Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2dedf48b authored by Manoj Prabhu B's avatar Manoj Prabhu B
Browse files

diag: Fix possible kernel addresses leak 



This patch addresses kernel addresses leak by changing
the format specifier to adhere to the kptr_restrict system setting.

CRs-Fixed: 987013
Change-Id: I32649a26f54d96c56d80aa2a1bd5f5d9dd0dd9d3
Signed-off-by: default avatarManoj Prabhu B <bmanoj@codeaurora.org>
parent b0af7638

drivers/char/diag/diag_dci.c

+7 −7
Original line number Diff line number Diff line
@@ -411,7 +411,7 @@ static int diag_process_single_dci_pkt(unsigned char *buf, int len, 
	uint8_t cmd_code = 0;



	if (!buf || len < 0) {

		pr_err("diag: Invalid input in %s, buf: %p, len: %d\n",

		pr_err("diag: Invalid input in %s, buf: %pK, len: %d\n",

			__func__, buf, len);

		return -EIO;

	}
@@ -759,7 +759,7 @@ static int diag_dci_remove_req_entry(unsigned char *buf, int len, 
{

	uint16_t rsp_count = 0, delayed_rsp_id = 0;

	if (!buf || len <= 0 || !entry) {

		pr_err("diag: In %s, invalid input buf: %p, len: %d, entry: %p\n",

		pr_err("diag: In %s, invalid input buf: %pK, len: %d, entry: %pK\n",

			__func__, buf, len, entry);

		return -EIO;

	}
@@ -813,7 +813,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) 
	int peripheral_mask, status;



	if (!buf || (len < sizeof(struct diag_ctrl_dci_status))) {

		pr_err("diag: In %s, invalid buf %p or length: %d\n",

		pr_err("diag: In %s, invalid buf %pK or length: %d\n",

		       __func__, buf, len);

		return;

	}
@@ -1941,7 +1941,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) 
			mutex_unlock(&driver->dci_mutex);

			return -ENOMEM;

		}

		pr_debug("diag: head of dci log mask %p\n", head_log_mask_ptr);

		pr_debug("diag: head of dci log mask %pK\n", head_log_mask_ptr);

		count = 0; /* iterator for extracting log codes */



		while (count < num_codes) {
@@ -1971,7 +1971,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) 
			while (log_mask_ptr && (offset < DCI_LOG_MASK_SIZE)) {

				if (*log_mask_ptr == equip_id) {

					found = 1;

					pr_debug("diag: find equip id = %x at %p\n",

					pr_debug("diag: find equip id = %x at %pK\n",

						 equip_id, log_mask_ptr);

					break;

				} else {
@@ -2055,7 +2055,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) 
			mutex_unlock(&driver->dci_mutex);

			return -ENOMEM;

		}

		pr_debug("diag: head of dci event mask %p\n", event_mask_ptr);

		pr_debug("diag: head of dci event mask %pK\n", event_mask_ptr);

		count = 0; /* iterator for extracting log codes */

		while (count < num_codes) {

			if (read_len >= USER_SPACE_DATA) {
@@ -2944,7 +2944,7 @@ int diag_dci_write_proc(uint8_t peripheral, int pkt_type, char *buf, int len) 
	if (!buf || peripheral >= NUM_PERIPHERALS || len < 0 ||

	    !(driver->feature[PERIPHERAL_MODEM].rcvd_feature_mask)) {

		DIAG_LOG(DIAG_DEBUG_DCI,

			"buf: 0x%p, p: %d, len: %d, f_mask: %d\n",

			"buf: 0x%pK, p: %d, len: %d, f_mask: %d\n",

				buf, peripheral, len,

				driver->feature[peripheral].rcvd_feature_mask);

		return -EINVAL;

drivers/char/diag/diag_debugfs.c

+9 −9
Original line number Diff line number Diff line 
/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -428,7 +428,7 @@ static ssize_t diag_dbgfs_read_usbinfo(struct file *file, char __user *ubuf, 
		bytes_written = scnprintf(buf+bytes_in_buffer, bytes_remaining,

			"id: %d\n"

