evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

msm: camera: Prevent info leak in kernel driver.

Browse source 
-Use %pK for kernel address to avoid the information leak.

CRs-Fixed: 2009672

Change-Id: Ib0631d5578aba033510babe4f43e2a63bb959747
Signed-off-by: Alok Kediya <kediya@codeaurora.org>
This commit is contained in:
Alok Kediya 2017-03-02 14:06:06 +05:30 • committed by Gerrit - the friendly Code Review server
parent 796d604a03
commit 6bbe19f38d
1 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
View file

@ -229,8 +229,8 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr,
mapped_info->paddr += accu_length; mapped_info->paddr += accu_length;
accu_length += qbuf_buf->planes[i].length; accu_length += qbuf_buf->planes[i].length;
CDBG("%s: plane: %d addr:%lu\n", CDBG("%s: plane: %d addr:%pK\n",
__func__, i, (unsigned long)mapped_info->paddr); __func__, i, (void *)mapped_info->paddr);
} }
buf_info->num_planes = qbuf_buf->num_planes; buf_info->num_planes = qbuf_buf->num_planes;
@ -312,8 +312,8 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr,
pr_err_ratelimited("%s: cannot map address", __func__); pr_err_ratelimited("%s: cannot map address", __func__);
goto smmu_map_error; goto smmu_map_error;
} }
CDBG("%s: addr:%lu\n", CDBG("%s: addr:%pK\n",
__func__, (unsigned long)mapped_info->paddr); __func__, (void *)mapped_info->paddr);
return rc; return rc;
smmu_map_error: smmu_map_error:
@ -1335,14 +1335,15 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
struct msm_isp_buffer *bufs = NULL; struct msm_isp_buffer *bufs = NULL;
uint32_t i = 0, j = 0, k = 0, rc = 0; uint32_t i = 0, j = 0, k = 0, rc = 0;
char *print_buf = NULL, temp_buf[100]; char *print_buf = NULL, temp_buf[100];
uint32_t start_addr = 0, end_addr = 0, print_buf_size = 2000; uint32_t print_buf_size = 2000;
unsigned long start_addr = 0, end_addr = 0;
int buf_addr_delta = -1; int buf_addr_delta = -1;
int temp_delta = 0; int temp_delta = 0;
uint32_t debug_stream_id = 0; uint32_t debug_stream_id = 0;
uint32_t debug_buf_idx = 0; uint32_t debug_buf_idx = 0;
uint32_t debug_buf_plane = 0; uint32_t debug_buf_plane = 0;
uint32_t debug_start_addr = 0; unsigned long debug_start_addr = 0;
uint32_t debug_end_addr = 0; unsigned long debug_end_addr = 0;
uint32_t debug_frame_id = 0; uint32_t debug_frame_id = 0;
enum msm_isp_buffer_state debug_state = MSM_ISP_BUFFER_STATE_UNUSED; enum msm_isp_buffer_state debug_state = MSM_ISP_BUFFER_STATE_UNUSED;
unsigned long flags; unsigned long flags;
@ -1401,8 +1402,8 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
debug_stream_id, debug_frame_id); debug_stream_id, debug_frame_id);
pr_err("%s: nearby buf index %d, plane %d, state %d\n", __func__, pr_err("%s: nearby buf index %d, plane %d, state %d\n", __func__,
debug_buf_idx, debug_buf_plane, debug_state); debug_buf_idx, debug_buf_plane, debug_state);
pr_err("%s: buf address 0x%x -- 0x%x\n", __func__, pr_err("%s: buf address %pK -- %pK\n", __func__,
debug_start_addr, debug_end_addr); (void *)debug_start_addr, (void *)debug_end_addr);
if (BUF_DEBUG_FULL) { if (BUF_DEBUG_FULL) {
print_buf = kzalloc(print_buf_size, GFP_ATOMIC); print_buf = kzalloc(print_buf_size, GFP_ATOMIC);
@ -1437,9 +1438,10 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
mapped_info[k].len; mapped_info[k].len;
snprintf(temp_buf, snprintf(temp_buf,
sizeof(temp_buf), sizeof(temp_buf),
" buf %d plane %d start_addr %x end_addr %x\n", " buf %d plane %d start_addr %pK end_addr %pK\n",
j, k, start_addr, j, k,
end_addr); (void *)start_addr,
(void *)end_addr);
strlcat(print_buf, temp_buf, strlcat(print_buf, temp_buf,
print_buf_size); print_buf_size);
} }