diff --git a/arch/arm64/kernel/vdso/vdso.S b/arch/arm64/kernel/vdso/vdso.S index 60c1db54b41a..82379a70ef03 100644 --- a/arch/arm64/kernel/vdso/vdso.S +++ b/arch/arm64/kernel/vdso/vdso.S @@ -21,9 +21,8 @@ #include #include - __PAGE_ALIGNED_DATA - .globl vdso_start, vdso_end + .section .rodata .balign PAGE_SIZE vdso_start: .incbin "arch/arm64/kernel/vdso/vdso.so" diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index b4e84e791631..c439a7dd13bd 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -411,7 +411,7 @@ static int diag_process_single_dci_pkt(unsigned char *buf, int len, uint8_t cmd_code = 0; if (!buf || len < 0) { - pr_err("diag: Invalid input in %s, buf: %p, len: %d\n", + pr_err("diag: Invalid input in %s, buf: %pK, len: %d\n", __func__, buf, len); return -EIO; } @@ -759,7 +759,7 @@ static int diag_dci_remove_req_entry(unsigned char *buf, int len, { uint16_t rsp_count = 0, delayed_rsp_id = 0; if (!buf || len <= 0 || !entry) { - pr_err("diag: In %s, invalid input buf: %p, len: %d, entry: %p\n", + pr_err("diag: In %s, invalid input buf: %pK, len: %d, entry: %pK\n", __func__, buf, len, entry); return -EIO; } @@ -813,7 +813,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) int peripheral_mask, status; if (!buf || (len < sizeof(struct diag_ctrl_dci_status))) { - pr_err("diag: In %s, invalid buf %p or length: %d\n", + pr_err("diag: In %s, invalid buf %pK or length: %d\n", __func__, buf, len); return; } @@ -1939,7 +1939,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) mutex_unlock(&driver->dci_mutex); return -ENOMEM; } - pr_debug("diag: head of dci log mask %p\n", head_log_mask_ptr); + pr_debug("diag: head of dci log mask %pK\n", head_log_mask_ptr); count = 0; /* iterator for extracting log codes */ while (count < num_codes) { @@ -1969,7 +1969,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) while (log_mask_ptr && (offset < DCI_LOG_MASK_SIZE)) { if (*log_mask_ptr == equip_id) { found = 1; - pr_debug("diag: find equip id = %x at %p\n", + pr_debug("diag: find equip id = %x at %pK\n", equip_id, log_mask_ptr); break; } else { @@ -2053,7 +2053,7 @@ int diag_process_dci_transaction(unsigned char *buf, int len) mutex_unlock(&driver->dci_mutex); return -ENOMEM; } - pr_debug("diag: head of dci event mask %p\n", event_mask_ptr); + pr_debug("diag: head of dci event mask %pK\n", event_mask_ptr); count = 0; /* iterator for extracting log codes */ while (count < num_codes) { if (read_len >= USER_SPACE_DATA) { @@ -2941,7 +2941,7 @@ int diag_dci_write_proc(uint8_t peripheral, int pkt_type, char *buf, int len) if (!buf || peripheral >= NUM_PERIPHERALS || len < 0 || !(driver->feature[PERIPHERAL_MODEM].rcvd_feature_mask)) { DIAG_LOG(DIAG_DEBUG_DCI, - "buf: 0x%p, p: %d, len: %d, f_mask: %d\n", + "buf: 0x%pK, p: %d, len: %d, f_mask: %d\n", buf, peripheral, len, driver->feature[PERIPHERAL_MODEM].rcvd_feature_mask); return -EINVAL; diff --git a/drivers/char/diag/diag_debugfs.c b/drivers/char/diag/diag_debugfs.c index bb73ee08d4b0..f5e4eba1e96b 100644 --- a/drivers/char/diag/diag_debugfs.c +++ b/drivers/char/diag/diag_debugfs.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -428,7 +428,7 @@ static ssize_t diag_dbgfs_read_usbinfo(struct file *file, char __user *ubuf, bytes_written = scnprintf(buf+bytes_in_buffer, bytes_remaining, "id: %d\n" "name: %s\n" - "hdl: %p\n" + "hdl: %pK\n" "connected: %d\n" "diag state: %d\n" "enabled: %d\n" @@ -527,7 +527,7 @@ static ssize_t diag_dbgfs_read_smdinfo(struct file *file, char __user *ubuf, bytes_written = scnprintf(buf+bytes_in_buffer, bytes_remaining, "name\t\t:\t%s\n" - "hdl\t\t:\t%p\n" + "hdl\t\t:\t%pK\n" "inited\t\t:\t%d\n" "opened\t\t:\t%d\n" "diag_state\t:\t%d\n" @@ -633,7 +633,7 @@ static ssize_t diag_dbgfs_read_socketinfo(struct file *file, char __user *ubuf, bytes_written = scnprintf(buf+bytes_in_buffer, bytes_remaining, "name\t\t:\t%s\n" - "hdl\t\t:\t%p\n" + "hdl\t\t:\t%pK\n" "inited\t\t:\t%d\n" "opened\t\t:\t%d\n" "diag_state\t:\t%d\n" @@ -823,9 +823,9 @@ static ssize_t diag_dbgfs_read_mhiinfo(struct file *file, char __user *ubuf, "bridge index: %s\n" "mempool: %s\n" "read ch opened: %d\n" - "read ch hdl: %p\n" + "read ch hdl: %pK\n" "write ch opened: %d\n" - "write ch hdl: %p\n" + "write ch hdl: %pK\n" "read work pending: %d\n" "read done work pending: %d\n" "open work pending: %d\n" @@ -900,9 +900,9 @@ static ssize_t diag_dbgfs_read_bridge(struct file *file, char __user *ubuf, "type: %d\n" "inited: %d\n" "ctxt: %d\n" - "dev_ops: %p\n" - "dci_read_buf: %p\n" - "dci_read_ptr: %p\n" + "dev_ops: %pK\n" + "dci_read_buf: %pK\n" + "dci_read_ptr: %pK\n" "dci_read_len: %d\n\n", info->id, info->name, diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index 53df7f41b7db..ccbe66cd9e7c 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -397,7 +397,7 @@ static void diag_send_time_sync_update(uint8_t peripheral) if (!driver->diagfwd_cntl[peripheral] || !driver->diagfwd_cntl[peripheral]->ch_open) { - pr_err("diag: In %s, control channel is not open, p: %d, %p\n", + pr_err("diag: In %s, control channel is not open, p: %d, %pK\n", __func__, peripheral, driver->diagfwd_cntl[peripheral]); return; } @@ -433,7 +433,7 @@ static void diag_send_feature_mask_update(uint8_t peripheral) if (!driver->diagfwd_cntl[peripheral] || !driver->diagfwd_cntl[peripheral]->ch_open) { - pr_err("diag: In %s, control channel is not open, p: %d, %p\n", + pr_err("diag: In %s, control channel is not open, p: %d, %pK\n", __func__, peripheral, driver->diagfwd_cntl[peripheral]); return; } @@ -484,7 +484,7 @@ static int diag_cmd_get_ssid_range(unsigned char *src_buf, int src_len, mask_info = (!info) ? &msg_mask : info->msg_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -530,7 +530,7 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, struct diag_msg_build_mask_t rsp; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; } @@ -587,7 +587,7 @@ static int diag_cmd_get_msg_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &msg_mask : info->msg_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -645,7 +645,7 @@ static int diag_cmd_set_msg_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &msg_mask : info->msg_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -758,7 +758,7 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &msg_mask : info->msg_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -811,7 +811,7 @@ static int diag_cmd_get_event_mask(unsigned char *src_buf, int src_len, struct diag_event_mask_config_t rsp; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; } @@ -853,7 +853,7 @@ static int diag_cmd_update_event_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &event_mask : info->event_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -909,7 +909,7 @@ static int diag_cmd_toggle_events(unsigned char *src_buf, int src_len, mask_info = (!info) ? &event_mask : info->event_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -964,7 +964,7 @@ static int diag_cmd_get_log_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &log_mask : info->log_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -1046,7 +1046,7 @@ static int diag_cmd_get_log_range(unsigned char *src_buf, int src_len, mask_info = (!info) ? &log_mask : info->log_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -1090,7 +1090,7 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &log_mask : info->log_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; @@ -1210,7 +1210,7 @@ static int diag_cmd_disable_log_mask(unsigned char *src_buf, int src_len, mask_info = (!info) ? &log_mask : info->log_mask; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || !mask_info) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d, mask_info: %p\n", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d, mask_info: %pK\n", __func__, src_buf, src_len, dest_buf, dest_len, mask_info); return -EINVAL; diff --git a/drivers/char/diag/diag_memorydevice.c b/drivers/char/diag/diag_memorydevice.c index d3afbcbc394c..b4153c196188 100755 --- a/drivers/char/diag/diag_memorydevice.c +++ b/drivers/char/diag/diag_memorydevice.c @@ -158,7 +158,7 @@ int diag_md_write(int id, unsigned char *buf, int len, int ctx) if (ch->tbl[i].buf != buf) continue; found = 1; - pr_err_ratelimited("diag: trying to write the same buffer buf: %p, ctxt: %d len: %d at i: %d back to the table, proc: %d, mode: %d\n", + pr_err_ratelimited("diag: trying to write the same buffer buf: %pK, ctxt: %d len: %d at i: %d back to the table, proc: %d, mode: %d\n", buf, ctx, ch->tbl[i].len, i, id, driver->logging_mode); } diff --git a/drivers/char/diag/diag_usb.c b/drivers/char/diag/diag_usb.c index 364e8c7e735c..e77c5055f732 100644 --- a/drivers/char/diag/diag_usb.c +++ b/drivers/char/diag/diag_usb.c @@ -132,7 +132,7 @@ static void diag_usb_buf_tbl_remove(struct diag_usb_info *usb_info, list_for_each_safe(start, temp, &usb_info->buf_tbl) { entry = list_entry(start, struct diag_usb_buf_tbl_t, track); if (entry->buf == buf) { - DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %p\n", buf); + DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %pK\n", buf); atomic_dec(&entry->ref_count); /* * Remove reference from the table if it is the @@ -155,7 +155,7 @@ static struct diag_usb_buf_tbl_t *diag_usb_buf_tbl_get( list_for_each_safe(start, temp, &usb_info->buf_tbl) { entry = list_entry(start, struct diag_usb_buf_tbl_t, track); if (entry->buf == buf) { - DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %p\n", buf); + DIAG_LOG(DIAG_DEBUG_MUX, "ref_count-- for %pK\n", buf); atomic_dec(&entry->ref_count); return entry; } @@ -303,7 +303,7 @@ static void diag_usb_write_done(struct diag_usb_info *ch, ch->write_cnt++; entry = diag_usb_buf_tbl_get(ch, req->context); if (!entry) { - pr_err_ratelimited("diag: In %s, unable to find entry %p in the table\n", + pr_err_ratelimited("diag: In %s, unable to find entry %pK in the table\n", __func__, req->context); return; } @@ -395,7 +395,7 @@ static int diag_usb_write_ext(struct diag_usb_info *usb_info, struct diag_request *req = NULL; if (!usb_info || !buf || len <= 0) { - pr_err_ratelimited("diag: In %s, usb_info: %p buf: %p, len: %d\n", + pr_err_ratelimited("diag: In %s, usb_info: %pK buf: %pK, len: %d\n", __func__, usb_info, buf, len); return -EINVAL; } @@ -515,7 +515,8 @@ int diag_usb_write(int id, unsigned char *buf, int len, int ctxt) spin_lock_irqsave(&usb_info->write_lock, flags); if (diag_usb_buf_tbl_add(usb_info, buf, len, ctxt)) { - DIAG_LOG(DIAG_DEBUG_MUX, "ERR! unable to add buf %p to table\n", + DIAG_LOG(DIAG_DEBUG_MUX, + "ERR! unable to add buf %pK to table\n", buf); diagmem_free(driver, req, usb_info->mempool); spin_unlock_irqrestore(&usb_info->write_lock, flags); diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index ce53e10090f3..ba3da25521d6 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -959,7 +959,7 @@ static int diag_process_userspace_remote(int proc, void *buf, int len) int bridge_index = proc - 1; if (!buf || len < 0) { - pr_err("diag: Invalid input in %s, buf: %p, len: %d\n", + pr_err("diag: Invalid input in %s, buf: %pK, len: %d\n", __func__, buf, len); return -EINVAL; } @@ -2163,7 +2163,7 @@ static int diag_process_apps_data_hdlc(unsigned char *buf, int len, const uint32_t max_encoded_size = ((2 * len) + 3); if (!buf || len <= 0) { - pr_err("diag: In %s, invalid buf: %p len: %d\n", + pr_err("diag: In %s, invalid buf: %pK len: %d\n", __func__, buf, len); return -EIO; } @@ -2282,7 +2282,7 @@ static int diag_process_apps_data_non_hdlc(unsigned char *buf, int len, const uint32_t max_pkt_size = sizeof(header) + len + 1; if (!buf || len <= 0) { - pr_err("diag: In %s, invalid buf: %p len: %d\n", + pr_err("diag: In %s, invalid buf: %pK len: %d\n", __func__, buf, len); return -EIO; } @@ -2353,7 +2353,7 @@ static int diag_user_process_dci_data(const char __user *buf, int len) unsigned char *user_space_data = NULL; if (!buf || len <= 0 || len > diag_mempools[mempool].itemsize) { - pr_err_ratelimited("diag: In %s, invalid buf %p len: %d\n", + pr_err_ratelimited("diag: In %s, invalid buf %pK len: %d\n", __func__, buf, len); return -EBADMSG; } @@ -2385,7 +2385,7 @@ static int diag_user_process_dci_apps_data(const char __user *buf, int len, unsigned char *user_space_data = NULL; if (!buf || len <= 0 || len > diag_mempools[mempool].itemsize) { - pr_err_ratelimited("diag: In %s, invalid buf %p len: %d\n", + pr_err_ratelimited("diag: In %s, invalid buf %pK len: %d\n", __func__, buf, len); return -EBADMSG; } @@ -2426,7 +2426,7 @@ static int diag_user_process_raw_data(const char __user *buf, int len) struct diag_md_session_t *info = NULL; if (!buf || len <= 0 || len > CALLBACK_BUF_SIZE) { - pr_err_ratelimited("diag: In %s, invalid buf %p len: %d\n", + pr_err_ratelimited("diag: In %s, invalid buf %pK len: %d\n", __func__, buf, len); return -EBADMSG; } @@ -2496,7 +2496,7 @@ static int diag_user_process_userspace_data(const char __user *buf, int len) uint8_t hdlc_disabled; if (!buf || len <= 0 || len > USER_SPACE_DATA) { - pr_err_ratelimited("diag: In %s, invalid buf %p len: %d\n", + pr_err_ratelimited("diag: In %s, invalid buf %pK len: %d\n", __func__, buf, len); return -EBADMSG; } @@ -2585,7 +2585,7 @@ static int diag_user_process_apps_data(const char __user *buf, int len, uint8_t hdlc_disabled; if (!buf || len <= 0 || len > DIAG_MAX_RSP_SIZE) { - pr_err_ratelimited("diag: In %s, invalid buf %p len: %d\n", + pr_err_ratelimited("diag: In %s, invalid buf %pK len: %d\n", __func__, buf, len); return -EBADMSG; } diff --git a/drivers/char/diag/diagfwd.c b/drivers/char/diag/diagfwd.c index 57c3047f685c..39088fc382e0 100755 --- a/drivers/char/diag/diagfwd.c +++ b/drivers/char/diag/diagfwd.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2008-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2008-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -406,7 +406,7 @@ void diag_update_pkt_buffer(unsigned char *buf, uint32_t len, int type) uint32_t max_len = 0; if (!buf || len == 0) { - pr_err("diag: In %s, Invalid ptr %p and length %d\n", + pr_err("diag: In %s, Invalid ptr %pK and length %d\n", __func__, buf, len); return; } @@ -525,7 +525,7 @@ int diag_process_stm_cmd(unsigned char *buf, unsigned char *dest_buf) int i; if (!buf || !dest_buf) { - pr_err("diag: Invalid pointers buf: %p, dest_buf %p in %s\n", + pr_err("diag: Invalid pointers buf: %pK, dest_buf %pK in %s\n", buf, dest_buf, __func__); return -EIO; } @@ -614,7 +614,7 @@ int diag_process_time_sync_query_cmd(unsigned char *src_buf, int src_len, struct diag_cmd_time_sync_query_rsp_t rsp; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; } @@ -641,7 +641,7 @@ int diag_process_time_sync_switch_cmd(unsigned char *src_buf, int src_len, int err = 0, write_len = 0; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; } @@ -713,7 +713,7 @@ int diag_cmd_log_on_demand(unsigned char *src_buf, int src_len, return 0; if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { - pr_err("diag: Invalid input in %s, src_buf: %p, src_len: %d, dest_buf: %p, dest_len: %d", + pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; } diff --git a/drivers/char/diag/diagfwd_bridge.c b/drivers/char/diag/diagfwd_bridge.c index 038740d42b95..701677b30a71 100644 --- a/drivers/char/diag/diagfwd_bridge.c +++ b/drivers/char/diag/diagfwd_bridge.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -142,7 +142,7 @@ int diagfwd_bridge_register(int id, int ctxt, struct diag_remote_dev_ops *ops) char wq_name[DIAG_BRIDGE_NAME_SZ + 10]; if (!ops) { - pr_err("diag: Invalid pointers ops: %p ctxt: %d\n", ops, ctxt); + pr_err("diag: Invalid pointers ops: %pK ctxt: %d\n", ops, ctxt); return -EINVAL; } diff --git a/drivers/char/diag/diagfwd_hsic.c b/drivers/char/diag/diagfwd_hsic.c index 987931fdc762..5fed1f88382d 100644 --- a/drivers/char/diag/diagfwd_hsic.c +++ b/drivers/char/diag/diagfwd_hsic.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2016 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -354,7 +354,7 @@ static int hsic_write(int id, unsigned char *buf, int len, int ctxt) return -EINVAL; } if (!buf || len <= 0) { - pr_err_ratelimited("diag: In %s, ch %d, invalid buf %p len %d\n", + pr_err_ratelimited("diag: In %s, ch %d, invalid buf %pK len %d\n", __func__, id, buf, len); return -EINVAL; } diff --git a/drivers/char/diag/diagfwd_mhi.c b/drivers/char/diag/diagfwd_mhi.c index a35d5c715840..b8ed216faaf6 100644 --- a/drivers/char/diag/diagfwd_mhi.c +++ b/drivers/char/diag/diagfwd_mhi.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -131,8 +131,6 @@ static int mhi_buf_tbl_add(struct diag_mhi_info *mhi_info, int type, item = kzalloc(sizeof(struct diag_mhi_buf_tbl_t), GFP_KERNEL); if (!item) { - pr_err_ratelimited("diag: In %s, unable to allocate new item for buf tbl, ch: %p, type: %d, buf: %p, len: %d\n", - __func__, ch, ch->type, buf, len); return -ENOMEM; } kmemleak_not_leak(item); @@ -185,7 +183,7 @@ static void mhi_buf_tbl_remove(struct diag_mhi_info *mhi_info, int type, spin_unlock_irqrestore(&ch->lock, flags); if (!found) { - pr_err_ratelimited("diag: In %s, unable to find buffer, ch: %p, type: %d, buf: %p\n", + pr_err_ratelimited("diag: In %s, unable to find buffer, ch: %pK, type: %d, buf: %pK\n", __func__, ch, ch->type, buf); } } @@ -398,7 +396,7 @@ static void mhi_read_done_work_fn(struct work_struct *work) if (!buf) break; DIAG_LOG(DIAG_DEBUG_BRIDGE, - "read from mhi port %d buf %p\n", + "read from mhi port %d buf %pK\n", mhi_info->id, buf); /* * The read buffers can come after the MHI channels are closed. @@ -444,7 +442,7 @@ static void mhi_read_work_fn(struct work_struct *work) goto fail; DIAG_LOG(DIAG_DEBUG_BRIDGE, - "queueing a read buf %p, ch: %s\n", + "queueing a read buf %pK, ch: %s\n", buf, mhi_info->name); spin_lock_irqsave(&read_ch->lock, flags); err = mhi_queue_xfer(read_ch->hdl, buf, DIAG_MDM_BUF_SIZE, @@ -488,7 +486,7 @@ static int mhi_write(int id, unsigned char *buf, int len, int ctxt) } if (!buf || len <= 0) { - pr_err("diag: In %s, ch %d, invalid buf %p len %d\n", + pr_err("diag: In %s, ch %d, invalid buf %pK len %d\n", __func__, id, buf, len); return -EINVAL; } @@ -515,7 +513,7 @@ static int mhi_write(int id, unsigned char *buf, int len, int ctxt) err = mhi_queue_xfer(ch->hdl, buf, len, mhi_flags); spin_unlock_irqrestore(&ch->lock, flags); if (err) { - pr_err_ratelimited("diag: In %s, cannot write to MHI channel %p, len %d, err: %d\n", + pr_err_ratelimited("diag: In %s, cannot write to MHI channel %pK, len %d, err: %d\n", __func__, diag_mhi[id].name, len, err); mhi_buf_tbl_remove(&diag_mhi[id], TYPE_MHI_WRITE_CH, buf, len); goto fail; diff --git a/drivers/char/diag/diagfwd_peripheral.c b/drivers/char/diag/diagfwd_peripheral.c index e9654375b8a8..c7877825ba46 100644 --- a/drivers/char/diag/diagfwd_peripheral.c +++ b/drivers/char/diag/diagfwd_peripheral.c @@ -254,7 +254,7 @@ static void diagfwd_data_read_done(struct diagfwd_info *fwd_info, temp_buf = fwd_info->buf_2; write_buf = fwd_info->buf_2->data; } else { - pr_err("diag: In %s, no match for buffer %p, peripheral %d, type: %d\n", + pr_err("diag: In %s, no match for buffer %pK, peripheral %d, type: %d\n", __func__, buf, fwd_info->peripheral, fwd_info->type); goto end; @@ -268,7 +268,7 @@ static void diagfwd_data_read_done(struct diagfwd_info *fwd_info, fwd_info->buf_2->data_raw == buf) { temp_buf = fwd_info->buf_2; } else { - pr_err("diag: In %s, no match for non encode buffer %p, peripheral %d, type: %d\n", + pr_err("diag: In %s, no match for non encode buffer %pK, peripheral %d, type: %d\n", __func__, buf, fwd_info->peripheral, fwd_info->type); goto end; @@ -288,7 +288,7 @@ static void diagfwd_data_read_done(struct diagfwd_info *fwd_info, fwd_info->buf_2->data_raw == buf) { temp_buf = fwd_info->buf_2; } else { - pr_err("diag: In %s, no match for non encode buffer %p, peripheral %d, type: %d\n", + pr_err("diag: In %s, no match for non encode buffer %pK, peripheral %d, type: %d\n", __func__, buf, fwd_info->peripheral, fwd_info->type); goto end; @@ -945,7 +945,7 @@ void diagfwd_channel_read(struct diagfwd_info *fwd_info) if (!(fwd_info->p_ops && fwd_info->p_ops->read && fwd_info->ctxt)) goto fail_return; - DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "issued a read p: %d t: %d buf: %p\n", + DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "issued a read p: %d t: %d buf: %pK\n", fwd_info->peripheral, fwd_info->type, read_buf); err = fwd_info->p_ops->read(fwd_info->ctxt, read_buf, read_len); if (err) diff --git a/drivers/char/diag/diagfwd_smd.c b/drivers/char/diag/diagfwd_smd.c index 3686cf6fcc52..3ee21101e2f2 100644 --- a/drivers/char/diag/diagfwd_smd.c +++ b/drivers/char/diag/diagfwd_smd.c @@ -438,7 +438,7 @@ void diag_smd_invalidate(void *ctxt, struct diagfwd_info *fwd_ctxt) smd_info = (struct diag_smd_info *)ctxt; prev = smd_info->fwd_ctxt; smd_info->fwd_ctxt = fwd_ctxt; - DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "%s prev: %p fwd_ctxt: %p\n", + DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "%s prev: %pK fwd_ctxt: %pK\n", smd_info->name, prev, smd_info->fwd_ctxt); } @@ -467,7 +467,7 @@ static void __diag_smd_init(struct diag_smd_info *smd_info) atomic_set(&smd_info->opened, 0); atomic_set(&smd_info->diag_state, 0); - DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "%s initialized fwd_ctxt: %p\n", + DIAG_LOG(DIAG_DEBUG_PERIPHERALS, "%s initialized fwd_ctxt: %pK\n", smd_info->name, smd_info->fwd_ctxt); } @@ -599,7 +599,7 @@ static int diag_smd_write_ext(struct diag_smd_info *smd_info, uint8_t avail = 0; if (!smd_info || !buf || len <= 0) { - pr_err_ratelimited("diag: In %s, invalid params, smd_info: %p, buf: %p, len: %d\n", + pr_err_ratelimited("diag: In %s, invalid params, smd_info: %pK, buf: %pK, len: %d\n", __func__, smd_info, buf, len); return -EINVAL; } @@ -671,7 +671,7 @@ static int diag_smd_write(void *ctxt, unsigned char *buf, int len) smd_info = (struct diag_smd_info *)ctxt; if (!smd_info || !buf || len <= 0) { - pr_err_ratelimited("diag: In %s, invalid params, smd_info: %p, buf: %p, len: %d\n", + pr_err_ratelimited("diag: In %s, invalid params, smd_info: %pK, buf: %pK, len: %d\n", __func__, smd_info, buf, len); return -EINVAL; } @@ -753,7 +753,7 @@ static int diag_smd_read(void *ctxt, unsigned char *buf, int buf_len) if (!smd_info->hdl || !atomic_read(&smd_info->opened)) { DIAG_LOG(DIAG_DEBUG_PERIPHERALS, - "%s stopping read, hdl: %p, opened: %d\n", + "%s stopping read, hdl: %pK, opened: %d\n", smd_info->name, smd_info->hdl, atomic_read(&smd_info->opened)); goto fail_return; diff --git a/drivers/char/diag/diagfwd_socket.c b/drivers/char/diag/diagfwd_socket.c index 0b8c1fa77305..58df832cbfc4 100644 --- a/drivers/char/diag/diagfwd_socket.c +++ b/drivers/char/diag/diagfwd_socket.c @@ -249,7 +249,7 @@ static void socket_data_ready(struct sock *sk_ptr) static void cntl_socket_data_ready(struct sock *sk_ptr) { if (!sk_ptr || !cntl_socket) { - pr_err_ratelimited("diag: In %s, invalid ptrs. sk_ptr: %p cntl_socket: %p\n", + pr_err_ratelimited("diag: In %s, invalid ptrs. sk_ptr: %pK cntl_socket: %pK\n", __func__, sk_ptr, cntl_socket); return; } diff --git a/drivers/coresight/coresight-csr.c b/drivers/coresight/coresight-csr.c index 390f8791386d..3f8f8771b0bf 100644 --- a/drivers/coresight/coresight-csr.c +++ b/drivers/coresight/coresight-csr.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2013, 2015 The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2013, 2015-2016 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -190,8 +190,6 @@ static int csr_probe(struct platform_device *pdev) drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL); if (!drvdata) return -ENOMEM; - /* Store the driver data pointer for use in exported functions */ - csrdrvdata = drvdata; drvdata->dev = &pdev->dev; platform_set_drvdata(pdev, drvdata); @@ -220,6 +218,9 @@ static int csr_probe(struct platform_device *pdev) if (IS_ERR(drvdata->csdev)) return PTR_ERR(drvdata->csdev); + /* Store the driver data pointer for use in exported functions */ + csrdrvdata = drvdata; + dev_info(dev, "CSR initialized\n"); return 0; } diff --git a/drivers/coresight/coresight-fuse.c b/drivers/coresight/coresight-fuse.c index 70e6136a55c5..f146dfb2b0fb 100644 --- a/drivers/coresight/coresight-fuse.c +++ b/drivers/coresight/coresight-fuse.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -303,8 +303,6 @@ static int fuse_probe(struct platform_device *pdev) drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL); if (!drvdata) return -ENOMEM; - /* Store the driver data pointer for use in exported functions */ - fusedrvdata = drvdata; drvdata->dev = &pdev->dev; platform_set_drvdata(pdev, drvdata); @@ -368,6 +366,9 @@ static int fuse_probe(struct platform_device *pdev) if (IS_ERR(drvdata->csdev)) return PTR_ERR(drvdata->csdev); + /* Store the driver data pointer for use in exported functions */ + fusedrvdata = drvdata; + dev_info(dev, "Fuse initialized\n"); return 0; } diff --git a/drivers/crypto/msm/qce.c b/drivers/crypto/msm/qce.c index 7ddbb1938400..4cf95b90a2df 100644 --- a/drivers/crypto/msm/qce.c +++ b/drivers/crypto/msm/qce.c @@ -1,6 +1,6 @@ /* Qualcomm Crypto Engine driver. * - * Copyright (c) 2010-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2010-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -1962,8 +1962,8 @@ int qce_aead_req(void *handle, struct qce_req *q_req) else q_req->cryptlen = areq->cryptlen - authsize; - if ((q_req->cryptlen > ULONG_MAX - ivsize) || - (q_req->cryptlen + ivsize > ULONG_MAX - areq->assoclen)) { + if ((q_req->cryptlen > UINT_MAX - ivsize) || + (q_req->cryptlen + ivsize > UINT_MAX - areq->assoclen)) { pr_err("Integer overflow on total aead req length.\n"); return -EINVAL; } diff --git a/drivers/crypto/msm/qcedev.c b/drivers/crypto/msm/qcedev.c index 51f50698e597..0aace3c42c03 100644 --- a/drivers/crypto/msm/qcedev.c +++ b/drivers/crypto/msm/qcedev.c @@ -1234,44 +1234,6 @@ static int qcedev_vbuf_ablk_cipher(struct qcedev_async_req *areq, struct qcedev_cipher_op_req *saved_req; struct qcedev_cipher_op_req *creq = &areq->cipher_op_req; - /* Verify Source Address's */ - for (i = 0; i < areq->cipher_op_req.entries; i++) - if (!access_ok(VERIFY_READ, - (void __user *)areq->cipher_op_req.vbuf.src[i].vaddr, - areq->cipher_op_req.vbuf.src[i].len)) - return -EFAULT; - - /* Verify Destination Address's */ - if (creq->in_place_op != 1) { - for (i = 0, total = 0; i < QCEDEV_MAX_BUFFERS; i++) { - if ((areq->cipher_op_req.vbuf.dst[i].vaddr != 0) && - (total < creq->data_len)) { - if (!access_ok(VERIFY_WRITE, - (void __user *)creq->vbuf.dst[i].vaddr, - creq->vbuf.dst[i].len)) { - pr_err("%s:DST WR_VERIFY err %d=0x%lx\n", - __func__, i, (uintptr_t) - creq->vbuf.dst[i].vaddr); - return -EFAULT; - } - total += creq->vbuf.dst[i].len; - } - } - } else { - for (i = 0, total = 0; i < creq->entries; i++) { - if (total < creq->data_len) { - if (!access_ok(VERIFY_WRITE, - (void __user *)creq->vbuf.src[i].vaddr, - creq->vbuf.src[i].len)) { - pr_err("%s:SRC WR_VERIFY err %d=0x%lx\n", - __func__, i, (uintptr_t) - creq->vbuf.src[i].vaddr); - return -EFAULT; - } - total += creq->vbuf.src[i].len; - } - } - } total = 0; if (areq->cipher_op_req.mode == QCEDEV_AES_MODE_CTR) @@ -1569,6 +1531,36 @@ static int qcedev_check_cipher_params(struct qcedev_cipher_op_req *req, __func__, total, req->data_len); goto error; } + /* Verify Source Address's */ + for (i = 0, total = 0; i < req->entries; i++) { + if (total < req->data_len) { + if (!access_ok(VERIFY_READ, + (void __user *)req->vbuf.src[i].vaddr, + req->vbuf.src[i].len)) { + pr_err("%s:SRC RD_VERIFY err %d=0x%lx\n", + __func__, i, (uintptr_t) + req->vbuf.src[i].vaddr); + goto error; + } + total += req->vbuf.src[i].len; + } + } + + /* Verify Destination Address's */ + for (i = 0, total = 0; i < QCEDEV_MAX_BUFFERS; i++) { + if ((req->vbuf.dst[i].vaddr != 0) && + (total < req->data_len)) { + if (!access_ok(VERIFY_WRITE, + (void __user *)req->vbuf.dst[i].vaddr, + req->vbuf.dst[i].len)) { + pr_err("%s:DST WR_VERIFY err %d=0x%lx\n", + __func__, i, (uintptr_t) + req->vbuf.dst[i].vaddr); + goto error; + } + total += req->vbuf.dst[i].len; + } + } return 0; error: return -EINVAL; diff --git a/drivers/crypto/msm/qcrypto.c b/drivers/crypto/msm/qcrypto.c index 8bdf9da4d654..16de1f790bd8 100644 --- a/drivers/crypto/msm/qcrypto.c +++ b/drivers/crypto/msm/qcrypto.c @@ -2260,12 +2260,12 @@ static int _qcrypto_process_aead(struct crypto_engine *pengine, * include assoicated data, ciphering data stream, * generated MAC, and CCM padding. */ - if ((MAX_ALIGN_SIZE * 2 > ULONG_MAX - req->assoclen) || + if ((MAX_ALIGN_SIZE * 2 > UINT_MAX - req->assoclen) || ((MAX_ALIGN_SIZE * 2 + req->assoclen) > - ULONG_MAX - qreq.ivsize) || + UINT_MAX - qreq.ivsize) || ((MAX_ALIGN_SIZE * 2 + req->assoclen + qreq.ivsize) - > ULONG_MAX - req->cryptlen)) { + > UINT_MAX - req->cryptlen)) { pr_err("Integer overflow on aead req length.