Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7db95aed authored by Manu Gautam's avatar Manu Gautam
Browse files

usb: dwc3: replace %p with %pK 



Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with 0's.
Debugging Note : &pK prints only Zeros as address. If you need actual
address information, write 0 to kptr_restrict.

echo 0 > /proc/sys/kernel/kptr_restrict

CRs-fixed: 10528497
Change-Id: Ib1f9a151e3cb186763541dc86cb5b67a7d739ece
Signed-off-by: default avatarManu Gautam <mgautam@codeaurora.org>
parent c30f3d4e

drivers/usb/dwc3/core.c

+1 −1
Original line number Diff line number Diff line
@@ -279,7 +279,7 @@ int dwc3_event_buffers_setup(struct dwc3 *dwc) 


	for (n = 0; n < dwc->num_event_buffers; n++) {

		evt = dwc->ev_buffs[n];

		dev_dbg(dwc->dev, "Event buf %p dma %08llx length %d\n",

		dev_dbg(dwc->dev, "Event buf %pK dma %08llx length %d\n",

				evt->buf, (unsigned long long) evt->dma,

				evt->length);

drivers/usb/dwc3/debugfs.c

+3 −3
Original line number Diff line number Diff line
@@ -673,7 +673,7 @@ static int dwc3_ep_req_list_show(struct seq_file *s, void *unused) 
		req = list_entry(ptr, struct dwc3_request, list);



		seq_printf(s,

			"req:0x%p len: %d sts: %d dma:0x%pa num_sgs: %d\n",

			"req:0x%pK len: %d sts: %d dma:0x%pKa num_sgs: %d\n",

			req, req->request.length, req->request.status,

			&req->request.dma, req->request.num_sgs);

	}
@@ -712,7 +712,7 @@ static int dwc3_ep_queued_req_show(struct seq_file *s, void *unused) 
		req = list_entry(ptr, struct dwc3_request, list);



		seq_printf(s,

			"req:0x%p len:%d sts:%d dma:%pa nsg:%d trb:0x%p\n",

			"req:0x%pK len:%d sts:%d dma:%pKa nsg:%d trb:0x%pK\n",

			req, req->request.length, req->request.status,

			&req->request.dma, req->request.num_sgs, req->trb);

	}
@@ -756,7 +756,7 @@ static int dwc3_ep_trbs_show(struct seq_file *s, void *unused) 
		dep->name, dep->flags, dep->free_slot, dep->busy_slot);

	for (j = 0; j < DWC3_TRB_NUM; j++) {

		trb = &dep->trb_pool[j];

		seq_printf(s, "trb:0x%p bph:0x%x bpl:0x%x size:0x%x ctrl: %x\n",

		seq_printf(s, "trb:0x%pK bph:0x%x bpl:0x%x size:0x%x ctrl: %x\n",

			trb, trb->bph, trb->bpl, trb->size, trb->ctrl);

	}

	spin_unlock_irqrestore(&dwc->lock, flags);

drivers/usb/dwc3/dwc3-msm.c

+6 −6
Original line number Diff line number Diff line 
/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved.

/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -691,7 +691,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, 
	spin_lock_irqsave(&dwc->lock, flags);

	if (!dep->endpoint.desc) {

		dev_err(mdwc->dev,

			"%s: trying to queue request %p to disabled ep %s\n",

			"%s: trying to queue request %pK to disabled ep %s\n",

			__func__, request, ep->name);

		spin_unlock_irqrestore(&dwc->lock, flags);

		return -EPERM;
@@ -728,7 +728,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, 


	if (dep->number == 0 || dep->number == 1) {

		dev_err(mdwc->dev,

			"%s: trying to queue dbm request %p to control ep %s\n",

			"%s: trying to queue dbm request %pK to control ep %s\n",

			__func__, request, ep->name);

		spin_unlock_irqrestore(&dwc->lock, flags);

		return -EPERM;
@@ -737,7 +737,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, 
	if (dep->busy_slot != dep->free_slot || !list_empty(&dep->request_list)

					 || !list_empty(&dep->req_queued)) {

		dev_err(mdwc->dev,

			"%s: trying to queue dbm request %p tp ep %s\n",

			"%s: trying to queue dbm request %pK tp ep %s\n",

			__func__, request, ep->name);

		spin_unlock_irqrestore(&dwc->lock, flags);

		return -EPERM;
@@ -760,7 +760,7 @@ static int dwc3_msm_ep_queue(struct usb_ep *ep, 
	list_add_tail(&req_complete->list_item, &mdwc->req_complete_list);

	request->complete = dwc3_msm_req_complete_func;



	dev_vdbg(dwc->dev, "%s: queing request %p to ep %s length %d\n",

	dev_vdbg(dwc->dev, "%s: queing request %pK to ep %s length %d\n",

			__func__, request, ep->name, request->length);

	size = dwc3_msm_read_reg(mdwc->base, DWC3_GEVNTSIZ(0));

	dbm_event_buffer_config(mdwc->dbm,
@@ -946,7 +946,7 @@ static void gsi_ring_in_db(struct usb_ep *ep, struct usb_gsi_request *request) 
		dev_dbg(mdwc->dev, "Failed to get GSI DBL address MSB\n");



	offset = dwc3_trb_dma_offset(dep, &dep->trb_pool[num_trbs-1]);

	dev_dbg(mdwc->dev, "Writing link TRB addr: %pa to %p (%x)\n",

	dev_dbg(mdwc->dev, "Writing link TRB addr: %pKa to %pK (%x)\n",

	&offset, gsi_dbl_address_lsb, dbl_lo_addr);



	writel_relaxed(offset, gsi_dbl_address_lsb);

drivers/usb/dwc3/dwc3-st.c

+1 −1
Original line number Diff line number Diff line
@@ -227,7 +227,7 @@ static int st_dwc3_probe(struct platform_device *pdev) 


	dwc3_data->syscfg_reg_off = res->start;



	dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n",

	dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n",

		 dwc3_data->glue_base, dwc3_data->syscfg_reg_off);



	dwc3_data->rstc_pwrdn = devm_reset_control_get(dev, "powerdown");

drivers/usb/dwc3/ep0.c

+2 −2
Original line number Diff line number Diff line
@@ -228,7 +228,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, 
	spin_lock_irqsave(&dwc->lock, flags);

	if (!dep->endpoint.desc) {

		dwc3_trace(trace_dwc3_ep0,

				"trying to queue request %p to disabled %s",

				"trying to queue request %pK to disabled %s",

				request, dep->name);

		ret = -ESHUTDOWN;

		goto out;
@@ -241,7 +241,7 @@ int dwc3_gadget_ep0_queue(struct usb_ep *ep, struct usb_request *request, 
	}



	dwc3_trace(trace_dwc3_ep0,

			"queueing request %p to %s length %d state '%s'",

			"queueing request %pK to %s length %d state '%s'",

			request, dep->name, request->length,

			dwc3_ep0_state_string(dwc->ep0state));