Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a214ef8 authored by Azam Sadiq Pasha Kapatrala Syed's avatar Azam Sadiq Pasha Kapatrala Syed Committed by Shubhraprakash Das
Browse files

msm: camera: Avoid exposing kernel addresses 



Usage of %p exposes the kernel addresses, an easy target to
kernel write vulnerabilities. With this patch currently
%pK prints only Zeros as address. If you need actual address
echo 0 > /proc/sys/kernel/kptr_restrict

CRs-Fixed: 987011
Change-Id: I6c79f82376936fc646b723872a96a6694fe47cd9
Signed-off-by: default avatarAzam Sadiq Pasha Kapatrala Syed <akapatra@codeaurora.org>
parent d1d953cf

drivers/media/platform/msm/camera_v2/common/cam_smmu_api.c

+16 −16
Original line number Diff line number Diff line
@@ -229,7 +229,7 @@ static void cam_smmu_print_list(int idx) 
	pr_err("index = %d ", idx);

	list_for_each_entry(mapping,

		&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {

		pr_err("ion_fd = %d, paddr= 0x%p, len = %u\n",

		pr_err("ion_fd = %d, paddr= 0x%pK, len = %u\n",

			 mapping->ion_fd, (void *)mapping->paddr,

			 (unsigned int)mapping->len);

	}
@@ -240,10 +240,10 @@ static void cam_smmu_print_table(void) 
	int i;



	for (i = 0; i < iommu_cb_set.cb_num; i++) {

		pr_err("i= %d, handle= %d, name_addr=%p\n", i,

		pr_err("i= %d, handle= %d, name_addr=%pK\n", i,

			   (int)iommu_cb_set.cb_info[i].handle,

			   (void *)iommu_cb_set.cb_info[i].name);

		pr_err("dev = %p ", iommu_cb_set.cb_info[i].dev);

		pr_err("dev = %pK ", iommu_cb_set.cb_info[i].dev);

	}

}
@@ -306,18 +306,18 @@ static void cam_smmu_check_vaddr_in_range(int idx, void *vaddr) 
		end_addr = (unsigned long)mapping->paddr + mapping->len;



		if (start_addr <= current_addr && current_addr < end_addr) {

			pr_err("Error: va %p is valid: range:%p-%p, fd = %d cb: %s\n",

			pr_err("Error: va %pK is valid: range:%pK-%pK, fd = %d cb: %s\n",

				vaddr, (void *)start_addr, (void *)end_addr,

				mapping->ion_fd,

				iommu_cb_set.cb_info[idx].name);

			return;

		} else {

			CDBG("va %p is not in this range: %p-%p, fd = %d\n",

			CDBG("va %pK is not in this range: %pK-%pK, fd = %d\n",

				vaddr, (void *)start_addr, (void *)end_addr,

				mapping->ion_fd);

		}

	}

	pr_err("Cannot find vaddr:%p in SMMU. %s uses invalid virtual address\n",

	pr_err("Cannot find vaddr:%pK in SMMU. %s uses invalid virtual address\n",

		vaddr, iommu_cb_set.cb_info[idx].name);

	return;

}
@@ -393,7 +393,7 @@ static int cam_smmu_iommu_fault_handler(struct iommu_domain *domain, 


	if (!token) {

		pr_err("Error: token is NULL\n");

		pr_err("Error: domain = %p, device = %p\n", domain, dev);

		pr_err("Error: domain = %pK, device = %pK\n", domain, dev);

		pr_err("iova = %lX, flags = %d\n", iova, flags);

		return 0;

	}
@@ -705,7 +705,7 @@ static void cam_smmu_clean_buffer_list(int idx) 


	list_for_each_entry_safe(mapping_info, temp,

			&iommu_cb_set.cb_info[idx].smmu_buf_list, list) {

		CDBG("Free mapping address %p, i = %d, fd = %d\n",

		CDBG("Free mapping address %pK, i = %d, fd = %d\n",

			 (void *)mapping_info->paddr, idx,

			mapping_info->ion_fd);
@@ -800,11 +800,11 @@ static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd, 
	}



	if (table->sgl) {

		CDBG("DMA buf: %p, device: %p, attach: %p, table: %p\n",

		CDBG("DMA buf: %pK, device: %pK, attach: %pK, table: %pK\n",

				(void *)buf,

				(void *)iommu_cb_set.cb_info[idx].dev,

				(void *)attach, (void *)table);

