Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f76d0b7 authored by VijayaKumar T M's avatar VijayaKumar T M Committed by Gerrit - the friendly Code Review server
Browse files

msm: camera: Prevent info leak in kernel driver. 



-Use %pK for kernel address to avoid the information leak.

CRs-Fixed: 2009672
Change-Id: Ib0631d5578aba033510babe4f43e2a63bb959747
Signed-off-by: default avatarAlok Kediya <kediya@codeaurora.org>
Signed-off-by: default avatarVijayaKumar T M <vtmuni@codeaurora.org>
parent 293603c0

drivers/media/platform/msm/ais/isp/msm_buf_mgr.c

+14 −12
Original line number Diff line number Diff line
@@ -212,8 +212,8 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr, 
		mapped_info->paddr += accu_length;

		accu_length += qbuf_buf->planes[i].length;



		CDBG("%s: plane: %d addr:%lu\n",

			__func__, i, (unsigned long)mapped_info->paddr);

		CDBG("%s: plane: %d addr:%pK\n",

			__func__, i, (void *)mapped_info->paddr);



	}

	buf_info->num_planes = qbuf_buf->num_planes;
@@ -275,8 +275,8 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr, 
		pr_err_ratelimited("%s: cannot map address", __func__);

		goto smmu_map_error;

	}

	CDBG("%s: addr:%lu\n",

		__func__, (unsigned long)mapped_info->paddr);

	CDBG("%s: addr:%pK\n",

		__func__, (void *)mapped_info->paddr);



	return rc;

smmu_map_error:
@@ -1364,14 +1364,15 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
	struct msm_isp_buffer *bufs = NULL;

	uint32_t i = 0, j = 0, k = 0, rc = 0;

	char *print_buf = NULL, temp_buf[100];

	uint32_t start_addr = 0, end_addr = 0, print_buf_size = 2000;

	uint32_t print_buf_size = 2000;

	unsigned long start_addr = 0, end_addr = 0;

	int buf_addr_delta = -1;

	int temp_delta = 0;

	uint32_t debug_output_id = 0;

	uint32_t debug_buf_idx = 0;

	uint32_t debug_buf_plane = 0;

	uint32_t debug_start_addr = 0;

	uint32_t debug_end_addr = 0;

	unsigned long debug_start_addr = 0;

	unsigned long debug_end_addr = 0;

	uint32_t debug_frame_id = 0;

	enum msm_isp_buffer_state debug_state = MSM_ISP_BUFFER_STATE_UNUSED;

	unsigned long flags;
@@ -1430,8 +1431,8 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
		debug_output_id, debug_frame_id);

	pr_err("%s: nearby buf index %d, plane %d, state %d\n", __func__,

		debug_buf_idx, debug_buf_plane, debug_state);

	pr_err("%s: buf address 0x%x -- 0x%x\n", __func__,

		debug_start_addr, debug_end_addr);

	pr_err("%s: buf address %pK -- %pK\n", __func__,

		(void *)debug_start_addr, (void *)debug_end_addr);



	if (BUF_DEBUG_FULL) {

		print_buf = kzalloc(print_buf_size, GFP_ATOMIC);
@@ -1466,9 +1467,10 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
							mapped_info[k].len;

						snprintf(temp_buf,

							sizeof(temp_buf),

							" buf %d plane %d start_addr %x end_addr %x\n",

							j, k, start_addr,

							end_addr);

							" buf %d plane %d start_addr %pK end_addr %pK\n",

							j, k,

							(void *)start_addr,

							(void *)end_addr);

						strlcat(print_buf, temp_buf,

							print_buf_size);

					}

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+14 −12
Original line number Diff line number Diff line
@@ -213,8 +213,8 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr, 
		mapped_info->paddr += accu_length;

		accu_length += qbuf_buf->planes[i].length;



		CDBG("%s: plane: %d addr:%lu\n",

			__func__, i, (unsigned long)mapped_info->paddr);

		CDBG("%s: plane: %d addr:%pK\n",

			__func__, i, (void *)mapped_info->paddr);



	}

	buf_info->num_planes = qbuf_buf->num_planes;
@@ -283,8 +283,8 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr, 
		pr_err_ratelimited("%s: cannot map address", __func__);

		goto smmu_map_error;

	}

	CDBG("%s: addr:%lu\n",

		__func__, (unsigned long)mapped_info->paddr);

	CDBG("%s: addr:%pK\n",

		__func__, (void *)mapped_info->paddr);



	return rc;

smmu_map_error:
@@ -1329,14 +1329,15 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
	struct msm_isp_buffer *bufs = NULL;

	uint32_t i = 0, j = 0, k = 0, rc = 0;

	char *print_buf = NULL, temp_buf[100];

	uint32_t start_addr = 0, end_addr = 0, print_buf_size = 2000;

	uint32_t print_buf_size = 2000;

	unsigned long start_addr = 0, end_addr = 0;

	int buf_addr_delta = -1;

	int temp_delta = 0;

	uint32_t debug_stream_id = 0;

	uint32_t debug_buf_idx = 0;

	uint32_t debug_buf_plane = 0;

	uint32_t debug_start_addr = 0;

	uint32_t debug_end_addr = 0;

	unsigned long debug_start_addr = 0;

	unsigned long debug_end_addr = 0;

	uint32_t debug_frame_id = 0;

	enum msm_isp_buffer_state debug_state = MSM_ISP_BUFFER_STATE_UNUSED;

	unsigned long flags;
@@ -1395,8 +1396,8 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
		debug_stream_id, debug_frame_id);

	pr_err("%s: nearby buf index %d, plane %d, state %d\n", __func__,

		debug_buf_idx, debug_buf_plane, debug_state);

	pr_err("%s: buf address 0x%x -- 0x%x\n", __func__,

		debug_start_addr, debug_end_addr);

	pr_err("%s: buf address %pK -- %pK\n", __func__,

		(void *)debug_start_addr, (void *)debug_end_addr);



	if (BUF_DEBUG_FULL) {

		print_buf = kzalloc(print_buf_size, GFP_ATOMIC);
@@ -1431,9 +1432,10 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr, 
							mapped_info[k].len;

						snprintf(temp_buf,

							sizeof(temp_buf),

							" buf %d plane %d start_addr %x end_addr %x\n",

							j, k, start_addr,

							end_addr);

							" buf %d plane %d start_addr %pK end_addr %pK\n",

							j, k,

							(void *)start_addr,

							(void *)end_addr);

						strlcat(print_buf, temp_buf,

							print_buf_size);

					}