\n"); return -EINVAL; } diff --git a/drivers/gpu/msm/kgsl_sharedmem.c b/drivers/gpu/msm/kgsl_sharedmem.c index 8f42cc2d3fd5..31254bcc601a 100644 --- a/drivers/gpu/msm/kgsl_sharedmem.c +++ b/drivers/gpu/msm/kgsl_sharedmem.c @@ -621,12 +621,11 @@ int kgsl_cache_range_op(struct kgsl_memdesc *memdesc, uint64_t offset, void *addr = (memdesc->hostptr) ? memdesc->hostptr : (void *) memdesc->useraddr; - /* Make sure that size is non-zero */ - if (!size) + if (size == 0 || size > UINT_MAX) return -EINVAL; - /* Make sure that the offset + size isn't bigger than we can handle */ - if ((offset + size) > ULONG_MAX) + /* Make sure that the offset + size does not overflow */ + if ((offset + size < offset) || (offset + size < size)) return -ERANGE; /* Make sure the offset + size do not overflow the address */ @@ -914,8 +913,8 @@ kgsl_sharedmem_readl(const struct kgsl_memdesc *memdesc, if (offsetbytes % sizeof(uint32_t) != 0) return -EINVAL; - WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size); - if (offsetbytes + sizeof(uint32_t) > memdesc->size) + WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t))); + if (offsetbytes > (memdesc->size - sizeof(uint32_t))) return -ERANGE; rmb(); @@ -937,8 +936,8 @@ kgsl_sharedmem_writel(struct kgsl_device *device, if (offsetbytes % sizeof(uint32_t) != 0) return -EINVAL; - WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size); - if (offsetbytes + sizeof(uint32_t) > memdesc->size) + WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t))); + if (offsetbytes > (memdesc->size - sizeof(uint32_t))) return -ERANGE; kgsl_cffdump_write(device, memdesc->gpuaddr + offsetbytes, @@ -963,8 +962,8 @@ kgsl_sharedmem_readq(const struct kgsl_memdesc *memdesc, if (offsetbytes % sizeof(uint32_t) != 0) return -EINVAL; - WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size); - if (offsetbytes + sizeof(uint32_t) > memdesc->size) + WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t))); + if (offsetbytes > (memdesc->size - sizeof(uint32_t))) return -ERANGE; /* @@ -990,8 +989,8 @@ kgsl_sharedmem_writeq(struct kgsl_device *device, if (offsetbytes % sizeof(uint32_t) != 0) return -EINVAL; - WARN_ON(offsetbytes + sizeof(uint32_t) > memdesc->size); - if (offsetbytes + sizeof(uint32_t) > memdesc->size) + WARN_ON(offsetbytes > (memdesc->size - sizeof(uint32_t))); + if (offsetbytes > (memdesc->size - sizeof(uint32_t))) return -ERANGE; kgsl_cffdump_write(device, lower_32_bits(memdesc->gpuaddr + offsetbytes), src); diff --git a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c index 65335d994131..19900dc18272 100755 --- a/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c +++ b/drivers/input/touchscreen/synaptics_dsx/synaptics_dsx_fw_update.c @@ -3626,6 +3626,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file, int retval; struct synaptics_rmi4_data *rmi4_data = fwu->rmi4_data; + if (count > (fwu->image_size - fwu->data_pos)) { + dev_err(rmi4_data->pdev->dev.parent, + "%s: Not enough space in buffer\n", + __func__); + return -EINVAL; + } + retval = secure_memcpy(&fwu->ext_data_source[fwu->data_pos], fwu->image_size - fwu->data_pos, buf, count, count); if (retval < 0) { diff --git a/drivers/input/touchscreen/synaptics_fw_update.c b/drivers/input/touchscreen/synaptics_fw_update.c index f4abf16d2837..7ced02986e6f 100644 --- a/drivers/input/touchscreen/synaptics_fw_update.c +++ b/drivers/input/touchscreen/synaptics_fw_update.c @@ -1697,6 +1697,13 @@ static ssize_t fwu_sysfs_store_image(struct file *data_file, struct kobject *kobj, struct bin_attribute *attributes, char *buf, loff_t pos, size_t count) { + if (count > fwu->image_size - fwu->data_pos) { + dev_err(&fwu->rmi4_data->i2c_client->dev, + "%s: Not enough space in buffer\n", + __func__); + return -EINVAL; + } + memcpy((void *)(&fwu->ext_data_source[fwu->data_pos]), (const void *)buf, count); diff --git a/drivers/media/platform/msm/camera_v2/common/cam_smmu_api.c b/drivers/media/platform/msm/camera_v2/common/cam_smmu_api.c index 58583bb99374..0fe09bfe170f 100644 --- a/drivers/media/platform/msm/camera_v2/common/cam_smmu_api.c +++ b/drivers/media/platform/msm/camera_v2/common/cam_smmu_api.c @@ -229,7 +229,7 @@ static void cam_smmu_print_list(int idx) pr_err("index = %d ", idx); list_for_each_entry(mapping, &iommu_cb_set.cb_info[idx].smmu_buf_list, list) { - pr_err("ion_fd = %d, paddr= 0x%p, len = %u\n", + pr_err("ion_fd = %d, paddr= 0x%pK, len = %u\n", mapping->ion_fd, (void *)mapping->paddr, (unsigned int)mapping->len); } @@ -240,10 +240,10 @@ static void cam_smmu_print_table(void) int i; for (i = 0; i < iommu_cb_set.cb_num; i++) { - pr_err("i= %d, handle= %d, name_addr=%p\n", i, + pr_err("i= %d, handle= %d, name_addr=%pK\n", i, (int)iommu_cb_set.cb_info[i].handle, (void *)iommu_cb_set.cb_info[i].name); - pr_err("dev = %p ", iommu_cb_set.cb_info[i].dev); + pr_err("dev = %pK ", iommu_cb_set.cb_info[i].dev); } } @@ -306,18 +306,18 @@ static void cam_smmu_check_vaddr_in_range(int idx, void *vaddr) end_addr = (unsigned long)mapping->paddr + mapping->len; if (start_addr <= current_addr && current_addr < end_addr) { - pr_err("Error: va %p is valid: range:%p-%p, fd = %d cb: %s\n", + pr_err("Error: va %pK is valid: range:%pK-%pK, fd = %d cb: %s\n", vaddr, (void *)start_addr, (void *)end_addr, mapping->ion_fd, iommu_cb_set.cb_info[idx].name); return; } else { - CDBG("va %p is not in this range: %p-%p, fd = %d\n", + CDBG("va %pK is not in this range: %pK-%pK, fd = %d\n", vaddr, (void *)start_addr, (void *)end_addr, mapping->ion_fd); } } - pr_err("Cannot find vaddr:%p in SMMU. %s uses invalid virtual address\n", + pr_err("Cannot find vaddr:%pK in SMMU. %s uses invalid virtual address\n", vaddr, iommu_cb_set.cb_info[idx].name); return; } @@ -393,7 +393,7 @@ static int cam_smmu_iommu_fault_handler(struct iommu_domain *domain, if (!token) { pr_err("Error: token is NULL\n"); - pr_err("Error: domain = %p, device = %p\n", domain, dev); + pr_err("Error: domain = %pK, device = %pK\n", domain, dev); pr_err("iova = %lX, flags = %d\n", iova, flags); return 0; } @@ -705,7 +705,7 @@ static void cam_smmu_clean_buffer_list(int idx) list_for_each_entry_safe(mapping_info, temp, &iommu_cb_set.cb_info[idx].smmu_buf_list, list) { - CDBG("Free mapping address %p, i = %d, fd = %d\n", + CDBG("Free mapping address %pK, i = %d, fd = %d\n", (void *)mapping_info->paddr, idx, mapping_info->ion_fd); @@ -794,11 +794,11 @@ static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd, } if (table->sgl) { - CDBG("DMA buf: %p, device: %p, attach: %p, table: %p\n", + CDBG("DMA buf: %pK, device: %pK, attach: %pK, table: %pK\n", (void *)buf, (void *)iommu_cb_set.cb_info[idx].dev, (void *)attach, (void *)table); - CDBG("table sgl: %p, rc: %d, dma_address: 0x%x\n", + CDBG("table sgl: %pK, rc: %d, dma_address: 0x%x\n", (void *)table->sgl, rc, (unsigned int)table->sgl->dma_address); } else { @@ -832,7 +832,7 @@ static int cam_smmu_map_buffer_and_add_to_list(int idx, int ion_fd, rc = -ENOSPC; goto err_unmap_sg; } - CDBG("ion_fd = %d, dev = %p, paddr= %p, len = %u\n", ion_fd, + CDBG("ion_fd = %d, dev = %pK, paddr= %pK, len = %u\n", ion_fd, (void *)iommu_cb_set.cb_info[idx].dev, (void *)*paddr_ptr, (unsigned int)*len_ptr); @@ -856,10 +856,10 @@ static int cam_smmu_unmap_buf_and_remove_from_list( { if ((!mapping_info->buf) || (!mapping_info->table) || (!mapping_info->attach)) { - pr_err("Error: Invalid params dev = %p, table = %p", + pr_err("Error: Invalid params dev = %pK, table = %pK", (void *)iommu_cb_set.cb_info[idx].dev, (void *)mapping_info->table); - pr_err("Error:dma_buf = %p, attach = %p\n", + pr_err("Error:dma_buf = %pK, attach = %pK\n", (void *)mapping_info->buf, (void *)mapping_info->attach); return -EINVAL; @@ -983,7 +983,7 @@ static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx, CDBG("%s: nents = %lu, idx = %d, virt_len = %zx\n", __func__, nents, idx, virt_len); - CDBG("%s: phys_len = %zx, iommu_dir = %d, virt_addr = %p\n", + CDBG("%s: phys_len = %zx, iommu_dir = %d, virt_addr = %pK\n", __func__, phys_len, iommu_dir, virt_addr); /* This table will go inside the 'mapping' structure @@ -1049,7 +1049,7 @@ static int cam_smmu_alloc_scratch_buffer_add_to_list(int idx, mapping_info->ref_count = 1; mapping_info->phys_len = phys_len; - CDBG("%s: paddr = %p, len = %zx, phys_len = %zx", + CDBG("%s: paddr = %pK, len = %zx, phys_len = %zx", __func__, (void *)mapping_info->paddr, mapping_info->len, mapping_info->phys_len); @@ -1087,7 +1087,7 @@ static int cam_smmu_free_scratch_buffer_remove_from_list( &iommu_cb_set.cb_info[idx].scratch_map; if (!mapping_info->table) { - pr_err("Error: Invalid params: dev = %p, table = %p, ", + pr_err("Error: Invalid params: dev = %pK, table = %pK, ", (void *)iommu_cb_set.cb_info[idx].dev, (void *)mapping_info->table); return -EINVAL; diff --git a/drivers/media/platform/msm/camera_v2/common/cam_soc_api.c b/drivers/media/platform/msm/camera_v2/common/cam_soc_api.c index d3ef03691d12..9f518810dd7b 100644 --- a/drivers/media/platform/msm/camera_v2/common/cam_soc_api.c +++ b/drivers/media/platform/msm/camera_v2/common/cam_soc_api.c @@ -165,7 +165,7 @@ int msm_camera_get_clk_info(struct platform_device *pdev, rc = PTR_ERR((*clk_ptr)[i]); goto err4; } - CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]); + CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]); } devm_kfree(&pdev->dev, rates); @@ -289,7 +289,7 @@ int msm_camera_get_clk_info_and_rates( rc = PTR_ERR(clks[i]); goto err5; } - CDBG("clk ptr[%d] :%p\n", i, clks[i]); + CDBG("clk ptr[%d] :%pK\n", i, clks[i]); } *pclk_info = clk_info; *pclks = clks; @@ -435,7 +435,7 @@ int msm_camera_put_clk_info(struct platform_device *pdev, if (clk_ptr[i] != NULL) devm_clk_put(&pdev->dev, (*clk_ptr)[i]); - CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]); + CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]); } devm_kfree(&pdev->dev, *clk_info); devm_kfree(&pdev->dev, *clk_ptr); @@ -459,7 +459,7 @@ int msm_camera_put_clk_info_and_rates(struct platform_device *pdev, for (i = cnt - 1; i >= 0; i--) { if (clk_ptr[i] != NULL) devm_clk_put(&pdev->dev, (*clk_ptr)[i]); - CDBG("clk ptr[%d] :%p\n", i, (*clk_ptr)[i]); + CDBG("clk ptr[%d] :%pK\n", i, (*clk_ptr)[i]); } devm_kfree(&pdev->dev, *clk_info); devm_kfree(&pdev->dev, *clk_ptr); @@ -528,7 +528,7 @@ int msm_camera_get_regulator_info(struct platform_device *pdev, pr_err("Regulator phandle not found :%s\n", name); goto err1; } - CDBG("vdd ptr[%d] :%p\n", i, (*vdd)[i]); + CDBG("vdd ptr[%d] :%pK\n", i, (*vdd)[i]); } return 0; @@ -594,7 +594,7 @@ void msm_camera_put_regulators(struct platform_device *pdev, for (i = cnt - 1; i >= 0; i--) { if (!IS_ERR_OR_NULL((*vdd)[i])) devm_regulator_put((*vdd)[i]); - CDBG("vdd ptr[%d] :%p\n", i, (*vdd)[i]); + CDBG("vdd ptr[%d] :%pK\n", i, (*vdd)[i]); } devm_kfree(&pdev->dev, *vdd); @@ -633,7 +633,7 @@ int msm_camera_register_irq(struct platform_device *pdev, rc = -EINVAL; } - CDBG("Registered irq for %s[resource - %p]\n", irq_name, irq); + CDBG("Registered irq for %s[resource - %pK]\n", irq_name, irq); return rc; } @@ -659,7 +659,7 @@ int msm_camera_register_threaded_irq(struct platform_device *pdev, rc = -EINVAL; } - CDBG("Registered irq for %s[resource - %p]\n", irq_name, irq); + CDBG("Registered irq for %s[resource - %pK]\n", irq_name, irq); return rc; } @@ -691,7 +691,7 @@ int msm_camera_unregister_irq(struct platform_device *pdev, return -EINVAL; } - CDBG("Un Registering irq for [resource - %p]\n", irq); + CDBG("Un Registering irq for [resource - %pK]\n", irq); devm_free_irq(&pdev->dev, irq->start, dev_id); return 0; @@ -718,7 +718,7 @@ void __iomem *msm_camera_get_reg_base(struct platform_device *pdev, } if (reserve_mem) { - CDBG("device:%p, mem : %p, size : %d\n", + CDBG("device:%pK, mem : %pK, size : %d\n", &pdev->dev, mem, (int)resource_size(mem)); if (!devm_request_mem_region(&pdev->dev, mem->start, resource_size(mem), @@ -737,7 +737,7 @@ void __iomem *msm_camera_get_reg_base(struct platform_device *pdev, return NULL; } - CDBG("base : %p\n", base); + CDBG("base : %pK\n", base); return base; } EXPORT_SYMBOL(msm_camera_get_reg_base); @@ -781,7 +781,7 @@ int msm_camera_put_reg_base(struct platform_device *pdev, pr_err("err: mem resource %s not found\n", device_name); return -EINVAL; } - CDBG("mem : %p, size : %d\n", mem, (int)resource_size(mem)); + CDBG("mem : %pK, size : %d\n", mem, (int)resource_size(mem)); devm_iounmap(&pdev->dev, base); if (reserve_mem) diff --git a/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c b/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c index f978f97d7895..51a9ea85d1f3 100644 --- a/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c +++ b/drivers/media/platform/msm/camera_v2/common/msm_camera_io_util.c @@ -27,7 +27,7 @@ void msm_camera_io_w(u32 data, void __iomem *addr) { - CDBG("%s: 0x%p %08x\n", __func__, (addr), (data)); + CDBG("%s: 0x%pK %08x\n", __func__, (addr), (data)); writel_relaxed((data), (addr)); } @@ -43,7 +43,7 @@ int32_t msm_camera_io_w_block(const u32 *addr, void __iomem *base, return -EINVAL; for (i = 0; i < len; i++) { - CDBG("%s: len =%d val=%x base =%p\n", __func__, + CDBG("%s: len =%d val=%x base =%pK\n", __func__, len, addr[i], base); writel_relaxed(addr[i], base); } @@ -62,7 +62,7 @@ int32_t msm_camera_io_w_reg_block(const u32 *addr, void __iomem *base, return -EINVAL; for (i = 0; i < len; i = i + 2) { - CDBG("%s: len =%d val=%x base =%p reg=%x\n", __func__, + CDBG("%s: len =%d val=%x base =%pK reg=%x\n", __func__, len, addr[i + 1], base, addr[i]); writel_relaxed(addr[i + 1], base + addr[i]); } @@ -71,7 +71,7 @@ int32_t msm_camera_io_w_reg_block(const u32 *addr, void __iomem *base, void msm_camera_io_w_mb(u32 data, void __iomem *addr) { - CDBG("%s: 0x%p %08x\n", __func__, (addr), (data)); + CDBG("%s: 0x%pK %08x\n", __func__, (addr), (data)); /* ensure write is done */ wmb(); writel_relaxed((data), (addr)); @@ -89,7 +89,7 @@ int32_t msm_camera_io_w_mb_block(const u32 *addr, void __iomem *base, u32 len) for (i = 0; i < len; i++) { /* ensure write is done */ wmb(); - CDBG("%s: len =%d val=%x base =%p\n", __func__, + CDBG("%s: len =%d val=%x base =%pK\n", __func__, len, addr[i], base); writel_relaxed(addr[i], base); } @@ -102,7 +102,7 @@ u32 msm_camera_io_r(void __iomem *addr) { uint32_t data = readl_relaxed(addr); - CDBG("%s: 0x%p %08x\n", __func__, (addr), (data)); + CDBG("%s: 0x%pK %08x\n", __func__, (addr), (data)); return data; } @@ -114,7 +114,7 @@ u32 msm_camera_io_r_mb(void __iomem *addr) data = readl_relaxed(addr); /* ensure read is done */ rmb(); - CDBG("%s: 0x%p %08x\n", __func__, (addr), (data)); + CDBG("%s: 0x%pK %08x\n", __func__, (addr), (data)); return data; } @@ -180,7 +180,7 @@ void msm_camera_io_dump(void __iomem *addr, int size, int enable) u32 *p = (u32 *) addr; u32 data; - CDBG("%s: addr=%p size=%d\n", __func__, addr, size); + CDBG("%s: addr=%pK size=%d\n", __func__, addr, size); if (!p || (size <= 0) || !enable) return; @@ -216,12 +216,12 @@ void msm_camera_io_dump_wstring_base(void __iomem *addr, { int i, u = sizeof(struct msm_cam_dump_string_info); - pr_debug("%s: addr=%p data=%p size=%d u=%d, cnt=%d\n", __func__, + pr_debug("%s: addr=%pK data=%pK size=%d u=%d, cnt=%d\n", __func__, addr, dump_data, size, u, (size/u)); if (!addr || (size <= 0) || !dump_data) { - pr_err("%s: addr=%p data=%p size=%d\n", __func__, + pr_err("%s: addr=%pK data=%pK size=%d\n", __func__, addr, dump_data, size); return; } @@ -233,7 +233,7 @@ void msm_camera_io_dump_wstring_base(void __iomem *addr, void msm_camera_io_memcpy(void __iomem *dest_addr, void __iomem *src_addr, u32 len) { - CDBG("%s: %p %p %d\n", __func__, dest_addr, src_addr, len); + CDBG("%s: %pK %pK %d\n", __func__, dest_addr, src_addr, len); msm_camera_io_memcpy_toio(dest_addr, src_addr, len / 4); } @@ -728,7 +728,7 @@ int msm_camera_request_gpio_table(struct gpio *gpio_tbl, uint8_t size, int rc = 0, i = 0, err = 0; if (!gpio_tbl || !size) { - pr_err("%s:%d invalid gpio_tbl %p / size %d\n", __func__, + pr_err("%s:%d invalid gpio_tbl %pK / size %d\n", __func__, __LINE__, gpio_tbl, size); return -EINVAL; } @@ -772,7 +772,7 @@ int msm_camera_get_dt_reg_settings(struct device_node *of_node, unsigned int cnt; if (!of_node || !dt_prop_name || !size || !reg_s) { - pr_err("%s: Error invalid args %p:%p:%p:%p\n", + pr_err("%s: Error invalid args %pK:%pK:%pK:%pK\n", __func__, size, reg_s, of_node, dt_prop_name); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/fd/msm_fd_hw.c b/drivers/media/platform/msm/camera_v2/fd/msm_fd_hw.c index 3663979dcbd5..0ad3c1e895f9 100644 --- a/drivers/media/platform/msm/camera_v2/fd/msm_fd_hw.c +++ b/drivers/media/platform/msm/camera_v2/fd/msm_fd_hw.c @@ -661,7 +661,7 @@ int32_t msm_fd_hw_set_dt_parms_by_name(struct msm_fd_device *fd, dt_reg_settings[i + MSM_FD_REG_ADDR_OFFSET_IDX], dt_reg_settings[i + MSM_FD_REG_VALUE_IDX] & dt_reg_settings[i + MSM_FD_REG_MASK_IDX]); - pr_debug("%s:%d] %p %08x\n", __func__, __LINE__, + pr_debug("%s:%d] %pK %08x\n", __func__, __LINE__, fd->iomem_base[base_idx] + dt_reg_settings[i + MSM_FD_REG_ADDR_OFFSET_IDX], dt_reg_settings[i + MSM_FD_REG_VALUE_IDX] & diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c index 3d256168660e..c73916f6d5cd 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_buf_mgr.c @@ -64,13 +64,13 @@ static int msm_buf_check_head_sanity(struct msm_isp_bufq *bufq) } if (prev->next != &bufq->head) { - pr_err("%s: Error! head prev->next is %p should be %p\n", + pr_err("%s: Error! head prev->next is %pK should be %pK\n", __func__, prev->next, &bufq->head); return -EINVAL; } if (next->prev != &bufq->head) { - pr_err("%s: Error! head next->prev is %p should be %p\n", + pr_err("%s: Error! head next->prev is %pK should be %pK\n", __func__, next->prev, &bufq->head); return -EINVAL; } @@ -229,7 +229,7 @@ static void msm_isp_unprepare_v4l2_buf( struct msm_isp_bufq *bufq = NULL; if (!buf_mgr || !buf_info) { - pr_err("%s: NULL ptr %p %p\n", __func__, + pr_err("%s: NULL ptr %pK %pK\n", __func__, buf_mgr, buf_info); return; } @@ -256,7 +256,7 @@ static int msm_isp_map_buf(struct msm_isp_buf_mgr *buf_mgr, int ret; if (!buf_mgr || !mapped_info) { - pr_err_ratelimited("%s: %d] NULL ptr buf_mgr %p mapped_info %p\n", + pr_err_ratelimited("%s: %d] NULL ptr buf_mgr %pK mapped_info %pK\n", __func__, __LINE__, buf_mgr, mapped_info); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c index 4b5ae76ca21e..4fae2ffba8e9 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp46.c @@ -904,7 +904,7 @@ static int msm_vfe46_start_fetch_engine(struct vfe_device *vfe_dev, rc = vfe_dev->buf_mgr->ops->get_buf_by_index( vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf); if (rc < 0 || !buf) { - pr_err("%s: No fetch buffer rc= %d buf= %p\n", + pr_err("%s: No fetch buffer rc= %d buf= %pK\n", __func__, rc, buf); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c index 5d06fa348af2..fea920590506 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp47.c @@ -1041,7 +1041,7 @@ static int msm_vfe47_start_fetch_engine(struct vfe_device *vfe_dev, rc = vfe_dev->buf_mgr->ops->get_buf_by_index( vfe_dev->buf_mgr, bufq_handle, fe_cfg->buf_idx, &buf); if (rc < 0 || !buf) { - pr_err("%s: No fetch buffer rc= %d buf= %p\n", + pr_err("%s: No fetch buffer rc= %d buf= %pK\n", __func__, rc, buf); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c index e470a061765d..5a0d47e5e560 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c @@ -622,7 +622,7 @@ void msm_isp_check_for_output_error(struct vfe_device *vfe_dev, int i; if (!vfe_dev || !sof_info) { - pr_err("%s %d failed: vfe_dev %p sof_info %p\n", __func__, + pr_err("%s %d failed: vfe_dev %pK sof_info %pK\n", __func__, __LINE__, vfe_dev, sof_info); return; } @@ -1178,7 +1178,7 @@ static int msm_isp_axi_stream_enable_cfg( !dual_vfe_res->axi_data[ISP_VFE0] || !dual_vfe_res->vfe_base[ISP_VFE1] || !dual_vfe_res->axi_data[ISP_VFE1]) { - pr_err("%s:%d failed vfe0 %p %p vfe %p %p\n", + pr_err("%s:%d failed vfe0 %pK %pK vfe %pK %pK\n", __func__, __LINE__, dual_vfe_res->vfe_base[ISP_VFE0], dual_vfe_res->axi_data[ISP_VFE0], @@ -1553,7 +1553,7 @@ static int msm_isp_cfg_ping_pong_address(struct vfe_device *vfe_dev, !dual_vfe_res->axi_data[ISP_VFE0] || !dual_vfe_res->vfe_base[ISP_VFE1] || !dual_vfe_res->axi_data[ISP_VFE1]) { - pr_err("%s:%d failed vfe0 %p %p vfe %p %p\n", + pr_err("%s:%d failed vfe0 %pK %pK vfe %pK %pK\n", __func__, __LINE__, dual_vfe_res->vfe_base[ISP_VFE0], dual_vfe_res->axi_data[ISP_VFE0], @@ -2134,7 +2134,7 @@ int msm_isp_axi_reset(struct vfe_device *vfe_dev, unsigned long flags; if (!reset_cmd) { - pr_err("%s: NULL pointer reset cmd %p\n", __func__, reset_cmd); + pr_err("%s: NULL pointer reset cmd %pK\n", __func__, reset_cmd); rc = -1; return rc; } @@ -2757,7 +2757,7 @@ static int msm_isp_return_empty_buffer(struct vfe_device *vfe_dev, struct msm_isp_timestamp timestamp; if (!vfe_dev || !stream_info) { - pr_err("%s %d failed: vfe_dev %p stream_info %p\n", __func__, + pr_err("%s %d failed: vfe_dev %pK stream_info %pK\n", __func__, __LINE__, vfe_dev, stream_info); return -EINVAL; } @@ -2835,7 +2835,7 @@ static int msm_isp_request_frame(struct vfe_device *vfe_dev, bool dual_vfe = false; if (!vfe_dev || !stream_info) { - pr_err("%s %d failed: vfe_dev %p stream_info %p\n", __func__, + pr_err("%s %d failed: vfe_dev %pK stream_info %pK\n", __func__, __LINE__, vfe_dev, stream_info); return -EINVAL; } @@ -3475,7 +3475,7 @@ void msm_isp_axi_disable_all_wm(struct vfe_device *vfe_dev) int i, j; if (!vfe_dev || !axi_data) { - pr_err("%s: error %p %p\n", __func__, vfe_dev, axi_data); + pr_err("%s: error %pK %pK\n", __func__, vfe_dev, axi_data); return; } diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c index aa68293e70e8..2986ef360906 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_stats_util.c @@ -88,8 +88,9 @@ static int msm_isp_stats_cfg_ping_pong_address(struct vfe_device *vfe_dev, !dual_vfe_res->stats_data[ISP_VFE0] || !dual_vfe_res->vfe_base[ISP_VFE1] || !dual_vfe_res->stats_data[ISP_VFE1]) { - pr_err("%s:%d error vfe0 %p %p vfe1 %p %p\n", __func__, - __LINE__, dual_vfe_res->vfe_base[ISP_VFE0], + pr_err("%s:%d error vfe0 %pK %pK vfe1 %pK %pK\n", + __func__, __LINE__, + dual_vfe_res->vfe_base[ISP_VFE0], dual_vfe_res->stats_data[ISP_VFE0], dual_vfe_res->vfe_base[ISP_VFE1], dual_vfe_res->stats_data[ISP_VFE1]); @@ -156,7 +157,7 @@ static int32_t msm_isp_stats_buf_divert(struct vfe_device *vfe_dev, uint32_t stats_idx; if (!vfe_dev || !ts || !buf_event || !stream_info) { - pr_err("%s:%d failed: invalid params %p %p %p %p\n", + pr_err("%s:%d failed: invalid params %pK %pK %pK %pK\n", __func__, __LINE__, vfe_dev, ts, buf_event, stream_info); return -EINVAL; diff --git a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c index 4bd2460f907b..e17935580d67 100644 --- a/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c +++ b/drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c @@ -468,14 +468,14 @@ static int msm_isp_get_max_clk_rate(struct vfe_device *vfe_dev, long *rate) long round_rate = 0; if (!vfe_dev || !rate) { - pr_err("%s:%d failed: vfe_dev %p rate %p\n", __func__, __LINE__, - vfe_dev, rate); + pr_err("%s:%d failed: vfe_dev %pK rate %pK\n", __func__, + __LINE__, vfe_dev, rate); return -EINVAL; } *rate = 0; if (!vfe_dev->hw_info) { - pr_err("%s:%d failed: vfe_dev->hw_info %p\n", __func__, + pr_err("%s:%d failed: vfe_dev->hw_info %pK\n", __func__, __LINE__, vfe_dev->hw_info); return -EINVAL; } @@ -505,13 +505,13 @@ static int msm_isp_get_clk_rates(struct vfe_device *vfe_dev, int32_t rc = 0; uint32_t svs = 0, nominal = 0, turbo = 0; if (!vfe_dev || !rates) { - pr_err("%s:%d failed: vfe_dev %p rates %p\n", __func__, + pr_err("%s:%d failed: vfe_dev %pK rates %pK\n", __func__, __LINE__, vfe_dev, rates); return -EINVAL; } if (!vfe_dev->pdev) { - pr_err("%s:%d failed: vfe_dev->pdev %p\n", __func__, + pr_err("%s:%d failed: vfe_dev->pdev %pK\n", __func__, __LINE__, vfe_dev->pdev); return -EINVAL; } @@ -519,7 +519,7 @@ static int msm_isp_get_clk_rates(struct vfe_device *vfe_dev, of_node = vfe_dev->pdev->dev.of_node; if (!of_node) { - pr_err("%s %d failed: of_node = %p\n", __func__, + pr_err("%s %d failed: of_node = %pK\n", __func__, __LINE__, of_node); return -EINVAL; } @@ -730,7 +730,7 @@ static int msm_isp_set_dual_HW_master_slave_mode( unsigned long flags; if (!vfe_dev || !arg) { - pr_err("%s: Error! Invalid input vfe_dev %p arg %p\n", + pr_err("%s: Error! Invalid input vfe_dev %pK arg %pK\n", __func__, vfe_dev, arg); return -EINVAL; } @@ -816,7 +816,7 @@ static int msm_isp_proc_cmd_list_unlocked(struct vfe_device *vfe_dev, void *arg) struct msm_vfe_cfg_cmd_list cmd, cmd_next; if (!vfe_dev || !arg) { - pr_err("%s:%d failed: vfe_dev %p arg %p", __func__, __LINE__, + pr_err("%s:%d failed: vfe_dev %pK arg %pK", __func__, __LINE__, vfe_dev, arg); return -EINVAL; } @@ -886,7 +886,7 @@ static int msm_isp_proc_cmd_list_compat(struct vfe_device *vfe_dev, void *arg) struct msm_vfe_cfg_cmd2 current_cmd; if (!vfe_dev || !arg) { - pr_err("%s:%d failed: vfe_dev %p arg %p", __func__, __LINE__, + pr_err("%s:%d failed: vfe_dev %pK arg %pK", __func__, __LINE__, vfe_dev, arg); return -EINVAL; } @@ -942,10 +942,10 @@ static long msm_isp_ioctl_unlocked(struct v4l2_subdev *sd, struct vfe_device *vfe_dev = v4l2_get_subdevdata(sd); if (!vfe_dev || !vfe_dev->vfe_base) { - pr_err("%s:%d failed: invalid params %p\n", + pr_err("%s:%d failed: invalid params %pK\n", __func__, __LINE__, vfe_dev); if (vfe_dev) - pr_err("%s:%d failed %p\n", __func__, + pr_err("%s:%d failed %pK\n", __func__, __LINE__, vfe_dev->vfe_base); return -EINVAL; } @@ -1124,10 +1124,10 @@ static long msm_isp_ioctl_compat(struct v4l2_subdev *sd, long rc = 0; if (!vfe_dev || !vfe_dev->vfe_base) { - pr_err("%s:%d failed: invalid params %p\n", + pr_err("%s:%d failed: invalid params %pK\n", __func__, __LINE__, vfe_dev); if (vfe_dev) - pr_err("%s:%d failed %p\n", __func__, + pr_err("%s:%d failed %pK\n", __func__, __LINE__, vfe_dev->vfe_base); return -EINVAL; } @@ -1173,13 +1173,13 @@ static int msm_isp_send_hw_cmd(struct vfe_device *vfe_dev, uint32_t *cfg_data, uint32_t cmd_len) { if (!vfe_dev || !reg_cfg_cmd) { - pr_err("%s:%d failed: vfe_dev %p reg_cfg_cmd %p\n", __func__, + pr_err("%s:%d failed: vfe_dev %pK reg_cfg_cmd %pK\n", __func__, __LINE__, vfe_dev, reg_cfg_cmd); return -EINVAL; } if ((reg_cfg_cmd->cmd_type != VFE_CFG_MASK) && (!cfg_data || !cmd_len)) { - pr_err("%s:%d failed: cmd type %d cfg_data %p cmd_len %d\n", + pr_err("%s:%d failed: cmd type %d cfg_data %pK cmd_len %d\n", __func__, __LINE__, reg_cfg_cmd->cmd_type, cfg_data, cmd_len); return -EINVAL; @@ -1819,7 +1819,7 @@ static int msm_isp_process_iommu_page_fault(struct vfe_device *vfe_dev) { int rc = vfe_dev->buf_mgr->pagefault_debug_disable; - pr_err("%s:%d] VFE%d Handle Page fault! vfe_dev %p\n", __func__, + pr_err("%s:%d] VFE%d Handle Page fault! vfe_dev %pK\n", __func__, __LINE__, vfe_dev->pdev->id, vfe_dev); msm_isp_halt_send_error(vfe_dev, ISP_EVENT_IOMMU_P_FAULT); @@ -2009,7 +2009,7 @@ void msm_isp_do_tasklet(unsigned long data) uint32_t irq_status0, irq_status1; if (vfe_dev->vfe_base == NULL || vfe_dev->vfe_open_cnt == 0) { - ISP_DBG("%s: VFE%d open cnt = %d, device closed(base = %p)\n", + ISP_DBG("%s: VFE%d open cnt = %d, device closed(base = %pK)\n", __func__, vfe_dev->pdev->id, vfe_dev->vfe_open_cnt, vfe_dev->vfe_base); return; @@ -2079,7 +2079,7 @@ static void msm_vfe_iommu_fault_handler(struct iommu_domain *domain, vfe_dev->page_fault_addr = iova; if (!vfe_dev->buf_mgr || !vfe_dev->buf_mgr->ops || !vfe_dev->axi_data.num_active_stream) { - pr_err("%s:%d buf_mgr %p active strms %d\n", __func__, + pr_err("%s:%d buf_mgr %pK active strms %d\n", __func__, __LINE__, vfe_dev->buf_mgr, vfe_dev->axi_data.num_active_stream); goto end; @@ -2096,7 +2096,7 @@ static void msm_vfe_iommu_fault_handler(struct iommu_domain *domain, } mutex_unlock(&vfe_dev->core_mutex); } else { - ISP_DBG("%s:%d] no token received: %p\n", + ISP_DBG("%s:%d] no token received: %pK\n", __func__, __LINE__, token); goto end; } @@ -2126,7 +2126,7 @@ int msm_isp_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) } if (vfe_dev->vfe_base) { - pr_err("%s:%d invalid params cnt %d base %p\n", __func__, + pr_err("%s:%d invalid params cnt %d base %pK\n", __func__, __LINE__, vfe_dev->vfe_open_cnt, vfe_dev->vfe_base); vfe_dev->vfe_base = NULL; } diff --git a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c index 1837d946ff6d..6c756baf366c 100644 --- a/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c +++ b/drivers/media/platform/msm/camera_v2/ispif/msm_ispif.c @@ -1293,7 +1293,7 @@ static int msm_ispif_set_vfe_info(struct ispif_device *ispif, { if (!vfe_info || (vfe_info->num_vfe == 0) || (vfe_info->num_vfe > ispif->hw_num_isps)) { - pr_err("Invalid VFE info: %p %d\n", vfe_info, + pr_err("Invalid VFE info: %pK %d\n", vfe_info, (vfe_info ? vfe_info->num_vfe : 0)); return -EINVAL; } @@ -1328,7 +1328,7 @@ static int msm_ispif_init(struct ispif_device *ispif, if (ispif->csid_version >= CSID_VERSION_V30) { if (!ispif->clk_mux_mem || !ispif->clk_mux_io) { - pr_err("%s csi clk mux mem %p io %p\n", __func__, + pr_err("%s csi clk mux mem %pK io %pK\n", __func__, ispif->clk_mux_mem, ispif->clk_mux_io); rc = -ENOMEM; return rc; diff --git a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c index 9339029dbc0f..071ce0a41ed9 100644 --- a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c +++ b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_hw.