		CDBG("table sgl: %p, rc: %d, dma_address: 0x%x\n",

		CDBG("table sgl: %pK, rc: %d, dma_address: 0x%x\n",

				(void *)table->sgl, rc,

				(unsigned int)table->sgl->dma_address);

	} else {
@@ -838,7 +838,7 @@ static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd, 
		rc = -ENOSPC;

		goto err_unmap_sg;

	}

	CDBG("ion_fd = %d, dev = %p, paddr= %p, len = %u\n", ion_fd,

	CDBG("ion_fd = %d, dev = %pK, paddr= %pK, len = %u\n", ion_fd,

			(void *)iommu_cb_set.cb_info[idx].dev,

			(void *)*paddr_ptr, (unsigned int)*len_ptr);
@@ -862,10 +862,10 @@ static int cam_smmu_unmap_buf_and_remove_from_list( 
{

	if ((!mapping_info->buf) || (!mapping_info->table) ||

		(!mapping_info->attach)) {

		pr_err("Error: Invalid params dev = %p, table = %p",

		pr_err("Error: Invalid params dev = %pK, table = %pK",

			(void *)iommu_cb_set.cb_info[idx].dev,

			(void *)mapping_info->table);

		pr_err("Error:dma_buf = %p, attach = %p\n",

		pr_err("Error:dma_buf = %pK, attach = %pK\n",

			(void *)mapping_info->buf,

			(void *)mapping_info->attach);

		return -EINVAL;
@@ -989,7 +989,7 @@ static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx, 


	CDBG("%s: nents = %lu, idx = %d, virt_len  = %zx\n",

		__func__, nents, idx, virt_len);

	CDBG("%s: phys_len = %zx, iommu_dir = %d, virt_addr = %p\n",

	CDBG("%s: phys_len = %zx, iommu_dir = %d, virt_addr = %pK\n",

		__func__, phys_len, iommu_dir, virt_addr);



	/* This table will go inside the 'mapping' structure
@@ -1055,7 +1055,7 @@ static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx, 
	mapping_info->ref_count = 1;

	mapping_info->phys_len = phys_len;



	CDBG("%s: paddr = %p, len = %zx, phys_len = %zx",

	CDBG("%s: paddr = %pK, len = %zx, phys_len = %zx",

		__func__, (void *)mapping_info->paddr,

		mapping_info->len, mapping_info->phys_len);
@@ -1093,7 +1093,7 @@ static int cam_smmu_free_scratch_buffer_remove_from_list( 
		&iommu_cb_set.cb_info[idx].scratch_map;



	if (!mapping_info->table) {

		pr_err("Error: Invalid params: dev = %p, table = %p, ",

		pr_err("Error: Invalid params: dev = %pK, table = %pK, ",

				(void *)iommu_cb_set.cb_info[idx].dev,

				(void *)mapping_info->table);

		return -EINVAL;

drivers/media/platform/msm/camera_v2/common/cam_soc_api.c

+13 −13
Original line number Diff line number Diff line
@@ -165,7 +165,7 @@ int msm_camera_get_clk_info(struct platform_device *pdev, 
			rc = PTR_ERR((*clk_ptr)[i]);

			goto err4;

		}

		CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]);

		CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]);

	}



	devm_kfree(&pdev->dev, rates);
@@ -289,7 +289,7 @@ int msm_camera_get_clk_info_and_rates( 
			rc = PTR_ERR(clks[i]);

			goto err5;

		}

		CDBG("clk ptr[%d] :%p\n", i, clks[i]);

		CDBG("clk ptr[%d] :%pK\n", i, clks[i]);

	}

	*pclk_info = clk_info;

	*pclks = clks;
@@ -405,7 +405,7 @@ long msm_camera_clk_set_rate(struct device *dev, 
	if (!dev || !clk || (clk_rate < 0))

		return -EINVAL;



