 0;

if (!vfe_dev || !rate) {
pr_err("%s:%d failed: vfe_dev %p rate %p\n", __func__, __LINE__,
pr_err("%s:%d failed: vfe_dev %pK rate %pK\n", __func__, __LINE__,
vfe_dev, rate);
return -EINVAL;
}

*rate = 0;
if (!vfe_dev->hw_info) {
pr_err("%s:%d failed: vfe_dev->hw_info %p\n", __func__,
pr_err("%s:%d failed: vfe_dev->hw_info %pK\n", __func__,
__LINE__, vfe_dev->hw_info);
return -EINVAL;
}
Expand Down Expand Up @@ -472,13 +472,13 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev,
uint32_t *cfg_data, uint32_t cmd_len)
{
if (!vfe_dev || !reg_cfg_cmd) {
pr_err("%s:%d failed: vfe_dev %p reg_cfg_cmd %p\n", __func__,
pr_err("%s:%d failed: vfe_dev %pK reg_cfg_cmd %pK\n", __func__,
__LINE__, vfe_dev, reg_cfg_cmd);
return -EINVAL;
}
if ((reg_cfg_cmd->cmd_type != VFE_CFG_MASK) &&
(!cfg_data || !cmd_len)) {
pr_err("%s:%d failed: cmd type %d cfg_data %p cmd_len %d\n",
pr_err("%s:%d failed: cmd type %d cfg_data %pK cmd_len %d\n",
__func__, __LINE__, reg_cfg_cmd->cmd_type, cfg_data,
cmd_len);
return -EINVAL;
Expand Down
4 changes: 2 additions & 2 deletions drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c
View file
Expand Up @@ -948,7 +948,7 @@ static int msm_ispif_set_vfe_info(struct ispif_device *ispif,
{
if (!vfe_info || (vfe_info->num_vfe <= 0) ||
((uint32_t)(vfe_info->num_vfe) > ispif->hw_num_isps)) {
pr_err("Invalid VFE info: %p %d\n", vfe_info,
pr_err("Invalid VFE info: %pK %d\n", vfe_info,
(vfe_info ? vfe_info->num_vfe:0));
return -EINVAL;
}
Expand Down Expand Up @@ -983,7 +983,7 @@ static int msm_ispif_init(struct ispif_device *ispif,

if (ispif->csid_version >= CSID_VERSION_V30) {
if (!ispif->clk_mux_mem || !ispif->clk_mux_io) {
pr_err("%s csi clk mux mem %p io %p\n", __func__,
pr_err("%s csi clk mux mem %pK io %pK\n", __func__,
ispif->clk_mux_mem, ispif->clk_mux_io);
rc = -ENOMEM;
return rc;
Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c
View file
Expand Up @@ -393,7 +393,7 @@ void msm_jpeg_io_dump(void *base, int size)
int i;
u32 *p = (u32 *) addr;
u32 data;
JPEG_DBG_HIGH("%s:%d] %p %d", __func__, __LINE__, addr, size);
JPEG_DBG_HIGH("%s:%d] %pK %d", __func__, __LINE__, addr, size);
line_str[0] = '\0';
p_str = line_str;
for (i = 0; i < size/4; i++) {
Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c
View file
Expand Up @@ -599,7 +599,7 @@ int __msm_jpeg_open(struct msm_jpeg_device *pgmn_dev)
return rc;
}

JPEG_DBG("%s:%d] platform resources - mem %p, base %p, irq %d\n",
JPEG_DBG("%s:%d] platform resources - mem %pK, base %pK, irq %d\n",
__func__, __LINE__,
pgmn_dev->mem, pgmn_dev->base, pgmn_dev->irq);
pgmn_dev->res_size = resource_size(pgmn_dev->mem);
Expand Down
10 changes: 5 additions & 5 deletions drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c
View file
Expand Up @@ -874,7 +874,7 @@ static void cpp_load_fw(struct cpp_device *cpp_dev, char *fw_name_bin)
rc = request_firmware(&fw, fw_name_bin, dev);
if (rc) {
dev_err(dev,
"Fail to loc blob %s from dev %p, Error: %d\n",
"Fail to loc blob %s from dev %pK, Error: %d\n",
fw_name_bin, dev, rc);
}
if (NULL != fw)
Expand Down Expand Up @@ -966,7 +966,7 @@ static int cpp_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
return -ENODEV;
}