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -805,7 +805,7 @@ void msm_jpeg_hw_write(struct msm_jpeg_hw_cmd *hw_cmd_p, new_data = hw_cmd_p->data & hw_cmd_p->mask; new_data |= old_data; - JPEG_DBG("%s:%d] %p %08x\n", __func__, __LINE__, + JPEG_DBG("%s:%d] %pK %08x\n", __func__, __LINE__, paddr, new_data); msm_camera_io_w(new_data, paddr); } @@ -908,7 +908,7 @@ void msm_jpeg_io_dump(void *base, int size) int i; u32 *p = (u32 *) addr; u32 data; - JPEG_DBG_HIGH("%s:%d] %p %d", __func__, __LINE__, addr, size); + JPEG_DBG_HIGH("%s:%d] %pK %d", __func__, __LINE__, addr, size); line_str[0] = '\0'; p_str = line_str; for (i = 0; i < size/4; i++) { diff --git a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_platform.c b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_platform.c index e076d356d112..266a5a6be2a2 100644 --- a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_platform.c +++ b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_platform.c @@ -210,7 +210,7 @@ static int32_t msm_jpeg_set_init_dt_parms(struct msm_jpeg_device *pgmn_dev, return -EINVAL; } for (i = 0; i < dt_count; i = i + 2) { - JPEG_DBG("%s:%d] %p %08x\n", + JPEG_DBG("%s:%d] %pK %08x\n", __func__, __LINE__, base + dt_reg_settings[i], dt_reg_settings[i + 1]); diff --git a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c index 2e2841aed1a2..d27f56a9ad65 100644 --- a/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c +++ b/drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c @@ -754,7 +754,7 @@ int __msm_jpeg_open(struct msm_jpeg_device *pgmn_dev) __LINE__, rc); goto platform_init_fail; } - JPEG_DBG("%s:%d] platform resources - base %p, irq %d\n", + JPEG_DBG("%s:%d] platform resources - base %pK, irq %d\n", __func__, __LINE__, pgmn_dev->base, (int)pgmn_dev->jpeg_irq_res->start); msm_jpeg_q_cleanup(&pgmn_dev->evt_q); diff --git a/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_hw.c b/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_hw.c index 46970a3e73b5..26c5cf963f55 100644 --- a/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_hw.c +++ b/drivers/media/platform/msm/camera_v2/jpeg_dma/msm_jpeg_dma_hw.c @@ -93,7 +93,7 @@ static inline u32 msm_jpegdma_hw_read_reg(struct msm_jpegdma_device *dma, static inline void msm_jpegdma_hw_write_reg(struct msm_jpegdma_device *dma, enum msm_jpegdma_mem_resources base_idx, u32 reg, u32 value) { - pr_debug("%s:%d]%p %08x\n", __func__, __LINE__, + pr_debug("%s:%d]%pK %08x\n", __func__, __LINE__, dma->iomem_base[base_idx] + reg, value); msm_camera_io_w(value, dma->iomem_base[base_idx] + reg); diff --git a/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c b/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c index 50f0cc66c952..67eaa71b4a9b 100644 --- a/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c +++ b/drivers/media/platform/msm/camera_v2/msm_vb2/msm_vb2.c @@ -248,7 +248,7 @@ static int msm_vb2_put_buf(struct vb2_buffer *vb, int session_id, break; } if (WARN_ON(vb2_buf != vb)) { - pr_err("VB buffer is INVALID vb=%p, ses_id=%d, str_id=%d\n", + pr_err("VB buffer is INVALID vb=%pK, ses_id=%d, str_id=%d\n", vb, session_id, stream_id); spin_unlock_irqrestore(&stream->stream_lock, flags); return -EINVAL; @@ -290,7 +290,7 @@ static int msm_vb2_buf_done(struct vb2_buffer *vb, int session_id, break; } if (WARN_ON(vb2_buf != vb)) { - pr_err("VB buffer is INVALID ses_id=%d, str_id=%d, vb=%p\n", + pr_err("VB buffer is INVALID ses_id=%d, str_id=%d, vb=%pK\n", session_id, stream_id, vb); spin_unlock_irqrestore(&stream->stream_lock, flags); return -EINVAL; diff --git a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c index ce8afafa46de..01fee69e85be 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c +++ b/drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c @@ -1414,13 +1414,13 @@ static int cpp_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) CPP_DBG("E\n"); if (!sd || !fh) { - pr_err("Wrong input parameters sd %p fh %p!", + pr_err("Wrong input parameters sd %pK fh %pK!", sd, fh); return -EINVAL; } cpp_dev = v4l2_get_subdevdata(sd); if (!cpp_dev) { - pr_err("failed: cpp_dev %p\n", cpp_dev); + pr_err("failed: cpp_dev %pK\n", cpp_dev); return -EINVAL; } mutex_lock(&cpp_dev->mutex); @@ -1443,7 +1443,7 @@ static int cpp_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) return -ENODEV; } - CPP_DBG("open %d %p\n", i, &fh->vfh); + CPP_DBG("open %d %pK\n", i, &fh->vfh); cpp_dev->cpp_open_cnt++; if (cpp_dev->cpp_open_cnt == 1) { rc = cpp_init_hardware(cpp_dev); @@ -1485,7 +1485,7 @@ static int cpp_close_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) cpp_dev = v4l2_get_subdevdata(sd); if (!cpp_dev) { - pr_err("failed: cpp_dev %p\n", cpp_dev); + pr_err("failed: cpp_dev %pK\n", cpp_dev); return -EINVAL; } @@ -1780,7 +1780,7 @@ static void msm_cpp_do_timeout_work(struct work_struct *work) mutex_lock(&cpp_dev->mutex); if (!work || (cpp_timer.data.cpp_dev->state != CPP_STATE_ACTIVE)) { - pr_err("Invalid work:%p or state:%d\n", work, + pr_err("Invalid work:%pK or state:%d\n", work, cpp_timer.data.cpp_dev->state); /* Do not flush queue here as it is not a fatal error */ goto end; @@ -2838,7 +2838,7 @@ static int msm_cpp_copy_from_ioctl_ptr(void *dst_ptr, { int ret; if ((ioctl_ptr->ioctl_ptr == NULL) || (ioctl_ptr->len == 0)) { - pr_err("%s: Wrong ioctl_ptr %p / len %zu\n", __func__, + pr_err("%s: Wrong ioctl_ptr %pK / len %zu\n", __func__, ioctl_ptr, ioctl_ptr->len); return -EINVAL; } @@ -2861,7 +2861,7 @@ static int msm_cpp_copy_from_ioctl_ptr(void *dst_ptr, { int ret; if ((ioctl_ptr->ioctl_ptr == NULL) || (ioctl_ptr->len == 0)) { - pr_err("%s: Wrong ioctl_ptr %p / len %zu\n", __func__, + pr_err("%s: Wrong ioctl_ptr %pK / len %zu\n", __func__, ioctl_ptr, ioctl_ptr->len); return -EINVAL; } @@ -2933,14 +2933,14 @@ static int msm_cpp_validate_input(unsigned int cmd, void *arg, break; default: { if (ioctl_ptr == NULL) { - pr_err("Wrong ioctl_ptr %p\n", ioctl_ptr); + pr_err("Wrong ioctl_ptr for cmd %u\n", cmd); return -EINVAL; } *ioctl_ptr = arg; if ((*ioctl_ptr == NULL) || ((*ioctl_ptr)->ioctl_ptr == NULL)) { - pr_err("Wrong arg %p\n", arg); + pr_err("Error invalid ioctl argument cmd %u", cmd); return -EINVAL; } break; @@ -2957,7 +2957,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, int rc = 0; if (sd == NULL) { - pr_err("sd %p\n", sd); + pr_err("sd %pK\n", sd); return -EINVAL; } cpp_dev = v4l2_get_subdevdata(sd); @@ -3033,7 +3033,7 @@ long msm_cpp_subdev_ioctl(struct v4l2_subdev *sd, &cpp_dev->pdev->dev); if (rc) { dev_err(&cpp_dev->pdev->dev, - "Fail to loc blob %s dev %p, rc:%d\n", + "Fail to loc blob %s dev %pK, rc:%d\n", cpp_dev->fw_name_bin, &cpp_dev->pdev->dev, rc); kfree(cpp_dev->fw_name_bin); @@ -3490,14 +3490,15 @@ static long msm_cpp_subdev_do_ioctl( struct v4l2_fh *vfh = NULL; if ((arg == NULL) || (file == NULL)) { - pr_err("Invalid input parameters arg %p, file %p\n", arg, file); + pr_err("Invalid input parameters arg %pK, file %pK\n", + arg, file); return -EINVAL; } vdev = video_devdata(file); sd = vdev_to_v4l2_subdev(vdev); if (sd == NULL) { - pr_err("Invalid input parameter sd %p\n", sd); + pr_err("Invalid input parameter sd %pK\n", sd); return -EINVAL; } vfh = file->private_data; @@ -3773,7 +3774,7 @@ static long msm_cpp_subdev_fops_compat_ioctl(struct file *file, } cpp_dev = v4l2_get_subdevdata(sd); if (!vdev || !cpp_dev) { - pr_err("Invalid vdev %p or cpp_dev %p structures!", + pr_err("Invalid vdev %pK or cpp_dev %pK structures!", vdev, cpp_dev); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c index bf4d3595ecf4..f2f1dca81f18 100644 --- a/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c +++ b/drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c @@ -56,12 +56,12 @@ static void vpe_mem_dump(const char * const name, const void * const addr, int i; u32 *p = (u32 *) addr; u32 data; - VPE_DBG("%s: (%s) %p %d\n", __func__, name, addr, size); + VPE_DBG("%s: (%s) %pK %d\n", __func__, name, addr, size); line_str[0] = '\0'; p_str = line_str; for (i = 0; i < size/4; i++) { if (i % 4 == 0) { - snprintf(p_str, 12, "%p: ", p); + snprintf(p_str, 12, "%pK: ", p); p_str += 10; } data = *p++; @@ -614,7 +614,7 @@ static int vpe_open_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) goto err_mutex_unlock; } - VPE_DBG("open %d %p\n", i, &fh->vfh); + VPE_DBG("open %d %pK\n", i, &fh->vfh); vpe_dev->vpe_open_cnt++; if (vpe_dev->vpe_open_cnt == 1) { rc = vpe_init_hardware(vpe_dev); @@ -669,7 +669,7 @@ static int vpe_close_node(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh) return -ENODEV; } - VPE_DBG("close %d %p\n", i, &fh->vfh); + VPE_DBG("close %d %pK\n", i, &fh->vfh); vpe_dev->vpe_open_cnt--; if (vpe_dev->vpe_open_cnt == 0) { vpe_deinit_mem(vpe_dev); diff --git a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c index 91cedb8fb5db..a06a5d10e06b 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c +++ b/drivers/media/platform/msm/camera_v2/sensor/actuator/msm_actuator.c @@ -650,7 +650,7 @@ static int32_t msm_actuator_move_focus( if ((a_ctrl->region_size <= 0) || (a_ctrl->region_size > MAX_ACTUATOR_REGION) || (!move_params->ringing_params)) { - pr_err("Invalid-region size = %d, ringing_params = %p\n", + pr_err("Invalid-region size = %d, ringing_params = %pK\n", a_ctrl->region_size, move_params->ringing_params); return -EFAULT; } @@ -784,7 +784,7 @@ static int32_t msm_actuator_bivcm_move_focus( if ((a_ctrl->region_size <= 0) || (a_ctrl->region_size > MAX_ACTUATOR_REGION) || (!move_params->ringing_params)) { - pr_err("Invalid-region size = %d, ringing_params = %p\n", + pr_err("Invalid-region size = %d, ringing_params = %pK\n", a_ctrl->region_size, move_params->ringing_params); return -EFAULT; } @@ -1569,7 +1569,7 @@ static long msm_actuator_subdev_ioctl(struct v4l2_subdev *sd, struct msm_actuator_ctrl_t *a_ctrl = v4l2_get_subdevdata(sd); void __user *argp = (void __user *)arg; CDBG("Enter\n"); - CDBG("%s:%d a_ctrl %p argp %p\n", __func__, __LINE__, a_ctrl, argp); + CDBG("%s:%d a_ctrl %pK argp %pK\n", __func__, __LINE__, a_ctrl, argp); switch (cmd) { case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID: return msm_actuator_get_subdev_id(a_ctrl, argp); @@ -1582,11 +1582,13 @@ static long msm_actuator_subdev_ioctl(struct v4l2_subdev *sd, pr_err("a_ctrl->i2c_client.i2c_func_tbl NULL\n"); return -EINVAL; } + mutex_lock(a_ctrl->actuator_mutex); rc = msm_actuator_power_down(a_ctrl); if (rc < 0) { pr_err("%s:%d Actuator Power down failed\n", __func__, __LINE__); } + mutex_unlock(a_ctrl->actuator_mutex); return msm_actuator_close(sd, NULL); default: return -ENOIOCTLCMD; @@ -1799,7 +1801,7 @@ static int32_t msm_actuator_i2c_probe(struct i2c_client *client, goto probe_failure; } - CDBG("client = 0x%p\n", client); + CDBG("client = 0x%pK\n", client); rc = of_property_read_u32(client->dev.of_node, "cell-index", &act_ctrl_t->subdev_id); diff --git a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c index a2c1708f526e..ddbf6191837e 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c +++ b/drivers/media/platform/msm/camera_v2/sensor/cci/msm_cci.c @@ -941,7 +941,7 @@ static int32_t msm_cci_i2c_read_bytes(struct v4l2_subdev *sd, uint16_t read_bytes = 0; if (!sd || !c_ctrl) { - pr_err("%s:%d sd %p c_ctrl %p\n", __func__, + pr_err("%s:%d sd %pK c_ctrl %pK\n", __func__, __LINE__, sd, c_ctrl); return -EINVAL; } @@ -1234,7 +1234,7 @@ static int32_t msm_cci_i2c_set_sync_prms(struct v4l2_subdev *sd, cci_dev = v4l2_get_subdevdata(sd); if (!cci_dev || !c_ctrl) { - pr_err("%s:%d failed: invalid params %p %p\n", __func__, + pr_err("%s:%d failed: invalid params %pK %pK\n", __func__, __LINE__, cci_dev, c_ctrl); rc = -EINVAL; return rc; @@ -1256,7 +1256,7 @@ static int32_t msm_cci_init(struct v4l2_subdev *sd, cci_dev = v4l2_get_subdevdata(sd); if (!cci_dev || !c_ctrl) { - pr_err("%s:%d failed: invalid params %p %p\n", __func__, + pr_err("%s:%d failed: invalid params %pK %pK\n", __func__, __LINE__, cci_dev, c_ctrl); rc = -EINVAL; return rc; @@ -1498,7 +1498,7 @@ static int32_t msm_cci_write(struct v4l2_subdev *sd, cci_dev = v4l2_get_subdevdata(sd); if (!cci_dev || !c_ctrl) { - pr_err("%s:%d failed: invalid params %p %p\n", __func__, + pr_err("%s:%d failed: invalid params %pK %pK\n", __func__, __LINE__, cci_dev, c_ctrl); rc = -EINVAL; return rc; @@ -2016,7 +2016,7 @@ static int msm_cci_probe(struct platform_device *pdev) { struct cci_device *new_cci_dev; int rc = 0, i = 0; - CDBG("%s: pdev %p device id = %d\n", __func__, pdev, pdev->id); + CDBG("%s: pdev %pK device id = %d\n", __func__, pdev, pdev->id); new_cci_dev = kzalloc(sizeof(struct cci_device), GFP_KERNEL); if (!new_cci_dev) { pr_err("%s: no enough memory\n", __func__); @@ -2028,7 +2028,7 @@ static int msm_cci_probe(struct platform_device *pdev) ARRAY_SIZE(new_cci_dev->msm_sd.sd.name), "msm_cci"); v4l2_set_subdevdata(&new_cci_dev->msm_sd.sd, new_cci_dev); platform_set_drvdata(pdev, &new_cci_dev->msm_sd.sd); - CDBG("%s sd %p\n", __func__, &new_cci_dev->msm_sd.sd); + CDBG("%s sd %pK\n", __func__, &new_cci_dev->msm_sd.sd); if (pdev->dev.of_node) of_property_read_u32((&pdev->dev)->of_node, "cell-index", &pdev->id); @@ -2116,7 +2116,7 @@ static int msm_cci_probe(struct platform_device *pdev) if (!new_cci_dev->write_wq[i]) pr_err("Failed to create write wq\n"); } - CDBG("%s cci subdev %p\n", __func__, &new_cci_dev->msm_sd.sd); + CDBG("%s cci subdev %pK\n", __func__, &new_cci_dev->msm_sd.sd); CDBG("%s line %d\n", __func__, __LINE__); return 0; diff --git a/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c b/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c index 7e552ea85523..1f7611af0507 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c +++ b/drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c @@ -230,7 +230,7 @@ static int msm_csid_config(struct csid_device *csid_dev, void __iomem *csidbase; csidbase = csid_dev->base; if (!csidbase || !csid_params) { - pr_err("%s:%d csidbase %p, csid params %p\n", __func__, + pr_err("%s:%d csidbase %pK, csid params %pK\n", __func__, __LINE__, csidbase, csid_params); return -EINVAL; } @@ -679,7 +679,7 @@ static int32_t msm_csid_cmd(struct csid_device *csid_dev, void __user *arg) struct csid_cfg_data *cdata = (struct csid_cfg_data *)arg; if (!csid_dev || !cdata) { - pr_err("%s:%d csid_dev %p, cdata %p\n", __func__, __LINE__, + pr_err("%s:%d csid_dev %pK, cdata %pK\n", __func__, __LINE__, csid_dev, cdata); return -EINVAL; } @@ -810,7 +810,7 @@ static int32_t msm_csid_cmd32(struct csid_device *csid_dev, void __user *arg) cdata = &local_arg; if (!csid_dev || !cdata) { - pr_err("%s:%d csid_dev %p, cdata %p\n", __func__, __LINE__, + pr_err("%s:%d csid_dev %pK, cdata %pK\n", __func__, __LINE__, csid_dev, cdata); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c index a918335bfbc6..865b1bc5662b 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c +++ b/drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c @@ -509,7 +509,7 @@ static int msm_csiphy_lane_config(struct csiphy_device *csiphy_dev, val |= csiphy_params->csid_core; } msm_camera_io_w(val, csiphy_dev->clk_mux_base); - CDBG("%s clk mux addr %p val 0x%x\n", __func__, + CDBG("%s clk mux addr %pK val 0x%x\n", __func__, csiphy_dev->clk_mux_base, val); /* ensure write is done */ mb(); @@ -735,7 +735,7 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) csiphy_dev->num_clk, 1); } else if (csiphy_dev->hw_dts_version >= CSIPHY_VERSION_V30) { if (!csiphy_dev->clk_mux_mem || !csiphy_dev->clk_mux_io) { - pr_err("%s clk mux mem %p io %p\n", __func__, + pr_err("%s clk mux mem %pK io %pK\n", __func__, csiphy_dev->clk_mux_mem, csiphy_dev->clk_mux_io); rc = -ENOMEM; @@ -852,7 +852,7 @@ static int msm_csiphy_init(struct csiphy_device *csiphy_dev) csiphy_dev->num_clk, 1); } else if (csiphy_dev->hw_dts_version >= CSIPHY_VERSION_V30) { if (!csiphy_dev->clk_mux_mem || !csiphy_dev->clk_mux_io) { - pr_err("%s clk mux mem %p io %p\n", __func__, + pr_err("%s clk mux mem %pK io %pK\n", __func__, csiphy_dev->clk_mux_mem, csiphy_dev->clk_mux_io); rc = -ENOMEM; @@ -968,7 +968,7 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg) mipi_csiphy_glbl_pwr_cfg_addr); } else { if (!csi_lane_params) { - pr_err("%s:%d failed: csi_lane_params %p\n", __func__, + pr_err("%s:%d failed: csi_lane_params %pK\n", __func__, __LINE__, csi_lane_params); return -EINVAL; } @@ -1079,7 +1079,7 @@ static int msm_csiphy_release(struct csiphy_device *csiphy_dev, void *arg) mipi_csiphy_glbl_pwr_cfg_addr); } else { if (!csi_lane_params) { - pr_err("%s:%d failed: csi_lane_params %p\n", __func__, + pr_err("%s:%d failed: csi_lane_params %pK\n", __func__, __LINE__, csi_lane_params); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c b/drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c index 6808037d191e..e0b67c34a7b9 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c +++ b/drivers/media/platform/msm/camera_v2/sensor/eeprom/msm_eeprom.c @@ -698,7 +698,7 @@ static long msm_eeprom_subdev_ioctl(struct v4l2_subdev *sd, struct msm_eeprom_ctrl_t *e_ctrl = v4l2_get_subdevdata(sd); void __user *argp = (void __user *)arg; CDBG("%s E\n", __func__); - CDBG("%s:%d a_ctrl %p argp %p\n", __func__, __LINE__, e_ctrl, argp); + CDBG("%s:%d a_ctrl %pK argp %pK\n", __func__, __LINE__, e_ctrl, argp); switch (cmd) { case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID: return msm_eeprom_get_subdev_id(e_ctrl, argp); @@ -807,7 +807,7 @@ static int msm_eeprom_i2c_probe(struct i2c_client *client, } e_ctrl->eeprom_v4l2_subdev_ops = &msm_eeprom_subdev_ops; e_ctrl->eeprom_mutex = &msm_eeprom_mutex; - CDBG("%s client = 0x%p\n", __func__, client); + CDBG("%s client = 0x%pK\n", __func__, client); e_ctrl->eboard_info = (struct msm_eeprom_board_info *)(id->driver_data); if (!e_ctrl->eboard_info) { pr_err("%s:%d board info NULL\n", __func__, __LINE__); @@ -1571,7 +1571,7 @@ static long msm_eeprom_subdev_ioctl32(struct v4l2_subdev *sd, void __user *argp = (void __user *)arg; CDBG("%s E\n", __func__); - CDBG("%s:%d a_ctrl %p argp %p\n", __func__, __LINE__, e_ctrl, argp); + CDBG("%s:%d a_ctrl %pK argp %pK\n", __func__, __LINE__, e_ctrl, argp); switch (cmd) { case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID: return msm_eeprom_get_subdev_id(e_ctrl, argp); diff --git a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c index 61720e29ddfd..84f83baa1b80 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c +++ b/drivers/media/platform/msm/camera_v2/sensor/flash/msm_flash.c @@ -347,7 +347,7 @@ static int32_t msm_flash_i2c_release( int32_t rc = 0; if (!(&flash_ctrl->power_info) || !(&flash_ctrl->flash_i2c_client)) { - pr_err("%s:%d failed: %p %p\n", + pr_err("%s:%d failed: %pK %pK\n", __func__, __LINE__, &flash_ctrl->power_info, &flash_ctrl->flash_i2c_client); return -EINVAL; diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c index 7315327e6d12..99d4b6541c4a 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c +++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c @@ -272,6 +272,12 @@ int32_t msm_camera_cci_i2c_write_seq_table( client_addr_type = client->addr_type; client->addr_type = write_setting->addr_type; + if (reg_setting->reg_data_size > I2C_SEQ_REG_DATA_MAX) { + pr_err("%s: number of bytes %u exceeding the max supported %d\n", + __func__, reg_setting->reg_data_size, I2C_SEQ_REG_DATA_MAX); + return rc; + } + for (i = 0; i < write_setting->size; i++) { rc = msm_camera_cci_i2c_write_seq(client, reg_setting->reg_addr, reg_setting->reg_data, reg_setting->reg_data_size); diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c index 02e21b512313..8b73c48275ac 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c +++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_dt_util.c @@ -34,7 +34,7 @@ int msm_camera_fill_vreg_params(struct camera_vreg_t *cam_vreg, /* Validate input parameters */ if (!cam_vreg || !power_setting) { - pr_err("%s:%d failed: cam_vreg %p power_setting %p", __func__, + pr_err("%s:%d failed: cam_vreg %pK power_setting %pK", __func__, __LINE__, cam_vreg, power_setting); return -EINVAL; } @@ -1229,7 +1229,7 @@ int msm_camera_power_up(struct msm_camera_power_ctrl_t *ctrl, CDBG("%s:%d\n", __func__, __LINE__); if (!ctrl || !sensor_i2c_client) { - pr_err("failed ctrl %p sensor_i2c_client %p\n", ctrl, + pr_err("failed ctrl %pK sensor_i2c_client %pK\n", ctrl, sensor_i2c_client); return -EINVAL; } @@ -1454,7 +1454,7 @@ int msm_camera_power_down(struct msm_camera_power_ctrl_t *ctrl, CDBG("%s:%d\n", __func__, __LINE__); if (!ctrl || !sensor_i2c_client) { - pr_err("failed ctrl %p sensor_i2c_client %p\n", ctrl, + pr_err("failed ctrl %pK sensor_i2c_client %pK\n", ctrl, sensor_i2c_client); return -EINVAL; } diff --git a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c index f542ec2e26bf..eced0ce434d5 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c +++ b/drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_qup_i2c.c @@ -290,6 +290,12 @@ int32_t msm_camera_qup_i2c_write_seq_table(struct msm_camera_i2c_client *client, client_addr_type = client->addr_type; client->addr_type = write_setting->addr_type; + if (reg_setting->reg_data_size > I2C_SEQ_REG_DATA_MAX) { + pr_err("%s: number of bytes %u exceeding the max supported %d\n", + __func__, reg_setting->reg_data_size, I2C_SEQ_REG_DATA_MAX); + return rc; + } + for (i = 0; i < write_setting->size; i++) { rc = msm_camera_qup_i2c_write_seq(client, reg_setting->reg_addr, reg_setting->reg_data, reg_setting->reg_data_size); diff --git a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c index b58b39aa5361..3d53746c8143 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c +++ b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor.c @@ -108,7 +108,7 @@ int msm_sensor_power_down(struct msm_sensor_ctrl_t *s_ctrl) struct msm_camera_i2c_client *sensor_i2c_client; if (!s_ctrl) { - pr_err("%s:%d failed: s_ctrl %p\n", + pr_err("%s:%d failed: s_ctrl %pK\n", __func__, __LINE__, s_ctrl); return -EINVAL; } @@ -121,7 +121,7 @@ int msm_sensor_power_down(struct msm_sensor_ctrl_t *s_ctrl) sensor_i2c_client = s_ctrl->sensor_i2c_client; if (!power_info || !sensor_i2c_client) { - pr_err("%s:%d failed: power_info %p sensor_i2c_client %p\n", + pr_err("%s:%d failed: power_info %pK sensor_i2c_client %pK\n", __func__, __LINE__, power_info, sensor_i2c_client); return -EINVAL; } @@ -139,7 +139,7 @@ int msm_sensor_power_up(struct msm_sensor_ctrl_t *s_ctrl) uint32_t retry = 0; if (!s_ctrl) { - pr_err("%s:%d failed: %p\n", + pr_err("%s:%d failed: %pK\n", __func__, __LINE__, s_ctrl); return -EINVAL; } @@ -154,7 +154,7 @@ int msm_sensor_power_up(struct msm_sensor_ctrl_t *s_ctrl) if (!power_info || !sensor_i2c_client || !slave_info || !sensor_name) { - pr_err("%s:%d failed: %p %p %p %p\n", + pr_err("%s:%d failed: %pK %pK %pK %pK\n", __func__, __LINE__, power_info, sensor_i2c_client, slave_info, sensor_name); return -EINVAL; @@ -210,7 +210,7 @@ int msm_sensor_match_id(struct msm_sensor_ctrl_t *s_ctrl) const char *sensor_name; if (!s_ctrl) { - pr_err("%s:%d failed: %p\n", + pr_err("%s:%d failed: %pK\n", __func__, __LINE__, s_ctrl); return -EINVAL; } @@ -219,7 +219,7 @@ int msm_sensor_match_id(struct msm_sensor_ctrl_t *s_ctrl) sensor_name = s_ctrl->sensordata->sensor_name; if (!sensor_i2c_client || !slave_info || !sensor_name) { - pr_err("%s:%d failed: %p %p %p\n", + pr_err("%s:%d failed: %pK %pK %pK\n", __func__, __LINE__, sensor_i2c_client, slave_info, sensor_name); return -EINVAL; @@ -1462,13 +1462,13 @@ int32_t msm_sensor_init_default_params(struct msm_sensor_ctrl_t *s_ctrl) /* Validate input parameters */ if (!s_ctrl) { - pr_err("%s:%d failed: invalid params s_ctrl %p\n", __func__, + pr_err("%s:%d failed: invalid params s_ctrl %pK\n", __func__, __LINE__, s_ctrl); return -EINVAL; } if (!s_ctrl->sensor_i2c_client) { - pr_err("%s:%d failed: invalid params sensor_i2c_client %p\n", + pr_err("%s:%d failed: invalid params sensor_i2c_client %pK\n", __func__, __LINE__, s_ctrl->sensor_i2c_client); return -EINVAL; } @@ -1477,7 +1477,7 @@ int32_t msm_sensor_init_default_params(struct msm_sensor_ctrl_t *s_ctrl) s_ctrl->sensor_i2c_client->cci_client = kzalloc(sizeof( struct msm_camera_cci_client), GFP_KERNEL); if (!s_ctrl->sensor_i2c_client->cci_client) { - pr_err("%s:%d failed: no memory cci_client %p\n", __func__, + pr_err("%s:%d failed: no memory cci_client %pK\n", __func__, __LINE__, s_ctrl->sensor_i2c_client->cci_client); return -ENOMEM; } @@ -1511,7 +1511,7 @@ int32_t msm_sensor_init_default_params(struct msm_sensor_ctrl_t *s_ctrl) /* Initialize clock info */ clk_info = kzalloc(sizeof(cam_8974_clk_info), GFP_KERNEL); if (!clk_info) { - pr_err("%s:%d failed no memory clk_info %p\n", __func__, + pr_err("%s:%d failed no memory clk_info %pK\n", __func__, __LINE__, clk_info); rc = -ENOMEM; goto FREE_CCI_CLIENT; diff --git a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c index 15fdbf442297..33c3560e8139 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c +++ b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_driver.c @@ -488,10 +488,8 @@ static int32_t msm_sensor_get_power_down_settings(void *setting, } /* Allocate memory for power down setting */ pd = kzalloc(sizeof(*pd) * size_down, GFP_KERNEL); - if (!pd) { - pr_err("failed: no memory power_setting %p", pd); + if (!pd) return -EFAULT; - } if (slave_info->power_setting_array.power_down_setting) { #ifdef CONFIG_COMPAT @@ -555,10 +553,8 @@ static int32_t msm_sensor_get_power_up_settings(void *setting, /* Allocate memory for power up setting */ pu = kzalloc(sizeof(*pu) * size, GFP_KERNEL); - if (!pu) { - pr_err("failed: no memory power_setting %p", pu); + if (!pu) return -ENOMEM; - } #ifdef CONFIG_COMPAT if (is_compat_task()) { @@ -671,22 +667,20 @@ int32_t msm_sensor_driver_probe(void *setting, /* Validate input parameters */ if (!setting) { - pr_err("failed: slave_info %p", setting); + pr_err("failed: slave_info %pK", setting); return -EINVAL; } /* Allocate memory for slave info */ slave_info = kzalloc(sizeof(*slave_info), GFP_KERNEL); - if (!slave_info) { - pr_err("failed: no memory slave_info %p", slave_info); + if (!slave_info) return -ENOMEM; - } #ifdef CONFIG_COMPAT if (is_compat_task()) { struct msm_camera_sensor_slave_info32 *slave_info32 = kzalloc(sizeof(*slave_info32), GFP_KERNEL); if (!slave_info32) { - pr_err("failed: no memory for slave_info32 %p\n", + pr_err("failed: no memory for slave_info32 %pK\n", slave_info32); rc = -ENOMEM; goto free_slave_info; @@ -781,13 +775,13 @@ int32_t msm_sensor_driver_probe(void *setting, /* Extract s_ctrl from camera id */ s_ctrl = g_sctrl[slave_info->camera_id]; if (!s_ctrl) { - pr_err("failed: s_ctrl %p for camera_id %d", s_ctrl, + pr_err("failed: s_ctrl %pK for camera_id %d", s_ctrl, slave_info->camera_id); rc = -EINVAL; goto free_slave_info; } - CDBG("s_ctrl[%d] %p", slave_info->camera_id, s_ctrl); + CDBG("s_ctrl[%d] %pK", slave_info->camera_id, s_ctrl); if (s_ctrl->is_probe_succeed == 1) { /* @@ -827,12 +821,9 @@ int32_t msm_sensor_driver_probe(void *setting, camera_info = kzalloc(sizeof(struct msm_camera_slave_info), GFP_KERNEL); - if (!camera_info) { - pr_err("failed: no memory slave_info %p", camera_info); + if (!camera_info) goto free_slave_info; - } - s_ctrl->sensordata->slave_info = camera_info; /* Fill sensor slave info */ @@ -844,7 +835,7 @@ int32_t msm_sensor_driver_probe(void *setting, /* Fill CCI master, slave address and CCI default params */ if (!s_ctrl->sensor_i2c_client) { - pr_err("failed: sensor_i2c_client %p", + pr_err("failed: sensor_i2c_client %pK", s_ctrl->sensor_i2c_client); rc = -EINVAL; goto free_camera_info; @@ -857,7 +848,7 @@ int32_t msm_sensor_driver_probe(void *setting, cci_client = s_ctrl->sensor_i2c_client->cci_client; if (!cci_client) { - pr_err("failed: cci_client %p", cci_client); + pr_err("failed: cci_client %pK", cci_client); goto free_camera_info; } cci_client->cci_i2c_master = s_ctrl->cci_i2c_master; @@ -1025,7 +1016,7 @@ static int32_t msm_sensor_driver_get_gpio_data( /* Validate input paramters */ if (!sensordata || !of_node) { - pr_err("failed: invalid params sensordata %p of_node %p", + pr_err("failed: invalid params sensordata %pK of_node %pK", sensordata, of_node); return -EINVAL; } @@ -1213,7 +1204,7 @@ static int32_t msm_sensor_driver_parse(struct msm_sensor_ctrl_t *s_ctrl) s_ctrl->sensor_i2c_client = kzalloc(sizeof(*s_ctrl->sensor_i2c_client), GFP_KERNEL); if (!s_ctrl->sensor_i2c_client) { - pr_err("failed: no memory sensor_i2c_client %p", + pr_err("failed: no memory sensor_i2c_client %pK", s_ctrl->sensor_i2c_client); return -ENOMEM; } @@ -1222,7 +1213,7 @@ static int32_t msm_sensor_driver_parse(struct msm_sensor_ctrl_t *s_ctrl) s_ctrl->msm_sensor_mutex = kzalloc(sizeof(*s_ctrl->msm_sensor_mutex), GFP_KERNEL); if (!s_ctrl->msm_sensor_mutex) { - pr_err("failed: no memory msm_sensor_mutex %p", + pr_err("failed: no memory msm_sensor_mutex %pK", s_ctrl->msm_sensor_mutex); goto FREE_SENSOR_I2C_CLIENT; } @@ -1251,7 +1242,7 @@ static int32_t msm_sensor_driver_parse(struct msm_sensor_ctrl_t *s_ctrl) /* Store sensor control structure in static database */ g_sctrl[s_ctrl->id] = s_ctrl; - CDBG("g_sctrl[%d] %p", s_ctrl->id, g_sctrl[s_ctrl->id]); + CDBG("g_sctrl[%d] %pK", s_ctrl->id, g_sctrl[s_ctrl->id]); return rc; @@ -1308,10 +1299,8 @@ static int32_t msm_sensor_driver_platform_probe(struct platform_device *pdev) /* Create sensor control structure */ s_ctrl = kzalloc(sizeof(*s_ctrl), GFP_KERNEL); - if (!s_ctrl) { - pr_err("failed: no memory s_ctrl %p", s_ctrl); + if (!s_ctrl) return -ENOMEM; - } platform_set_drvdata(pdev, s_ctrl); @@ -1355,10 +1344,8 @@ static int32_t msm_sensor_driver_i2c_probe(struct i2c_client *client, /* Create sensor control structure */ s_ctrl = kzalloc(sizeof(*s_ctrl), GFP_KERNEL); - if (!s_ctrl) { - pr_err("failed: no memory s_ctrl %p", s_ctrl); + if (!s_ctrl) return -ENOMEM; - } i2c_set_clientdata(client, s_ctrl); diff --git a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_init.c b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_init.c index 8b6e3d3e1f78..ed0b9742bddb 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_init.c +++ b/drivers/media/platform/msm/camera_v2/sensor/msm_sensor_init.