	CDBG("clk : %p, enable : %ld\n", clk, clk_rate);

	CDBG("clk : %pK, enable : %ld\n", clk, clk_rate);



	if (clk_rate > 0) {

		rate = clk_round_rate(clk, clk_rate);
@@ -436,7 +436,7 @@ int msm_camera_put_clk_info(struct platform_device *pdev, 
		if (clk_ptr[i] != NULL)

			devm_clk_put(&pdev->dev, (*clk_ptr)[i]);



		CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]);

		CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]);

	}

	devm_kfree(&pdev->dev, *clk_info);

	devm_kfree(&pdev->dev, *clk_ptr);
@@ -460,7 +460,7 @@ int msm_camera_put_clk_info_and_rates(struct platform_device *pdev, 
	for (i = cnt - 1; i >= 0; i--) {

		if (clk_ptr[i] != NULL)

			devm_clk_put(&pdev->dev, (*clk_ptr)[i]);

		CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]);

		CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]);

	}

	devm_kfree(&pdev->dev, *clk_info);

	devm_kfree(&pdev->dev, *clk_ptr);
@@ -531,7 +531,7 @@ int msm_camera_get_regulator_info(struct platform_device *pdev, 
			rc = -EINVAL;

			goto err1;

		}

		CDBG("vdd ptr[%d] :%p\n", i, tmp_reg[i].vdd);

		CDBG("vdd ptr[%d] :%pK\n", i, tmp_reg[i].vdd);

	}



	*num_reg = cnt;
@@ -607,7 +607,7 @@ void msm_camera_put_regulators(struct platform_device *pdev, 
	for (i = cnt - 1; i >= 0; i--) {

		if (vdd_info[i] && !IS_ERR_OR_NULL(vdd_info[i]->vdd))

			devm_regulator_put(vdd_info[i]->vdd);

			CDBG("vdd ptr[%d] :%p\n", i, vdd_info[i]->vdd);

			CDBG("vdd ptr[%d] :%pK\n", i, vdd_info[i]->vdd);

	}



	devm_kfree(&pdev->dev, *vdd_info);
@@ -646,7 +646,7 @@ int msm_camera_register_irq(struct platform_device *pdev, 
		rc = -EINVAL;

	}



	CDBG("Registered irq for %s[resource - %p]\n", irq_name, irq);

	CDBG("Registered irq for %s[resource - %pK]\n", irq_name, irq);



	return rc;

}
@@ -671,7 +671,7 @@ int msm_camera_register_threaded_irq(struct platform_device *pdev, 
		rc = -EINVAL;

	}



	CDBG("Registered irq for %s[resource - %p]\n", irq_name, irq);

	CDBG("Registered irq for %s[resource - %pK]\n", irq_name, irq);



	return rc;

}
@@ -703,7 +703,7 @@ int msm_camera_unregister_irq(struct platform_device *pdev, 
		return -EINVAL;

	}



	CDBG("Un Registering irq for [resource - %p]\n", irq);

	CDBG("Un Registering irq for [resource - %pK]\n", irq);

	devm_free_irq(&pdev->dev, irq->start, dev_id);



	return 0;
@@ -730,7 +730,7 @@ void __iomem *msm_camera_get_reg_base(struct platform_device *pdev, 
	}



	if (reserve_mem) {

		CDBG("device:%p, mem : %p, size : %d\n",

		CDBG("device:%pK, mem : %pK, size : %d\n",

			&pdev->dev, mem, (int)resource_size(mem));

		if (!devm_request_mem_region(&pdev->dev, mem->start,

			resource_size(mem),
@@ -749,7 +749,7 @@ void __iomem *msm_camera_get_reg_base(struct platform_device *pdev, 
		return NULL;

	}



	CDBG("base : %p\n", base);

	CDBG("base : %pK\n", base);

	return base;

}

EXPORT_SYMBOL(msm_camera_get_reg_base);
@@ -793,7 +793,7 @@ int msm_camera_put_reg_base(struct platform_device *pdev, 
		pr_err("err: mem resource %s not found\n", device_name);

		return -EINVAL;

