releases/4.4.181/binder-replace-p-with-pk.patch

   1 From foo@baz Tue 04 Jun 2019 04:46:27 PM CEST
   2 From: Todd Kjos <tkjos@android.com>
   3 Date: Wed, 7 Feb 2018 13:57:37 -0800
   4 Subject: binder: replace "%p" with "%pK"
   5
   6 From: Todd Kjos <tkjos@android.com>
   7
   8 commit 8ca86f1639ec5890d400fff9211aca22d0a392eb upstream.
   9
  10 The format specifier "%p" can leak kernel addresses. Use
  11 "%pK" instead. There were 4 remaining cases in binder.c.
  12
  13 Signed-off-by: Todd Kjos <tkjos@google.com>
  14 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  15 [bwh: Backported to 4.4: adjust context]
  16 Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
  17 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  18 ---
  19  drivers/android/binder.c |    8 ++++----
  20  1 file changed, 4 insertions(+), 4 deletions(-)
  21
  22 --- a/drivers/android/binder.c
  23 +++ b/drivers/android/binder.c
  24 @@ -1249,7 +1249,7 @@ static void binder_transaction_buffer_re
  25         int debug_id = buffer->debug_id;
  26
  27         binder_debug(BINDER_DEBUG_TRANSACTION,
  28 -                    "%d buffer release %d, size %zd-%zd, failed at %p\n",
  29 +                    "%d buffer release %d, size %zd-%zd, failed at %pK\n",
  30                      proc->pid, buffer->debug_id,
  31                      buffer->data_size, buffer->offsets_size, failed_at);
  32
  33 @@ -2105,7 +2105,7 @@ static int binder_thread_write(struct bi
  34                                 }
  35                         }
  36                         binder_debug(BINDER_DEBUG_DEAD_BINDER,
  37 -                                    "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
  38 +                                    "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
  39                                      proc->pid, thread->pid, (u64)cookie,
  40                                      death);
  41                         if (death == NULL) {
  42 @@ -3249,7 +3249,7 @@ static void print_binder_transaction(str
  43                                      struct binder_transaction *t)
  44  {
  45         seq_printf(m,
  46 -                  "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
  47 +                  "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
  48                    prefix, t->debug_id, t,
  49                    t->from ? t->from->proc->pid : 0,
  50                    t->from ? t->from->pid : 0,
  51 @@ -3263,7 +3263,7 @@ static void print_binder_transaction(str
  52         if (t->buffer->target_node)
  53                 seq_printf(m, " node %d",
  54                            t->buffer->target_node->debug_id);
  55 -       seq_printf(m, " size %zd:%zd data %p\n",
  56 +       seq_printf(m, " size %zd:%zd data %pK\n",
  57                    t->buffer->data_size, t->buffer->offsets_size,
  58                    t->buffer->data);
  59  }