Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a40e736e authored by Mallikarjuna Reddy Amireddy's avatar Mallikarjuna Reddy Amireddy Committed by Gerrit - the friendly Code Review server
Browse files

qseecom: Change format specifier %p to %pK 



Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with 0's.
So that %pK will not leak kernel pointers to unprivileged users.
So change the format specifier from %p to %pK.

Debugging Note : &pK prints only Zeros as address. if you need actual
address information, pls echo 0 to kptr_restrict.
$ echo 0 > /proc/sys/kernel/kptr_restrict

Change-Id: I0baf2be2d5a476e2e4267f20b99d0ddf5492469e
Signed-off-by: default avatarMallikarjuna Reddy Amireddy <mamire@codeaurora.org>
parent ec9fd7cc

drivers/misc/qseecom.c

+11 −11
Original line number Original line Diff line number Diff line
@@ -1371,7 +1371,7 @@ static int qseecom_set_client_mem_param(struct qseecom_dev_handle *data, 




	if ((req.ifd_data_fd <= 0) || (req.virt_sb_base == NULL) ||

	if ((req.ifd_data_fd <= 0) || (req.virt_sb_base == NULL) ||

					(req.sb_len == 0)) {

					(req.sb_len == 0)) {

		pr_err("Inavlid input(s)ion_fd(%d), sb_len(%d), vaddr(0x%p)\n",

		pr_err("Inavlid input(s)ion_fd(%d), sb_len(%d), vaddr(0x%pK)\n",

			req.ifd_data_fd, req.sb_len, req.virt_sb_base);

			req.ifd_data_fd, req.sb_len, req.virt_sb_base);

		return -EFAULT;

		return -EFAULT;

	}

	}
@@ -2225,7 +2225,7 @@ int __qseecom_process_rpmb_svc_cmd(struct qseecom_dev_handle *data_ptr, 
	void *req_buf = NULL;

	void *req_buf = NULL;





	if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) {

	if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) {

		pr_err("Error with pointer: req_ptr = %p, send_svc_ptr = %p\n",

		pr_err("Error with pointer: req_ptr = %pK, send_svc_ptr = %pK\n",

			req_ptr, send_svc_ireq_ptr);

			req_ptr, send_svc_ireq_ptr);

		return -EINVAL;

		return -EINVAL;

	}

	}
@@ -2272,7 +2272,7 @@ int __qseecom_process_fsm_key_svc_cmd(struct qseecom_dev_handle *data_ptr, 
	uint32_t reqd_len_sb_in = 0;

	uint32_t reqd_len_sb_in = 0;





	if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) {

	if ((req_ptr == NULL) || (send_svc_ireq_ptr == NULL)) {

		pr_err("Error with pointer: req_ptr = %p, send_svc_ptr = %p\n",

		pr_err("Error with pointer: req_ptr = %pK, send_svc_ptr = %pK\n",

			req_ptr, send_svc_ireq_ptr);

			req_ptr, send_svc_ireq_ptr);

		return -EINVAL;

		return -EINVAL;

	}

	}
@@ -2877,7 +2877,7 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, 
					(!cleanup) &&

					(!cleanup) &&

					((uint64_t)sg_dma_address(sg_ptr->sgl)

					((uint64_t)sg_dma_address(sg_ptr->sgl)

					>= PHY_ADDR_4G - sg->length)) {

					>= PHY_ADDR_4G - sg->length)) {

					pr_err("App %s sgl PA exceeds 4G: phy_addr=%pad, len=%x\n",

					pr_err("App %s sgl PA exceeds 4G: phy_addr=%pKad, len=%x\n",

						data->client.app_name,

						data->client.app_name,

						&(sg_dma_address(sg_ptr->sgl)),

						&(sg_dma_address(sg_ptr->sgl)),

						sg->length);

						sg->length);
@@ -2934,7 +2934,7 @@ static int __qseecom_update_cmd_buf(void *msg, bool cleanup, 
						(!cleanup) &&

						(!cleanup) &&

						((uint64_t)(sg_dma_address(sg))

						((uint64_t)(sg_dma_address(sg))

						>= PHY_ADDR_4G - sg->length)) {

						>= PHY_ADDR_4G - sg->length)) {

						pr_err("App %s sgl PA exceeds 4G: phy_addr=%pad, len=%x\n",

						pr_err("App %s sgl PA exceeds 4G: phy_addr=%pKad, len=%x\n",

							data->client.app_name,

							data->client.app_name,

							&(sg_dma_address(sg)),

							&(sg_dma_address(sg)),

							sg->length);

							sg->length);
@@ -4092,7 +4092,7 @@ int qseecom_send_command(struct qseecom_handle *handle, void *send_buf, 
	if (ret)

	if (ret)

		return ret;

		return ret;





	pr_debug("sending cmd_req->rsp size: %u, ptr: 0x%p\n",

	pr_debug("sending cmd_req->rsp size: %u, ptr: 0x%pK\n",

			req.resp_len, req.resp_buf);

			req.resp_len, req.resp_buf);

	return ret;

	return ret;

}

}
@@ -6378,7 +6378,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) 
			ret = -EINVAL;

			ret = -EINVAL;

			break;

			break;

		}

		}

		pr_debug("SET_MEM_PARAM: qseecom addr = 0x%p\n", data);

		pr_debug("SET_MEM_PARAM: qseecom addr = 0x%pK\n", data);

		ret = qseecom_set_client_mem_param(data, argp);

		ret = qseecom_set_client_mem_param(data, argp);

		if (ret)

		if (ret)

			pr_err("failed Qqseecom_set_mem_param request: %d\n",

			pr_err("failed Qqseecom_set_mem_param request: %d\n",
@@ -6394,7 +6394,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) 
			break;

			break;

		}

		}

		data->type = QSEECOM_CLIENT_APP;

		data->type = QSEECOM_CLIENT_APP;

		pr_debug("LOAD_APP_REQ: qseecom_addr = 0x%p\n", data);

		pr_debug("LOAD_APP_REQ: qseecom_addr = 0x%pK\n", data);

		mutex_lock(&app_access_lock);

		mutex_lock(&app_access_lock);

		atomic_inc(&data->ioctl_count);

		atomic_inc(&data->ioctl_count);

		ret = qseecom_load_app(data, argp);

		ret = qseecom_load_app(data, argp);
@@ -6412,7 +6412,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) 
			ret = -EINVAL;

			ret = -EINVAL;

			break;

			break;

		}

		}

		pr_debug("UNLOAD_APP: qseecom_addr = 0x%p\n", data);

		pr_debug("UNLOAD_APP: qseecom_addr = 0x%pK\n", data);

		mutex_lock(&app_access_lock);

		mutex_lock(&app_access_lock);

		atomic_inc(&data->ioctl_count);

		atomic_inc(&data->ioctl_count);

		ret = qseecom_unload_app(data, false);

		ret = qseecom_unload_app(data, false);
@@ -6543,7 +6543,7 @@ long qseecom_ioctl(struct file *file, unsigned cmd, unsigned long arg) 
		data->type = QSEECOM_CLIENT_APP;

		data->type = QSEECOM_CLIENT_APP;

		mutex_lock(&app_access_lock);

		mutex_lock(&app_access_lock);

		atomic_inc(&data->ioctl_count);

		atomic_inc(&data->ioctl_count);

		pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%p\n", data);

		pr_debug("APP_LOAD_QUERY: qseecom_addr = 0x%pK\n", data);

		ret = qseecom_query_app_loaded(data, argp);

		ret = qseecom_query_app_loaded(data, argp);

		atomic_dec(&data->ioctl_count);

		atomic_dec(&data->ioctl_count);

		mutex_unlock(&app_access_lock);

		mutex_unlock(&app_access_lock);
@@ -6862,7 +6862,7 @@ static int qseecom_release(struct inode *inode, struct file *file) 
	int ret = 0;

	int ret = 0;





	if (data->released == false) {

	if (data->released == false) {

		pr_debug("data: released=false, type=%d, mode=%d, data=0x%p\n",

		pr_debug("data: released=false, type=%d, mode=%d, data=0x%pK\n",

			data->type, data->mode, data);

			data->type, data->mode, data);

		switch (data->type) {

		switch (data->type) {

		case QSEECOM_LISTENER_SERVICE:

		case QSEECOM_LISTENER_SERVICE: