Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c17f3462 authored by Dibyendu Roy's avatar Dibyendu Roy
Browse files

Bluetooth: Replace %p with %pK 



The %pK restrictions are used to eliminate exposing kernel addresses.
When kptr_restrict is set to "0" there are no restrictions. When
kptr_restrict is set to "1", kernel pointers printed using the %pK
format specifier will be replaced with 0's unless the user has
CAP_SYSLOG. When kptr_restrict is set to "2", kernel pointers printed
using %pK will be replaced with 0's regardless of privileges.

Change-Id: Iacd8f7b7cdafed3a111507d3da899be9261ff09f
Signed-off-by: default avatarDibyendu Roy <dibyen@codeaurora.org>
parent 1c10389d

drivers/bluetooth/hci_h4.c

+4 −4
Original line number Diff line number Diff line
@@ -60,7 +60,7 @@ static int h4_open(struct hci_uart *hu) 
{

	struct h4_struct *h4;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	h4 = kzalloc(sizeof(*h4), GFP_KERNEL);

	if (!h4)
@@ -77,7 +77,7 @@ static int h4_flush(struct hci_uart *hu) 
{

	struct h4_struct *h4 = hu->priv;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	skb_queue_purge(&h4->txq);
@@ -91,7 +91,7 @@ static int h4_close(struct hci_uart *hu) 


	hu->priv = NULL;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	skb_queue_purge(&h4->txq);
@@ -108,7 +108,7 @@ static int h4_enqueue(struct hci_uart *hu, struct sk_buff *skb) 
{

	struct h4_struct *h4 = hu->priv;



	BT_DBG("hu %p skb %p", hu, skb);

	BT_DBG("hu %pK skb %pK", hu, skb);



	/* Prepend skb with frame type */

	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);

drivers/bluetooth/hci_ibs.c

+15 −15
Original line number Diff line number Diff line
@@ -226,7 +226,7 @@ static int send_hci_ibs_cmd(u8 cmd, struct hci_uart *hu) 
	struct ibs_struct *ibs = hu->priv;

	struct hci_ibs_cmd *hci_ibs_packet;



	BT_DBG("hu %p cmd 0x%x", hu, cmd);

	BT_DBG("hu %pK cmd 0x%x", hu, cmd);



	/* allocate packet */

	skb = bt_skb_alloc(1, GFP_ATOMIC);
@@ -254,7 +254,7 @@ static void ibs_wq_awake_device(struct work_struct *work) 
	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;

	unsigned long flags;



	BT_DBG(" %p ", hu);

	BT_DBG(" %pK ", hu);



	/* Vote for serial clock */

	ibs_msm_serial_clock_vote(HCI_IBS_TX_VOTE_CLOCK_ON, hu);
@@ -281,7 +281,7 @@ static void ibs_wq_awake_rx(struct work_struct *work) 
	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;

	unsigned long flags;



	BT_DBG(" %p ", hu);

	BT_DBG(" %pK ", hu);



	ibs_msm_serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_ON, hu);
@@ -309,7 +309,7 @@ static void ibs_wq_serial_rx_clock_vote_off(struct work_struct *work) 
					ws_rx_vote_off);

	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;



	BT_DBG(" %p ", hu);

	BT_DBG(" %pK ", hu);



	ibs_msm_serial_clock_vote(HCI_IBS_RX_VOTE_CLOCK_OFF, hu);
@@ -321,7 +321,7 @@ static void ibs_wq_serial_tx_clock_vote_off(struct work_struct *work) 
					ws_tx_vote_off);

	struct hci_uart *hu = (struct hci_uart *)ibs->ibs_hu;



	BT_DBG(" %p ", hu);

	BT_DBG(" %pK ", hu);



	hci_uart_tx_wakeup(hu);  /* run HCI tx handling unlocked */
@@ -337,7 +337,7 @@ static void hci_ibs_tx_idle_timeout(unsigned long arg) 
	struct ibs_struct *ibs = hu->priv;

	unsigned long flags;



	BT_DBG("hu %p idle timeout in %lu state", hu, ibs->tx_ibs_state);

	BT_DBG("hu %pK idle timeout in %lu state", hu, ibs->tx_ibs_state);



	spin_lock_irqsave_nested(&ibs->hci_ibs_lock,

					flags, SINGLE_DEPTH_NESTING);
@@ -371,7 +371,7 @@ static void hci_ibs_wake_retrans_timeout(unsigned long arg) 
	unsigned long flags;

	unsigned long retransmit = 0;