			"name: %s\n"

			"hdl: %p\n"

			"hdl: %pK\n"

			"connected: %d\n"

			"diag state: %d\n"

			"enabled: %d\n"
@@ -527,7 +527,7 @@ static ssize_t diag_dbgfs_read_smdinfo(struct file *file, char __user *ubuf, 
			bytes_written = scnprintf(buf+bytes_in_buffer,

				bytes_remaining,

				"name\t\t:\t%s\n"

				"hdl\t\t:\t%p\n"

				"hdl\t\t:\t%pK\n"

				"inited\t\t:\t%d\n"

				"opened\t\t:\t%d\n"

				"diag_state\t:\t%d\n"
@@ -633,7 +633,7 @@ static ssize_t diag_dbgfs_read_socketinfo(struct file *file, char __user *ubuf, 
			bytes_written = scnprintf(buf+bytes_in_buffer,

				bytes_remaining,

				"name\t\t:\t%s\n"

				"hdl\t\t:\t%p\n"

				"hdl\t\t:\t%pK\n"

				"inited\t\t:\t%d\n"

				"opened\t\t:\t%d\n"

				"diag_state\t:\t%d\n"
@@ -823,9 +823,9 @@ static ssize_t diag_dbgfs_read_mhiinfo(struct file *file, char __user *ubuf, 
			"bridge index: %s\n"

			"mempool: %s\n"

			"read ch opened: %d\n"

			"read ch hdl: %p\n"

			"read ch hdl: %pK\n"

			"write ch opened: %d\n"

			"write ch hdl: %p\n"

			"write ch hdl: %pK\n"

			"read work pending: %d\n"

			"read done work pending: %d\n"

			"open work pending: %d\n"
@@ -900,9 +900,9 @@ static ssize_t diag_dbgfs_read_bridge(struct file *file, char __user *ubuf, 
			"type: %d\n"

			"inited: %d\n"

			"ctxt: %d\n"

			"dev_ops: %p\n"

			"dci_read_buf: %p\n"

			"dci_read_ptr: %p\n"

			"dev_ops: %pK\n"

			"dci_read_buf: %pK\n"

			"dci_read_ptr: %pK\n"

			"dci_read_len: %d\n\n",

			info->id,

			info->name,

drivers/char/diag/diag_masks.c

+14 −14
Original line number Diff line number Diff line
@@ -397,7 +397,7 @@ static void diag_send_time_sync_update(uint8_t peripheral) 


	if (!driver->diagfwd_cntl[peripheral] ||

		!driver->diagfwd_cntl[peripheral]->ch_open) {

		pr_err("diag: In %s, control channel is not open, p: %d, %p\n",

		pr_err("diag: In %s, control channel is not open, p: %d, %pK\n",

			__func__, peripheral, driver->diagfwd_cntl[peripheral]);

		return;

	}
@@ -433,7 +433,7 @@ static void diag_send_feature_mask_update(uint8_t peripheral) 


	if (!driver->diagfwd_cntl[peripheral] ||

	    !driver->diagfwd_cntl[peripheral]->ch_open) {

		pr_err("diag: In %s, control channel is not open, p: %d, %p\n",

		pr_err("diag: In %s, control channel is not open, p: %d, %pK\n",

		       __func__, peripheral, driver->diagfwd_cntl[peripheral]);

		return;

	}
@@ -484,7 +484,7 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &msg_mask : info->msg_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -530,7 +530,7 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, 
	struct diag_msg_build_mask_t rsp;



	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n",

		       __func__, src_buf, src_len, dest_buf, dest_len);

		return -EINVAL;

	}
@@ -587,7 +587,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &msg_mask : info->msg_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -645,7 +645,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &msg_mask : info->msg_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -758,7 +758,7 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &msg_mask : info->msg_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -811,7 +811,7 @@ static int diag_cmd_get_event_mask(unsigned char *src_buf, int src_len, 
	struct diag_event_mask_config_t rsp;



	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n",

		       __func__, src_buf, src_len, dest_buf, dest_len);

		return -EINVAL;