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -64,7 +64,7 @@ static int32_t msm_sensor_driver_cmd(struct msm_sensor_init_t *s_init, /* Validate input parameters */ if (!s_init || !cfg) { - pr_err("failed: s_init %p cfg %p", s_init, cfg); + pr_err("failed: s_init %pK cfg %pK", s_init, cfg); return -EINVAL; } @@ -106,7 +106,7 @@ static long msm_sensor_init_subdev_ioctl(struct v4l2_subdev *sd, /* Validate input parameters */ if (!s_init) { - pr_err("failed: s_init %p", s_init); + pr_err("failed: s_init %pK", s_init); return -EINVAL; } @@ -167,12 +167,10 @@ static int __init msm_sensor_init_module(void) int ret = 0; /* Allocate memory for msm_sensor_init control structure */ s_init = kzalloc(sizeof(struct msm_sensor_init_t), GFP_KERNEL); - if (!s_init) { - pr_err("failed: no memory s_init %p", NULL); + if (!s_init) return -ENOMEM; - } - CDBG("MSM_SENSOR_INIT_MODULE %p", NULL); + CDBG("MSM_SENSOR_INIT_MODULE %pK", NULL); /* Initialize mutex */ mutex_init(&s_init->imutex); diff --git a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c index 7c35f1de89f6..0e64166f461e 100644 --- a/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c +++ b/drivers/media/platform/msm/camera_v2/sensor/ois/msm_ois.c @@ -423,7 +423,7 @@ static long msm_ois_subdev_ioctl(struct v4l2_subdev *sd, struct msm_ois_ctrl_t *o_ctrl = v4l2_get_subdevdata(sd); void __user *argp = (void __user *)arg; CDBG("Enter\n"); - CDBG("%s:%d o_ctrl %p argp %p\n", __func__, __LINE__, o_ctrl, argp); + CDBG("%s:%d o_ctrl %pK argp %pK\n", __func__, __LINE__, o_ctrl, argp); switch (cmd) { case VIDIOC_MSM_SENSOR_GET_SUBDEV_ID: return msm_ois_get_subdev_id(o_ctrl, argp); @@ -499,7 +499,7 @@ static int32_t msm_ois_i2c_probe(struct i2c_client *client, goto probe_failure; } - CDBG("client = 0x%p\n", client); + CDBG("client = 0x%pK\n", client); rc = of_property_read_u32(client->dev.of_node, "cell-index", &ois_ctrl_t->subdev_id); diff --git a/drivers/media/radio/radio-iris.c b/drivers/media/radio/radio-iris.c index 5c490edc1c6f..36961295b944 100644 --- a/drivers/media/radio/radio-iris.c +++ b/drivers/media/radio/radio-iris.c @@ -3814,8 +3814,20 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, bytes_to_copy = (ctrl->controls[0]).size; spur_tbl_req.mode = data[0]; spur_tbl_req.no_of_freqs_entries = data[1]; - spur_data = kmalloc((data[1] * SPUR_DATA_LEN) + 2, - GFP_ATOMIC); + + if (((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) != + bytes_to_copy - 2) || + ((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) > + 2 * FM_SPUR_TBL_SIZE)) { + FMDERR("Invalid data len: data[1] = %d, bytes = %zu", + spur_tbl_req.no_of_freqs_entries, + bytes_to_copy); + retval = -EINVAL; + goto END; + } + spur_data = + kmalloc((spur_tbl_req.no_of_freqs_entries * SPUR_DATA_LEN) + + 2, GFP_ATOMIC); if (!spur_data) { FMDERR("Allocation failed for Spur data"); retval = -EFAULT; @@ -3830,7 +3842,8 @@ static int iris_vidioc_s_ext_ctrls(struct file *file, void *priv, if (spur_tbl_req.no_of_freqs_entries <= ENTRIES_EACH_CMD) { memcpy(&spur_tbl_req.spur_data[0], spur_data, - (data[1] * SPUR_DATA_LEN)); + (spur_tbl_req.no_of_freqs_entries * + SPUR_DATA_LEN)); retval = radio_hci_request(radio->fm_hdev, hci_fm_set_spur_tbl_req, (unsigned long)&spur_tbl_req, diff --git a/drivers/misc/qcom/qdsp6v2/audio_utils.c b/drivers/misc/qcom/qdsp6v2/audio_utils.c index cad0220a4960..8eeb79102ee2 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_utils.c +++ b/drivers/misc/qcom/qdsp6v2/audio_utils.c @@ -24,6 +24,15 @@ #include #include "audio_utils.h" +/* + * Define maximum buffer size. Below values are chosen considering the higher + * values used among all native drivers. + */ +#define MAX_FRAME_SIZE 1536 +#define MAX_FRAMES 5 +#define META_SIZE (sizeof(struct meta_out_dsp)) +#define MAX_BUFFER_SIZE (1 + ((MAX_FRAME_SIZE + META_SIZE) * MAX_FRAMES)) + static int audio_in_pause(struct q6audio_in *audio) { int rc; @@ -329,6 +338,10 @@ long audio_in_ioctl(struct file *file, rc = -EINVAL; break; } + if (cfg.buffer_size > MAX_BUFFER_SIZE) { + rc = -EINVAL; + break; + } audio->str_cfg.buffer_size = cfg.buffer_size; audio->str_cfg.buffer_count = cfg.buffer_count; if (audio->opened) { diff --git a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c index b7ee8a82a049..30274fd4b725 100644 --- a/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c +++ b/drivers/misc/qcom/qdsp6v2/ultrasound/q6usm.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -793,13 +793,13 @@ int q6usm_open_read(struct us_client *usc, int rc = 0x00; struct usm_stream_cmd_open_read open; - pr_debug("%s: session[%d]", __func__, usc->session); - if ((usc == NULL) || (usc->apr == NULL)) { pr_err("%s: client or its apr is NULL\n", __func__); return -EINVAL; } + pr_debug("%s: session[%d]", __func__, usc->session); + q6usm_add_hdr(usc, &open.hdr, sizeof(open), true); open.hdr.opcode = USM_STREAM_CMD_OPEN_READ; open.src_endpoint = 0; /* AFE */ @@ -1040,13 +1040,13 @@ int q6usm_open_write(struct us_client *usc, uint32_t int_format = INVALID_FORMAT; struct usm_stream_cmd_open_write open; - pr_debug("%s: session[%d]", __func__, usc->session); - if ((usc == NULL) || (usc->apr == NULL)) { pr_err("%s: APR handle NULL\n", __func__); return -EINVAL; } + pr_debug("%s: session[%d]", __func__, usc->session); + q6usm_add_hdr(usc, &open.hdr, sizeof(open), true); open.hdr.opcode = USM_STREAM_CMD_OPEN_WRITE; diff --git a/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c b/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c index e0323ec70a19..7572374cc524 100644 --- a/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c +++ b/drivers/misc/qcom/qdsp6v2/ultrasound/usf.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -60,6 +60,9 @@ #define USF_MAX_BUF_SIZE 3145680 #define USF_MAX_BUF_NUM 32 +/* max size for buffer set from user space */ +#define USF_MAX_USER_BUF_SIZE 100000 + /* Place for opreation result, received from QDSP6 */ #define APR_RESULT_IND 1 @@ -572,11 +575,6 @@ static int config_xx(struct usf_xx_type *usf_xx, struct us_xx_info_type *config) (void *)config->port_id, min_map_size); - if (rc) { - pr_err("%s: ports offsets copy failure\n", __func__); - return -EINVAL; - } - usf_xx->encdec_cfg.format_id = config->stream_format; usf_xx->encdec_cfg.params_size = config->params_data_size; usf_xx->user_upd_info_na = 1; /* it's used in US_GET_TX_UPDATE */ @@ -936,6 +934,12 @@ static int usf_set_us_detection(struct usf_type *usf, unsigned long arg) return -EFAULT; } + if (detect_info.params_data_size > USF_MAX_USER_BUF_SIZE) { + pr_err("%s: user buffer size exceeds maximum\n", + __func__); + return -EFAULT; + } + rc = __usf_set_us_detection(usf, &detect_info); if (rc < 0) { pr_err("%s: set us detection failed; rc=%d\n", @@ -1033,6 +1037,12 @@ static int usf_set_tx_info(struct usf_type *usf, unsigned long arg) return -EFAULT; } + if (config_tx.us_xx_info.params_data_size > USF_MAX_USER_BUF_SIZE) { + pr_err("%s: user buffer size exceeds maximum\n", + __func__); + return -EFAULT; + } + return __usf_set_tx_info(usf, &config_tx); } /* usf_set_tx_info */ @@ -1099,6 +1109,12 @@ static int usf_set_rx_info(struct usf_type *usf, unsigned long arg) return -EFAULT; } + if (config_rx.us_xx_info.params_data_size > USF_MAX_USER_BUF_SIZE) { + pr_err("%s: user buffer size exceeds maximum\n", + __func__); + return -EFAULT; + } + return __usf_set_rx_info(usf, &config_rx); } /* usf_set_rx_info */ @@ -1453,9 +1469,17 @@ static int __usf_get_stream_param(struct usf_xx_type *usf_xx, int dir) { struct us_client *usc = usf_xx->usc; - struct us_port_data *port = &usc->port[dir]; + struct us_port_data *port; int rc = 0; + if (usc == NULL) { + pr_err("%s: us_client is null\n", + __func__); + return -EFAULT; + } + + port = &usc->port[dir]; + if (port->param_buf == NULL) { pr_err("%s: parameter buffer is null\n", __func__); @@ -1994,6 +2018,12 @@ static int usf_set_us_detection32(struct usf_type *usf, unsigned long arg) return -EFAULT; } + if (detect_info32.params_data_size > USF_MAX_USER_BUF_SIZE) { + pr_err("%s: user buffer size exceeds maximum\n", + __func__); + return -EFAULT; + } + memset(&detect_info, 0, sizeof(detect_info)); detect_info.us_detector = detect_info32.us_detector; detect_info.us_detect_mode = detect_info32.us_detect_mode; diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index 30023ef2887e..6e334a7379bf 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -2244,7 +2244,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) pch->ppp = NULL; pch->chan = chan; - pch->chan_net = net; + pch->chan_net = get_net(net); chan->ppp = pch; init_ppp_file(&pch->file, CHANNEL); pch->file.hdrlen = chan->hdrlen; diff --git a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c index f3b883ea2e16..b1127da90971 100644 --- a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c @@ -2453,7 +2453,7 @@ int rmnet_ipa_set_data_quota(struct wan_ioctl_set_data_quota *data) * * Return codes: * 0: Success - * -EFAULT: Invalid interface name provided + * -EFAULT: Invalid src/dst pipes provided * other: See ipa_qmi_set_data_quota */ int rmnet_ipa_set_tether_client_pipe( @@ -2461,6 +2461,23 @@ int rmnet_ipa_set_tether_client_pipe( { int number, i; + /* error checking if ul_src_pipe_len valid or not*/ + if (data->ul_src_pipe_len > QMI_IPA_MAX_PIPES_V01 || + data->ul_src_pipe_len < 0) { + IPAWANERR("UL src pipes %d exceeding max %d\n", + data->ul_src_pipe_len, + QMI_IPA_MAX_PIPES_V01); + return -EFAULT; + } + /* error checking if dl_dst_pipe_len valid or not*/ + if (data->dl_dst_pipe_len > QMI_IPA_MAX_PIPES_V01 || + data->dl_dst_pipe_len < 0) { + IPAWANERR("DL dst pipes %d exceeding max %d\n", + data->dl_dst_pipe_len, + QMI_IPA_MAX_PIPES_V01); + return -EFAULT; + } + IPAWANDBG("client %d, UL %d, DL %d, reset %d\n", data->ipa_client, data->ul_src_pipe_len, diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 2ba632da6e11..21366ad499da 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -2468,6 +2468,23 @@ int rmnet_ipa3_set_tether_client_pipe( { int number, i; + /* error checking if ul_src_pipe_len valid or not*/ + if (data->ul_src_pipe_len > QMI_IPA_MAX_PIPES_V01 || + data->ul_src_pipe_len < 0) { + IPAWANERR("UL src pipes %d exceeding max %d\n", + data->ul_src_pipe_len, + QMI_IPA_MAX_PIPES_V01); + return -EFAULT; + } + /* error checking if dl_dst_pipe_len valid or not*/ + if (data->dl_dst_pipe_len > QMI_IPA_MAX_PIPES_V01 || + data->dl_dst_pipe_len < 0) { + IPAWANERR("DL dst pipes %d exceeding max %d\n", + data->dl_dst_pipe_len, + QMI_IPA_MAX_PIPES_V01); + return -EFAULT; + } + IPAWANDBG("client %d, UL %d, DL %d, reset %d\n", data->ipa_client, data->ul_src_pipe_len, diff --git a/drivers/platform/msm/msm_bus/msm_bus_dbg_voter.c b/drivers/platform/msm/msm_bus/msm_bus_dbg_voter.c index e4c8f1f446df..a876484859eb 100644 --- a/drivers/platform/msm/msm_bus/msm_bus_dbg_voter.c +++ b/drivers/platform/msm/msm_bus/msm_bus_dbg_voter.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. * * This program is Mree software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -133,7 +133,7 @@ static ssize_t bus_floor_vote_store_api(struct device *dev, return 0; } - if (sscanf(buf, "%s %llu", name, &vote_khz) != 2) { + if (sscanf(buf, "%9s %llu", name, &vote_khz) != 2) { pr_err("%s:return error", __func__); return -EINVAL; } diff --git a/drivers/soc/qcom/jtag-fuse.c b/drivers/soc/qcom/jtag-fuse.c index 46de4e5f2026..d7389f397b9c 100644 --- a/drivers/soc/qcom/jtag-fuse.c +++ b/drivers/soc/qcom/jtag-fuse.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -152,8 +152,6 @@ static int jtag_fuse_probe(struct platform_device *pdev) drvdata = devm_kzalloc(dev, sizeof(*drvdata), GFP_KERNEL); if (!drvdata) return -ENOMEM; - /* Store the driver data pointer for use in exported functions */ - fusedrvdata = drvdata; drvdata->dev = &pdev->dev; platform_set_drvdata(pdev, drvdata); @@ -174,6 +172,8 @@ static int jtag_fuse_probe(struct platform_device *pdev) if (!drvdata->base) return -ENOMEM; + /* Store the driver data pointer for use in exported functions */ + fusedrvdata = drvdata; dev_info(dev, "JTag Fuse initialized\n"); return 0; } diff --git a/drivers/soc/qcom/qdsp6v2/apr.c b/drivers/soc/qcom/qdsp6v2/apr.c index 94d0b0dd21b2..9383ea9f4251 100644 --- a/drivers/soc/qcom/qdsp6v2/apr.c +++ b/drivers/soc/qcom/qdsp6v2/apr.c @@ -454,7 +454,7 @@ void apr_cb_func(void *buf, int len, void *priv) pr_debug("\n*****************\n"); if (!buf || len <= APR_HDR_SIZE) { - pr_err("APR: Improper apr pkt received:%p %d\n", buf, len); + pr_err("APR: Improper apr pkt received:%pK %d\n", buf, len); return; } hdr = buf; @@ -540,7 +540,7 @@ void apr_cb_func(void *buf, int len, void *priv) return; } pr_debug("svc_idx = %d\n", i); - pr_debug("%x %x %x %p %p\n", c_svc->id, c_svc->dest_id, + pr_debug("%x %x %x %pK %pK\n", c_svc->id, c_svc->dest_id, c_svc->client_id, c_svc->fn, c_svc->priv); data.payload_size = hdr->pkt_size - hdr_size; data.opcode = hdr->opcode; @@ -604,7 +604,7 @@ static void apr_reset_deregister(struct work_struct *work) container_of(work, struct apr_reset_work, work); handle = apr_reset->handle; - pr_debug("%s:handle[%p]\n", __func__, handle); + pr_debug("%s:handle[%pK]\n", __func__, handle); apr_deregister(handle); kfree(apr_reset); } @@ -637,7 +637,7 @@ int apr_deregister(void *handle) client[dest_id][client_id].svc_cnt--; if (!client[dest_id][client_id].svc_cnt) { svc->need_reset = 0x0; - pr_debug("%s: service is reset %p\n", __func__, svc); + pr_debug("%s: service is reset %pK\n", __func__, svc); } } @@ -665,7 +665,7 @@ void apr_reset(void *handle) if (!handle) return; - pr_debug("%s: handle[%p]\n", __func__, handle); + pr_debug("%s: handle[%pK]\n", __func__, handle); if (apr_reset_workqueue == NULL) { pr_err("%s: apr_reset_workqueue is NULL\n", __func__); diff --git a/drivers/soc/qcom/qdsp6v2/msm_audio_ion.c b/drivers/soc/qcom/qdsp6v2/msm_audio_ion.c index 09b8bda2f6c8..e63f60edf0d4 100644 --- a/drivers/soc/qcom/qdsp6v2/msm_audio_ion.c +++ b/drivers/soc/qcom/qdsp6v2/msm_audio_ion.c @@ -157,11 +157,11 @@ int msm_audio_ion_alloc(const char *name, struct ion_client **client, pr_err("%s: ION memory mapping for AUDIO failed\n", __func__); goto err_ion_handle; } - pr_debug("%s: mapped address = %p, size=%zd\n", __func__, + pr_debug("%s: mapped address = %pK, size=%zd\n", __func__, *vaddr, bufsz); if (bufsz != 0) { - pr_debug("%s: memset to 0 %p %zd\n", __func__, *vaddr, bufsz); + pr_debug("%s: memset to 0 %pK %zd\n", __func__, *vaddr, bufsz); memset((void *)*vaddr, 0, bufsz); } @@ -208,7 +208,7 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, bufsz should be 0 and fd shouldn't be 0 as of now */ *handle = ion_import_dma_buf(*client, fd); - pr_debug("%s: DMA Buf name=%s, fd=%d handle=%p\n", __func__, + pr_debug("%s: DMA Buf name=%s, fd=%d handle=%pK\n", __func__, name, fd, *handle); if (IS_ERR_OR_NULL((void *) (*handle))) { pr_err("%s: ion import dma buffer failed\n", @@ -239,7 +239,7 @@ int msm_audio_ion_import(const char *name, struct ion_client **client, rc = -ENOMEM; goto err_ion_handle; } - pr_debug("%s: mapped address = %p, size=%zd\n", __func__, + pr_debug("%s: mapped address = %pK, size=%zd\n", __func__, *vaddr, bufsz); return 0; @@ -321,7 +321,7 @@ int msm_audio_ion_mmap(struct audio_buffer *ab, offset = 0; } len = min(len, remainder); - pr_debug("vma=%p, addr=%x len=%ld vm_start=%x vm_end=%x vm_page_prot=%ld\n", + pr_debug("vma=%pK, addr=%x len=%ld vm_start=%x vm_end=%x vm_page_prot=%ld\n", vma, (unsigned int)addr, len, (unsigned int)vma->vm_start, (unsigned int)vma->vm_end, @@ -344,8 +344,8 @@ int msm_audio_ion_mmap(struct audio_buffer *ab, , __func__ , ret); return ret; } - pr_debug("phys=%pa len=%zd\n", &phys_addr, phys_len); - pr_debug("vma=%p, vm_start=%x vm_end=%x vm_pgoff=%ld vm_page_prot=%ld\n", + pr_debug("phys=%pK len=%zd\n", &phys_addr, phys_len); + pr_debug("vma=%pK, vm_start=%x vm_end=%x vm_pgoff=%ld vm_page_prot=%ld\n", vma, (unsigned int)vma->vm_start, (unsigned int)vma->vm_end, vma->vm_pgoff, (unsigned long int)vma->vm_page_prot); @@ -380,7 +380,7 @@ struct ion_client *msm_audio_ion_client_create(const char *name) void msm_audio_ion_client_destroy(struct ion_client *client) { - pr_debug("%s: client = %p smmu_enabled = %d\n", __func__, + pr_debug("%s: client = %pK smmu_enabled = %d\n", __func__, client, msm_audio_ion_data.smmu_enabled); ion_client_destroy(client); @@ -402,7 +402,7 @@ int msm_audio_ion_import_legacy(const char *name, struct ion_client *client, bufsz should be 0 and fd shouldn't be 0 as of now */ *handle = ion_import_dma_buf(client, fd); - pr_debug("%s: DMA Buf name=%s, fd=%d handle=%p\n", __func__, + pr_debug("%s: DMA Buf name=%s, fd=%d handle=%pK\n", __func__, name, fd, *handle); if (IS_ERR_OR_NULL((void *)(*handle))) { pr_err("%s: ion import dma buffer failed\n", @@ -468,7 +468,7 @@ int msm_audio_ion_cache_operations(struct audio_buffer *abuff, int cache_op) int msm_cache_ops = 0; if (!abuff) { - pr_err("Invalid params: %p, %p\n", __func__, abuff); + pr_err("%s: Invalid params: %pK\n", __func__, abuff); return -EINVAL; } rc = ion_handle_get_flags(abuff->client, abuff->handle, @@ -641,7 +641,7 @@ static int msm_audio_dma_buf_unmap(struct ion_client *client, if (!found) { dev_err(cb_dev, - "%s: cannot find allocation, ion_handle %p, ion_client %p", + "%s: cannot find allocation, ion_handle %pK, ion_client %pK", __func__, handle, client); rc = -EINVAL; } @@ -671,7 +671,7 @@ static int msm_audio_ion_get_phys(struct ion_client *client, rc = ion_phys(client, handle, addr, len); } - pr_debug("phys=%pa, len=%zd, rc=%d\n", &(*addr), *len, rc); + pr_debug("phys=%pK, len=%zd, rc=%d\n", &(*addr), *len, rc); err: return rc; } diff --git a/drivers/soc/qcom/scm.c b/drivers/soc/qcom/scm.c index 77f77fc4b80d..20d8689edc38 100644 --- a/drivers/soc/qcom/scm.c +++ b/drivers/soc/qcom/scm.c @@ -53,9 +53,16 @@ DEFINE_MUTEX(scm_lmh_lock); #define SMC_ATOMIC_MASK 0x80000000 #define IS_CALL_AVAIL_CMD 1 -#define SCM_BUF_LEN(__cmd_size, __resp_size) \ - (sizeof(struct scm_command) + sizeof(struct scm_response) + \ - __cmd_size + __resp_size) +#define SCM_BUF_LEN(__cmd_size, __resp_size) ({ \ + size_t x = __cmd_size + __resp_size; \ + size_t y = sizeof(struct scm_command) + sizeof(struct scm_response); \ + size_t result; \ + if (x < __cmd_size || (x + y) < x) \ + result = 0; \ + else \ + result = x + y; \ + result; \ + }) /** * struct scm_command - one SCM command buffer * @len: total available memory for command and response @@ -352,6 +359,9 @@ int scm_call_noalloc(u32 svc_id, u32 cmd_id, const void *cmd_buf, int ret; size_t len = SCM_BUF_LEN(cmd_len, resp_len); + if (len == 0) + return -EINVAL; + if (cmd_len > scm_buf_len || resp_len > scm_buf_len || len > scm_buf_len) return -EINVAL; @@ -657,10 +667,6 @@ int scm_call2(u32 fn_id, struct scm_desc *desc) desc->ret[0] = desc->ret[1] = desc->ret[2] = 0; - pr_debug("scm_call: func id %#llx, args: %#x, %#llx, %#llx, %#llx, %#llx\n", - x0, desc->arginfo, desc->args[0], desc->args[1], - desc->args[2], desc->x5); - if (scm_version == SCM_ARMV8_64) ret = __scm_call_armv8_64(x0, desc->arginfo, desc->args[0], desc->args[1], @@ -684,10 +690,8 @@ int scm_call2(u32 fn_id, struct scm_desc *desc) } while (ret == SCM_V2_EBUSY && (retry_count++ < SCM_EBUSY_MAX_RETRY)); if (ret < 0) - pr_err("scm_call failed: func id %#llx, arginfo: %#x, args: %#llx, %#llx, %#llx, %#llx, ret: %d, syscall returns: %#llx, %#llx, %#llx\n", - x0, desc->arginfo, desc->args[0], desc->args[1], - desc->args[2], desc->x5, ret, desc->ret[0], - desc->ret[1], desc->ret[2]); + pr_err("scm_call failed: func id %#llx, ret: %d, syscall returns: %#llx, %#llx, %#llx\n", + x0, ret, desc->ret[0], desc->ret[1], desc->ret[2]); if (arglen > N_REGISTER_ARGS) kfree(desc->extra_arg_buf); @@ -772,7 +776,7 @@ int scm_call(u32 svc_id, u32 cmd_id, const void *cmd_buf, size_t cmd_len, int ret; size_t len = SCM_BUF_LEN(cmd_len, resp_len); - if (cmd_len > len || resp_len > len) + if (len == 0 || PAGE_ALIGN(len) < len) return -EINVAL; cmd = kzalloc(PAGE_ALIGN(len), GFP_KERNEL); diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index dff1721de7ee..71f07333ff63 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -409,13 +409,22 @@ static void ion_handle_get(struct ion_handle *handle) kref_get(&handle->ref); } +static int ion_handle_put_nolock(struct ion_handle *handle) +{ + int ret; + + ret = kref_put(&handle->ref, ion_handle_destroy); + + return ret; +} + int ion_handle_put(struct ion_handle *handle) { struct ion_client *client = handle->client; int ret; mutex_lock(&client->lock); - ret = kref_put(&handle->ref, ion_handle_destroy); + ret = ion_handle_put_nolock(handle); mutex_unlock(&client->lock); return ret; @@ -439,20 +448,30 @@ static struct ion_handle *ion_handle_lookup(struct ion_client *client, return ERR_PTR(-EINVAL); } -struct ion_handle *ion_handle_get_by_id(struct ion_client *client, +static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client, int id) { struct ion_handle *handle; - mutex_lock(&client->lock); handle = idr_find(&client->idr, id); if (handle) ion_handle_get(handle); - mutex_unlock(&client->lock); return handle ? handle : ERR_PTR(-EINVAL); } +struct ion_handle *ion_handle_get_by_id(struct ion_client *client, + int id) +{ + struct ion_handle *handle; + + mutex_lock(&client->lock); + handle = ion_handle_get_by_id_nolock(client, id); + mutex_unlock(&client->lock); + + return handle; +} + static bool ion_handle_validate(struct ion_client *client, struct ion_handle *handle) { @@ -609,21 +628,27 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, } EXPORT_SYMBOL(ion_alloc); -void ion_free(struct ion_client *client, struct ion_handle *handle) +static void ion_free_nolock(struct ion_client *client, struct ion_handle *handle) { bool valid_handle; BUG_ON(client != handle->client); - mutex_lock(&client->lock); valid_handle = ion_handle_validate(client, handle); if (!valid_handle) { WARN(1, "%s: invalid handle passed to free.