	}

	CDBG("mem : %p, size : %d\n", mem, (int)resource_size(mem));

	CDBG("mem : %pK, size : %d\n", mem, (int)resource_size(mem));



	devm_iounmap(&pdev->dev, base);

	if (reserve_mem)

drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c

+13 −13
Original line number Diff line number Diff line
@@ -27,7 +27,7 @@ 


void msm_camera_io_w(u32 data, void __iomem *addr)

{

	CDBG("%s: 0x%p %08x\n", __func__,  (addr), (data));

	CDBG("%s: 0x%pK %08x\n", __func__,  (addr), (data));

	writel_relaxed((data), (addr));

}
@@ -43,7 +43,7 @@ int32_t msm_camera_io_w_block(const u32 *addr, void __iomem *base, 
		return -EINVAL;



	for (i = 0; i < len; i++) {

		CDBG("%s: len =%d val=%x base =%p\n", __func__,

		CDBG("%s: len =%d val=%x base =%pK\n", __func__,

			len, addr[i], base);

		writel_relaxed(addr[i], base);

	}
@@ -62,7 +62,7 @@ int32_t msm_camera_io_w_reg_block(const u32 *addr, void __iomem *base, 
		return -EINVAL;



	for (i = 0; i < len; i = i + 2) {

		CDBG("%s: len =%d val=%x base =%p reg=%x\n", __func__,

		CDBG("%s: len =%d val=%x base =%pK reg=%x\n", __func__,

			len, addr[i + 1], base,  addr[i]);

		writel_relaxed(addr[i + 1], base + addr[i]);

	}
@@ -71,7 +71,7 @@ int32_t msm_camera_io_w_reg_block(const u32 *addr, void __iomem *base, 


void msm_camera_io_w_mb(u32 data, void __iomem *addr)

{

	CDBG("%s: 0x%p %08x\n", __func__,  (addr), (data));

	CDBG("%s: 0x%pK %08x\n", __func__,  (addr), (data));

	/* ensure write is done */

	wmb();

	writel_relaxed((data), (addr));
@@ -89,7 +89,7 @@ int32_t msm_camera_io_w_mb_block(const u32 *addr, void __iomem *base, u32 len) 
	for (i = 0; i < len; i++) {

		/* ensure write is done */

		wmb();

		CDBG("%s: len =%d val=%x base =%p\n", __func__,

		CDBG("%s: len =%d val=%x base =%pK\n", __func__,

			len, addr[i], base);

		writel_relaxed(addr[i], base);

	}
@@ -102,7 +102,7 @@ u32 msm_camera_io_r(void __iomem *addr) 
{

	uint32_t data = readl_relaxed(addr);



	CDBG("%s: 0x%p %08x\n", __func__,  (addr), (data));

	CDBG("%s: 0x%pK %08x\n", __func__,  (addr), (data));

	return data;

}
@@ -114,7 +114,7 @@ u32 msm_camera_io_r_mb(void __iomem *addr) 
	data = readl_relaxed(addr);

	/* ensure read is done */

	rmb();

	CDBG("%s: 0x%p %08x\n", __func__,  (addr), (data));

	CDBG("%s: 0x%pK %08x\n", __func__,  (addr), (data));

	return data;

}
@@ -180,7 +180,7 @@ void msm_camera_io_dump(void __iomem *addr, int size, int enable) 
	u32 *p = (u32 *) addr;

	u32 data;



	CDBG("%s: addr=%p size=%d\n", __func__, addr, size);

	CDBG("%s: addr=%pK size=%d\n", __func__, addr, size);



	if (!p || (size <= 0) || !enable)

		return;
@@ -216,12 +216,12 @@ void msm_camera_io_dump_wstring_base(void __iomem *addr, 
{

	int i, u = sizeof(struct msm_cam_dump_string_info);



	pr_debug("%s: addr=%p data=%p size=%d u=%d, cnt=%d\n", __func__,

	pr_debug("%s: addr=%pK data=%pK size=%d u=%d, cnt=%d\n", __func__,

		addr, dump_data, size, u,

		(size/u));



	if (!addr || (size <= 0) || !dump_data) {

		pr_err("%s: addr=%p data=%p size=%d\n", __func__,

		pr_err("%s: addr=%pK data=%pK size=%d\n", __func__,

			addr, dump_data, size);

		return;