	}
@@ -853,7 +853,7 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &event_mask : info->event_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -909,7 +909,7 @@ static int diag_cmd_toggle_events(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &event_mask : info->event_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -964,7 +964,7 @@ static int diag_cmd_get_log_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &log_mask : info->log_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -1046,7 +1046,7 @@ static int diag_cmd_get_log_range(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &log_mask : info->log_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -1090,7 +1090,7 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &log_mask : info->log_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;
@@ -1210,7 +1210,7 @@ static int diag_cmd_disable_log_mask(unsigned char *src_buf, int src_len, 
	mask_info = (!info) ? &log_mask : info->log_mask;

	if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 ||

	    !mask_info) {

		pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n",

		pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n",

		       __func__, src_buf, src_len, dest_buf, dest_len,

		       mask_info);

		return -EINVAL;

drivers/char/diag/diag_memorydevice.c

+1 −1
Original line number Diff line number Diff line
@@ -158,7 +158,7 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx) 
		if (ch->tbl[i].buf != buf)

			continue;

		found = 1;

		pr_err_ratelimited("diag: trying to write the same buffer buf: %p, ctxt: %d len: %d at i: %d back to the table, proc: %d, mode: %d\n",

		pr_err_ratelimited("diag: trying to write the same buffer buf: %pK, ctxt: %d len: %d at i: %d back to the table, proc: %d, mode: %d\n",

				   buf, ctx, ch->tbl[i].len,

				   i, id, driver->logging_mode);

	}

drivers/char/diag/diag_usb.c

+6 −5
Original line number Diff line number Diff line
@@ -132,7 +132,7 @@ static void diag_usb_buf_tbl_remove(struct diag_usb_info *usb_info, 
	list_for_each_safe(start, temp, &usb_info->buf_tbl) {

		entry = list_entry(start, struct diag_usb_buf_tbl_t, track);

		if (entry->buf == buf) {

			DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %p\n", buf);

			DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %pK\n", buf);

			atomic_dec(&entry->ref_count);

			/*

			 * Remove reference from the table if it is the
@@ -155,7 +155,7 @@ static struct diag_usb_buf_tbl_t *diag_usb_buf_tbl_get( 
	list_for_each_safe(start, temp, &usb_info->buf_tbl) {

		entry = list_entry(start, struct diag_usb_buf_tbl_t, track);

		if (entry->buf == buf) {

			DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %p\n", buf);

			DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %pK\n", buf);

			atomic_dec(&entry->ref_count);

			return entry;

		}
@@ -303,7 +303,7 @@ static void diag_usb_write_done(struct diag_usb_info *ch, 
	ch->write_cnt++;

	entry = diag_usb_buf_tbl_get(ch, req->context);

	if (!entry) {

		pr_err_ratelimited("diag: In %s, unable to find entry %p in the table\n",

		pr_err_ratelimited("diag: In %s, unable to find entry %pK in the table\n",

				   __func__, req->context);

		return;

	}
@@ -398,7 +398,7 @@ static int diag_usb_write_ext(struct diag_usb_info *usb_info, 
	struct diag_request *req = NULL;



	if (!usb_info || !buf || len <= 0) {

		pr_err_ratelimited("diag: In %s, usb_info: %p buf: %p, len: %d\n",

		pr_err_ratelimited("diag: In %s, usb_info: %pK buf: %pK, len: %d\n",

				   __func__, usb_info, buf, len);

		return -EINVAL;

	}
@@ -518,7 +518,8 @@ int diag_usb_write(int id, unsigned char *buf, int len, int ctxt) 


	spin_lock_irqsave(&usb_info->write_lock, flags);

	if (diag_usb_buf_tbl_add(usb_info, buf, len, ctxt)) {

		DIAG_LOG(DIAG_DEBUG_MUX, "ERR! unable to add buf %p to table\n",

		DIAG_LOG(DIAG_DEBUG_MUX,

					"ERR! unable to add buf %pK to table\n",

			 buf);

		diagmem_free(driver, req, usb_info->mempool);

		spin_unlock_irqrestore(&usb_info->write_lock, flags);