CPP_DBG("open %d %p\n", i, &fh->vfh);
CPP_DBG("open %d %pK\n", i, &fh->vfh);
cpp_dev->cpp_open_cnt++;
if (cpp_dev->cpp_open_cnt == 1) {
cpp_init_hardware(cpp_dev);
Expand All @@ -986,7 +986,7 @@ static int cpp_close_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
struct msm_device_queue *eventData_q = NULL;

if (!cpp_dev) {
pr_err("failed: cpp_dev %p\n", cpp_dev);
pr_err("failed: cpp_dev %pK\n", cpp_dev);
return -EINVAL;
}

Expand Down Expand Up @@ -1192,7 +1192,7 @@ static void msm_cpp_do_timeout_work(struct work_struct *work)
pr_err("cpp_timer_callback called. (jiffies=%lu)\n",
jiffies);
if (!work || cpp_timer.data.cpp_dev->state != CPP_STATE_ACTIVE) {
pr_err("Invalid work:%p or state:%d\n", work,
pr_err("Invalid work:%pK or state:%d\n", work,
cpp_timer.data.cpp_dev->state);
return;
}
Expand Down Expand Up @@ -1542,7 +1542,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd,
return -EINVAL;
}
if ((ioctl_ptr->ioctl_ptr == NULL) || (ioctl_ptr->len == 0)) {
pr_err("ioctl_ptr OR ioctl_ptr->len is NULL %p %d\n",
pr_err("ioctl_ptr OR ioctl_ptr->len is NULL %pK %d\n",
ioctl_ptr, ioctl_ptr->len);
return -EINVAL;
}
Expand Down
6 changes: 3 additions & 3 deletions drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c
View file
Expand Up @@ -52,7 +52,7 @@ static void vpe_mem_dump(const char * const name, const void * const addr,
int i;
u32 *p = (u32 *) addr;
u32 data;
VPE_DBG("%s: (%s) %p %d\n", __func__, name, addr, size);
VPE_DBG("%s: (%s) %pK %d\n", __func__, name, addr, size);
line_str[0] = '\0';
p_str = line_str;
for (i = 0; i < size/4; i++) {
Expand Down Expand Up @@ -595,7 +595,7 @@ static int vpe_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
goto err_mutex_unlock;
}

VPE_DBG("open %d %p\n", i, &fh->vfh);
VPE_DBG("open %d %pK\n", i, &fh->vfh);
vpe_dev->vpe_open_cnt++;
if (vpe_dev->vpe_open_cnt == 1) {
rc = vpe_init_hardware(vpe_dev);
Expand Down Expand Up @@ -651,7 +651,7 @@ static int vpe_close_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh)
return -ENODEV;
}

VPE_DBG("close %d %p\n", i, &fh->vfh);
VPE_DBG("close %d %pK\n", i, &fh->vfh);
vpe_dev->vpe_open_cnt--;
if (vpe_dev->vpe_open_cnt == 0) {
vpe_deinit_mem(vpe_dev);
Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c
View file
Expand Up @@ -906,7 +906,7 @@ static long msm_actuator_subdev_ioctl(struct v4l2_subdev *sd,
struct msm_actuator_ctrl_t *a_ctrl = v4l2_get_subdevdata(sd);
void __user *argp = (void __user *)arg;
CDBG("Enter\n");
CDBG("%s:%d a_ctrl %p argp %p\n", __func__, __LINE__, a_ctrl, argp);
CDBG("%s:%d a_ctrl %pK argp %pK\n", __func__, __LINE__, a_ctrl, argp);
switch (cmd) {
case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID:
return msm_actuator_get_subdev_id(a_ctrl, argp);
Expand Down
10 changes: 5 additions & 5 deletions drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c
View file
Expand Up @@ -477,7 +477,7 @@ static int32_t msm_cci_i2c_read_bytes(struct v4l2_subdev *sd,
uint16_t read_bytes = 0;

if (!sd || !c_ctrl) {
pr_err("%s:%d sd %p c_ctrl %p\n", __func__,
pr_err("%s:%d sd %pK c_ctrl %pK\n", __func__,
__LINE__, sd, c_ctrl);
return -EINVAL;
}
Expand Down Expand Up @@ -669,7 +669,7 @@ static int32_t msm_cci_init(struct v4l2_subdev *sd,
cci_dev = v4l2_get_subdevdata(sd);