	BT_DBG("hu %p wake retransmit timeout in %lu state",

	BT_DBG("hu %pK wake retransmit timeout in %lu state",

		hu, ibs->tx_ibs_state);



	spin_lock_irqsave_nested(&ibs->hci_ibs_lock,
@@ -404,7 +404,7 @@ static int ibs_open(struct hci_uart *hu) 
{

	struct ibs_struct *ibs;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	ibs = kzalloc(sizeof(*ibs), GFP_ATOMIC);

	if (!ibs)
@@ -500,7 +500,7 @@ static int ibs_flush(struct hci_uart *hu) 
{

	struct ibs_struct *ibs = hu->priv;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	skb_queue_purge(&ibs->tx_wait_q);

	skb_queue_purge(&ibs->txq);
@@ -513,7 +513,7 @@ static int ibs_close(struct hci_uart *hu) 
{

	struct ibs_struct *ibs = hu->priv;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	skb_queue_purge(&ibs->tx_wait_q);

	skb_queue_purge(&ibs->txq);
@@ -542,7 +542,7 @@ static void ibs_device_want_to_wakeup(struct hci_uart *hu) 
	unsigned long flags;

	struct ibs_struct *ibs = hu->priv;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	/* lock hci_ibs state */

	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -591,7 +591,7 @@ static void ibs_device_want_to_sleep(struct hci_uart *hu) 
	unsigned long flags;

	struct ibs_struct *ibs = hu->priv;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	/* lock hci_ibs state */

	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -627,7 +627,7 @@ static void ibs_device_woke_up(struct hci_uart *hu) 
	struct ibs_struct *ibs = hu->priv;

	struct sk_buff *skb = NULL;



	BT_DBG("hu %p", hu);

	BT_DBG("hu %pK", hu);



	/* lock hci_ibs state */

	spin_lock_irqsave(&ibs->hci_ibs_lock, flags);
@@ -672,7 +672,7 @@ static int ibs_enqueue(struct hci_uart *hu, struct sk_buff *skb) 
	unsigned long flags = 0;

	struct ibs_struct *ibs = hu->priv;



	BT_DBG("hu %p skb %p", hu, skb);

	BT_DBG("hu %pK skb %pK", hu, skb);



	/* Prepend skb with frame type */

	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
@@ -752,7 +752,7 @@ static int ibs_recv(struct hci_uart *hu, void *data, int count) 
	struct hci_sco_hdr   *sh;

	register int len, type, dlen;



	BT_DBG("hu %p count %d rx_state %ld rx_count %ld",

	BT_DBG("hu %pK count %d rx_state %ld rx_count %ld",

			hu, count, ibs->rx_state, ibs->rx_count);



	ptr = data;

drivers/bluetooth/hci_ldisc.c

+6 −6
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ static void hci_uart_write_work(struct work_struct *work) 
	struct hci_dev *hdev = hu->hdev;

	struct sk_buff *skb;



	BT_DBG("hu %p hdev %p tty %p", hu, hdev, tty);

	BT_DBG("hu %pK hdev %pK tty %pK", hu, hdev, tty);



	/* REVISIT: should we cope with bad skbs or ->write() returning

	 * and error value ?
@@ -219,7 +219,7 @@ int hci_uart_init_ready(struct hci_uart *hu) 
/* Initialize device */

static int hci_uart_open(struct hci_dev *hdev)

{

	BT_DBG("%s %p", hdev->name, hdev);

	BT_DBG("%s %pK", hdev->name, hdev);



	/* Nothing to do for UART driver */
@@ -234,7 +234,7 @@ static int hci_uart_flush(struct hci_dev *hdev) 
	struct hci_uart *hu  = hci_get_drvdata(hdev);

	struct tty_struct *tty = hu->tty;



	BT_DBG("hdev %p tty %p", hdev, tty);

	BT_DBG("hdev %pK tty %pK", hdev, tty);



	if (hu->tx_skb) {

		kfree_skb(hu->tx_skb); hu->tx_skb = NULL;
@@ -253,7 +253,7 @@ static int hci_uart_flush(struct hci_dev *hdev) 
/* Close device */

static int hci_uart_close(struct hci_dev *hdev)

{

	BT_DBG("hdev %p", hdev);

	BT_DBG("hdev %pK", hdev);



