Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7cc0d0ff authored by Alistair Strachan's avatar Alistair Strachan
Browse files

ANDROID: staging: ion: Obey kptr_restrict 



The /sys/kernel/debug/ion/clients/<client> file could disobey the
setting of kptr_restrict if a client went away after the file started
to be accessed. Use %pK when printing the ion client to avoid this
problem.

Some other debugging messages also did not use %pK, but since those
messages are not very useful and have been removed upstream, just remove
them instead.

Bug: 77937819
Change-Id: Ie45897fe2d6ec3f842a02883e8ec929ed2e76933
Signed-off-by: default avatarAlistair Strachan <astrachan@google.com>
parent 132f097f

drivers/staging/android/ion/ion.c

+1 −10
Original line number Diff line number Diff line
@@ -620,7 +620,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) 


	mutex_lock(&debugfs_mutex);

	if (!is_client_alive(client)) {

		seq_printf(s, "ion_client 0x%p dead, can't dump its buffers\n",

		seq_printf(s, "ion_client 0x%pK dead, can't dump its buffers\n",

			   client);

		mutex_unlock(&debugfs_mutex);

		return 0;
@@ -773,7 +773,6 @@ void ion_client_destroy(struct ion_client *client) 
	struct ion_device *dev = client->dev;

	struct rb_node *n;



	pr_debug("%s: %d\n", __func__, __LINE__);

	mutex_lock(&debugfs_mutex);

	while ((n = rb_first(&client->handles))) {

		struct ion_handle *handle = rb_entry(n, struct ion_handle,
@@ -846,9 +845,6 @@ static void ion_buffer_sync_for_device(struct ion_buffer *buffer, 
	int pages = PAGE_ALIGN(buffer->size) / PAGE_SIZE;

	int i;



	pr_debug("%s: syncing for device %s\n", __func__,

		 dev ? dev_name(dev) : "null");



	if (!ion_buffer_fault_user_mappings(buffer))

		return;
@@ -902,7 +898,6 @@ static void ion_vm_open(struct vm_area_struct *vma) 
	mutex_lock(&buffer->lock);

	list_add(&vma_list->list, &buffer->vmas);

	mutex_unlock(&buffer->lock);

	pr_debug("%s: adding %p\n", __func__, vma);

}



static void ion_vm_close(struct vm_area_struct *vma)
@@ -910,14 +905,12 @@ static void ion_vm_close(struct vm_area_struct *vma) 
	struct ion_buffer *buffer = vma->vm_private_data;

	struct ion_vma_list *vma_list, *tmp;



	pr_debug("%s\n", __func__);

	mutex_lock(&buffer->lock);

	list_for_each_entry_safe(vma_list, tmp, &buffer->vmas, list) {

		if (vma_list->vma != vma)

			continue;

		list_del(&vma_list->list);

		kfree(vma_list);

		pr_debug("%s: deleting %p\n", __func__, vma);

		break;

	}

	mutex_unlock(&buffer->lock);
@@ -1207,7 +1200,6 @@ static int ion_release(struct inode *inode, struct file *file) 
{

	struct ion_client *client = file->private_data;



	pr_debug("%s: %d\n", __func__, __LINE__);

	ion_client_destroy(client);

	return 0;

}
@@ -1219,7 +1211,6 @@ static int ion_open(struct inode *inode, struct file *file) 
	struct ion_client *client;

	char debug_name[64];



	pr_debug("%s: %d\n", __func__, __LINE__);

	snprintf(debug_name, 64, "%u", task_pid_nr(current->group_leader));

	client = ion_client_create(dev, debug_name);

	if (IS_ERR(client))

drivers/staging/android/ion/ion_cma_heap.c

+0 −4
Original line number Diff line number Diff line
@@ -49,8 +49,6 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, 
	struct device *dev = cma_heap->dev;

	struct ion_cma_buffer_info *info;



	dev_dbg(dev, "Request buffer allocation len %ld\n", len);



	if (buffer->flags & ION_FLAG_CACHED)

		return -EINVAL;
@@ -79,7 +77,6 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, 
	/* keep this for memory release */

	buffer->priv_virt = info;

	buffer->sg_table = info->table;

	dev_dbg(dev, "Allocate buffer %p\n", buffer);

	return 0;



free_table:
@@ -97,7 +94,6 @@ static void ion_cma_free(struct ion_buffer *buffer) 
	struct device *dev = cma_heap->dev;

	struct ion_cma_buffer_info *info = buffer->priv_virt;



	dev_dbg(dev, "Release buffer %p\n", buffer);

	/* release memory */

	dma_free_coherent(dev, buffer->size, info->cpu_addr, info->handle);

	/* release sg table */