\n", __func__); - mutex_unlock(&client->lock); return; } + ion_handle_put_nolock(handle); +} + +void ion_free(struct ion_client *client, struct ion_handle *handle) +{ + BUG_ON(client != handle->client); + + mutex_lock(&client->lock); + ion_free_nolock(client, handle); mutex_unlock(&client->lock); - ion_handle_put(handle); } EXPORT_SYMBOL(ion_free); @@ -790,7 +815,7 @@ static int ion_debug_client_show(struct seq_file *s, void *unused) struct ion_handle *handle = rb_entry(n, struct ion_handle, node); - seq_printf(s, "%16.16s: %16zx : %16d : %12p", + seq_printf(s, "%16.16s: %16zx : %16d : %12pK", handle->buffer->heap->name, handle->buffer->size, atomic_read(&handle->ref.refcount), @@ -1187,7 +1212,7 @@ static void ion_vm_open(struct vm_area_struct *vma) mutex_lock(&buffer->lock); list_add(&vma_list->list, &buffer->vmas); mutex_unlock(&buffer->lock); - pr_debug("%s: adding %p\n", __func__, vma); + pr_debug("%s: adding %pK\n", __func__, vma); } static void ion_vm_close(struct vm_area_struct *vma) @@ -1202,7 +1227,7 @@ static void ion_vm_close(struct vm_area_struct *vma) continue; list_del(&vma_list->list); kfree(vma_list); - pr_debug("%s: deleting %p\n", __func__, vma); + pr_debug("%s: deleting %pK\n", __func__, vma); break; } mutex_unlock(&buffer->lock); @@ -1490,11 +1515,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) { struct ion_handle *handle; - handle = ion_handle_get_by_id(client, data.handle.handle); - if (IS_ERR(handle)) + mutex_lock(&client->lock); + handle = ion_handle_get_by_id_nolock(client, data.handle.handle); + if (IS_ERR(handle)) { + mutex_unlock(&client->lock); return PTR_ERR(handle); - ion_free(client, handle); - ion_handle_put(handle); + } + ion_free_nolock(client, handle); + ion_handle_put_nolock(handle); + mutex_unlock(&client->lock); break; } case ION_IOC_SHARE: diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c index aaea7bed36e1..b2e1a4c1b170 100644 --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -94,7 +94,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, /* keep this for memory release */ buffer->priv_virt = info; - dev_dbg(dev, "Allocate buffer %p\n", buffer); + dev_dbg(dev, "Allocate buffer %pK\n", buffer); return 0; err: @@ -107,7 +107,7 @@ static void ion_cma_free(struct ion_buffer *buffer) struct device *dev = buffer->heap->priv; struct ion_cma_buffer_info *info = buffer->priv_virt; - dev_dbg(dev, "Release buffer %p\n", buffer); + dev_dbg(dev, "Release buffer %pK\n", buffer); /* release memory */ dma_free_coherent(dev, buffer->size, info->cpu_addr, info->handle); sg_free_table(info->table); @@ -123,7 +123,7 @@ static int ion_cma_phys(struct ion_heap *heap, struct ion_buffer *buffer, struct device *dev = heap->priv; struct ion_cma_buffer_info *info = buffer->priv_virt; - dev_dbg(dev, "Return buffer %p physical address %pa\n", buffer, + dev_dbg(dev, "Return buffer %pK physical address %pa\n", buffer, &info->handle); *addr = info->handle; diff --git a/drivers/staging/android/ion/ion_cma_secure_heap.c b/drivers/staging/android/ion/ion_cma_secure_heap.c index d945b9251437..90ae7eb65b65 100644 --- a/drivers/staging/android/ion/ion_cma_secure_heap.c +++ b/drivers/staging/android/ion/ion_cma_secure_heap.c @@ -3,7 +3,7 @@ * * Copyright (C) Linaro 2012 * Author: for ST-Ericsson. - * Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -501,7 +501,7 @@ static struct ion_secure_cma_buffer_info *__ion_secure_cma_allocate( /* keep this for memory release */ buffer->priv_virt = info; - dev_dbg(sheap->dev, "Allocate buffer %p\n", buffer); + dev_dbg(sheap->dev, "Allocate buffer %pK\n", buffer); return info; err: @@ -634,7 +634,7 @@ static struct ion_secure_cma_buffer_info *__ion_secure_cma_allocate_non_contig( sg = sg_next(sg); } buffer->priv_virt = info; - dev_dbg(sheap->dev, "Allocate buffer %p\n", buffer); + dev_dbg(sheap->dev, "Allocate buffer %pK\n", buffer); return info; err2: @@ -721,7 +721,7 @@ static void ion_secure_cma_free(struct ion_buffer *buffer) struct ion_secure_cma_buffer_info *info = buffer->priv_virt; int ret = 0; - dev_dbg(sheap->dev, "Release buffer %p\n", buffer); + dev_dbg(sheap->dev, "Release buffer %pK\n", buffer); if (msm_secure_v2_is_supported()) ret = msm_unsecure_table(info->table); atomic_sub(buffer->size, &sheap->total_allocated); @@ -743,8 +743,8 @@ static int ion_secure_cma_phys(struct ion_heap *heap, struct ion_buffer *buffer, container_of(heap, struct ion_cma_secure_heap, heap); struct ion_secure_cma_buffer_info *info = buffer->priv_virt; - dev_dbg(sheap->dev, "Return buffer %p physical address 0x%pa\n", buffer, - &info->phys); + dev_dbg(sheap->dev, "Return buffer %pK physical address 0x%pa\n", + buffer, &info->phys); *addr = info->phys; *len = buffer->size; diff --git a/drivers/staging/android/ion/msm/msm_ion.c b/drivers/staging/android/ion/msm/msm_ion.c index b67b36a2a5ee..dddcfa028b55 100644 --- a/drivers/staging/android/ion/msm/msm_ion.c +++ b/drivers/staging/android/ion/msm/msm_ion.c @@ -693,7 +693,7 @@ long msm_ion_custom_ioctl(struct ion_client *client, } else { handle = ion_import_dma_buf(client, data.flush_data.fd); if (IS_ERR(handle)) { - pr_info("%s: Could not import handle: %p\n", + pr_info("%s: Could not import handle: %pK\n", __func__, handle); return -EINVAL; } @@ -706,7 +706,7 @@ long msm_ion_custom_ioctl(struct ion_client *client, + data.flush_data.length; if (start && check_vaddr_bounds(start, end)) { - pr_err("%s: virtual address %p is out of bounds\n", + pr_err("%s: virtual address %pK is out of bounds\n", __func__, data.flush_data.vaddr); ret = -EINVAL; } else { diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index a85eadff6bea..dfcb5f8b8f18 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -1202,10 +1202,11 @@ static int proc_getdriver(struct usb_dev_state *ps, void __user *arg) static int proc_connectinfo(struct usb_dev_state *ps, void __user *arg) { - struct usbdevfs_connectinfo ci = { - .devnum = ps->dev->devnum, - .slow = ps->dev->speed == USB_SPEED_LOW - }; + struct usbdevfs_connectinfo ci; + + memset(&ci, 0, sizeof(ci)); + ci.devnum = ps->dev->devnum; + ci.slow = ps->dev->speed == USB_SPEED_LOW; if (copy_to_user(arg, &ci, sizeof(ci))) return -EFAULT; diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 67160a0f0515..ea08fd7eb891 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -690,7 +690,6 @@ static void ffs_user_copy_worker(struct work_struct *work) usb_ep_free_request(io_data->ep, io_data->req); - io_data->kiocb->private = NULL; if (io_data->read) kfree(io_data->iovec); kfree(io_data->buf); diff --git a/drivers/usb/gadget/function/f_mbim.c b/drivers/usb/gadget/function/f_mbim.c index 64b0ee43be36..ea10a02f0262 100644 --- a/drivers/usb/gadget/function/f_mbim.c +++ b/drivers/usb/gadget/function/f_mbim.c @@ -741,7 +741,7 @@ static void mbim_notify_complete(struct usb_ep *ep, struct usb_request *req) struct f_mbim *mbim = req->context; struct usb_cdc_notification *event = req->buf; - pr_debug("dev:%p\n", mbim); + pr_debug("dev:%pK\n", mbim); spin_lock(&mbim->lock); switch (req->status) { @@ -771,7 +771,7 @@ static void mbim_notify_complete(struct usb_ep *ep, struct usb_request *req) mbim_do_notify(mbim); spin_unlock(&mbim->lock); - pr_debug("dev:%p Exit\n", mbim); + pr_debug("dev:%pK Exit\n", mbim); } static void mbim_ep0out_complete(struct usb_ep *ep, struct usb_request *req) @@ -782,7 +782,7 @@ static void mbim_ep0out_complete(struct usb_ep *ep, struct usb_request *req) struct f_mbim *mbim = func_to_mbim(f); struct mbim_ntb_input_size *ntb = NULL; - pr_debug("dev:%p\n", mbim); + pr_debug("dev:%pK\n", mbim); req->context = NULL; if (req->status || req->actual != req->length) { @@ -820,7 +820,7 @@ static void mbim_ep0out_complete(struct usb_ep *ep, struct usb_request *req) invalid: usb_ep_set_halt(ep); - pr_err("dev:%p Failed\n", mbim); + pr_err("dev:%pK Failed\n", mbim); return; } @@ -855,7 +855,7 @@ fmbim_cmd_complete(struct usb_ep *ep, struct usb_request *req) if (!first_command_sent) first_command_sent = true; - pr_debug("dev:%p port#%d\n", dev, dev->port_num); + pr_debug("dev:%pK port#%d\n", dev, dev->port_num); cpkt = mbim_alloc_ctrl_pkt(len, GFP_ATOMIC); if (!cpkt) { @@ -1195,7 +1195,7 @@ static int mbim_set_alt(struct usb_function *f, unsigned intf, unsigned alt) return ret; } - pr_info("Set mbim port in_desc = 0x%p\n", + pr_info("Set mbim port in_desc = 0x%pK\n", mbim->bam_port.in->desc); ret = config_ep_by_speed(cdev->gadget, f, @@ -1207,7 +1207,7 @@ static int mbim_set_alt(struct usb_function *f, unsigned intf, unsigned alt) return ret; } - pr_info("Set mbim port out_desc = 0x%p\n", + pr_info("Set mbim port out_desc = 0x%pK\n", mbim->bam_port.out->desc); pr_debug("Activate mbim\n"); @@ -1840,7 +1840,7 @@ mbim_write(struct file *fp, const char __user *buf, size_t count, loff_t *pos) pr_debug("Enter(%zu)\n", count); if (!dev || !req || !req->buf) { - pr_err("%s: dev %p req %p req->buf %p\n", + pr_err("%s: dev %pK req %pK req->buf %pK\n", __func__, dev, req, req ? req->buf : req); return -ENODEV; } @@ -1862,7 +1862,7 @@ mbim_write(struct file *fp, const char __user *buf, size_t count, loff_t *pos) } if (dev->not_port.notify_state != MBIM_NOTIFY_RESPONSE_AVAILABLE) { - pr_err("dev:%p state=%d error\n", dev, + pr_err("dev:%pK state=%d error\n", dev, dev->not_port.notify_state); mbim_unlock(&dev->write_excl); return -EINVAL; diff --git a/drivers/usb/gadget/function/u_ctrl_hsic.c b/drivers/usb/gadget/function/u_ctrl_hsic.c index 7bbf4e4705fa..ff411d182783 100644 --- a/drivers/usb/gadget/function/u_ctrl_hsic.c +++ b/drivers/usb/gadget/function/u_ctrl_hsic.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011, 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2011, 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -574,7 +574,7 @@ static ssize_t gctrl_read_stats(struct file *file, char __user *ubuf, temp += scnprintf(buf + temp, DEBUG_BUF_SIZE - temp, "\nName: %s\n" - "#PORT:%d port: %p\n" + "#PORT:%d port: %pK\n" "to_usbhost: %lu\n" "to_modem: %lu\n" "cpkt_drp_cnt: %lu\n" diff --git a/drivers/usb/gadget/function/u_data_hsic.c b/drivers/usb/gadget/function/u_data_hsic.c index 07bb5a8fac5f..a4db3b59fb8d 100644 --- a/drivers/usb/gadget/function/u_data_hsic.c +++ b/drivers/usb/gadget/function/u_data_hsic.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2011-2014, Linux Foundation. All rights reserved. +/* Copyright (c) 2011-2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -156,7 +156,7 @@ static int ghsic_data_alloc_requests(struct usb_ep *ep, struct list_head *head, struct usb_request *req; unsigned long flags; - pr_debug("%s: ep:%s head:%p num:%d cb:%p", __func__, + pr_debug("%s: ep:%s head:%pK num:%d cb:%pK", __func__, ep->name, head, num, cb); for (i = 0; i < num; i++) { @@ -272,7 +272,7 @@ static int ghsic_data_receive(void *p, void *data, size_t len) return -ENOTCONN; } - pr_debug("%s: p:%p#%d skb_len:%d\n", __func__, + pr_debug("%s: p:%pK#%d skb_len:%d\n", __func__, port, port->port_num, skb->len); spin_lock_irqsave(&port->tx_lock, flags); @@ -316,7 +316,7 @@ static void ghsic_data_write_tomdm(struct work_struct *w) } while ((skb = __skb_dequeue(&port->rx_skb_q))) { - pr_debug("%s: port:%p tom:%lu pno:%d\n", __func__, + pr_debug("%s: port:%pK tom:%lu pno:%d\n", __func__, port, port->to_modem, port->port_num); info = (struct timestamp_info *)skb->cb; @@ -424,7 +424,7 @@ static void ghsic_data_start_rx(struct gdata_port *port) struct timestamp_info *info; unsigned int created; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -481,7 +481,7 @@ static void ghsic_data_start_io(struct gdata_port *port) struct usb_ep *ep_out, *ep_in; int ret; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); if (!port) return; @@ -543,7 +543,7 @@ static void ghsic_data_connect_w(struct work_struct *w) !test_bit(CH_READY, &port->bridge_sts)) return; - pr_debug("%s: port:%p\n", __func__, port); + pr_debug("%s: port:%pK\n", __func__, port); ret = data_bridge_open(&port->brdg); if (ret) { @@ -855,14 +855,14 @@ int ghsic_data_connect(void *gptr, int port_num) ret = usb_ep_enable(port->in); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:IN ep:%p", + pr_err("%s: usb_ep_enable failed eptype:IN ep:%pK", __func__, port->in); goto fail; } if (port->out) { ret = usb_ep_enable(port->out); if (ret) { - pr_err("%s: usb_ep_enable failed eptype:OUT ep:%p", + pr_err("%s: usb_ep_enable failed eptype:OUT ep:%pK", __func__, port->out); usb_ep_disable(port->in); goto fail; @@ -939,7 +939,7 @@ static void dbg_timestamp(char *event, struct sk_buff * skb) write_lock_irqsave(&dbg_data.lck, flags); scnprintf(dbg_data.buf[dbg_data.idx], DBG_DATA_MSG, - "%p %u[%s] %u %u %u %u %u %u\n", + "%pK %u[%s] %u %u %u %u %u %u\n", skb, skb->len, event, info->created, info->rx_queued, info->rx_done, info->rx_done_sent, info->tx_queued, get_timestamp()); @@ -1013,7 +1013,7 @@ static ssize_t ghsic_data_read_stats(struct file *file, spin_lock_irqsave(&port->rx_lock, flags); temp += scnprintf(buf + temp, DEBUG_DATA_BUF_SIZE - temp, "\nName: %s\n" - "#PORT:%d port#: %p\n" + "#PORT:%d port#: %pK\n" "data_ch_open: %d\n" "data_ch_ready: %d\n" "\n******UL INFO*****\n\n" diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c index 60afb39eb73c..c53fbb3e0b8c 100644 --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -544,6 +544,11 @@ static int treo_attach(struct usb_serial *serial) (serial->num_interrupt_in == 0)) return 0; + if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) { + dev_err(&serial->interface->dev, "missing endpoints\n"); + return -ENODEV; + } + /* * It appears that Treos and Kyoceras want to use the * 1st bulk in endpoint to communicate with the 2nd bulk out endpoint, diff --git a/drivers/video/fbdev/core/fbcmap.c b/drivers/video/fbdev/core/fbcmap.c index 8bfba4242791..fcad1cd157fb 100644 --- a/drivers/video/fbdev/core/fbcmap.c +++ b/drivers/video/fbdev/core/fbcmap.c @@ -166,6 +166,9 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) int tooff = 0, fromoff = 0; int size; + if ((int)(to->start) < 0) + return -EINVAL; + if (to->start > from->start) fromoff = to->start - from->start; else diff --git a/drivers/video/msm/mdss/mdss_dsi.c b/drivers/video/msm/mdss/mdss_dsi.c index 2a63695cfd71..91bc35803b02 100755 --- a/drivers/video/msm/mdss/mdss_dsi.c +++ b/drivers/video/msm/mdss/mdss_dsi.c @@ -2868,7 +2868,7 @@ static int mdss_dsi_ctrl_clock_init(struct platform_device *ctrl_pdev, error_clk_client_deregister: mdss_dsi_clk_deregister(ctrl_pdata->dsi_clk_handle); error_clk_deinit: - mdss_dsi_clk_deinit(ctrl_pdata); + mdss_dsi_clk_deinit(ctrl_pdata->clk_mngr); error_link_clk_deinit: mdss_dsi_link_clk_deinit(&ctrl_pdev->dev, ctrl_pdata); return rc; diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c index d41843181818..e770c1ee4613 100644 --- a/fs/ext4/ext4_jbd2.c +++ b/fs/ext4/ext4_jbd2.c @@ -88,13 +88,13 @@ int __ext4_journal_stop(const char *where, unsigned int line, handle_t *handle) return 0; } + err = handle->h_err; if (!handle->h_transaction) { - err = jbd2_journal_stop(handle); - return handle->h_err ? handle->h_err : err; + rc = jbd2_journal_stop(handle); + return err ? err : rc; } sb = handle->h_transaction->t_journal->j_private; - err = handle->h_err; rc = jbd2_journal_stop(handle); if (!err) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index b5fcb1ac0dd7..9ae86f5fcd8d 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -375,9 +375,13 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext) ext4_fsblk_t block = ext4_ext_pblock(ext); int len = ext4_ext_get_actual_len(ext); ext4_lblk_t lblock = le32_to_cpu(ext->ee_block); - ext4_lblk_t last = lblock + len - 1; - if (len == 0 || lblock > last) + /* + * We allow neither: + * - zero length + * - overflow/wrap-around + */ + if (lblock + len <= lblock) return 0; return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len); } diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c index 777f74370143..761a3fd198b8 100644 --- a/fs/ext4/inode.c +++ b/fs/ext4/inode.c @@ -3408,6 +3408,7 @@ int ext4_can_truncate(struct inode *inode) int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) { +#if 0 struct super_block *sb = inode->i_sb; ext4_lblk_t first_block, stop_block; struct address_space *mapping = inode->i_mapping; @@ -3531,6 +3532,12 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) out_mutex: mutex_unlock(&inode->i_mutex); return ret; +#else + /* + * Disabled as per b/28760453 + */ + return -EOPNOTSUPP; +#endif } int ext4_inode_attach_jinode(struct inode *inode) @@ -4841,6 +4848,8 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) might_sleep(); trace_ext4_mark_inode_dirty(inode, _RET_IP_); err = ext4_reserve_inode_write(handle, inode, &iloc); + if (err) + return err; if (ext4_handle_valid(handle) && EXT4_I(inode)->i_extra_isize < sbi->s_want_extra_isize && !ext4_test_inode_state(inode, EXT4_STATE_NO_EXPAND)) { @@ -4871,9 +4880,7 @@ int ext4_mark_inode_dirty(handle_t *handle, struct inode *inode) } } } - if (!err) - err = ext4_mark_iloc_dirty(handle, inode, &iloc); - return err; + return ext4_mark_iloc_dirty(handle, inode, &iloc); } /* diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 447486425b8c..d3a22a11ac76 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2598,7 +2598,7 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) * list entries can cause panics at unmount time. */ mutex_lock(&sbi->s_orphan_lock); - list_del(&EXT4_I(inode)->i_orphan); + list_del_init(&EXT4_I(inode)->i_orphan); mutex_unlock(&sbi->s_orphan_lock); } } diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c index ca4588388fc3..77c81c64a47e 100644 --- a/fs/ext4/resize.c +++ b/fs/ext4/resize.c @@ -186,7 +186,7 @@ static struct ext4_new_flex_group_data *alloc_flex_gd(unsigned long flexbg_size) if (flex_gd == NULL) goto out3; - if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_flex_group_data)) + if (flexbg_size >= UINT_MAX / sizeof(struct ext4_new_group_data)) goto out2; flex_gd->count = flexbg_size; diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c index ff2f2e6ad311..2abbb2babcae 100644 --- a/fs/jbd2/transaction.c +++ b/fs/jbd2/transaction.c @@ -1087,6 +1087,7 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh) JBUFFER_TRACE(jh, "file as BJ_Reserved"); spin_lock(&journal->j_list_lock); __jbd2_journal_file_buffer(jh, transaction, BJ_Reserved); + spin_unlock(&journal->j_list_lock); } else if (jh->b_transaction == journal->j_committing_transaction) { /* first access by this transaction */ jh->b_modified = 0; @@ -1094,8 +1095,8 @@ int jbd2_journal_get_create_access(handle_t *handle, struct buffer_head *bh) JBUFFER_TRACE(jh, "set next transaction"); spin_lock(&journal->j_list_lock); jh->b_next_transaction = transaction; + spin_unlock(&journal->j_list_lock); } - spin_unlock(&journal->j_list_lock); jbd_unlock_bh_state(bh); /* diff --git a/include/net/tcp.h b/include/net/tcp.h index e3308f5a03cc..87045aaa8518 100755 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1446,6 +1446,8 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli { if (sk->sk_send_head == skb_unlinked) sk->sk_send_head = NULL; + if (tcp_sk(sk)->highest_sack == skb_unlinked) + tcp_sk(sk)->highest_sack = NULL; } static inline void tcp_init_send_head(struct sock *sk) diff --git a/include/sound/q6asm-v2.h b/include/sound/q6asm-v2.h index 44c216907006..2c2ee07578d5 100644 --- a/include/sound/q6asm-v2.h +++ b/include/sound/q6asm-v2.h @@ -211,7 +211,7 @@ struct audio_client *q6asm_get_audio_client(int session_id); int q6asm_audio_client_buf_alloc(unsigned int dir/* 1:Out,0:In */, struct audio_client *ac, unsigned int bufsz, - unsigned int bufcnt); + uint32_t bufcnt); int q6asm_audio_client_buf_alloc_contiguous(unsigned int dir /* 1:Out,0:In */, struct audio_client *ac, diff --git a/include/trace/events/net.h b/include/trace/events/net.h index 1de256b35807..c978ecadbb7c 100644 --- a/include/trace/events/net.h +++ b/include/trace/events/net.h @@ -57,7 +57,7 @@ TRACE_EVENT(net_dev_start_xmit, __entry->gso_type = skb_shinfo(skb)->gso_type; ), - TP_printk("dev=%s queue_mapping=%u skbaddr=%p vlan_tagged=%d vlan_proto=0x%04x vlan_tci=0x%04x protocol=0x%04x ip_summed=%d len=%u data_len=%u network_offset=%d transport_offset_valid=%d transport_offset=%d tx_flags=%d gso_size=%d gso_segs=%d gso_type=%#x", + TP_printk("dev=%s queue_mapping=%u skbaddr=%pK vlan_tagged=%d vlan_proto=0x%04x vlan_tci=0x%04x protocol=0x%04x ip_summed=%d len=%u data_len=%u network_offset=%d transport_offset_valid=%d transport_offset=%d tx_flags=%d gso_size=%d gso_segs=%d gso_type=%#x", __get_str(name), __entry->queue_mapping, __entry->skbaddr, __entry->vlan_tagged, __entry->vlan_proto, __entry->vlan_tci, __entry->protocol, __entry->ip_summed, __entry->len, @@ -90,7 +90,7 @@ TRACE_EVENT(net_dev_xmit, __assign_str(name, dev->name); ), - TP_printk("dev=%s skbaddr=%p len=%u rc=%d", + TP_printk("dev=%s skbaddr=%pK len=%u rc=%d", __get_str(name), __entry->skbaddr, __entry->len, __entry->rc) ); @@ -112,7 +112,7 @@ DECLARE_EVENT_CLASS(net_dev_template, __assign_str(name, skb->dev->name); ), - TP_printk("dev=%s skbaddr=%p len=%u", + TP_printk("dev=%s skbaddr=%pK len=%u", __get_str(name), __entry->skbaddr, __entry->len) ) @@ -191,7 +191,7 @@ DECLARE_EVENT_CLASS(net_dev_rx_verbose_template, __entry->gso_type = skb_shinfo(skb)->gso_type; ), - TP_printk("dev=%s napi_id=%#x queue_mapping=%u skbaddr=%p vlan_tagged=%d vlan_proto=0x%04x vlan_tci=0x%04x protocol=0x%04x ip_summed=%d hash=0x%08x l4_hash=%d len=%u data_len=%u truesize=%u mac_header_valid=%d mac_header=%d nr_frags=%d gso_size=%d gso_type=%#x", + TP_printk("dev=%s napi_id=%#x queue_mapping=%u skbaddr=%pK vlan_tagged=%d vlan_proto=0x%04x vlan_tci=0x%04x protocol=0x%04x ip_summed=%d hash=0x%08x l4_hash=%d len=%u data_len=%u truesize=%u mac_header_valid=%d mac_header=%d nr_frags=%d gso_size=%d gso_type=%#x", __get_str(name), __entry->napi_id, __entry->queue_mapping, __entry->skbaddr, __entry->vlan_tagged, __entry->vlan_proto, __entry->vlan_tci, __entry->protocol, __entry->ip_summed, diff --git a/kernel/cgroup.c b/kernel/cgroup.c index fb77cf140207..59591ce7fb2c 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -5515,7 +5515,7 @@ static int cgroup_css_links_read(struct seq_file *seq, void *v) struct task_struct *task; int count = 0; - seq_printf(seq, "css_set %p\n", cset); + seq_printf(seq, "css_set %pK\n", cset); list_for_each_entry(task, &cset->tasks, cg_list) { if (count++ > MAX_TASKS_SHOWN_PER_CSS) diff --git a/kernel/events/core.c b/kernel/events/core.c index 83dbf36ab7a8..25d5a021b1e8 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -911,6 +911,77 @@ static void put_ctx(struct perf_event_context *ctx) } } +/* + * Because of perf_event::ctx migration in sys_perf_event_open::move_group and + * perf_pmu_migrate_context() we need some magic. + * + * Those places that change perf_event::ctx will hold both + * perf_event_ctx::mutex of the 'old' and 'new' ctx value. + * + * Lock ordering is by mutex address. There is one other site where + * perf_event_context::mutex nests and that is put_event(). But remember that + * that is a parent<->child context relation, and migration does not affect + * children, therefore these two orderings should not interact. + * + * The change in perf_event::ctx does not affect children (as claimed above) + * because the sys_perf_event_open() case will install a new event and break + * the ctx parent<->child relation, and perf_pmu_migrate_context() is only + * concerned with cpuctx and that doesn't have children. + * + * The places that change perf_event::ctx will issue: + * + * perf_remove_from_context(); + * synchronize_rcu(); + * perf_install_in_context(); + * + * to affect the change. The remove_from_context() + synchronize_rcu() should + * quiesce the event, after which we can install it in the new location. This + * means that only external vectors (perf_fops, prctl) can perturb the event + * while in transit. Therefore all such accessors should also acquire + * perf_event_context::mutex to serialize against this. + * + * However; because event->ctx can change while we're waiting to acquire + * ctx->mutex we must be careful and use the below perf_event_ctx_lock() + * function. + * + * Lock order: + * task_struct::perf_event_mutex + * perf_event_context::mutex + * perf_event_context::lock + * perf_event::child_mutex; + * perf_event::mmap_mutex + * mmap_sem + */ +static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event) +{ + struct perf_event_context *ctx; + +again: + rcu_read_lock(); + ctx = ACCESS_ONCE(event->ctx); + if (!atomic_inc_not_zero(&ctx->refcount)) { + rcu_read_unlock(); + goto again; + } + rcu_read_unlock(); + + mutex_lock(&ctx->mutex); + if (event->ctx != ctx) { + mutex_unlock(&ctx->mutex); + put_ctx(ctx); + goto again; + } + + return ctx; +} + +static void perf_event_ctx_unlock(struct perf_event *event, + struct perf_event_context *ctx) +{ + mutex_unlock(&ctx->mutex); + put_ctx(ctx); +} + /* * This must be done under the ctx->lock, such as to serialize against * context_equiv(), therefore we cannot call put_ctx() since that might end up @@ -1690,7 +1761,7 @@ int __perf_event_disable(void *info) * is the current context on this CPU and preemption is disabled, * hence we can't get into perf_event_task_sched_out for this context. */ -void perf_event_disable(struct perf_event *event) +static void _perf_event_disable(struct perf_event *event) { struct perf_event_context *ctx = event->ctx; struct task_struct *task = ctx->task; @@ -1731,6 +1802,19 @@ void perf_event_disable(struct perf_event *event) } raw_spin_unlock_irq(&ctx->lock); } + +/* + * Strictly speaking kernel users cannot create groups and therefore this + * interface does not need the perf_event_ctx_lock() magic. + */ +void perf_event_disable(struct perf_event *event) +{ + struct perf_event_context *ctx; + + ctx = perf_event_ctx_lock(event); + _perf_event_disable(event); + perf_event_ctx_unlock(event, ctx); +} EXPORT_SYMBOL_GPL(perf_event_disable); static void perf_set_shadow_time(struct perf_event *event, @@ -2194,7 +2278,7 @@ static int __perf_event_enable(void *info) * perf_event_for_each_child or perf_event_for_each as described * for perf_event_disable. */ -void perf_event_enable(struct perf_event *event) +static void _perf_event_enable(struct perf_event *event) { struct perf_event_context *ctx = event->ctx; struct task_struct *task = ctx->task; @@ -2250,9 +2334,21 @@ void perf_event_enable(struct perf_event *event) out: raw_spin_unlock_irq(&ctx->lock); } + +/* + * See perf_event_disable(); + */ +void perf_event_enable(struct perf_event *event) +{ + struct perf_event_context *ctx; + + ctx = perf_event_ctx_lock(event); + _perf_event_enable(event); + perf_event_ctx_unlock(event, ctx); +} EXPORT_SYMBOL_GPL(perf_event_enable); -int perf_event_refresh(struct perf_event *event, int refresh) +static int _perf_event_refresh(struct perf_event *event, int refresh) { /* * not supported on inherited events @@ -2261,10 +2357,25 @@ int perf_event_refresh(struct perf_event *event, int refresh) return -EINVAL; atomic_add(refresh, &event->event_limit); - perf_event_enable(event); + _perf_event_enable(event); return 0; } + +/* + * See perf_event_disable() + */ +int perf_event_refresh(struct perf_event *event, int refresh) +{ + struct perf_event_context *ctx; + int ret; + + ctx = perf_event_ctx_lock(event); + ret = _perf_event_refresh(event, refresh); + perf_event_ctx_unlock(event, ctx); + + return ret; +} EXPORT_SYMBOL_GPL(perf_event_refresh); static void ctx_sched_out(struct perf_event_context *ctx, @@ -3462,7 +3573,16 @@ static void perf_remove_from_owner(struct perf_event *event) rcu_read_unlock(); if (owner) { - mutex_lock(&owner->perf_event_mutex); + /* + * If we're here through perf_event_exit_task() we're already + * holding ctx->mutex which would be an inversion wrt. the + * normal lock order. + * + * However we can safely take this lock because its the child + * ctx->mutex. + */ + mutex_lock_nested(&owner->perf_event_mutex, SINGLE_DEPTH_NESTING); + /* * We have to re-check the event->owner field, if it is cleared * we raced with perf_event_exit_task(), acquiring the mutex @@ -3597,12 +3717,13 @@ static int perf_event_read_group(struct perf_event *event, u64 read_format, char __user *buf) { struct perf_event *leader = event->group_leader, *sub; - int n = 0, size = 0, ret = -EFAULT; struct perf_event_context *ctx = leader->ctx; - u64 values[5]; + int n = 0, size = 0, ret; u64 count, enabled, running; + u64 values[5]; + + lockdep_assert_held(&ctx->mutex); - mutex_lock(&ctx->mutex); count = perf_event_read_value(leader, &enabled, &running); values[n++] = 1 + leader->nr_siblings; @@ -3617,7 +3738,7 @@ static int perf_event_read_group(struct perf_event *event, size = n * sizeof(u64); if (copy_to_user(buf, values, size)) - goto unlock; + return -EFAULT; ret = size; @@ -3631,14 +3752,11 @@ static int perf_event_read_group(struct perf_event *event, size = n * sizeof(u64); if (copy_to_user(buf + ret, values, size)) { - ret = -EFAULT; - goto unlock; + return -EFAULT; } ret += size; } -unlock: - mutex_unlock(&ctx->mutex); return ret; } @@ -3710,8 +3828,14 @@ static ssize_t perf_read(struct file *file, char __user *buf, size_t count, loff_t *ppos) { struct perf_event *event = file->private_data; + struct perf_event_context *ctx; + int ret; - return perf_read_hw(event, buf, count); + ctx = perf_event_ctx_lock(event); + ret = perf_read_hw(event, buf, count); + perf_event_ctx_unlock(event, ctx); + + return ret; } static unsigned int perf_poll(struct file *file, poll_table *wait) @@ -3737,7 +3861,7 @@ static unsigned int perf_poll(struct file *file, poll_table *wait) return events; } -static void perf_event_reset(struct perf_event *event) +static void _perf_event_reset(struct perf_event *event) { (void)perf_event_read(event); local64_set(&event->count, 0); @@ -3756,6 +3880,7 @@ static void perf_event_for_each_child(struct perf_event *event, struct perf_event *child; WARN_ON_ONCE(event->ctx->parent_ctx); + mutex_lock(&event->child_mutex); func(event); list_for_each_entry(child, &event->child_list, child_list) @@ -3769,14 +3894,13 @@ static void perf_event_for_each(struct perf_event *event, struct perf_event_context *ctx = event->ctx; struct perf_event *sibling; - WARN_ON_ONCE(ctx->parent_ctx); - mutex_lock(&ctx->mutex); + lockdep_assert_held(&ctx->mutex); + event = event->group_leader; perf_event_for_each_child(event, func); list_for_each_entry(sibling, &event->sibling_list, group_entry) perf_event_for_each_child(sibling, func); - mutex_unlock(&ctx->mutex); } static int perf_event_period(struct perf_event *event, u64 __user *arg) @@ -3846,25 +3970,24 @@ static int perf_event_set_output(struct perf_event *event, struct perf_event *output_event); static int perf_event_set_filter(struct perf_event *event, void __user *arg); -static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned long arg) { - struct perf_event *event = file->private_data; void (*func)(struct perf_event *); u32 flags = arg; switch (cmd) { case PERF_EVENT_IOC_ENABLE: - func = perf_event_enable; + func = _perf_event_enable; break; case PERF_EVENT_IOC_DISABLE: - func = perf_event_disable; + func = _perf_event_disable; break; case PERF_EVENT_IOC_RESET: - func = perf_event_reset; + func = _perf_event_reset; break; case PERF_EVENT_IOC_REFRESH: - return perf_event_refresh(event, arg); + return _perf_event_refresh(event, arg); case PERF_EVENT_IOC_PERIOD: return perf_event_period(event, (u64 __user *)arg); @@ -3911,6 +4034,19 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) return 0; } +static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) +{ + struct perf_event *event = file->private_data; + struct perf_event_context *ctx; + long ret; + + ctx = perf_event_ctx_lock(event); + ret = _perf_ioctl(event, cmd, arg); + perf_event_ctx_unlock(event, ctx); + + return ret; +} + #ifdef CONFIG_COMPAT static long perf_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg) @@ -3933,11 +4069,15 @@ static long perf_compat_ioctl(struct file *file, unsigned int cmd, int perf_event_task_enable(void) { + struct perf_event_context *ctx; struct perf_event *event; mutex_lock(¤t->perf_event_mutex); - list_for_each_entry(event, ¤t->perf_event_list, owner_entry) - perf_event_for_each_child(event, perf_event_enable); + list_for_each_entry(event, ¤t->perf_event_list, owner_entry) { + ctx = perf_event_ctx_lock(event); + perf_event_for_each_child(event, _perf_event_enable); + perf_event_ctx_unlock(event, ctx); + } mutex_unlock(¤t->perf_event_mutex); return 0; @@ -3945,11 +4085,15 @@ int perf_event_task_enable(void) int perf_event_task_disable(void) { + struct perf_event_context *ctx; struct perf_event *event; mutex_lock(¤t->perf_event_mutex); - list_for_each_entry(event, ¤t->perf_event_list, owner_entry) - perf_event_for_each_child(event, perf_event_disable); + list_for_each_entry(event, ¤t->perf_event_list, owner_entry) { + ctx = perf_event_ctx_lock(event); + perf_event_for_each_child(event, _perf_event_disable); + perf_event_ctx_unlock(event, ctx); + } mutex_unlock(¤t->perf_event_mutex); return 0; @@ -7272,6 +7416,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) return ret; } +static void mutex_lock_double(struct mutex *a, struct mutex *b) +{ + if (b < a) + swap(a, b); + + mutex_lock(a); + mutex_lock_nested(b, SINGLE_DEPTH_NESTING); +} + /** * sys_perf_event_open - open a performance event, associate it to a task/cpu * @@ -7287,7 +7440,7 @@ SYSCALL_DEFINE5(perf_event_open, struct perf_event *group_leader = NULL, *output_event = NULL; struct perf_event *event, *sibling; struct perf_event_attr attr; - struct perf_event_context *ctx; + struct perf_event_context *ctx, *uninitialized_var(gctx); struct file *event_file = NULL; struct fd group = {NULL, 0}; struct task_struct *task = NULL; @@ -7476,9 +7629,14 @@ SYSCALL_DEFINE5(perf_event_open, } if (move_group) { - struct perf_event_context *gctx = group_leader->ctx; + gctx = group_leader->ctx; + + /* + * See perf_event_ctx_lock() for comments on the details + * of swizzling perf_event::ctx. + */ + mutex_lock_double(&gctx->mutex, &ctx->mutex); - mutex_lock(&gctx->mutex); perf_remove_from_context(group_leader, false); /* @@ -7493,15 +7651,19 @@ SYSCALL_DEFINE5(perf_event_open, perf_event__state_init(sibling); put_ctx(gctx); } - mutex_unlock(&gctx->mutex); - put_ctx(gctx); + } else { + mutex_lock(&ctx->mutex); } WARN_ON_ONCE(ctx->parent_ctx); - mutex_lock(&ctx->mutex); if (move_group) { + /* + * Wait for everybody to stop referencing the events through + * the old lists, before installing it on new lists. + */ synchronize_rcu(); + perf_install_in_context(ctx, group_leader, group_leader->cpu); get_ctx(ctx); list_for_each_entry(sibling, &group_leader->sibling_list, @@ -7513,6 +7675,11 @@ SYSCALL_DEFINE5(perf_event_open, perf_install_in_context(ctx, event, event->cpu); perf_unpin_context(ctx); + + if (move_group) { + mutex_unlock(&gctx->mutex); + put_ctx(gctx); + } mutex_unlock(&ctx->mutex); put_online_cpus(); @@ -7620,7 +7787,11 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) src_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, src_cpu)->ctx; dst_ctx = &per_cpu_ptr(pmu->pmu_cpu_context, dst_cpu)->ctx; - mutex_lock(&src_ctx->mutex); + /* + * See perf_event_ctx_lock() for comments on the details + * of swizzling perf_event::ctx. + */ + mutex_lock_double(&src_ctx->mutex, &dst_ctx->mutex); list_for_each_entry_safe(event, tmp, &src_ctx->event_list, event_entry) { perf_remove_from_context(event, false); @@ -7628,11 +7799,9 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) put_ctx(src_ctx); list_add(&event->migrate_entry, &events); } - mutex_unlock(&src_ctx->mutex); synchronize_rcu(); - mutex_lock(&dst_ctx->mutex); list_for_each_entry_safe(event, tmp, &events, migrate_entry) { list_del(&event->migrate_entry); if (event->state >= PERF_EVENT_STATE_OFF) @@ -7642,6 +7811,7 @@ void perf_pmu_migrate_context(struct pmu *pmu, int src_cpu, int dst_cpu) get_ctx(dst_ctx); } mutex_unlock(&dst_ctx->mutex); + mutex_unlock(&src_ctx->mutex); } EXPORT_SYMBOL_GPL(perf_pmu_migrate_context); diff --git a/kernel/sched/sched_avg.c b/kernel/sched/sched_avg.c index cdb1d7c53849..dc6131a9fd0a 100644 --- a/kernel/sched/sched_avg.c +++ b/kernel/sched/sched_avg.