	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))

		return 0;
@@ -294,7 +294,7 @@ static int hci_uart_tty_open(struct tty_struct *tty) 
{

	struct hci_uart *hu;



	BT_DBG("tty %p", tty);

	BT_DBG("tty %pK", tty);



	/* Error if the tty has no write op instead of leaving an exploitable

	   hole */
@@ -339,7 +339,7 @@ static void hci_uart_tty_close(struct tty_struct *tty) 
	struct hci_uart *hu = (void *)tty->disc_data;

	struct hci_dev *hdev;



	BT_DBG("tty %p", tty);

	BT_DBG("tty %pK", tty);



	/* Detach from the tty */

	tty->disc_data = NULL;

net/bluetooth/af_bluetooth.c

+9 −9
Original line number Diff line number Diff line
@@ -184,7 +184,7 @@ EXPORT_SYMBOL(bt_sock_unlink); 
 */

void bt_accept_enqueue(struct sock *parent, struct sock *sk)

{

	BT_DBG("parent %p, sk %p", parent, sk);

	BT_DBG("parent %pK, sk %pK", parent, sk);



	sock_hold(sk);

	bt_sk(sk)->parent = parent;
@@ -195,7 +195,7 @@ EXPORT_SYMBOL(bt_accept_enqueue); 


void bt_accept_unlink(struct sock *sk)

{

	BT_DBG("sk %p state %d", sk, sk->sk_state);

	BT_DBG("sk %pK state %d", sk, sk->sk_state);

	if (!bt_sk(sk)->parent)

		return;
@@ -214,7 +214,7 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock) 
	struct list_head *p, *n;

	struct sock *sk;



	BT_DBG("parent %p", parent);

	BT_DBG("parent %pK", parent);



	list_for_each_safe(p, n, &bt_sk(parent)->accept_q) {

		sk = (struct sock *) list_entry(p, struct bt_sock, accept_q);
@@ -247,7 +247,7 @@ int bt_sock_recvmsg(struct kiocb *iocb, struct socket *sock, 
	size_t copied;

	int err;



	BT_DBG("sock %p sk %p len %zu", sock, sk, len);

	BT_DBG("sock %pK sk %pK len %zu", sock, sk, len);



	if (flags & (MSG_OOB))

		return -EOPNOTSUPP;
@@ -322,7 +322,7 @@ int bt_sock_stream_recvmsg(struct kiocb *iocb, struct socket *sock, 
	if (flags & MSG_OOB)

		return -EOPNOTSUPP;



	BT_DBG("sk %p size %zu", sk, size);

	BT_DBG("sk %pK size %zu", sk, size);



	lock_sock(sk);
@@ -438,7 +438,7 @@ unsigned int bt_sock_poll(struct file *file, struct socket *sock, 
	struct sock *sk = sock->sk;

	unsigned int mask = 0;



	BT_DBG("sock %p, sk %p", sock, sk);

	BT_DBG("sock %pK, sk %pK", sock, sk);



	poll_wait(file, sk_sleep(sk), wait);
@@ -482,7 +482,7 @@ int bt_sock_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) 
	long amount;

	int err;



	BT_DBG("sk %p cmd %x arg %lx", sk, cmd, arg);

	BT_DBG("sk %pK cmd %x arg %lx", sk, cmd, arg);



	switch (cmd) {

	case TIOCOUTQ:
@@ -529,7 +529,7 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo) 
	DECLARE_WAITQUEUE(wait, current);

	int err = 0;



	BT_DBG("sk %p", sk);

	BT_DBG("sk %pK", sk);



	add_wait_queue(sk_sleep(sk), &wait);

	set_current_state(TASK_INTERRUPTIBLE);
@@ -566,7 +566,7 @@ int bt_sock_wait_ready(struct sock *sk, unsigned long flags) 
	unsigned long timeo;

	int err = 0;



	BT_DBG("sk %p", sk);

	BT_DBG("sk %pK", sk);



	timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);

net/bluetooth/bnep/core.c

+1 −1
Original line number Diff line number Diff line
@@ -394,7 +394,7 @@ static int bnep_tx_frame(struct bnep_session *s, struct sk_buff *skb) 
	int len = 0, il = 0;

	u8 type = 0;



	BT_DBG("skb %p dev %p type %d", skb, skb->dev, skb->pkt_type);

	BT_DBG("skb %pK dev %pK type %d", skb, skb->dev, skb->pkt_type);



	if (!skb->dev) {

		/* Control frame sent by us */