evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: camera: Prevent info leak in kernel driver."

Browse source
This commit is contained in:
Linux Build Service Account 2017-03-11 10:08:10 -08:00 • committed by Gerrit - the friendly Code Review server
commit a2adda724d
1 changed files with 14 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c
View file

@ -229,8 +229,8 @@ static int msm_isp_prepare_v4l2_buf(struct msm_isp_buf_mgr *buf_mgr,
mapped_info->paddr += accu_length;
accu_length += qbuf_buf->planes[i].length;
CDBG("%s: plane: %d addr:%lu\n",
__func__, i, (unsigned long)mapped_info->paddr);
CDBG("%s: plane: %d addr:%pK\n",
__func__, i, (void *)mapped_info->paddr);
}
buf_info->num_planes = qbuf_buf->num_planes;
@ -312,8 +312,8 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr,
pr_err_ratelimited("%s: cannot map address", __func__);
goto smmu_map_error;
}
CDBG("%s: addr:%lu\n",
__func__, (unsigned long)mapped_info->paddr);
CDBG("%s: addr:%pK\n",
__func__, (void *)mapped_info->paddr);
return rc;
smmu_map_error:
@ -1336,14 +1336,15 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
struct msm_isp_buffer *bufs = NULL;
uint32_t i = 0, j = 0, k = 0, rc = 0;
char *print_buf = NULL, temp_buf[100];
uint32_t start_addr = 0, end_addr = 0, print_buf_size = 2000;
uint32_t print_buf_size = 2000;
unsigned long start_addr = 0, end_addr = 0;
int buf_addr_delta = -1;
int temp_delta = 0;
uint32_t debug_stream_id = 0;
uint32_t debug_buf_idx = 0;
uint32_t debug_buf_plane = 0;
uint32_t debug_start_addr = 0;
uint32_t debug_end_addr = 0;
unsigned long debug_start_addr = 0;
unsigned long debug_end_addr = 0;
uint32_t debug_frame_id = 0;
enum msm_isp_buffer_state debug_state = MSM_ISP_BUFFER_STATE_UNUSED;
unsigned long flags;
@ -1402,8 +1403,8 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
debug_stream_id, debug_frame_id);
pr_err("%s: nearby buf index %d, plane %d, state %d\n", __func__,
debug_buf_idx, debug_buf_plane, debug_state);
pr_err("%s: buf address 0x%x -- 0x%x\n", __func__,
debug_start_addr, debug_end_addr);
pr_err("%s: buf address %pK -- %pK\n", __func__,
(void *)debug_start_addr, (void *)debug_end_addr);
if (BUF_DEBUG_FULL) {
print_buf = kzalloc(print_buf_size, GFP_ATOMIC);
@ -1438,9 +1439,10 @@ static int msm_isp_buf_mgr_debug(struct msm_isp_buf_mgr *buf_mgr,
mapped_info[k].len;
snprintf(temp_buf,
sizeof(temp_buf),
" buf %d plane %d start_addr %x end_addr %x\n",
j, k, start_addr,
end_addr);
" buf %d plane %d start_addr %pK end_addr %pK\n",
j, k,
(void *)start_addr,
(void *)end_addr);
strlcat(print_buf, temp_buf,
print_buf_size);
}