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012, 2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012, 2015-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -60,17 +60,17 @@ void sched_get_nr_running_avg(int *avg, int *iowait_avg, int *big_avg) spin_lock_irqsave(&per_cpu(nr_lock, cpu), flags); curr_time = sched_clock(); + diff = curr_time - per_cpu(last_time, cpu); + BUG_ON((s64)diff < 0); + tmp_avg += per_cpu(nr_prod_sum, cpu); - tmp_avg += per_cpu(nr, cpu) * - (curr_time - per_cpu(last_time, cpu)); + tmp_avg += per_cpu(nr, cpu) * diff; tmp_big_avg += per_cpu(nr_big_prod_sum, cpu); - tmp_big_avg += nr_eligible_big_tasks(cpu) * - (curr_time - per_cpu(last_time, cpu)); + tmp_big_avg += nr_eligible_big_tasks(cpu) * diff; tmp_iowait += per_cpu(iowait_prod_sum, cpu); - tmp_iowait += nr_iowait_cpu(cpu) * - (curr_time - per_cpu(last_time, cpu)); + tmp_iowait += nr_iowait_cpu(cpu) * diff; per_cpu(last_time, cpu) = curr_time; @@ -107,14 +107,15 @@ EXPORT_SYMBOL(sched_get_nr_running_avg); */ void sched_update_nr_prod(int cpu, long delta, bool inc) { - int diff; - s64 curr_time; + u64 diff; + u64 curr_time; unsigned long flags, nr_running; spin_lock_irqsave(&per_cpu(nr_lock, cpu), flags); nr_running = per_cpu(nr, cpu); curr_time = sched_clock(); diff = curr_time - per_cpu(last_time, cpu); + BUG_ON((s64)diff < 0); per_cpu(last_time, cpu) = curr_time; per_cpu(nr, cpu) = nr_running + (inc ? delta : -delta); diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 0fc5cfedcc8c..7d370a6ebf18 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1693,14 +1693,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, !cpumask_test_cpu(cpu_id, buffer->cpumask)) return size; - size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); - size *= BUF_PAGE_SIZE; + nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); /* we need a minimum of two pages */ - if (size < BUF_PAGE_SIZE * 2) - size = BUF_PAGE_SIZE * 2; + if (nr_pages < 2) + nr_pages = 2; - nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); + size = nr_pages * BUF_PAGE_SIZE; /* * Don't succeed if resizing is disabled, as a reader might be diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c index 4b9c114ee9de..17b5a671cf44 100644 --- a/kernel/trace/trace_event_perf.c +++ b/kernel/trace/trace_event_perf.c @@ -256,7 +256,8 @@ int perf_trace_add(struct perf_event *p_event, int flags) void perf_trace_del(struct perf_event *p_event, int flags) { struct ftrace_event_call *tp_event = p_event->tp_event; - hlist_del_rcu(&p_event->hlist_entry); + if (!hlist_unhashed(&p_event->hlist_entry)) + hlist_del_rcu(&p_event->hlist_entry); tp_event->class->reg(tp_event, TRACE_REG_PERF_DEL, p_event); } diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c index 2937ba5e5e09..806c5b6b4b3a 100644 --- a/lib/asn1_decoder.c +++ b/lib/asn1_decoder.c @@ -210,9 +210,8 @@ int asn1_ber_decoder(const struct asn1_decoder *decoder, unsigned char tmp; /* Skip conditional matches if possible */ - if ((op & ASN1_OP_MATCH__COND && - flags & FLAG_MATCHED) || - dp == datalen) { + if ((op & ASN1_OP_MATCH__COND && flags & FLAG_MATCHED) || + (op & ASN1_OP_MATCH__SKIP && dp == datalen)) { pc += asn1_op_lengths[op]; goto next_op; } diff --git a/mm/memory.c b/mm/memory.c index f7ce43b57fc2..62b30f222c09 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -3317,8 +3317,18 @@ static int __handle_mm_fault(struct mm_struct *mm, struct vm_area_struct *vma, if (unlikely(pmd_none(*pmd)) && unlikely(__pte_alloc(mm, vma, pmd, address))) return VM_FAULT_OOM; - /* if an huge pmd materialized from under us just retry later */ - if (unlikely(pmd_trans_huge(*pmd))) + /* + * If a huge pmd materialized under us just retry later. Use + * pmd_trans_unstable() instead of pmd_trans_huge() to ensure the pmd + * didn't become pmd_trans_huge under us and then back to pmd_none, as + * a result of MADV_DONTNEED running immediately after a huge pmd fault + * in a different thread of this mm, in turn leading to a misleading + * pmd_trans_huge() retval. All we have to ensure is that it is a + * regular pmd that we can walk with pte_offset_map() and we can do that + * through an atomic read in C, which is what pmd_trans_unstable() + * provides. + */ + if (unlikely(pmd_trans_unstable(pmd))) return 0; /* * A regular pmd is established and it can't morph into a huge pmd diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c index 128644c0cfe8..a9e1e67bbbd7 100644 --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -335,16 +335,21 @@ static int rfcomm_sock_create(struct net *net, struct socket *sock, static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len) { - struct sockaddr_rc *sa = (struct sockaddr_rc *) addr; + struct sockaddr_rc sa; struct sock *sk = sock->sk; - int chan = sa->rc_channel; - int err = 0; - - BT_DBG("sk %pK %pMR", sk, &sa->rc_bdaddr); + int chan; + int len, err = 0; if (!addr || addr->sa_family != AF_BLUETOOTH) return -EINVAL; + memset(&sa, 0, sizeof(sa)); + len = min_t(unsigned int, sizeof(sa), addr_len); + memcpy(&sa, addr, len); + chan = sa.rc_channel; + + BT_DBG("sk %pK %pMR", sk, &sa.rc_bdaddr); + lock_sock(sk); if (sk->sk_state != BT_OPEN) { @@ -359,11 +364,11 @@ static int rfcomm_sock_bind(struct socket *sock, struct sockaddr *addr, int addr write_lock(&rfcomm_sk_list.lock); - if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa->rc_bdaddr)) { + if (chan && __rfcomm_get_listen_sock_by_addr(chan, &sa.rc_bdaddr)) { err = -EADDRINUSE; } else { /* Save source address */ - bacpy(&rfcomm_pi(sk)->src, &sa->rc_bdaddr); + bacpy(&rfcomm_pi(sk)->src, &sa.rc_bdaddr); rfcomm_pi(sk)->channel = chan; sk->sk_state = BT_BOUND; } diff --git a/net/core/neighbour.c b/net/core/neighbour.c index aa9e11d9205c..df8ab19191a3 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -703,7 +703,7 @@ void neigh_destroy(struct neighbour *neigh) NEIGH_CACHE_STAT_INC(neigh->tbl, destroys); if (!neigh->dead) { - pr_warn("Destroying alive neighbour %p\n", neigh); + pr_warn("Destroying alive neighbour %pK\n", neigh); dump_stack(); return; } @@ -1367,7 +1367,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) out: return rc; discard: - neigh_dbg(1, "%s: dst=%p neigh=%p\n", __func__, dst, neigh); + neigh_dbg(1, "%s: dst=%pK neigh=%pK\n", __func__, dst, neigh); out_kfree_skb: rc = -EINVAL; kfree_skb(skb); diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index 6bda044c3a2a..8bc4e3b83b92 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -1018,14 +1018,8 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev, goto nla_put_failure; if (1) { - struct rtnl_link_ifmap map = { - .mem_start = dev->mem_start, - .mem_end = dev->mem_end, - .base_addr = dev->base_addr, - .irq = dev->irq, - .dma = dev->dma, - .port = dev->if_port, - }; + struct rtnl_link_ifmap map; + memset(&map, 0, sizeof(map)); map.mem_start = dev->mem_start; map.mem_end = dev->mem_end; diff --git a/net/ipc_router/ipc_router_socket.c b/net/ipc_router/ipc_router_socket.c index c26993c2950e..323aa0ccf4b7 100644 --- a/net/ipc_router/ipc_router_socket.c +++ b/net/ipc_router/ipc_router_socket.c @@ -555,10 +555,18 @@ static unsigned int msm_ipc_router_poll(struct file *file, static int msm_ipc_router_close(struct socket *sock) { struct sock *sk = sock->sk; - struct msm_ipc_port *port_ptr = msm_ipc_sk_port(sk); + struct msm_ipc_port *port_ptr; int ret; + if (!sk) + return -EINVAL; + lock_sock(sk); + port_ptr = msm_ipc_sk_port(sk); + if (!port_ptr) { + release_sock(sk); + return -EINVAL; + } ret = msm_ipc_router_close_port(port_ptr); msm_ipc_unload_default_node(msm_ipc_sk(sk)->default_node_vote_info); release_sock(sk); diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c index 59f8d47bffe4..f65379c4d86d 100644 --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -656,7 +656,7 @@ int ping_common_sendmsg(int family, struct msghdr *msg, size_t len, void *user_icmph, size_t icmph_len) { u8 type, code; - if (len > 0xFFFF) + if (len > 0xFFFF || len < icmph_len) return -EMSGSIZE; /* diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c index bb9cbc17d926..3e8691895385 100644 --- a/net/llc/af_llc.c +++ b/net/llc/af_llc.c @@ -626,6 +626,7 @@ static void llc_cmsg_rcv(struct msghdr *msg, struct sk_buff *skb) if (llc->cmsg_flags & LLC_CMSG_PKTINFO) { struct llc_pktinfo info; + memset(&info, 0, sizeof(info)); info.lpi_ifindex = llc_sk(skb->sk)->dev->ifindex; llc_pdu_decode_dsap(skb, &info.lpi_sap); llc_pdu_decode_da(skb, info.lpi_mac); diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c index 63745440403b..e8c0cb51bd43 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c @@ -235,7 +235,7 @@ EXPORT_SYMBOL_GPL(nf_ct_invert_tuple); static void clean_from_lists(struct nf_conn *ct) { - pr_debug("clean_from_lists(%p)\n", ct); + pr_debug("clean_from_lists(%pK)\n", ct); hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode); hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_REPLY].hnnode); @@ -301,7 +301,7 @@ destroy_conntrack(struct nf_conntrack *nfct) struct list_head *sip_node_save_list; void (*delete_entry)(struct nf_conn *ct); - pr_debug("destroy_conntrack(%p)\n", ct); + pr_debug("destroy_conntrack(%pK)\n", ct); NF_CT_ASSERT(atomic_read(&nfct->use) == 0); NF_CT_ASSERT(!timer_pending(&ct->timeout)); @@ -346,7 +346,7 @@ destroy_conntrack(struct nf_conntrack *nfct) if (ct->master) nf_ct_put(ct->master); - pr_debug("destroy_conntrack: returning ct=%p to slab\n", ct); + pr_debug("destroy_conntrack: returning ct=%pK to slab\n", ct); nf_conntrack_free(ct); } @@ -635,7 +635,7 @@ __nf_conntrack_confirm(struct sk_buff *skb) * confirmed us. */ NF_CT_ASSERT(!nf_ct_is_confirmed(ct)); - pr_debug("Confirming conntrack %p\n", ct); + pr_debug("Confirming conntrack %pK\n", ct); /* We have to check the DYING flag after unlink to prevent * a race against nf_ct_get_next_corpse() possibly called from * user context, else we insert an already 'dead' hash, blocking @@ -981,7 +981,7 @@ init_conntrack(struct net *net, struct nf_conn *tmpl, spin_lock(&nf_conntrack_expect_lock); exp = nf_ct_find_expectation(net, zone, tuple); if (exp) { - pr_debug("conntrack: expectation arrives ct=%p exp=%p\n", + pr_debug("conntrack: expectation arrives ct=%pK exp=%pK\n", ct, exp); /* Welcome, Mr. Bond. We've been expecting you... */ __set_bit(IPS_EXPECTED_BIT, &ct->status); @@ -1074,14 +1074,14 @@ resolve_normal_ct(struct net *net, struct nf_conn *tmpl, } else { /* Once we've had two way comms, always ESTABLISHED. */ if (test_bit(IPS_SEEN_REPLY_BIT, &ct->status)) { - pr_debug("nf_conntrack_in: normal packet for %p\n", ct); + pr_debug("nf_conntrack_in: normal packet for %pK\n", ct); *ctinfo = IP_CT_ESTABLISHED; } else if (test_bit(IPS_EXPECTED_BIT, &ct->status)) { - pr_debug("nf_conntrack_in: related packet for %p\n", + pr_debug("nf_conntrack_in: related packet for %pK\n", ct); *ctinfo = IP_CT_RELATED; } else { - pr_debug("nf_conntrack_in: new packet for %p\n", ct); + pr_debug("nf_conntrack_in: new packet for %pK\n", ct); *ctinfo = IP_CT_NEW; } *set_reply = 0; @@ -1223,7 +1223,7 @@ void nf_conntrack_alter_reply(struct nf_conn *ct, /* Should be unconfirmed, so not in hash table yet */ NF_CT_ASSERT(!nf_ct_is_confirmed(ct)); - pr_debug("Altering reply tuple of %p to ", ct); + pr_debug("Altering reply tuple of %pK to ", ct); nf_ct_dump_tuple(newreply); ct->tuplehash[IP_CT_DIR_REPLY].tuple = *newreply; @@ -1800,7 +1800,7 @@ int nf_conntrack_init_net(struct net *net) if (!net->ct.stat) goto err_pcpu_lists; - net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%p", net); + net->ct.slabname = kasprintf(GFP_KERNEL, "nf_conntrack_%pK", net); if (!net->ct.slabname) goto err_slabname; diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c index 1aa7049c93f5..daec7d6957a9 100644 --- a/net/netfilter/nfnetlink.c +++ b/net/netfilter/nfnetlink.c @@ -321,10 +321,12 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, nlh = nlmsg_hdr(skb); err = 0; - if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) || - skb->len < nlh->nlmsg_len) { - err = -EINVAL; - goto ack; + if (nlh->nlmsg_len < NLMSG_HDRLEN || + skb->len < nlh->nlmsg_len || + nlmsg_len(nlh) < sizeof(struct nfgenmsg)) { + nfnl_err_reset(&err_list); + success = false; + goto done; } /* Only requests are handled by the kernel */ @@ -433,6 +435,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh, static void nfnetlink_rcv(struct sk_buff *skb) { struct nlmsghdr *nlh = nlmsg_hdr(skb); + u_int16_t res_id; int msglen; if (nlh->nlmsg_len < NLMSG_HDRLEN || @@ -457,7 +460,12 @@ static void nfnetlink_rcv(struct sk_buff *skb) nfgenmsg = nlmsg_data(nlh); skb_pull(skb, msglen); - nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id); + /* Work around old nft using host byte order */ + if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES) + res_id = NFNL_SUBSYS_NFTABLES; + else + res_id = ntohs(nfgenmsg->res_id); + nfnetlink_rcv_batch(skb, nlh, res_id); } else { netlink_rcv_skb(skb, &nfnetlink_rcv_msg); } diff --git a/net/netfilter/xt_qtaguid.c b/net/netfilter/xt_qtaguid.c index bd27e833e9db..397b2b64e295 100644 --- a/net/netfilter/xt_qtaguid.c +++ b/net/netfilter/xt_qtaguid.c @@ -2592,8 +2592,7 @@ static int pp_stats_line(struct seq_file *m, struct tag_stat *ts_entry, uid_t stat_uid = get_uid_from_tag(tag); struct proc_print_info *ppi = m->private; /* Detailed tags are not available to everybody */ - if (get_atag_from_tag(tag) && !can_read_other_uid_stats( - make_kuid(&init_user_ns,stat_uid))) { + if (!can_read_other_uid_stats(make_kuid(&init_user_ns,stat_uid))) { CT_DEBUG("qtaguid: stats line: " "%s 0x%llx %u: insufficient priv " "from pid=%u tgid=%u uid=%u stats.gid=%u\n", diff --git a/net/rmnet_data/rmnet_data_handlers.c b/net/rmnet_data/rmnet_data_handlers.c index 9712ed2e2146..26cb1256c182 100644 --- a/net/rmnet_data/rmnet_data_handlers.c +++ b/net/rmnet_data/rmnet_data_handlers.c @@ -112,9 +112,10 @@ void rmnet_print_packet(const struct sk_buff *skb, const char *dev, char dir) if (!printlen) return; - pr_err("[%s][%c] - PKT skb->len=%d skb->head=%p skb->data=%p skb->tail=%p skb->end=%p\n", - dev, dir, skb->len, (void *)skb->head, (void *)skb->data, - skb_tail_pointer(skb), skb_end_pointer(skb)); + pr_err("[%s][%c] - PKT skb->len=%d skb->head=%pK skb->data=%pK\n", + dev, dir, skb->len, (void *)skb->head, (void *)skb->data); + pr_err("[%s][%c] - PKT skb->tail=%pK skb->end=%pK\n", + dev, dir, skb_tail_pointer(skb), skb_end_pointer(skb)); if (skb->len > 0) len = skb->len; diff --git a/net/rmnet_data/rmnet_data_trace.h b/net/rmnet_data/rmnet_data_trace.h index 9ec507706f17..69c388c9faf2 100644 --- a/net/rmnet_data/rmnet_data_trace.h +++ b/net/rmnet_data/rmnet_data_trace.h @@ -39,8 +39,8 @@ DECLARE_EVENT_CLASS(rmnet_handler_template, __assign_str(name, skb->dev->name); ), - TP_printk("dev=%s skbaddr=%p len=%u", - __get_str(name), __entry->skbaddr, __entry->len) + TP_printk("dev=%s skbaddr=%pK len=%u", + __get_str(name), __entry->skbaddr, __entry->len) ) DEFINE_EVENT(rmnet_handler_template, rmnet_egress_handler, @@ -128,8 +128,9 @@ DECLARE_EVENT_CLASS(rmnet_aggregation_template, __entry->num = num_agg_pakcets; ), - TP_printk("dev=%s skbaddr=%p len=%u agg_count: %d", - __get_str(name), __entry->skbaddr, __entry->len, __entry->num) + TP_printk("dev=%s skbaddr=%pK len=%u agg_count: %d", + __get_str(name), __entry->skbaddr, __entry->len, + __entry->num) ) DEFINE_EVENT(rmnet_aggregation_template, rmnet_map_aggregate, diff --git a/net/rmnet_data/rmnet_data_vnd.c b/net/rmnet_data/rmnet_data_vnd.c index 70f1701f1296..6166eed417cc 100644 --- a/net/rmnet_data/rmnet_data_vnd.c +++ b/net/rmnet_data/rmnet_data_vnd.c @@ -825,7 +825,7 @@ static int _rmnet_vnd_update_flow_map(uint8_t action, itm->tc_flow_valid[i] = 1; itm->tc_flow_id[i] = tc_flow; rc = RMNET_VND_UPDATE_FLOW_OK; - LOGD("{%p}->tc_flow_id[%d]=%08X", + LOGD("{%pK}->tc_flow_id[%d]=%08X", itm, i, tc_flow); break; } @@ -841,7 +841,7 @@ static int _rmnet_vnd_update_flow_map(uint8_t action, itm->tc_flow_valid[i] = 0; itm->tc_flow_id[i] = 0; j++; - LOGD("{%p}->tc_flow_id[%d]=0", itm, i); + LOGD("{%pK}->tc_flow_id[%d]=0", itm, i); } } else { j++; @@ -985,7 +985,7 @@ int rmnet_vnd_del_tc_flow(uint32_t id, uint32_t map_flow, uint32_t tc_flow) if (r == RMNET_VND_UPDATE_FLOW_NO_VALID_LEFT) { if (itm) - LOGD("Removed flow mapping [%s][0x%08X]@%p", + LOGD("Removed flow mapping [%s][0x%08X]@%pK", dev->name, itm->map_flow_id, itm); kfree(itm); } diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index 7ecd04c21360..997ff7b2509b 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -277,6 +277,7 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk, memset(&theirs, 0, sizeof(theirs)); memcpy(new, ours, sizeof(*new)); + memset(dte, 0, sizeof(*dte)); len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask); if (len < 0) diff --git a/sound/soc/msm/msm-cpe-lsm.c b/sound/soc/msm/msm-cpe-lsm.c index cec3630e6751..6483b93253c1 100644 --- a/sound/soc/msm/msm-cpe-lsm.c +++ b/sound/soc/msm/msm-cpe-lsm.c @@ -1196,6 +1196,7 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, dev_err(rtd->dev, "%s: No memory for sound model\n", __func__); kfree(session->conf_levels); + session->conf_levels = NULL; return -ENOMEM; } session->snd_model_size = snd_model.data_size; @@ -1207,6 +1208,8 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, __func__); kfree(session->conf_levels); kfree(session->snd_model_data); + session->conf_levels = NULL; + session->snd_model_data = NULL; return -EFAULT; } @@ -1218,6 +1221,8 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, __func__, rc); kfree(session->snd_model_data); kfree(session->conf_levels); + session->snd_model_data = NULL; + session->conf_levels = NULL; return rc; } @@ -1231,6 +1236,8 @@ static int msm_cpe_lsm_ioctl_shared(struct snd_pcm_substream *substream, lsm_ops->lsm_shmem_dealloc(cpe->core_handle, session); kfree(session->snd_model_data); kfree(session->conf_levels); + session->snd_model_data = NULL; + session->conf_levels = NULL; return rc; } diff --git a/sound/soc/msm/qdsp6v2/audio_cal_utils.c b/sound/soc/msm/qdsp6v2/audio_cal_utils.c index 95e62d51dc11..e5c80f7c20c9 100644 --- a/sound/soc/msm/qdsp6v2/audio_cal_utils.c +++ b/sound/soc/msm/qdsp6v2/audio_cal_utils.c @@ -636,7 +636,7 @@ static struct cal_block_data *create_cal_block(struct cal_type_data *cal_type, goto err; } cal_block->buffer_number = basic_cal->cal_hdr.buffer_number; - pr_debug("%s: created block for cal type %d, buf num %d, map handle %d, map size %zd paddr 0x%pa!\n", + pr_debug("%s: created block for cal type %d, buf num %d, map handle %d, map size %zd paddr 0x%pK!\n", __func__, cal_type->info.reg.cal_type, cal_block->buffer_number, cal_block->map_data.ion_map_handle, diff --git a/sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c index 6c0d7bb7b259..58a4de5af145 100644 --- a/sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-compr-q6-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -187,7 +187,7 @@ static void compr_event_handler(uint32_t opcode, pr_debug("%s:writing %d bytes of buffer[%d] to dsp 2\n", __func__, prtd->pcm_count, prtd->out_head); temp = buf[0].phys + (prtd->out_head * prtd->pcm_count); - pr_debug("%s:writing buffer[%d] from 0x%pa\n", + pr_debug("%s:writing buffer[%d] from 0x%pK\n", __func__, prtd->out_head, &temp); if (runtime->tstamp_mode == SNDRV_PCM_TSTAMP_ENABLE) @@ -238,7 +238,7 @@ static void compr_event_handler(uint32_t opcode, break; case ASM_DATA_EVENT_READ_DONE_V2: { pr_debug("ASM_DATA_EVENT_READ_DONE\n"); - pr_debug("buf = %p, data = 0x%X, *data = %p,\n" + pr_debug("buf = %pK, data = 0x%X, *data = %pK,\n" "prtd->pcm_irq_pos = %d\n", prtd->audio_client->port[OUT].buf, *(uint32_t *)prtd->audio_client->port[OUT].buf->data, @@ -248,7 +248,7 @@ static void compr_event_handler(uint32_t opcode, memcpy(prtd->audio_client->port[OUT].buf->data + prtd->pcm_irq_pos, (ptrmem + READDONE_IDX_SIZE), COMPRE_CAPTURE_HEADER_SIZE); - pr_debug("buf = %p, updated data = 0x%X, *data = %p\n", + pr_debug("buf = %pK, updated data = 0x%X, *data = %pK\n", prtd->audio_client->port[OUT].buf, *(uint32_t *)(prtd->audio_client->port[OUT].buf->data + prtd->pcm_irq_pos), @@ -264,7 +264,7 @@ static void compr_event_handler(uint32_t opcode, } buf = prtd->audio_client->port[OUT].buf; - pr_debug("pcm_irq_pos=%d, buf[0].phys = 0x%pa\n", + pr_debug("pcm_irq_pos=%d, buf[0].phys = 0x%pK\n", prtd->pcm_irq_pos, &buf[0].phys); read_param.len = prtd->pcm_count - COMPRE_CAPTURE_HEADER_SIZE; read_param.paddr = buf[0].phys + @@ -290,7 +290,7 @@ static void compr_event_handler(uint32_t opcode, pr_debug("%s: writing %d bytes of buffer[%d] to dsp\n", __func__, prtd->pcm_count, prtd->out_head); buf = prtd->audio_client->port[IN].buf; - pr_debug("%s: writing buffer[%d] from 0x%pa head %d count %d\n", + pr_debug("%s: writing buffer[%d] from 0x%pK head %d count %d\n", __func__, prtd->out_head, &buf[0].phys, prtd->pcm_count, prtd->out_head); if (runtime->tstamp_mode == SNDRV_PCM_TSTAMP_ENABLE) @@ -605,7 +605,7 @@ static int msm_compr_capture_prepare(struct snd_pcm_substream *substream) - COMPRE_CAPTURE_HEADER_SIZE; read_param.paddr = buf[i].phys + COMPRE_CAPTURE_HEADER_SIZE; - pr_debug("Push buffer [%d] to DSP, paddr: %pa, vaddr: %p\n", + pr_debug("Push buffer [%d] to DSP, paddr: %pK, vaddr: %pK\n", i, &read_param.paddr, buf[i].data); q6asm_async_read(prtd->audio_client, &read_param); @@ -951,7 +951,7 @@ static int msm_compr_hw_params(struct snd_pcm_substream *substream, dma_buf->addr = buf[0].phys; dma_buf->bytes = runtime->hw.buffer_bytes_max; - pr_debug("%s: buf[%p]dma_buf->area[%p]dma_buf->addr[%pa]\n" + pr_debug("%s: buf[%pK]dma_buf->area[%pK]dma_buf->addr[%pK]\n" "dma_buf->bytes[%zd]\n", __func__, (void *)buf, (void *)dma_buf->area, &dma_buf->addr, dma_buf->bytes); @@ -1024,6 +1024,7 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream, struct snd_dec_ddp *ddp = &compr->info.codec_param.codec.options.ddp; uint32_t params_length = 0; + memset(params_value, 0, MAX_AC3_PARAM_SIZE); /* check integer overflow */ if (ddp->params_length > UINT_MAX/sizeof(int)) { pr_err("%s: Integer overflow ddp->params_length %d\n", @@ -1064,12 +1065,14 @@ static int msm_compr_ioctl_shared(struct snd_pcm_substream *substream, struct snd_dec_ddp *ddp = &compr->info.codec_param.codec.options.ddp; uint32_t params_length = 0; + memset(params_value, 0, MAX_AC3_PARAM_SIZE); /* check integer overflow */ if (ddp->params_length > UINT_MAX/sizeof(int)) { pr_err("%s: Integer overflow ddp->params_length %d\n", __func__, ddp->params_length); return -EINVAL; } + params_length = ddp->params_length*sizeof(int); if (params_length > MAX_AC3_PARAM_SIZE) { /*MAX is 36*sizeof(int) this should not happen*/ pr_err("%s: params_length(%d) is greater than %zd\n", diff --git a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c index 3905d22b4ad3..8b21797c5256 100644 --- a/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-compress-q6-v2.c @@ -2075,7 +2075,7 @@ static int msm_compr_get_caps(struct snd_compr_stream *cstream, memcpy(arg, &prtd->compr_cap, sizeof(struct snd_compr_caps)); } else { ret = -EINVAL; - pr_err("%s: arg (0x%p), prtd (0x%p)\n", __func__, arg, prtd); + pr_err("%s: arg (0x%pK), prtd (0x%pK)\n", __func__, arg, prtd); } return ret; diff --git a/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c index 87cd3c2a0f33..a3e72f995932 100644 --- a/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-dai-q6-v2.c @@ -2194,7 +2194,7 @@ static int msm_auxpcm_dev_probe(struct platform_device *pdev) goto fail_pdata_nomem; } - dev_dbg(&pdev->dev, "%s: dev %p, dai_data %p, auxpcm_pdata %p\n", + dev_dbg(&pdev->dev, "%s: dev %pK, dai_data %pK, auxpcm_pdata %pK\n", __func__, &pdev->dev, dai_data, auxpcm_pdata); rc = of_property_read_u32_array(pdev->dev.of_node, diff --git a/sound/soc/msm/qdsp6v2/msm-dai-slim.c b/sound/soc/msm/qdsp6v2/msm-dai-slim.c index b46d0a53adc2..4bb8f59c27e9 100644 --- a/sound/soc/msm/qdsp6v2/msm-dai-slim.c +++ b/sound/soc/msm/qdsp6v2/msm-dai-slim.c @@ -482,7 +482,9 @@ static void msm_dai_slim_remove_dai_data( dai_data_t = &drv_data->slim_dai_data[i]; kfree(dai_data_t->chan_h); + dai_data_t->chan_h = NULL; kfree(dai_data_t->sh_ch); + dai_data_t->sh_ch = NULL; } } diff --git a/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c b/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c index 242dc5f4415d..fea7bb4e7331 100644 --- a/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c +++ b/sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and * only version 2 as published by the Free Software Foundation. @@ -1103,7 +1103,7 @@ static int msm_ds2_dap_send_end_point(int dev_map_idx, int endp_idx) ds2_ap_params_obj = &ds2_dap_params[cache_device]; pr_debug("%s: cache dev %d, dev_map_idx %d\n", __func__, cache_device, dev_map_idx); - pr_debug("%s: endp - %p %p\n", __func__, + pr_debug("%s: endp - %pK %pK\n", __func__, &ds2_dap_params[cache_device], ds2_ap_params_obj); params_value = kzalloc(params_length, GFP_KERNEL); @@ -1189,7 +1189,7 @@ static int msm_ds2_dap_send_cached_params(int dev_map_idx, } ds2_ap_params_obj = &ds2_dap_params[cache_device]; - pr_debug("%s: cached param - %p %p, cache_device %d\n", __func__, + pr_debug("%s: cached param - %pK %pK, cache_device %d\n", __func__, &ds2_dap_params[cache_device], ds2_ap_params_obj, cache_device); params_value = kzalloc(params_length, GFP_KERNEL); @@ -1356,7 +1356,11 @@ static int msm_ds2_dap_handle_commands(u32 cmd, void *arg) int ret = 0, port_id = 0; int32_t data; struct dolby_param_data *dolby_data = (struct dolby_param_data *)arg; - get_user(data, &dolby_data->data[0]); + if (get_user(data, &dolby_data->data[0])) { + pr_debug("%s error getting data\n", __func__); + ret = -EFAULT; + goto end; + } pr_debug("%s: param_id %d,be_id %d,device_id 0x%x,length %d,data %d\n", __func__, dolby_data->param_id, dolby_data->be_id, @@ -1471,11 +1475,23 @@ static int msm_ds2_dap_set_param(u32 cmd, void *arg) goto end; } + off = ds2_dap_params_offset[idx]; + if ((dolby_data->length <= 0) || + (dolby_data->length > TOTAL_LENGTH_DS2_PARAM - off)) { + pr_err("%s: invalid length %d at idx %d\n", + __func__, dolby_data->length, idx); + rc = -EINVAL; + goto end; + } + /* cache the parameters */ ds2_dap_params[cdev].dap_params_modified[idx] += 1; for (j = 0; j < dolby_data->length; j++) { - off = ds2_dap_params_offset[idx]; - get_user(data, &dolby_data->data[j]); + if (get_user(data, &dolby_data->data[j])) { + pr_debug("%s:error getting data\n", __func__); + rc = -EFAULT; + goto end; + } ds2_dap_params[cdev].params_val[off + j] = data; pr_debug("%s:off %d,val[i/p:o/p]-[%d / %d]\n", __func__, off, data, diff --git a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c b/sound/soc/msm/qdsp6v2/msm-dts-eagle.c index 9b1443f376f6..7a23a170be67 100644 --- a/sound/soc/msm/qdsp6v2/msm-dts-eagle.c +++ b/sound/soc/msm/qdsp6v2/msm-dts-eagle.