diff options
| author | Mallikarjuna Reddy Amireddy <mamire@codeaurora.org> | 2016-04-28 15:27:00 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-08-03 00:32:38 -0700 |
| commit | a40e736e64f8766c9f473382b42adeb10e6724f4 (patch) | |
| tree | dab8eed7b086a8852559968044cced8fabc4cc18 | |
| parent | ec9fd7cc51bcc302aefe26e4cbfc7f4e2590918d (diff) | |
qseecom: Change format specifier %p to %pK
Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with 0's.
So that %pK will not leak kernel pointers to unprivileged users.
So change the format specifier from %p to %pK.
Debugging Note : &pK prints only Zeros as address. if you need actual
address information, pls echo 0 to kptr_restrict.
$ echo 0 > /proc/sys/kernel/kptr_restrict
Change-Id: I0baf2be2d5a476e2e4267f20b99d0ddf5492469e
Signed-off-by: Mallikarjuna Reddy Amireddy <mamire@codeaurora.org>
| -rw-r--r-- | drivers/misc/qseecom.c | 22 |
1 files changed, 11 insertions, 11 deletions
diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index c994f7e00a16..ca790d684be7 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -1371,7 +1371,7 @@ static int qseecom_set_client_mem_param(struct qseecom_dev_handle *data, if ((req.ifd_data_fd <= 0) || (req.virt_sb_base == NULL) || (req.sb_len == 0)) { - pr_err("Inavlid input(s)ion_fd(%d), sb_len(%d), vaddr(0x%p)\n", + pr_err("Inavlid input(s)ion_fd(%d), sb_len(%d), vaddr(0x%pK)\n", req.ifd_data_fd, req.sb_len, req.virt_sb_base); return -EFAULT; } @@ -2225,7 +2225,7 @@ int __qseecom_process_rpmb_svc_cmd(struct qseecom_dev_handle *data_ptr, void *req_buf = NULL; if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) { - pr_err("Error with pointer: req_ptr = %p, send_svc_ptr = %p\n", + pr_err("Error with pointer: req_ptr = %pK, send_svc_ptr = %pK\n", req_ptr, send_svc_ireq_ptr); return -EINVAL; } @@ -2272,7 +2272,7 @@ int __qseecom_process_fsm_key_svc_cmd(struct qseecom_dev_handle *data_ptr, uint32_t reqd_len_sb_in = 0; if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) { - pr_err("Error with pointer: req_ptr = %p, send_svc_ptr = %p\n", + pr_err("Error with pointer: req_ptr = %pK, send_svc_ptr = %pK\n", req_ptr, send_svc_ireq_ptr); return -EINVAL; } @@ -2877,7 +2877,7 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, (!cleanup) && ((uint64_t)sg_dma_address(sg_ptr->sgl) >= PHY_ADDR_4G - sg->length)) { - pr_err("App %s sgl PA exceeds 4G: phy_addr=%pad, len=%x\n", + pr_err("App %s sgl PA exceeds 4G: phy_addr=%pKad, len=%x\n", data->client.app_name, &(sg_dma_address(sg_ptr->sgl)), sg->length); @@ -2934,7 +2934,7 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, (!cleanup) && ((uint64_t)(sg_dma_address(sg)) >= PHY_ADDR_4G - sg->length)) { - pr_err("App %s sgl PA exceeds 4G: phy_addr=%pad, len=%x\n", + pr_err("App %s sgl PA exceeds 4G: phy_addr=%pKad, len=%x\n", data->client.app_name, &(sg_dma_address(sg)), sg->length); @@ -4092,7 +4092,7 @@ int qseecom_send_command(struct qseecom_handle *handle, void *send_buf, if (ret) return ret; - pr_debug("sending cmd_req->rsp size: %u, ptr: 0x%p\n", + pr_debug("sending cmd_req->rsp size: %u, ptr: 0x%pK\n", req.resp_len, req.resp_buf); return ret; } @@ -6378,7 +6378,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) ret = -EINVAL; break; } - pr_debug("SET_MEM_PARAM: qseecom addr = 0x%p\n", data); + pr_debug("SET_MEM_PARAM: qseecom addr = 0x%pK\n", data); ret = qseecom_set_client_mem_param(data, argp); if (ret) pr_err("failed Qqseecom_set_mem_param request: %d\n", @@ -6394,7 +6394,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) break; } data->type = QSEECOM_CLIENT_APP; - pr_debug("LOAD_APP_REQ: qseecom_addr = 0x%p\n", data); + pr_debug("LOAD_APP_REQ: qseecom_addr = 0x%pK\n", data); mutex_lock(&app_access_lock); atomic_inc(&data->ioctl_count); ret = qseecom_load_app(data, argp); @@ -6412,7 +6412,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) ret = -EINVAL; break; } - pr_debug("UNLOAD_APP: qseecom_addr = 0x%p\n", data); + pr_debug("UNLOAD_APP: qseecom_addr = 0x%pK\n", data); mutex_lock(&app_access_lock); atomic_inc(&data->ioctl_count); ret = qseecom_unload_app(data, false); @@ -6543,7 +6543,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) data->type = QSEECOM_CLIENT_APP; mutex_lock(&app_access_lock); atomic_inc(&data->ioctl_count); - pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%p\n", data); + pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%pK\n", data); ret = qseecom_query_app_loaded(data, argp); atomic_dec(&data->ioctl_count); mutex_unlock(&app_access_lock); @@ -6862,7 +6862,7 @@ static int qseecom_release(struct inode *inode, struct file *file) int ret = 0; if (data->released == false) { - pr_debug("data: released=false, type=%d, mode=%d, data=0x%p\n", + pr_debug("data: released=false, type=%d, mode=%d, data=0x%pK\n", data->type, data->mode, data); switch (data->type) { case QSEECOM_LISTENER_SERVICE: |