	}
@@ -233,7 +233,7 @@ void msm_camera_io_dump_wstring_base(void __iomem *addr, 
void msm_camera_io_memcpy(void __iomem *dest_addr,

	void __iomem *src_addr, u32 len)

{

	CDBG("%s: %p %p %d\n", __func__, dest_addr, src_addr, len);

	CDBG("%s: %pK %pK %d\n", __func__, dest_addr, src_addr, len);

	msm_camera_io_memcpy_toio(dest_addr, src_addr, len / 4);

}
@@ -728,7 +728,7 @@ int msm_camera_request_gpio_table(struct gpio *gpio_tbl, uint8_t size, 
	int rc = 0, i = 0, err = 0;



	if (!gpio_tbl || !size) {

		pr_err("%s:%d invalid gpio_tbl %p / size %d\n", __func__,

		pr_err("%s:%d invalid gpio_tbl %pK / size %d\n", __func__,

			__LINE__, gpio_tbl, size);

		return -EINVAL;

	}
@@ -772,7 +772,7 @@ int msm_camera_get_dt_reg_settings(struct device_node *of_node, 
	unsigned int cnt;



	if (!of_node || !dt_prop_name || !size || !reg_s) {

		pr_err("%s: Error invalid args %p:%p:%p:%p\n",

		pr_err("%s: Error invalid args %pK:%pK:%pK:%pK\n",

			__func__, size, reg_s, of_node, dt_prop_name);

		return -EINVAL;

	}

drivers/media/platform/msm/camera_v2/fd/msm_fd_hw.c

+1 −1
Original line number Diff line number Diff line
@@ -669,7 +669,7 @@ int32_t msm_fd_hw_set_dt_parms_by_name(struct msm_fd_device *fd, 
				dt_reg_settings[i + MSM_FD_REG_ADDR_OFFSET_IDX],

				dt_reg_settings[i + MSM_FD_REG_VALUE_IDX] &

				dt_reg_settings[i + MSM_FD_REG_MASK_IDX]);

			pr_debug("%s:%d] %p %08x\n", __func__, __LINE__,

			pr_debug("%s:%d] %pK %08x\n", __func__, __LINE__,

				fd->iomem_base[base_idx] +

				dt_reg_settings[i + MSM_FD_REG_ADDR_OFFSET_IDX],

				dt_reg_settings[i + MSM_FD_REG_VALUE_IDX] &

drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c

+4 −4
Original line number Diff line number Diff line
@@ -62,13 +62,13 @@ static int msm_buf_check_head_sanity(struct msm_isp_bufq *bufq) 
	}



	if (prev->next != &bufq->head) {

		pr_err("%s: Error! head prev->next is %p should be %p\n",

		pr_err("%s: Error! head prev->next is %pK should be %pK\n",

			__func__, prev->next, &bufq->head);

		return -EINVAL;

	}



	if (next->prev != &bufq->head) {

		pr_err("%s: Error! head next->prev is %p should be %p\n",

		pr_err("%s: Error! head next->prev is %pK should be %pK\n",

			__func__, next->prev, &bufq->head);

		return -EINVAL;

	}
@@ -228,7 +228,7 @@ static void msm_isp_unprepare_v4l2_buf( 
	struct msm_isp_bufq *bufq = NULL;



	if (!buf_mgr || !buf_info) {

		pr_err("%s: NULL ptr %p %p\n", __func__,

		pr_err("%s: NULL ptr %pK %pK\n", __func__,

			buf_mgr, buf_info);

		return;

	}
@@ -255,7 +255,7 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr, 
	int ret;



	if (!buf_mgr || !mapped_info) {

		pr_err_ratelimited("%s: %d] NULL ptr buf_mgr %p mapped_info %p\n",

		pr_err_ratelimited("%s: %d] NULL ptr buf_mgr %pK mapped_info %pK\n",

			__func__, __LINE__, buf_mgr, mapped_info);

		return -EINVAL;

	}