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -463,7 +463,7 @@ static int _sendcache_pre(struct audio_client *ac) err = -EINVAL; if ((_depc_size == 0) || !_depc || (size == 0) || cmd == 0 || ((offset + size) > _depc_size) || (err != 0)) { - eagle_precache_err("%s: primary device %i cache index %i general error - cache size = %u, cache ptr = %p, offset = %u, size = %u, cmd = %i", + eagle_precache_err("%s: primary device %i cache index %i general error - cache size = %u, cache ptr = %pK, offset = %u, size = %u, cmd = %i", __func__, _device_primary, cidx, _depc_size, _depc, offset, size, cmd); return -EINVAL; @@ -547,7 +547,7 @@ static int _sendcache_post(int port_id, int copp_idx, int topology) err = -EINVAL; if ((_depc_size == 0) || !_depc || (err != 0) || (size == 0) || (cmd == 0) || (offset + size) > _depc_size) { - eagle_postcache_err("%s: primary device %i cache index %i port_id 0x%X general error - cache size = %u, cache ptr = %p, offset = %u, size = %u, cmd = %i", + eagle_postcache_err("%s: primary device %i cache index %i port_id 0x%X general error - cache size = %u, cache ptr = %pK, offset = %u, size = %u, cmd = %i", __func__, _device_primary, cidx, port_id, _depc_size, _depc, offset, size, cmd); return -EINVAL; @@ -1012,7 +1012,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) eagle_ioctl_info("%s: called with control 0x%X (allocate param cache)", __func__, cmd); if (copy_from_user((void *)&size, (void *)arg, sizeof(size))) { - eagle_ioctl_err("%s: error copying size (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error copying size (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &size, sizeof(size)); return -EFAULT; } else if (size > DEPC_MAX_SIZE) { @@ -1052,7 +1052,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) eagle_ioctl_info("%s: control 0x%X (get param)", __func__, cmd); if (copy_from_user((void *)&depd, (void *)arg, sizeof(depd))) { - eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &depd, sizeof(depd)); return -EFAULT; } @@ -1123,7 +1123,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) eagle_ioctl_info("%s: control 0x%X (set param)", __func__, cmd); if (copy_from_user((void *)&depd, (void *)arg, sizeof(depd))) { - eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error copying dts_eagle_param_desc (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &depd, sizeof(depd)); return -EFAULT; } @@ -1156,7 +1156,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) if (copy_from_user((void *)&_depc[offset], (void *)(((char *)arg)+sizeof(depd)), depd.size)) { - eagle_ioctl_err("%s: error copying param to cache (src:%p, tgt:%p, size:%u)", + eagle_ioctl_err("%s: error copying param to cache (src:%pK, tgt:%pK, size:%u)", __func__, ((char *)arg)+sizeof(depd), &_depc[offset], depd.size); return -EFAULT; @@ -1175,7 +1175,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) eagle_ioctl_info("%s: with control 0x%X (set param cache block)", __func__, cmd); if (copy_from_user((void *)b_, (void *)arg, sizeof(b_))) { - eagle_ioctl_err("%s: error copying cache block data (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error copying cache block data (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, b_, sizeof(b_)); return -EFAULT; } @@ -1206,7 +1206,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) eagle_ioctl_dbg("%s: with control 0x%X (set active device)", __func__, cmd); if (copy_from_user((void *)data, (void *)arg, sizeof(data))) { - eagle_ioctl_err("%s: error copying active device data (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error copying active device data (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, data, sizeof(data)); return -EFAULT; } @@ -1228,7 +1228,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) __func__, cmd); if (copy_from_user((void *)&target, (void *)arg, sizeof(target))) { - eagle_ioctl_err("%s: error reading license index. (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error reading license index. (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &target, sizeof(target)); return -EFAULT; } @@ -1275,7 +1275,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) cmd); if (copy_from_user((void *)target, (void *)arg, sizeof(target))) { - eagle_ioctl_err("%s: error reading license index (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error reading license index (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, target, sizeof(target)); return -EFAULT; } @@ -1318,7 +1318,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) (void *)&(((u32 *)_sec_blob[target[0]])[1]), (void *)(((char *)arg)+sizeof(target)), target[1])) { - eagle_ioctl_err("%s: error copying license to index %u, size %u (src:%p, tgt:%p, size:%u)", + eagle_ioctl_err("%s: error copying license to index %u, size %u (src:%pK, tgt:%pK, size:%u)", __func__, target[0], target[1], ((char *)arg)+sizeof(target), &(((u32 *)_sec_blob[target[0]])[1]), @@ -1335,7 +1335,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) cmd); if (copy_from_user((void *)&target, (void *)arg, sizeof(target))) { - eagle_ioctl_err("%s: error reading license index (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error reading license index (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &target, sizeof(target)); return -EFAULT; } @@ -1365,7 +1365,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) __func__, cmd); if (copy_from_user((void *)&spec, (void *)arg, sizeof(spec))) { - eagle_ioctl_err("%s: error reading volume command specifier (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error reading volume command specifier (src:%pK, tgt:%pK, size:%zu)", __func__, (void *)arg, &spec, sizeof(spec)); return -EFAULT; } @@ -1387,7 +1387,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) if (copy_from_user((void *)&_vol_cmds_d[idx], (void *)(((char *)arg) + sizeof(int)), sizeof(struct vol_cmds_d))) { - eagle_ioctl_err("%s: error reading volume command descriptor (src:%p, tgt:%p, size:%zu)", + eagle_ioctl_err("%s: error reading volume command descriptor (src:%pK, tgt:%pK, size:%zu)", __func__, ((char *)arg) + sizeof(int), &_vol_cmds_d[idx], sizeof(struct vol_cmds_d)); @@ -1400,7 +1400,7 @@ int msm_dts_eagle_ioctl(unsigned int cmd, unsigned long arg) if (copy_from_user((void *)_vol_cmds[idx], (void *)(((char *)arg) + (sizeof(int) + sizeof(struct vol_cmds_d))), size)) { - eagle_ioctl_err("%s: error reading volume command string (src:%p, tgt:%p, size:%i)", + eagle_ioctl_err("%s: error reading volume command string (src:%pK, tgt:%pK, size:%i)", __func__, ((char *)arg) + (sizeof(int) + sizeof(struct vol_cmds_d)), _vol_cmds[idx], size); diff --git a/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c b/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c index ddfbcecd0c40..7c35d19bb610 100644 --- a/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c +++ b/sound/soc/msm/qdsp6v2/msm-dts-srs-tm-config.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014, 2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -292,7 +292,7 @@ static int reg_ion_mem(void) &po.kvaddr); if (rc != 0) pr_err("%s: failed to allocate memory.\n", __func__); - pr_debug("%s: exited ion_client = %p, ion_handle = %p, phys_addr = %lu, length = %d, vaddr = %p, rc = 0x%x\n", + pr_debug("%s: exited ion_client = %pK, ion_handle = %pK, phys_addr = %lu, length = %d, vaddr = %pK, rc = 0x%x\n", __func__, ion_client, ion_handle, (long)po.paddr, (unsigned int)po.size, po.kvaddr, rc); return rc; diff --git a/sound/soc/msm/qdsp6v2/msm-lsm-client.c b/sound/soc/msm/qdsp6v2/msm-lsm-client.c index fab1dd4311f5..c5c75a0495e9 100644 --- a/sound/soc/msm/qdsp6v2/msm-lsm-client.c +++ b/sound/soc/msm/qdsp6v2/msm-lsm-client.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2015, Linux Foundation. All rights reserved. + * Copyright (c) 2013-2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -95,7 +95,7 @@ static int msm_lsm_queue_lab_buffer(struct lsm_priv *prtd, int i) struct snd_soc_pcm_runtime *rtd; if (!prtd || !prtd->lsm_client) { - pr_err("%s: Invalid params prtd %p lsm client %p\n", + pr_err("%s: Invalid params prtd %pK lsm client %pK\n", __func__, prtd, ((!prtd) ? NULL : prtd->lsm_client)); return -EINVAL; } @@ -109,7 +109,7 @@ static int msm_lsm_queue_lab_buffer(struct lsm_priv *prtd, int i) if (!prtd->lsm_client->lab_buffer || i >= prtd->lsm_client->hw_params.period_count) { dev_err(rtd->dev, - "%s: Lab buffer not setup %p incorrect index %d period count %d\n", + "%s: Lab buffer not setup %pK incorrect index %d period count %d\n", __func__, prtd->lsm_client->lab_buffer, i, prtd->lsm_client->hw_params.period_count); return -EINVAL; @@ -137,7 +137,7 @@ static int lsm_lab_buffer_sanity(struct lsm_priv *prtd, struct snd_soc_pcm_runtime *rtd; if (!prtd || !read_done || !index) { - pr_err("%s: Invalid params prtd %p read_done %p index %p\n", + pr_err("%s: Invalid params prtd %pK read_done %pK index %pK\n", __func__, prtd, read_done, index); return -EINVAL; } @@ -151,7 +151,7 @@ static int lsm_lab_buffer_sanity(struct lsm_priv *prtd, if (!prtd->lsm_client->lab_enable || !prtd->lsm_client->lab_buffer) { dev_err(rtd->dev, - "%s: Lab not enabled %d invalid lab buffer %p\n", + "%s: Lab not enabled %d invalid lab buffer %pK\n", __func__, prtd->lsm_client->lab_enable, prtd->lsm_client->lab_buffer); return -EINVAL; @@ -165,7 +165,7 @@ static int lsm_lab_buffer_sanity(struct lsm_priv *prtd, (prtd->lsm_client->lab_buffer[i].mem_map_handle == read_done->mem_map_handle)) { dev_dbg(rtd->dev, - "%s: Buffer found %pa memmap handle %d\n", + "%s: Buffer found %pK memmap handle %d\n", __func__, &prtd->lsm_client->lab_buffer[i].phys, prtd->lsm_client->lab_buffer[i].mem_map_handle); if (read_done->total_size > @@ -212,7 +212,7 @@ static void lsm_event_handler(uint32_t opcode, uint32_t token, if (prtd->lsm_client->session != token || !read_done) { dev_err(rtd->dev, - "%s: EVENT_READ_DONE invalid callback, session %d callback %d payload %p", + "%s: EVENT_READ_DONE invalid callback, session %d callback %d payload %pK", __func__, prtd->lsm_client->session, token, read_done); return; @@ -310,7 +310,7 @@ static int msm_lsm_lab_buffer_alloc(struct lsm_priv *lsm, int alloc) int ret = 0; struct snd_dma_buffer *dma_buf = NULL; if (!lsm) { - pr_err("%s: Invalid param lsm %p\n", __func__, lsm); + pr_err("%s: Invalid param lsm %pK\n", __func__, lsm); return -EINVAL; } if (alloc) { @@ -781,7 +781,7 @@ static int msm_lsm_ioctl_shared(struct snd_pcm_substream *substream, snd_model_v2.data, snd_model_v2.data_size)) { dev_err(rtd->dev, "%s: copy from user data failed\n" - "data %p size %d\n", __func__, + "data %pK size %d\n", __func__, snd_model_v2.data, snd_model_v2.data_size); q6lsm_snd_model_buf_free(prtd->lsm_client); rc = -EFAULT; @@ -1795,7 +1795,7 @@ static int msm_lsm_hw_params(struct snd_pcm_substream *substream, if (!prtd || !params) { dev_err(rtd->dev, - "%s: invalid params prtd %p params %p", + "%s: invalid params prtd %pK params %pK", __func__, prtd, params); return -EINVAL; } @@ -1837,7 +1837,7 @@ static snd_pcm_uframes_t msm_lsm_pcm_pointer( if (!prtd) { dev_err(rtd->dev, - "%s: Invalid param %p\n", __func__, prtd); + "%s: Invalid param %pK\n", __func__, prtd); return 0; } @@ -1865,7 +1865,7 @@ static int msm_lsm_pcm_copy(struct snd_pcm_substream *substream, int ch, if (!prtd) { dev_err(rtd->dev, - "%s: Invalid param %p\n", __func__, prtd); + "%s: Invalid param %pK\n", __func__, prtd); return -EINVAL; } diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c index 8ebc2a1660e6..7d53ae4e77bd 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-afe-v2.c @@ -414,7 +414,7 @@ static int msm_afe_open(struct snd_pcm_substream *substream) pr_err("Failed to allocate memory for msm_audio\n"); return -ENOMEM; } else - pr_debug("prtd %p\n", prtd); + pr_debug("prtd %pK\n", prtd); mutex_init(&prtd->lock); spin_lock_init(&prtd->dsp_lock); @@ -483,7 +483,7 @@ static int msm_afe_playback_copy(struct snd_pcm_substream *substream, char *hwbuf = runtime->dma_area + frames_to_bytes(runtime, hwoff); u32 mem_map_handle = 0; - pr_debug("%s : appl_ptr 0x%lx hw_ptr 0x%lx dest_to_copy 0x%p\n", + pr_debug("%s : appl_ptr 0x%lx hw_ptr 0x%lx dest_to_copy 0x%pK\n", __func__, runtime->control->appl_ptr, runtime->status->hw_ptr, hwbuf); @@ -571,7 +571,7 @@ static int msm_afe_capture_copy(struct snd_pcm_substream *substream, } atomic_set(&prtd->rec_bytes_avail, 0); } - pr_debug("%s:appl_ptr 0x%lx hw_ptr 0x%lx src_to_copy 0x%p\n", + pr_debug("%s:appl_ptr 0x%lx hw_ptr 0x%lx src_to_copy 0x%pK\n", __func__, runtime->control->appl_ptr, runtime->status->hw_ptr, hwbuf); @@ -766,7 +766,7 @@ static int msm_afe_hw_params(struct snd_pcm_substream *substream, return -ENOMEM; } - pr_debug("%s:buf = %p\n", __func__, buf); + pr_debug("%s:buf = %pK\n", __func__, buf); dma_buf->dev.type = SNDRV_DMA_TYPE_DEV; dma_buf->dev.dev = substream->pcm->card->dev; dma_buf->private_data = NULL; diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c index c1909778e082..31be6091c74c 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-host-voice-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -504,7 +504,7 @@ static int hpcm_allocate_shared_memory(struct hpcm_drv *prtd) sess->tp_mem_table.size = sizeof(struct vss_imemory_table_t); - pr_debug("%s: data %p phys %pa\n", __func__, + pr_debug("%s: data %pK phys %pK\n", __func__, sess->tp_mem_table.data, &sess->tp_mem_table.phys); /* Split 4096 block into four 1024 byte blocks for each dai */ @@ -682,7 +682,7 @@ void hpcm_notify_evt_processing(uint8_t *data, char *session, } if (tp == NULL || tmd == NULL) { - pr_err("%s: tp = %p or tmd = %p is null\n", __func__, + pr_err("%s: tp = %pK or tmd = %pK is null\n", __func__, tp, tmd); return; diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c index f023f3a04048..65c0e51e4763 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-lpa-v2.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -126,7 +126,7 @@ static void event_handler(uint32_t opcode, pr_debug("%s:writing %d bytes of buffer[%d] to dsp 2\n", __func__, prtd->pcm_count, prtd->out_head); temp = buf[0].phys + (prtd->out_head * prtd->pcm_count); - pr_debug("%s:writing buffer[%d] from 0x%pa\n", + pr_debug("%s:writing buffer[%d] from 0x%pK\n", __func__, prtd->out_head, &temp); if (prtd->meta_data_mode) { memcpy(&output_meta_data, (char *)(buf->data + @@ -604,7 +604,7 @@ static int msm_pcm_hw_params(struct snd_pcm_substream *substream, if (buf == NULL || buf[0].data == NULL) return -ENOMEM; - pr_debug("%s:buf = %p\n", __func__, buf); + pr_debug("%s:buf = %pK\n", __func__, buf); dma_buf->dev.type = SNDRV_DMA_TYPE_DEV; dma_buf->dev.dev = substream->pcm->card->dev; dma_buf->private_data = NULL; diff --git a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c index 40a04d7b559c..ccd2eb36a54e 100644 --- a/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c +++ b/sound/soc/msm/qdsp6v2/msm-pcm-q6-v2.c @@ -759,7 +759,7 @@ static int msm_pcm_capture_copy(struct snd_pcm_substream *substream, pr_debug("%s: pcm stopped in_count 0\n", __func__); return 0; } - pr_debug("Checking if valid buffer is available...%p\n", + pr_debug("Checking if valid buffer is available...%pK\n", data); data = q6asm_is_cpu_buf_avail(OUT, prtd->audio_client, &size, &idx); bufptr = data; @@ -915,7 +915,7 @@ static int msm_pcm_hw_params(struct snd_pcm_substream *substream, if (buf == NULL || buf[0].data == NULL) return -ENOMEM; - pr_debug("%s:buf = %p\n", __func__, buf); + pr_debug("%s:buf = %pK\n", __func__, buf); dma_buf->dev.type = SNDRV_DMA_TYPE_DEV; dma_buf->dev.dev = substream->pcm->card->dev; dma_buf->private_data = NULL; diff --git a/sound/soc/msm/qdsp6v2/q6adm.c b/sound/soc/msm/qdsp6v2/q6adm.c index 5f7d237b51c8..6568ff9ca1d9 100644 --- a/sound/soc/msm/qdsp6v2/q6adm.c +++ b/sound/soc/msm/qdsp6v2/q6adm.c @@ -376,7 +376,7 @@ int adm_dts_eagle_get(int port_id, int copp_idx, int param_id, } if ((size == 0) || !data) { - pr_err("DTS_EAGLE_ADM: %s - invalid size %u or pointer %p.\n", + pr_err("DTS_EAGLE_ADM: %s - invalid size %u or pointer %pK.\n", __func__, size, data); return -EINVAL; } @@ -1239,7 +1239,7 @@ static int32_t adm_callback(struct apr_client_data *data, void *priv) payload = data->payload; if (data->opcode == RESET_EVENTS) { - pr_debug("%s: Reset event is received: %d %d apr[%p]\n", + pr_debug("%s: Reset event is received: %d %d apr[%pK]\n", __func__, data->reset_event, data->reset_proc, this_adm.apr); if (this_adm.apr) { @@ -1718,7 +1718,7 @@ static int remap_cal_data(struct cal_block_data *cal_block, int cal_index) pr_err("%s: ADM mmap did not work! size = %zd ret %d\n", __func__, cal_block->map_data.map_size, ret); - pr_debug("%s: ADM mmap did not work! addr = 0x%pa, size = %zd ret %d\n", + pr_debug("%s: ADM mmap did not work! addr = 0x%pK, size = %zd ret %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size, ret); @@ -1785,7 +1785,7 @@ static void send_adm_custom_topology(void) adm_top.payload_size = cal_block->cal_data.size; atomic_set(&this_adm.adm_stat, -1); - pr_debug("%s: Sending ADM_CMD_ADD_TOPOLOGIES payload = 0x%pa, size = %d\n", + pr_debug("%s: Sending ADM_CMD_ADD_TOPOLOGIES payload = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, adm_top.payload_size); result = apr_send_pkt(this_adm.apr, (uint32_t *)&adm_top); @@ -1874,14 +1874,14 @@ static int send_adm_cal_block(int port_id, int copp_idx, adm_params.payload_size = cal_block->cal_data.size; atomic_set(&this_adm.copp.stat[port_idx][copp_idx], -1); - pr_debug("%s: Sending SET_PARAMS payload = 0x%pa, size = %d\n", + pr_debug("%s: Sending SET_PARAMS payload = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, adm_params.payload_size); result = apr_send_pkt(this_adm.apr, (uint32_t *)&adm_params); if (result < 0) { pr_err("%s: Set params failed port 0x%x result %d\n", __func__, port_id, result); - pr_debug("%s: Set params failed port = 0x%x payload = 0x%pa result %d\n", + pr_debug("%s: Set params failed port = 0x%x payload = 0x%pK result %d\n", __func__, port_id, &cal_block->cal_data.paddr, result); result = -EINVAL; goto done; @@ -1893,7 +1893,7 @@ static int send_adm_cal_block(int port_id, int copp_idx, if (!result) { pr_err("%s: Set params timed out port = 0x%x\n", __func__, port_id); - pr_debug("%s: Set params timed out port = 0x%x, payload = 0x%pa\n", + pr_debug("%s: Set params timed out port = 0x%x, payload = 0x%pK\n", __func__, port_id, &cal_block->cal_data.paddr); result = -EINVAL; goto done; @@ -2364,7 +2364,7 @@ int adm_open(int port_id, int path, int rate, int channel_mode, int topology, res = adm_memory_map_regions(&this_adm.outband_memmap.paddr, 0, (uint32_t *)&this_adm.outband_memmap.size, 1); if (res < 0) { - pr_err("%s: SRS adm_memory_map_regions failed ! addr = 0x%p, size = %d\n", + pr_err("%s: SRS adm_memory_map_regions failed ! addr = 0x%pK, size = %d\n", __func__, (void *)this_adm.outband_memmap.paddr, (uint32_t)this_adm.outband_memmap.size); } @@ -2973,7 +2973,7 @@ int adm_map_rtac_block(struct rtac_cal_block_data *cal_block) pr_err("%s: RTAC mmap did not work! size = %d result %d\n", __func__, cal_block->map_data.map_size, result); - pr_debug("%s: RTAC mmap did not work! addr = 0x%pa, size = %d\n", + pr_debug("%s: RTAC mmap did not work! addr = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -4154,7 +4154,7 @@ static int adm_source_tracking_alloc_map_memory(void) (uint32_t *)&this_adm.sourceTrackingData.memmap.size, 1); if (ret < 0) { - pr_err("%s: failed to map memory, paddr = 0x%p, size = %d\n", + pr_err("%s: failed to map memory, paddr = 0x%pK, size = %d\n", __func__, (void *)this_adm.sourceTrackingData.memmap.paddr, (uint32_t)this_adm.sourceTrackingData.memmap.size); @@ -4174,7 +4174,7 @@ static int adm_source_tracking_alloc_map_memory(void) goto done; } ret = 0; - pr_debug("%s: paddr = 0x%p, size = %d, mem_map_handle = 0x%x\n", + pr_debug("%s: paddr = 0x%pK, size = %d, mem_map_handle = 0x%x\n", __func__, (void *)this_adm.sourceTrackingData.memmap.paddr, (uint32_t)this_adm.sourceTrackingData.memmap.size, atomic_read(&this_adm.mem_map_handles diff --git a/sound/soc/msm/qdsp6v2/q6afe.c b/sound/soc/msm/qdsp6v2/q6afe.c index caeef827c8cc..a650fb7ce0a8 100644 --- a/sound/soc/msm/qdsp6v2/q6afe.c +++ b/sound/soc/msm/qdsp6v2/q6afe.c @@ -259,7 +259,7 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) return -EINVAL; } if (data->opcode == RESET_EVENTS) { - pr_debug("%s: reset event = %d %d apr[%p]\n", + pr_debug("%s: reset event = %d %d apr[%pK]\n", __func__, data->reset_event, data->reset_proc, this_afe.apr); @@ -293,7 +293,7 @@ static int32_t afe_callback(struct apr_client_data *data, void *priv) return 0; if (!payload || (data->token >= AFE_MAX_PORTS)) { - pr_err("%s: Error: size %d payload %p token %d\n", + pr_err("%s: Error: size %d payload %pK token %d\n", __func__, data->payload_size, payload, data->token); return -EINVAL; @@ -689,7 +689,7 @@ static int afe_send_cal_block(u16 port_id, struct cal_block_data *cal_block) msm_audio_populate_upper_32_bits(cal_block->cal_data.paddr); afe_cal.param.mem_map_handle = cal_block->map_data.q6map_handle; - pr_debug("%s: AFE cal sent for device port = 0x%x, cal size = %zd, cal addr = 0x%pa\n", + pr_debug("%s: AFE cal sent for device port = 0x%x, cal size = %zd, cal addr = 0x%pK\n", __func__, port_id, cal_block->cal_data.size, &cal_block->cal_data.paddr); @@ -734,7 +734,7 @@ static int afe_send_custom_topology_block(struct cal_block_data *cal_block) msm_audio_populate_upper_32_bits(cal_block->cal_data.paddr); afe_cal.mem_map_handle = cal_block->map_data.q6map_handle; - pr_debug("%s:cmd_id:0x%x calsize:%zd memmap_hdl:0x%x caladdr:0x%pa", + pr_debug("%s:cmd_id:0x%x calsize:%zd memmap_hdl:0x%x caladdr:0x%pK", __func__, AFE_CMD_ADD_TOPOLOGIES, cal_block->cal_data.size, afe_cal.mem_map_handle, &cal_block->cal_data.paddr); @@ -1327,7 +1327,7 @@ static int remap_cal_data(struct cal_block_data *cal_block, int cal_index) pr_err("%s: mmap did not work! size = %zd ret %d\n", __func__, cal_block->map_data.map_size, ret); - pr_debug("%s: mmap did not work! addr = 0x%pa, size = %zd\n", + pr_debug("%s: mmap did not work! addr = 0x%pK, size = %zd\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -3585,7 +3585,7 @@ int q6afe_audio_client_buf_alloc_contiguous(unsigned int dir, size_t len; if (!(ac) || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + pr_err("%s: ac %pK dir %d\n", __func__, ac, dir); return -EINVAL; } @@ -3637,7 +3637,7 @@ int q6afe_audio_client_buf_alloc_contiguous(unsigned int dir, buf[cnt].used = dir ^ 1; buf[cnt].size = bufsz; buf[cnt].actual_size = bufsz; - pr_debug("%s: data[%p]phys[%pa][%p]\n", __func__, + pr_debug("%s: data[%pK]phys[%pK][%pK]\n", __func__, buf[cnt].data, &buf[cnt].phys, &buf[cnt].phys); @@ -3731,7 +3731,7 @@ int afe_cmd_memory_map(phys_addr_t dma_addr_p, u32 dma_buf_sz) mregion_pl->shm_addr_msw = msm_audio_populate_upper_32_bits(dma_addr_p); mregion_pl->mem_size_bytes = dma_buf_sz; - pr_debug("%s: dma_addr_p 0x%pa , size %d\n", __func__, + pr_debug("%s: dma_addr_p 0x%pK , size %d\n", __func__, &dma_addr_p, dma_buf_sz); atomic_set(&this_afe.state, 1); atomic_set(&this_afe.status, 0); @@ -3857,7 +3857,7 @@ int q6afe_audio_client_buf_free_contiguous(unsigned int dir, cnt = port->max_buf_cnt - 1; if (port->buf[0].data) { - pr_debug("%s: data[%p]phys[%pa][%p] , client[%p] handle[%p]\n", + pr_debug("%s: data[%pK]phys[%pK][%pK] , client[%pK] handle[%pK]\n", __func__, port->buf[0].data, &port->buf[0].phys, @@ -4107,7 +4107,7 @@ int afe_rt_proxy_port_write(phys_addr_t buf_addr_p, ret = -ENODEV; return ret; } - pr_debug("%s: buf_addr_p = 0x%pa bytes = %d\n", __func__, + pr_debug("%s: buf_addr_p = 0x%pK bytes = %d\n", __func__, &buf_addr_p, bytes); afecmd_wr.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, @@ -4144,7 +4144,7 @@ int afe_rt_proxy_port_read(phys_addr_t buf_addr_p, ret = -ENODEV; return ret; } - pr_debug("%s: buf_addr_p = 0x%pa bytes = %d\n", __func__, + pr_debug("%s: buf_addr_p = 0x%pK bytes = %d\n", __func__, &buf_addr_p, bytes); afecmd_rd.hdr.hdr_field = APR_HDR_FIELD(APR_MSG_TYPE_SEQ_CMD, @@ -5976,7 +5976,7 @@ static int afe_map_cal_data(int32_t cal_type, pr_err("%s: mmap did not work! size = %zd ret %d\n", __func__, cal_block->map_data.map_size, ret); - pr_debug("%s: mmap did not work! addr = 0x%pa, size = %zd\n", + pr_debug("%s: mmap did not work! addr = 0x%pK, size = %zd\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -6133,7 +6133,7 @@ int afe_map_rtac_block(struct rtac_cal_block_data *cal_block) result = afe_cmd_memory_map(cal_block->cal_data.paddr, cal_block->map_data.map_size); if (result < 0) { - pr_err("%s: afe_cmd_memory_map failed for addr = 0x%pa, size = %d, err %d\n", + pr_err("%s: afe_cmd_memory_map failed for addr = 0x%pK, size = %d, err %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size, result); return result; diff --git a/sound/soc/msm/qdsp6v2/q6asm.c b/sound/soc/msm/qdsp6v2/q6asm.c index 246fd17472f4..31ca2f230839 100755 --- a/sound/soc/msm/qdsp6v2/q6asm.c +++ b/sound/soc/msm/qdsp6v2/q6asm.c @@ -317,12 +317,12 @@ static void config_debug_fs_write(struct audio_buffer *ab) } static void config_debug_fs_init(void) { - out_buffer = kmalloc(OUT_BUFFER_SIZE, GFP_KERNEL); + out_buffer = kzalloc(OUT_BUFFER_SIZE, GFP_KERNEL); if (out_buffer == NULL) { pr_err("%s: kmalloc() for out_buffer failed\n", __func__); goto outbuf_fail; } - in_buffer = kmalloc(IN_BUFFER_SIZE, GFP_KERNEL); + in_buffer = kzalloc(IN_BUFFER_SIZE, GFP_KERNEL); if (in_buffer == NULL) { pr_err("%s: kmalloc() for in_buffer failed\n", __func__); goto inbuf_fail; @@ -548,7 +548,7 @@ static int q6asm_map_cal_memory(int32_t cal_type, pr_err("%s: mmap did not work! size = %zd result %d\n", __func__, cal_block->map_data.map_size, result); - pr_debug("%s: mmap did not work! addr = 0x%pa, size = %zd\n", + pr_debug("%s: mmap did not work! addr = 0x%pK, size = %zd\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -695,7 +695,7 @@ int send_asm_custom_topology(struct audio_client *ac) asm_top.mem_map_handle = cal_block->map_data.q6map_handle; asm_top.payload_size = cal_block->cal_data.size; - pr_debug("%s: Sending ASM_CMD_ADD_TOPOLOGIES payload = %pa, size = %d, map handle = 0x%x\n", + pr_debug("%s: Sending ASM_CMD_ADD_TOPOLOGIES payload = %pK, size = %d, map handle = 0x%x\n", __func__, &cal_block->cal_data.paddr, asm_top.payload_size, asm_top.mem_map_handle); @@ -703,7 +703,7 @@ int send_asm_custom_topology(struct audio_client *ac) if (result < 0) { pr_err("%s: Set topologies failed result %d\n", __func__, result); - pr_debug("%s: Set topologies failed payload = 0x%pa\n", + pr_debug("%s: Set topologies failed payload = 0x%pK\n", __func__, &cal_block->cal_data.paddr); goto unmap; @@ -713,7 +713,7 @@ int send_asm_custom_topology(struct audio_client *ac) (atomic_read(&ac->mem_state) >= 0), 5*HZ); if (!result) { pr_err("%s: Set topologies failed timeout\n", __func__); - pr_debug("%s: Set topologies failed after timedout payload = 0x%pa\n", + pr_debug("%s: Set topologies failed after timedout payload = 0x%pK\n", __func__, &cal_block->cal_data.paddr); result = -ETIMEDOUT; goto unmap; @@ -794,7 +794,7 @@ int q6asm_map_rtac_block(struct rtac_cal_block_data *cal_block) pr_err("%s: mmap did not work! size = %d result %d\n", __func__, cal_block->map_data.map_size, result); - pr_debug("%s: mmap did not work! addr = 0x%pa, size = %d\n", + pr_debug("%s: mmap did not work! addr = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -931,7 +931,7 @@ int q6asm_audio_client_buf_free_contiguous(unsigned int dir, } if (port->buf[0].data) { - pr_debug("%s: data[%p]phys[%pa][%p] , client[%p] handle[%p]\n", + pr_debug("%s: data[%pK]phys[%pK][%pK] , client[%pK] handle[%pK]\n", __func__, port->buf[0].data, &port->buf[0].phys, @@ -963,7 +963,7 @@ void q6asm_audio_client_free(struct audio_client *ac) struct audio_port_data *port; if (!ac) { - pr_err("%s: ac %p\n", __func__, ac); + pr_err("%s: ac %pK\n", __func__, ac); return; } if (!ac->session) { @@ -1172,15 +1172,16 @@ struct audio_client *q6asm_get_audio_client(int session_id) int q6asm_audio_client_buf_alloc(unsigned int dir, struct audio_client *ac, unsigned int bufsz, - unsigned int bufcnt) + uint32_t bufcnt) { int cnt = 0; int rc = 0; struct audio_buffer *buf; size_t len; - if (!