if (!cci_dev || !c_ctrl) {
pr_err("%s:%d failed: invalid params %p %p\n", __func__,
pr_err("%s:%d failed: invalid params %pK %pK\n", __func__,
__LINE__, cci_dev, c_ctrl);
rc = -ENOMEM;
return rc;
Expand Down Expand Up @@ -1115,7 +1115,7 @@ static int __devinit msm_cci_probe(struct platform_device *pdev)
{
struct cci_device *new_cci_dev;
int rc = 0;
CDBG("%s: pdev %p device id = %d\n", __func__, pdev, pdev->id);
CDBG("%s: pdev %pK device id = %d\n", __func__, pdev, pdev->id);
new_cci_dev = kzalloc(sizeof(struct cci_device), GFP_KERNEL);
if (!new_cci_dev) {
CDBG("%s: no enough memory\n", __func__);
Expand All @@ -1127,7 +1127,7 @@ static int __devinit msm_cci_probe(struct platform_device *pdev)
ARRAY_SIZE(new_cci_dev->msm_sd.sd.name), "msm_cci");
v4l2_set_subdevdata(&new_cci_dev->msm_sd.sd, new_cci_dev);
platform_set_drvdata(pdev, &new_cci_dev->msm_sd.sd);
CDBG("%s sd %p\n", __func__, &new_cci_dev->msm_sd.sd);
CDBG("%s sd %pK\n", __func__, &new_cci_dev->msm_sd.sd);
if (pdev->dev.of_node)
of_property_read_u32((&pdev->dev)->of_node,
"cell-index", &pdev->id);
Expand Down Expand Up @@ -1183,7 +1183,7 @@ static int __devinit msm_cci_probe(struct platform_device *pdev)
pr_err("%s: failed to add child nodes, rc=%d\n", __func__, rc);
new_cci_dev->cci_state = CCI_STATE_DISABLED;
g_cci_subdev = &new_cci_dev->msm_sd.sd;
CDBG("%s cci subdev %p\n", __func__, &new_cci_dev->msm_sd.sd);
CDBG("%s cci subdev %pK\n", __func__, &new_cci_dev->msm_sd.sd);
CDBG("%s line %d\n", __func__, __LINE__);
return 0;

Expand Down
4 changes: 2 additions & 2 deletions drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c
View file
Expand Up @@ -114,7 +114,7 @@ static int msm_csid_config(struct csid_device *csid_dev,
void __iomem *csidbase;
csidbase = csid_dev->base;
if (!csidbase || !csid_params) {
pr_err("%s:%d csidbase %p, csid params %p\n", __func__,
pr_err("%s:%d csidbase %pK, csid params %pK\n", __func__,
__LINE__, csidbase, csid_params);
return -EINVAL;
}
Expand Down Expand Up @@ -434,7 +434,7 @@ static long msm_csid_cmd(struct csid_device *csid_dev, void *arg)
struct csid_cfg_data *cdata = (struct csid_cfg_data *)arg;

if (!csid_dev || !cdata) {
pr_err("%s:%d csid_dev %p, cdata %p\n", __func__, __LINE__,
pr_err("%s:%d csid_dev %pK, cdata %pK\n", __func__, __LINE__,
csid_dev, cdata);
return -EINVAL;
}
Expand Down
10 changes: 5 additions & 5 deletions drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c
View file
Expand Up @@ -80,7 +80,7 @@ static int msm_csiphy_lane_config(struct csiphy_device *csiphy_dev,
val |= csiphy_params->csid_core;
}
msm_camera_io_w(val, csiphy_dev->clk_mux_base);
CDBG("%s clk mux addr %p val 0x%x\n", __func__,
CDBG("%s clk mux addr %pK val 0x%x\n", __func__,
csiphy_dev->clk_mux_base, val);
mb();
}
Expand Down Expand Up @@ -236,7 +236,7 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev)
ARRAY_SIZE(csiphy_8610_clk_info), 1);
} else if (CSIPHY_VERSION == CSIPHY_VERSION_V30) {
if (!csiphy_dev->clk_mux_mem || !csiphy_dev->clk_mux_io) {
pr_err("%s clk mux mem %p io %p\n", __func__,
pr_err("%s clk mux mem %pK io %pK\n", __func__,
csiphy_dev->clk_mux_mem,
csiphy_dev->clk_mux_io);
rc = -ENOMEM;
Expand Down Expand Up @@ -339,7 +339,7 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev)
ARRAY_SIZE(csiphy_8610_clk_info), 1);
} else if (CSIPHY_VERSION == CSIPHY_VERSION_V30) {
if (!csiphy_dev->clk_mux_mem || !csiphy_dev->clk_mux_io) {
pr_err("%s clk mux mem %p io %p\n", __func__,
pr_err("%s clk mux mem %pK io %pK\n", __func__,
csiphy_dev->clk_mux_mem,
csiphy_dev->clk_mux_io);
rc = -ENOMEM;
Expand Down Expand Up @@ -420,7 +420,7 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg)
MIPI_CSIPHY_LNn_CFG2_ADDR + 0x40*i);
} else {
if (!csi_lane_params) {
pr_err("%s:%d failed: csi_lane_params %p\n", __func__,
pr_err("%s:%d failed: csi_lane_params %pK\n", __func__,
__LINE__, csi_lane_params);
return -EINVAL;
}
Expand Down Expand Up @@ -504,7 +504,7 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg)
MIPI_CSIPHY_LNn_CFG2_ADDR + 0x40*i);
} else {
if (!csi_lane_params) {
pr_err("%s:%d failed: csi_lane_params %p\n", __func__,
pr_err("%s:%d failed: csi_lane_params %pK\n", __func__,
__LINE__, csi_lane_params);
return -EINVAL;
}
Expand Down
2 changes: 1 addition & 1 deletion drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c
View file
Expand Up @@ -192,7 +192,7 @@ static long msm_eeprom_subdev_ioctl(struct v4l2_subdev *sd,
struct msm_eeprom_ctrl_t *e_ctrl = v4l2_get_subdevdata(sd);
void __user *argp = (void __user *)arg;
CDBG("%s E\n", __func__);
CDBG("%s:%d a_ctrl %p argp %p\n", __func__, __LINE__, e_ctrl, argp);
CDBG("%s:%d a_ctrl %pK argp %pK\n", __func__, __LINE__, e_ctrl, argp);
switch (cmd) {
case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID:
return msm_eeprom_get_subdev_id(e_ctrl, argp);
Expand Down
6 changes: 3 additions & 3 deletions drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c
View file
Expand Up @@ -33,7 +33,7 @@ int msm_camera_fill_vreg_params(struct camera_vreg_t *cam_vreg,

