Commit 2f964780 authored by Vamsi Krishna Samavedam's avatar Vamsi Krishna Samavedam Committed by Greg Kroah-Hartman
Browse files

USB: core: replace %p with %pK 



Format specifier %p can leak kernel addresses while not valuing the
kptr_restrict system settings. When kptr_restrict is set to (1), kernel
pointers printed using the %pK format specifier will be replaced with
Zeros. Debugging Note : &pK prints only Zeros as address. If you need
actual address information, write 0 to kptr_restrict.

echo 0 > /proc/sys/kernel/kptr_restrict

[Found by poking around in a random vendor kernel tree, it would be nice
if someone would actually send these types of patches upstream - gkh]

Signed-off-by: default avatarVamsi Krishna Samavedam <vskrishn@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 628c2893

drivers/usb/core/devio.c

+7 −7
Original line number Diff line number Diff line
@@ -475,11 +475,11 @@ static void snoop_urb(struct usb_device *udev, 


	if (userurb) {		/* Async */

		if (when == SUBMIT)

			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "

			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "

					"length %u\n",

					userurb, ep, t, d, length);

		else

			dev_info(&udev->dev, "userurb %p, ep%d %s-%s, "

			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "

					"actual_length %u status %d\n",

					userurb, ep, t, d, length,

					timeout_or_status);
@@ -1895,7 +1895,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg) 
	if (as) {

		int retval;



		snoop(&ps->dev->dev, "reap %p\n", as->userurb);

		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);

		retval = processcompl(as, (void __user * __user *)arg);

		free_async(as);

		return retval;
@@ -1912,7 +1912,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg) 


	as = async_getcompleted(ps);

	if (as) {

		snoop(&ps->dev->dev, "reap %p\n", as->userurb);

		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);

		retval = processcompl(as, (void __user * __user *)arg);

		free_async(as);

	} else {
@@ -2043,7 +2043,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg) 
	if (as) {

		int retval;



		snoop(&ps->dev->dev, "reap %p\n", as->userurb);

		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);

		retval = processcompl_compat(as, (void __user * __user *)arg);

		free_async(as);

		return retval;
@@ -2060,7 +2060,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar 


	as = async_getcompleted(ps);

	if (as) {

		snoop(&ps->dev->dev, "reap %p\n", as->userurb);

		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);

		retval = processcompl_compat(as, (void __user * __user *)arg);

		free_async(as);

	} else {
@@ -2489,7 +2489,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd, 
#endif



	case USBDEVFS_DISCARDURB:

		snoop(&dev->dev, "%s: DISCARDURB %p\n", __func__, p);

		snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);

		ret = proc_unlinkurb(ps, p);

		break;

drivers/usb/core/hcd.c

+2 −2
Original line number Diff line number Diff line
@@ -1723,7 +1723,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) 
		if (retval == 0)

			retval = -EINPROGRESS;

		else if (retval != -EIDRM && retval != -EBUSY)

			dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n",

			dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n",

					urb, retval);

		usb_put_dev(udev);

	}
@@ -1890,7 +1890,7 @@ rescan: 
		/* kick hcd */

		unlink1(hcd, urb, -ESHUTDOWN);

		dev_dbg (hcd->self.controller,

			"shutdown urb %p ep%d%s%s\n",

			"shutdown urb %pK ep%d%s%s\n",

			urb, usb_endpoint_num(&ep->desc),

			is_in ? "in" : "out",

			({	char *s;

drivers/usb/core/urb.c

+1 −1
Original line number Diff line number Diff line
@@ -338,7 +338,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) 
	if (!urb || !urb->complete)

		return -EINVAL;

	if (urb->hcpriv) {

		WARN_ONCE(1, "URB %p submitted while active\n", urb);

		WARN_ONCE(1, "URB %pK submitted while active\n", urb);

		return -EBUSY;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE