Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit cbf83fb8 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: vc04_services: remove BCM2835_VCHIQ_SUPPORT_MEMDUMP 



BCM2835_VCHIQ_SUPPORT_MEMDUMP lets you look through any user memory.
That's too big of an information leak from a security perspective.  The
debugging dumps need to be more specific to this driver.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f57329c6

drivers/staging/vc04_services/Kconfig

+0 −12
Original line number Diff line number Diff line
@@ -19,18 +19,6 @@ config BCM2835_VCHIQ 
		Defaults to Y when the Broadcom Videocore services

		are included in the build, N otherwise.



if BCM2835_VCHIQ



config BCM2835_VCHIQ_SUPPORT_MEMDUMP

	bool "Support dumping memory contents to debug log"

	help

		BCM2835 VCHIQ supports the ability to dump the

		contents of memory to the debug log.  This

		is typically only needed by diagnostic tools used

		to debug issues with VideoCore.



endif



source "drivers/staging/vc04_services/bcm2835-audio/Kconfig"



source "drivers/staging/vc04_services/bcm2835-camera/Kconfig"

drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c

+0 −151
Original line number Diff line number Diff line
@@ -195,11 +195,6 @@ static const char *const ioctl_names[] = { 
vchiq_static_assert(ARRAY_SIZE(ioctl_names) ==

		    (VCHIQ_IOC_MAX + 1));



#if defined(CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP)

static void

dump_phys_mem(void *virt_addr, u32 num_bytes);

#endif



/****************************************************************************

*

*   add_completion
@@ -1161,20 +1156,6 @@ vchiq_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
				args.handle, args.option, args.value);

	} break;



#if defined(CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP)

	case VCHIQ_IOC_DUMP_PHYS_MEM: {

		VCHIQ_DUMP_MEM_T  args;



		if (copy_from_user

			 (&args, (const void __user *)arg,

			  sizeof(args)) != 0) {

			ret = -EFAULT;

			break;

		}

		dump_phys_mem(args.virt_addr, args.num_bytes);

	} break;

#endif



	case VCHIQ_IOC_LIB_VERSION: {

		unsigned int lib_version = (unsigned int)arg;
@@ -1654,42 +1635,6 @@ vchiq_compat_ioctl_get_config(struct file *file, 
	return vchiq_ioctl(file, VCHIQ_IOC_GET_CONFIG, (unsigned long)args);

}



#if defined(CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP)



struct vchiq_dump_mem32 {

	compat_uptr_t virt_addr;

	u32 num_bytes;

};



#define VCHIQ_IOC_DUMP_PHYS_MEM32 \

	_IOW(VCHIQ_IOC_MAGIC, 15, struct vchiq_dump_mem32)



static long

vchiq_compat_ioctl_dump_phys_mem(struct file *file,

				 unsigned int cmd,

				 unsigned long arg)

{

	VCHIQ_DUMP_MEM_T *args;

	struct vchiq_dump_mem32 args32;



	args = compat_alloc_user_space(sizeof(*args));

	if (!args)

		return -EFAULT;



	if (copy_from_user(&args32,

			   (struct vchiq_dump_mem32 *)arg,

			   sizeof(args32)))

		return -EFAULT;



	if (put_user(compat_ptr(args32.virt_addr), &args->virt_addr) ||

	    put_user(args32.num_bytes, &args->num_bytes))

		return -EFAULT;



	return vchiq_ioctl(file, VCHIQ_IOC_DUMP_PHYS_MEM, (unsigned long)args);

}



#endif



static long

vchiq_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)

{
@@ -1707,10 +1652,6 @@ vchiq_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 
		return vchiq_compat_ioctl_dequeue_message(file, cmd, arg);

	case VCHIQ_IOC_GET_CONFIG32:

		return vchiq_compat_ioctl_get_config(file, cmd, arg);

#if defined(CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP)

	case VCHIQ_IOC_DUMP_PHYS_MEM32:

		return vchiq_compat_ioctl_dump_phys_mem(file, cmd, arg);

#endif

	default:

		return vchiq_ioctl(file, cmd, arg);

	}
@@ -2048,98 +1989,6 @@ vchiq_dump_platform_service_state(void *dump_context, VCHIQ_SERVICE_T *service) 
	vchiq_dump(dump_context, buf, len + 1);

}



/****************************************************************************

*

*   dump_user_mem

*

***************************************************************************/



#if defined(CONFIG_BCM2835_VCHIQ_SUPPORT_MEMDUMP)



static void

dump_phys_mem(void *virt_addr, u32 num_bytes)

{

	int            rc;

	u8            *end_virt_addr = virt_addr + num_bytes;

	int            num_pages;

	int            offset;

	int            end_offset;

	int            page_idx;

	int            prev_idx;

	struct page   *page;

	struct page  **pages;

	u8            *kmapped_virt_ptr;



	/* Align virt_addr and end_virt_addr to 16 byte boundaries. */



	virt_addr = (void *)((unsigned long)virt_addr & ~0x0fuL);

	end_virt_addr = (void *)(((unsigned long)end_virt_addr + 15uL) &

		~0x0fuL);



	offset = (int)(long)virt_addr & (PAGE_SIZE - 1);

	end_offset = (int)(long)end_virt_addr & (PAGE_SIZE - 1);



	num_pages = DIV_ROUND_UP(offset + num_bytes, PAGE_SIZE);



	pages = kmalloc(sizeof(struct page *) * num_pages, GFP_KERNEL);

	if (!pages) {

		vchiq_log_error(vchiq_arm_log_level,

			"Unable to allocation memory for %d pages\n",

			num_pages);

		return;

	}



	down_read(&current->mm->mmap_sem);

	rc = get_user_pages(

		(unsigned long)virt_addr, /* start */

		num_pages,                /* len */

		0,                        /* gup_flags */

		pages,                    /* pages (array of page pointers) */

		NULL);                    /* vmas */

	up_read(&current->mm->mmap_sem);



	prev_idx = -1;

	page = NULL;



	if (rc < 0) {

		vchiq_log_error(vchiq_arm_log_level,

				"Failed to get user pages: %d\n", rc);

		goto out;

	}



	while (offset < end_offset) {

		int page_offset = offset % PAGE_SIZE;



		page_idx = offset / PAGE_SIZE;

		if (page_idx != prev_idx) {

			if (page != NULL)

				kunmap(page);

			page = pages[page_idx];

			kmapped_virt_ptr = kmap(page);

			prev_idx = page_idx;

		}



		if (vchiq_arm_log_level >= VCHIQ_LOG_TRACE)

			vchiq_log_dump_mem("ph",

				(u32)(unsigned long)&kmapped_virt_ptr[

					page_offset],

				&kmapped_virt_ptr[page_offset], 16);



		offset += 16;

	}



out:

	if (page != NULL)

		kunmap(page);



	for (page_idx = 0; page_idx < num_pages; page_idx++)

		put_page(pages[page_idx]);



	kfree(pages);

}



#endif



/****************************************************************************

*

*   vchiq_read