/* Validate input parameters */
if (!cam_vreg || !power_setting) {
pr_err("%s:%d failed: cam_vreg %p power_setting %p", __func__,
pr_err("%s:%d failed: cam_vreg %pK power_setting %pK", __func__,
__LINE__, cam_vreg, power_setting);
return -EINVAL;
}
Expand Down Expand Up @@ -977,7 +977,7 @@ int msm_camera_power_up(struct msm_camera_power_ctrl_t *ctrl,

CDBG("%s:%d\n", __func__, __LINE__);
if (!ctrl || !sensor_i2c_client) {
pr_err("failed ctrl %p sensor_i2c_client %p\n", ctrl,
pr_err("failed ctrl %pK sensor_i2c_client %pK\n", ctrl,
sensor_i2c_client);
return -EINVAL;
}
Expand Down Expand Up @@ -1167,7 +1167,7 @@ int msm_camera_power_down(struct msm_camera_power_ctrl_t *ctrl,

CDBG("%s:%d\n", __func__, __LINE__);
if (!ctrl || !sensor_i2c_client) {
pr_err("failed ctrl %p sensor_i2c_client %p\n", ctrl,
pr_err("failed ctrl %pK sensor_i2c_client %pK\n", ctrl,
sensor_i2c_client);
return -EINVAL;
}
Expand Down
6 changes: 3 additions & 3 deletions drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_io_util.c
View file
Expand Up @@ -78,7 +78,7 @@ void msm_camera_io_dump(void __iomem *addr, int size)
int i;
u32 *p = (u32 *) addr;
u32 data;
CDBG("%s: %p %d\n", __func__, addr, size);
CDBG("%s: %pK %d\n", __func__, addr, size);
line_str[0] = '\0';
p_str = line_str;
for (i = 0; i < size/4; i++) {
Expand All @@ -102,7 +102,7 @@ void msm_camera_io_dump(void __iomem *addr, int size)
void msm_camera_io_memcpy(void __iomem *dest_addr,
void __iomem *src_addr, u32 len)
{
CDBG("%s: %p %p %d\n", __func__, dest_addr, src_addr, len);
CDBG("%s: %pK %pK %d\n", __func__, dest_addr, src_addr, len);
msm_camera_io_memcpy_toio(dest_addr, src_addr, len / 4);
msm_camera_io_dump(dest_addr, len);
}
Expand Down Expand Up @@ -558,7 +558,7 @@ int msm_camera_request_gpio_table(struct gpio *gpio_tbl, uint8_t size,
int rc = 0, i = 0, err = 0;

if (!gpio_tbl || !size) {
pr_err("%s:%d invalid gpio_tbl %p / size %d\n", __func__,
pr_err("%s:%d invalid gpio_tbl %pK / size %d\n", __func__,
__LINE__, gpio_tbl, size);
return -EINVAL;
}
Expand Down

0 comments on commit 7fb8faa

Please sign in to comment.