(ac) || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + if (!(ac) || !(bufsz) || ((dir != IN) && (dir != OUT))) { + pr_err("%s: ac %pK bufsz %d dir %d\n", __func__, ac, bufsz, + dir); return -EINVAL; } @@ -1199,7 +1200,7 @@ int q6asm_audio_client_buf_alloc(unsigned int dir, return 0; } mutex_lock(&ac->cmd_lock); - if (bufcnt > (LONG_MAX/sizeof(struct audio_buffer))) { + if (bufcnt > (U32_MAX/sizeof(struct audio_buffer))) { pr_err("%s: Buffer size overflows", __func__); mutex_unlock(&ac->cmd_lock); goto fail; @@ -1233,7 +1234,7 @@ int q6asm_audio_client_buf_alloc(unsigned int dir, buf[cnt].used = 1; buf[cnt].size = bufsz; buf[cnt].actual_size = bufsz; - pr_debug("%s: data[%p]phys[%pa][%p]\n", + pr_debug("%s: data[%pK]phys[%pK][%pK]\n", __func__, buf[cnt].data, &buf[cnt].phys, @@ -1270,7 +1271,7 @@ int q6asm_audio_client_buf_alloc_contiguous(unsigned int dir, int bytes_to_alloc; if (!(ac) || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + pr_err("%s: ac %pK dir %d\n", __func__, ac, dir); return -EINVAL; } @@ -1333,7 +1334,7 @@ int q6asm_audio_client_buf_alloc_contiguous(unsigned int dir, buf[cnt].used = dir ^ 1; buf[cnt].size = bufsz; buf[cnt].actual_size = bufsz; - pr_debug("%s: data[%p]phys[%pa][%p]\n", + pr_debug("%s: data[%pK]phys[%pK][%pK]\n", __func__, buf[cnt].data, &buf[cnt].phys, @@ -1376,7 +1377,7 @@ static int32_t q6asm_srvc_callback(struct apr_client_data *data, void *priv) payload = data->payload; if (data->opcode == RESET_EVENTS) { - pr_debug("%s: Reset event is received: %d %d apr[%p]\n", + pr_debug("%s: Reset event is received: %d %d apr[%pK]\n", __func__, data->reset_event, data->reset_proc, @@ -1586,7 +1587,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) return -EINVAL; } if (!q6asm_is_valid_audio_client(ac)) { - pr_err("%s: audio client pointer is invalid, ac = %p\n", + pr_err("%s: audio client pointer is invalid, ac = %pK\n", __func__, ac); return -EINVAL; } @@ -1612,7 +1613,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) atomic_set(&ac->reset, 1); if (ac->apr == NULL) ac->apr = ac->apr2; - pr_debug("%s: Reset event is received: %d %d apr[%p]\n", + pr_debug("%s: Reset event is received: %d %d apr[%pK]\n", __func__, data->reset_event, data->reset_proc, ac->apr); if (ac->cb) @@ -1755,7 +1756,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) payload[0] || msm_audio_populate_upper_32_bits( port->buf[data->token].phys) != payload[1]) { - pr_debug("%s: Expected addr %pa\n", + pr_debug("%s: Expected addr %pK\n", __func__, &port->buf[data->token].phys); pr_err("%s: rxedl[0x%x] rxedu [0x%x]\n", __func__, payload[0], payload[1]); @@ -1842,7 +1843,7 @@ static int32_t q6asm_callback(struct apr_client_data *data, void *priv) msm_audio_populate_upper_32_bits( port->buf[token].phys) != payload[READDONE_IDX_BUFADD_MSW]) { - dev_vdbg(ac->dev, "%s: Expected addr %pa\n", + dev_vdbg(ac->dev, "%s: Expected addr %pK\n", __func__, &port->buf[token].phys); pr_err("%s: rxedl[0x%x] rxedu[0x%x]\n", __func__, @@ -1930,7 +1931,7 @@ void *q6asm_is_cpu_buf_avail(int dir, struct audio_client *ac, uint32_t *size, struct audio_port_data *port; if (!ac || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + pr_err("%s: ac %pK dir %d\n", __func__, ac, dir); return NULL; } @@ -1957,7 +1958,7 @@ void *q6asm_is_cpu_buf_avail(int dir, struct audio_client *ac, uint32_t *size, *size = port->buf[idx].actual_size; *index = port->cpu_buf; data = port->buf[idx].data; - dev_vdbg(ac->dev, "%s: session[%d]index[%d] data[%p]size[%d]\n", + dev_vdbg(ac->dev, "%s: session[%d]index[%d] data[%pK]size[%d]\n", __func__, ac->session, port->cpu_buf, @@ -1982,7 +1983,7 @@ void *q6asm_is_cpu_buf_avail_nolock(int dir, struct audio_client *ac, struct audio_port_data *port; if (!ac || ((dir != IN) && (dir != OUT))) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + pr_err("%s: ac %pK dir %d\n", __func__, ac, dir); return NULL; } @@ -2009,7 +2010,7 @@ void *q6asm_is_cpu_buf_avail_nolock(int dir, struct audio_client *ac, *size = port->buf[idx].actual_size; *index = port->cpu_buf; data = port->buf[idx].data; - dev_vdbg(ac->dev, "%s: session[%d]index[%d] data[%p]size[%d]\n", + dev_vdbg(ac->dev, "%s: session[%d]index[%d] data[%pK]size[%d]\n", __func__, ac->session, port->cpu_buf, data, *size); /* @@ -2030,7 +2031,7 @@ int q6asm_is_dsp_buf_avail(int dir, struct audio_client *ac) uint32_t idx; if (!ac || (dir != OUT)) { - pr_err("%s: ac %p dir %d\n", __func__, ac, dir); + pr_err("%s: ac %pK dir %d\n", __func__, ac, dir); return ret; } @@ -2306,13 +2307,13 @@ int q6asm_open_write_compressed(struct audio_client *ac, uint32_t format, struct asm_stream_cmd_open_write_compressed open; if (ac == NULL) { - pr_err("%s: ac[%p] NULL\n", __func__, ac); + pr_err("%s: ac[%pK] NULL\n", __func__, ac); rc = -EINVAL; goto fail_cmd; } if (ac->apr == NULL) { - pr_err("%s: APR handle[%p] NULL\n", __func__, ac->apr); + pr_err("%s: APR handle[%pK] NULL\n", __func__, ac->apr); rc = -EINVAL; goto fail_cmd; } @@ -4331,7 +4332,7 @@ int q6asm_memory_map(struct audio_client *ac, phys_addr_t buf_add, int dir, ac->port[dir].tmp_hdl = 0; port = &ac->port[dir]; - pr_debug("%s: buf_add 0x%pa, bufsz: %d\n", __func__, + pr_debug("%s: buf_add 0x%pK, bufsz: %d\n", __func__, &buf_add, bufsz); mregions->shm_addr_lsw = lower_32_bits(buf_add); mregions->shm_addr_msw = msm_audio_populate_upper_32_bits(buf_add); @@ -4475,7 +4476,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, struct asm_buffer_node *buffer_node = NULL; int rc = 0; int i = 0; - int cmd_size = 0; + uint32_t cmd_size = 0; uint32_t bufcnt_t; uint32_t bufsz_t; @@ -4497,10 +4498,25 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, bufsz_t = PAGE_ALIGN(bufsz_t); } + if (bufcnt_t > (UINT_MAX + - sizeof(struct avs_cmd_shared_mem_map_regions)) + / sizeof(struct avs_shared_map_region_payload)) { + pr_err("%s: Unsigned Integer Overflow. bufcnt_t = %u\n", + __func__, bufcnt_t); + return -EINVAL; + } + cmd_size = sizeof(struct avs_cmd_shared_mem_map_regions) + (sizeof(struct avs_shared_map_region_payload) * bufcnt_t); + + if (bufcnt > (UINT_MAX / sizeof(struct asm_buffer_node))) { + pr_err("%s: Unsigned Integer Overflow. bufcnt = %u\n", + __func__, bufcnt); + return -EINVAL; + } + buffer_node = kzalloc(sizeof(struct asm_buffer_node) * bufcnt, GFP_KERNEL); if (!buffer_node) { @@ -4521,7 +4537,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, q6asm_add_mmaphdr(ac, &mmap_regions->hdr, cmd_size, TRUE, ((ac->session << 8) | dir)); atomic_set(&ac->mem_state, -1); - pr_debug("%s: mmap_region=0x%p token=0x%x\n", __func__, + pr_debug("%s: mmap_region=0x%pK token=0x%x\n", __func__, mmap_regions, ((ac->session << 8) | dir)); mmap_regions->hdr.opcode = ASM_CMD_SHARED_MEM_MAP_REGIONS; @@ -4580,7 +4596,7 @@ static int q6asm_memory_map_regions(struct audio_client *ac, int dir, buffer_node[i].mmap_hdl = ac->port[dir].tmp_hdl; list_add_tail(&buffer_node[i].list, &ac->port[dir].mem_map_handle); - pr_debug("%s: i=%d, bufadd[i] = 0x%pa, maphdl[i] = 0x%x\n", + pr_debug("%s: i=%d, bufadd[i] = 0x%pK, maphdl[i] = 0x%x\n", __func__, i, &buffer_node[i].buf_phys_addr, buffer_node[i].mmap_hdl); } @@ -4921,7 +4937,7 @@ int q6asm_dts_eagle_set(struct audio_client *ac, int param_id, uint32_t size, struct asm_dts_eagle_param *ad; if (!ac || ac->apr == NULL || (size == 0) || !data) { - pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %p.\n", + pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %pK.\n", __func__, size, data); return -EINVAL; } @@ -4932,7 +4948,7 @@ int q6asm_dts_eagle_set(struct audio_client *ac, int param_id, uint32_t size, __func__, sz); return -ENOMEM; } - pr_debug("DTS_EAGLE_ASM - %s: ac %p param_id 0x%x size %u data %p m_id 0x%x\n", + pr_debug("DTS_EAGLE_ASM - %s: ac %pK param_id 0x%x size %u data %pK m_id 0x%x\n", __func__, ac, param_id, size, data, m_id); q6asm_add_hdr_async(ac, &ad->hdr, sz, 1); ad->hdr.opcode = ASM_STREAM_CMD_SET_PP_PARAMS_V2; @@ -4951,8 +4967,8 @@ int q6asm_dts_eagle_set(struct audio_client *ac, int param_id, uint32_t size, if (po) { struct list_head *ptr, *next; struct asm_buffer_node *node; - pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %p, physical %lu)\n", - __func__, po->kvaddr, (long)po->paddr); + pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %pK, physical %pK)\n", + __func__, po->kvaddr, &po->paddr); ad->param.data_payload_addr_lsw = lower_32_bits(po->paddr); ad->param.data_payload_addr_msw = msm_audio_populate_upper_32_bits(po->paddr); @@ -5028,7 +5044,7 @@ int q6asm_dts_eagle_get(struct audio_client *ac, int param_id, uint32_t size, (po ? 0 : size); if (!ac || ac->apr == NULL || (size == 0) || !data) { - pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %p\n", + pr_err("DTS_EAGLE_ASM - %s: APR handle NULL, invalid size %u or pointer %pK\n", __func__, size, data); return -EINVAL; } @@ -5038,7 +5054,7 @@ int q6asm_dts_eagle_get(struct audio_client *ac, int param_id, uint32_t size, __func__, sz); return -ENOMEM; } - pr_debug("DTS_EAGLE_ASM - %s: ac %p param_id 0x%x size %u data %p m_id 0x%x\n", + pr_debug("DTS_EAGLE_ASM - %s: ac %pK param_id 0x%x size %u data %pK m_id 0x%x\n", __func__, ac, param_id, size, data, m_id); q6asm_add_hdr(ac, &ad->hdr, sz, TRUE); ad->hdr.opcode = ASM_STREAM_CMD_GET_PP_PARAMS_V2; @@ -5063,8 +5079,8 @@ int q6asm_dts_eagle_get(struct audio_client *ac, int param_id, uint32_t size, if (po) { struct list_head *ptr, *next; struct asm_buffer_node *node; - pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %p, physical %lu)\n", - __func__, po->kvaddr, (long)po->paddr); + pr_debug("DTS_EAGLE_ASM - %s: using out of band memory (virtual %pK, physical %pK)\n", + __func__, po->kvaddr, &po->paddr); ad->param.data_payload_addr_lsw = lower_32_bits(po->paddr); ad->param.data_payload_addr_msw = msm_audio_populate_upper_32_bits(po->paddr); @@ -5512,7 +5528,7 @@ static int __q6asm_read(struct audio_client *ac, bool is_custom_len_reqd, } ab = &port->buf[dsp_buf]; - dev_vdbg(ac->dev, "%s: session[%d]dsp-buf[%d][%p]cpu_buf[%d][%pa]\n", + dev_vdbg(ac->dev, "%s: session[%d]dsp-buf[%d][%pK]cpu_buf[%d][%pK]\n", __func__, ac->session, dsp_buf, @@ -5538,7 +5554,7 @@ static int __q6asm_read(struct audio_client *ac, bool is_custom_len_reqd, port->dsp_buf = q6asm_get_next_buf(ac, port->dsp_buf, port->max_buf_cnt); mutex_unlock(&port->lock); - dev_vdbg(ac->dev, "%s: buf add[%pa] token[%d] uid[%d]\n", + dev_vdbg(ac->dev, "%s: buf add[%pK] token[%d] uid[%d]\n", __func__, &ab->phys, read.hdr.token, read.seq_id); rc = apr_send_pkt(ac->apr, (uint32_t *) &read); @@ -5590,7 +5606,7 @@ int q6asm_read_nolock(struct audio_client *ac) dsp_buf = port->dsp_buf; ab = &port->buf[dsp_buf]; - dev_vdbg(ac->dev, "%s: session[%d]dsp-buf[%d][%p]cpu_buf[%d][%pa]\n", + dev_vdbg(ac->dev, "%s: session[%d]dsp-buf[%d][%pK]cpu_buf[%d][%pK]\n", __func__, ac->session, dsp_buf, @@ -5616,7 +5632,7 @@ int q6asm_read_nolock(struct audio_client *ac) port->dsp_buf = q6asm_get_next_buf(ac, port->dsp_buf, port->max_buf_cnt); - dev_vdbg(ac->dev, "%s: buf add[%pa] token[%d] uid[%d]\n", + dev_vdbg(ac->dev, "%s: buf add[%pK] token[%d] uid[%d]\n", __func__, &ab->phys, read.hdr.token, read.seq_id); rc = apr_send_pkt(ac->apr, (uint32_t *) &read); @@ -5679,7 +5695,7 @@ int q6asm_async_write(struct audio_client *ac, else lbuf_phys_addr = param->paddr; - dev_vdbg(ac->dev, "%s: token[0x%x], buf_addr[%pa], buf_size[0x%x], ts_msw[0x%x], ts_lsw[0x%x], lbuf_phys_addr: 0x[%pa]\n", + dev_vdbg(ac->dev, "%s: token[0x%x], buf_addr[%pK], buf_size[0x%x], ts_msw[0x%x], ts_lsw[0x%x], lbuf_phys_addr: 0x[%pK]\n", __func__, write.hdr.token, ¶m->paddr, write.buf_size, write.timestamp_msw, @@ -5827,7 +5843,7 @@ int q6asm_write(struct audio_client *ac, uint32_t len, uint32_t msw_ts, list); write.mem_map_handle = buf_node->mmap_hdl; - dev_vdbg(ac->dev, "%s: ab->phys[%pa]bufadd[0x%x] token[0x%x]buf_id[0x%x]buf_size[0x%x]mmaphdl[0x%x]" + dev_vdbg(ac->dev, "%s: ab->phys[%pK]bufadd[0x%x] token[0x%x]buf_id[0x%x]buf_size[0x%x]mmaphdl[0x%x]" , __func__, &ab->phys, write.buf_addr_lsw, @@ -5901,7 +5917,7 @@ int q6asm_write_nolock(struct audio_client *ac, uint32_t len, uint32_t msw_ts, port->dsp_buf = q6asm_get_next_buf(ac, port->dsp_buf, port->max_buf_cnt); - dev_vdbg(ac->dev, "%s: ab->phys[%pa]bufadd[0x%x]token[0x%x] buf_id[0x%x]buf_size[0x%x]mmaphdl[0x%x]" + dev_vdbg(ac->dev, "%s: ab->phys[%pK]bufadd[0x%x]token[0x%x] buf_id[0x%x]buf_size[0x%x]mmaphdl[0x%x]" , __func__, &ab->phys, write.buf_addr_lsw, diff --git a/sound/soc/msm/qdsp6v2/q6core.c b/sound/soc/msm/qdsp6v2/q6core.c index 1d3318165fac..cc26af528aba 100644 --- a/sound/soc/msm/qdsp6v2/q6core.c +++ b/sound/soc/msm/qdsp6v2/q6core.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -188,7 +188,7 @@ void ocm_core_open(void) if (q6core_lcl.core_handle_q == NULL) q6core_lcl.core_handle_q = apr_register("ADSP", "CORE", aprv2_core_fn_q, 0xFFFFFFFF, NULL); - pr_debug("%s: Open_q %p\n", __func__, q6core_lcl.core_handle_q); + pr_debug("%s: Open_q %pK\n", __func__, q6core_lcl.core_handle_q); if (q6core_lcl.core_handle_q == NULL) pr_err("%s: Unable to register CORE\n", __func__); } @@ -351,7 +351,7 @@ int core_dts_eagle_set(int size, char *data) pr_debug("DTS_EAGLE_CORE - %s\n", __func__); if (size <= 0 || !data) { - pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %p.\n", + pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %pK.\n", __func__, size, data); return -EINVAL; } @@ -397,7 +397,7 @@ int core_dts_eagle_get(int id, int size, char *data) pr_debug("DTS_EAGLE_CORE - %s\n", __func__); if (size <= 0 || !data) { - pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %p.\n", + pr_err("DTS_EAGLE_CORE - %s: invalid size %i or pointer %pK.\n", __func__, size, data); return -EINVAL; } @@ -563,7 +563,7 @@ static int q6core_map_memory_regions(phys_addr_t *buf_add, uint32_t mempool_id, ++mregions; } - pr_debug("%s: sending memory map, addr %pa, size %d, bufcnt = %d\n", + pr_debug("%s: sending memory map, addr %pK, size %d, bufcnt = %d\n", __func__, buf_add, bufsz[0], mmap_regions->num_regions); *map_handle = 0; @@ -745,7 +745,7 @@ static int q6core_send_custom_topologies(void) q6core_lcl.adsp_status = 0; q6core_lcl.bus_bw_resp_received = 0; - pr_debug("%s: Register topologies addr %pa, size %zd, map handle %d\n", + pr_debug("%s: Register topologies addr %pK, size %zd, map handle %d\n", __func__, &cal_block->cal_data.paddr, cal_block->cal_data.size, cal_block->map_data.q6map_handle); diff --git a/sound/soc/msm/qdsp6v2/q6lsm.c b/sound/soc/msm/qdsp6v2/q6lsm.c index de397588d538..2bf0c490e834 100644 --- a/sound/soc/msm/qdsp6v2/q6lsm.c +++ b/sound/soc/msm/qdsp6v2/q6lsm.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2015, Linux Foundation. All rights reserved. + * Copyright (c) 2013-2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -135,7 +135,7 @@ static int q6lsm_callback(struct apr_client_data *data, void *priv) uint32_t *payload; if (!client || !data) { - pr_err("%s: client %p data %p\n", + pr_err("%s: client %pK data %pK\n", __func__, client, data); WARN_ON(1); return -EINVAL; @@ -348,6 +348,7 @@ void q6lsm_client_free(struct lsm_client *client) q6lsm_mmap_apr_dereg(); mutex_destroy(&client->cmd_lock); kfree(client); + client = NULL; } /* @@ -862,7 +863,7 @@ int q6lsm_register_sound_model(struct lsm_client *client, rmb(); cmd.mem_map_handle = client->sound_model.mem_map_handle; - pr_debug("%s: addr %pa, size %d, handle 0x%x\n", __func__, + pr_debug("%s: addr %pK, size %d, handle 0x%x\n", __func__, &client->sound_model.phys, cmd.model_size, cmd.mem_map_handle); rc = q6lsm_apr_send_pkt(client, client->apr, &cmd, true, NULL); if (rc) @@ -936,7 +937,7 @@ static int q6lsm_memory_map_regions(struct lsm_client *client, int rc; int cmd_size = 0; - pr_debug("%s: dma_addr_p 0x%pa, dma_buf_sz %d, mmap_p 0x%p, session %d\n", + pr_debug("%s: dma_addr_p 0x%pK, dma_buf_sz %d, mmap_p 0x%pK, session %d\n", __func__, &dma_addr_p, dma_buf_sz, mmap_p, client->session); if (CHECK_SESSION(client->session)) { @@ -1213,7 +1214,7 @@ int q6lsm_snd_model_buf_alloc(struct lsm_client *client, size_t len, if (cal_block == NULL) goto fail; - pr_debug("%s:Snd Model len = %zd cal size %zd phys addr %pa", __func__, + pr_debug("%s:Snd Model len = %zd cal size %zd phys addr %pK", __func__, len, cal_block->cal_data.size, &cal_block->cal_data.paddr); if (!cal_block->cal_data.paddr) { @@ -1268,8 +1269,8 @@ int q6lsm_snd_model_buf_alloc(struct lsm_client *client, size_t len, memcpy((client->sound_model.data + pad_zero + client->sound_model.size), (uint32_t *)cal_block->cal_data.kvaddr, client->lsm_cal_size); - pr_debug("%s: Copy cal start virt_addr %p phy_addr %pa\n" - "Offset cal virtual Addr %p\n", __func__, + pr_debug("%s: Copy cal start virt_addr %pK phy_addr %pK\n" + "Offset cal virtual Addr %pK\n", __func__, client->sound_model.data, &client->sound_model.phys, (pad_zero + client->sound_model.data + client->sound_model.size)); @@ -1588,7 +1589,7 @@ int q6lsm_lab_control(struct lsm_client *client, u32 enable) u32 param_size; if (!client) { - pr_err("%s: invalid param client %p\n", __func__, client); + pr_err("%s: invalid param client %pK\n", __func__, client); return -EINVAL; } /* enable/disable lab on dsp */ @@ -1645,7 +1646,7 @@ int q6lsm_stop_lab(struct lsm_client *client) { int rc = 0; if (!client) { - pr_err("%s: invalid param client %p\n", __func__, client); + pr_err("%s: invalid param client %pK\n", __func__, client); return -EINVAL; } rc = q6lsm_cmd(client, LSM_SESSION_CMD_EOB, true); @@ -1658,7 +1659,7 @@ int q6lsm_read(struct lsm_client *client, struct lsm_cmd_read *read) { int rc = 0; if (!client || !read) { - pr_err("%s: Invalid params client %p read %p\n", __func__, + pr_err("%s: Invalid params client %pK read %pK\n", __func__, client, read); return -EINVAL; } @@ -1728,7 +1729,7 @@ int q6lsm_lab_buffer_alloc(struct lsm_client *client, bool alloc) kfree(client->lab_buffer); client->lab_buffer = NULL; } else { - pr_debug("%s: Memory map handle %x phys %pa size %d\n", + pr_debug("%s: Memory map handle %x phys %pK size %d\n", __func__, client->lab_buffer[0].mem_map_handle, &client->lab_buffer[0].phys, diff --git a/sound/soc/msm/qdsp6v2/q6voice.c b/sound/soc/msm/qdsp6v2/q6voice.c index 0b817ab568ce..ecba59025228 100644 --- a/sound/soc/msm/qdsp6v2/q6voice.c +++ b/sound/soc/msm/qdsp6v2/q6voice.c @@ -359,7 +359,7 @@ static struct voice_data *voice_get_session(u32 session_id) break; } - pr_debug("%s:session_id 0x%x session handle %p\n", + pr_debug("%s:session_id 0x%x session handle %pK\n", __func__, session_id, v); return v; @@ -3545,7 +3545,7 @@ static int voice_map_cal_memory(struct cal_block_data *cal_block, cal_block->map_data.map_size, VOC_CAL_MEM_MAP_TOKEN); if (result < 0) { - pr_err("%s: Mmap did not work! addr = 0x%pa, size = %zd\n", + pr_err("%s: Mmap did not work! addr = 0x%pK, size = %zd\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -3585,7 +3585,7 @@ static int remap_cal_data(struct cal_block_data *cal_block, goto done; } } else { - pr_debug("%s: Cal block 0x%pa, size %zd already mapped. Q6 map handle = %d\n", + pr_debug("%s: Cal block 0x%pK, size %zd already mapped. Q6 map handle = %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size, cal_block->map_data.q6map_handle); @@ -3783,7 +3783,7 @@ int voc_map_rtac_block(struct rtac_cal_block_data *cal_block) if (!is_rtac_memory_allocated()) { result = voice_alloc_rtac_mem_map_table(); if (result < 0) { - pr_err("%s: RTAC alloc mem map table did not work! addr = 0x%pa, size = %d\n", + pr_err("%s: RTAC alloc mem map table did not work! addr = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -3798,7 +3798,7 @@ int voc_map_rtac_block(struct rtac_cal_block_data *cal_block) cal_block->map_data.map_size, VOC_RTAC_MEM_MAP_TOKEN); if (result < 0) { - pr_err("%s: RTAC mmap did not work! addr = 0x%pa, size = %d\n", + pr_err("%s: RTAC mmap did not work! addr = 0x%pK, size = %d\n", __func__, &cal_block->cal_data.paddr, cal_block->map_data.map_size); @@ -5148,7 +5148,7 @@ int voc_start_record(uint32_t port_id, uint32_t set, uint32_t session_id) break; } - pr_debug("%s: port_id: %d, set: %d, v: %p\n", + pr_debug("%s: port_id: %d, set: %d, v: %pK\n", __func__, port_id, set, v); mutex_lock(&v->lock); @@ -7086,12 +7086,12 @@ static int voice_alloc_oob_shared_mem(void) cnt++; } - pr_debug("%s buf[0].data:[%p], buf[0].phys:[%pa], &buf[0].phys:[%p],\n", + pr_debug("%s buf[0].data:[%pK], buf[0].phys:[%pK], &buf[0].phys:[%pK],\n", __func__, (void *)v->shmem_info.sh_buf.buf[0].data, &v->shmem_info.sh_buf.buf[0].phys, (void *)&v->shmem_info.sh_buf.buf[0].phys); - pr_debug("%s: buf[1].data:[%p], buf[1].phys[%pa], &buf[1].phys[%p]\n", + pr_debug("%s: buf[1].data:[%pK], buf[1].phys[%pK], &buf[1].phys[%pK]\n", __func__, (void *)v->shmem_info.sh_buf.buf[1].data, &v->shmem_info.sh_buf.buf[1].phys, @@ -7133,7 +7133,7 @@ static int voice_alloc_oob_mem_table(void) } v->shmem_info.memtbl.size = sizeof(struct vss_imemory_table_t); - pr_debug("%s data[%p]phys[%pa][%p]\n", __func__, + pr_debug("%s data[%pK]phys[%pK][%pK]\n", __func__, (void *)v->shmem_info.memtbl.data, &v->shmem_info.memtbl.phys, (void *)&v->shmem_info.memtbl.phys); @@ -7451,7 +7451,7 @@ static int voice_alloc_cal_mem_map_table(void) } common.cal_mem_map_table.size = sizeof(struct vss_imemory_table_t); - pr_debug("%s: data %p phys %pa\n", __func__, + pr_debug("%s: data %pK phys %pK\n", __func__, common.cal_mem_map_table.data, &common.cal_mem_map_table.phys); @@ -7478,7 +7478,7 @@ static int voice_alloc_rtac_mem_map_table(void) } common.rtac_mem_map_table.size = sizeof(struct vss_imemory_table_t); - pr_debug("%s: data %p phys %pa\n", __func__, + pr_debug("%s: data %pK phys %pK\n", __func__, common.rtac_mem_map_table.data, &common.rtac_mem_map_table.phys); @@ -8099,7 +8099,7 @@ static int voice_alloc_source_tracking_shared_memory(void) memset((void *)(common.source_tracking_sh_mem.sh_mem_block.data), 0, common.source_tracking_sh_mem.sh_mem_block.size); - pr_debug("%s: sh_mem_block: phys:[%pa], data:[0x%p], size:[%zd]\n", + pr_debug("%s: sh_mem_block: phys:[%pK], data:[0x%pK], size:[%zd]\n", __func__, &(common.source_tracking_sh_mem.sh_mem_block.phys), (void *)(common.source_tracking_sh_mem.sh_mem_block.data), @@ -8130,7 +8130,7 @@ static int voice_alloc_source_tracking_shared_memory(void) memset((void *)(common.source_tracking_sh_mem.sh_mem_table.data), 0, common.source_tracking_sh_mem.sh_mem_table.size); - pr_debug("%s sh_mem_table: phys:[%pa], data:[0x%p], size:[%zd],\n", + pr_debug("%s sh_mem_table: phys:[%pK], data:[0x%pK], size:[%zd],\n", __func__, &(common.source_tracking_sh_mem.sh_mem_table.phys), (void *)(common.source_tracking_sh_mem.sh_mem_table.data), diff --git a/sound/soc/msm/qdsp6v2/rtac.c b/sound/soc/msm/qdsp6v2/rtac.c index 9bb931282496..641a17bded64 100644 --- a/sound/soc/msm/qdsp6v2/rtac.c +++ b/sound/soc/msm/qdsp6v2/rtac.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -157,7 +157,7 @@ int rtac_allocate_cal_buffer(uint32_t cal_type) } if (rtac_cal[cal_type].cal_data.paddr != 0) { - pr_err("%s: memory already allocated! cal_type %d, paddr 0x%pa\n", + pr_err("%s: memory already allocated! cal_type %d, paddr 0x%pK\n", __func__, cal_type, &rtac_cal[cal_type].cal_data.paddr); result = -EPERM; goto done; @@ -176,7 +176,7 @@ int rtac_allocate_cal_buffer(uint32_t cal_type) goto done; } - pr_debug("%s: cal_type %d, paddr 0x%pa, kvaddr 0x%p, map_size 0x%x\n", + pr_debug("%s: cal_type %d, paddr 0x%pK, kvaddr 0x%pK, map_size 0x%x\n", __func__, cal_type, &rtac_cal[cal_type].cal_data.paddr, rtac_cal[cal_type].cal_data.kvaddr, @@ -206,7 +206,7 @@ int rtac_free_cal_buffer(uint32_t cal_type) result = msm_audio_ion_free(rtac_cal[cal_type].map_data.ion_client, rtac_cal[cal_type].map_data.ion_handle); if (result < 0) { - pr_err("%s: ION free for RTAC failed! cal_type %d, paddr 0x%pa\n", + pr_err("%s: ION free for RTAC failed! cal_type %d, paddr 0x%pK\n", __func__, cal_type, &rtac_cal[cal_type].cal_data.paddr); goto done; } @@ -690,7 +690,7 @@ static int get_voice_index(u32 mode, u32 handle) /* ADM APR */ void rtac_set_adm_handle(void *handle) { - pr_debug("%s: handle = %p\n", __func__, handle); + pr_debug("%s: handle = %pK\n", __func__, handle); mutex_lock(&rtac_adm_apr_mutex); rtac_adm_apr_data.apr_handle = handle; @@ -748,7 +748,7 @@ int send_adm_apr(void *buf, u32 opcode) if (copy_from_user(&user_buf_size, (void *)buf, sizeof(user_buf_size))) { - pr_err("%s: Copy from user failed! buf = 0x%p\n", + pr_err("%s: Copy from user failed! buf = 0x%pK\n", __func__, buf); goto done; } @@ -849,7 +849,7 @@ int send_adm_apr(void *buf, u32 opcode) memcpy(rtac_adm_buffer, &adm_params, sizeof(adm_params)); atomic_set(&rtac_adm_apr_data.cmd_state, 1); - pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pa\n", + pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pK\n", __func__, opcode, &rtac_cal[ADM_RTAC_CAL].cal_data.paddr); @@ -968,7 +968,7 @@ int send_rtac_asm_apr(void *buf, u32 opcode) if (copy_from_user(&user_buf_size, (void *)buf, sizeof(user_buf_size))) { - pr_err("%s: Copy from user failed! buf = 0x%p\n", + pr_err("%s: Copy from user failed! buf = 0x%pK\n", __func__, buf); goto done; } @@ -1069,7 +1069,7 @@ int send_rtac_asm_apr(void *buf, u32 opcode) memcpy(rtac_asm_buffer, &asm_params, sizeof(asm_params)); atomic_set(&rtac_asm_apr_data[session_id].cmd_state, 1); - pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pa\n", + pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pK\n", __func__, opcode, &rtac_cal[ASM_RTAC_CAL].cal_data.paddr); @@ -1209,7 +1209,7 @@ static int send_rtac_afe_apr(void *buf, uint32_t opcode) if (copy_from_user(&user_afe_buf, (void *)buf, sizeof(struct rtac_afe_user_data))) { - pr_err("%s: Copy from user failed! buf = 0x%p\n", + pr_err("%s: Copy from user failed! buf = 0x%pK\n", __func__, buf); goto done; } @@ -1325,7 +1325,7 @@ static int send_rtac_afe_apr(void *buf, uint32_t opcode) atomic_set(&rtac_afe_apr_data.cmd_state, 1); - pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pa\n", + pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pK\n", __func__, opcode, &rtac_cal[AFE_RTAC_CAL].cal_data.paddr); @@ -1449,7 +1449,7 @@ int send_voice_apr(u32 mode, void *buf, u32 opcode) if (copy_from_user(&user_buf_size, (void *)buf, sizeof(user_buf_size))) { - pr_err("%s: Copy from user failed! buf = 0x%p\n", + pr_err("%s: Copy from user failed! buf = 0x%pK\n", __func__, buf); goto done; } @@ -1551,7 +1551,7 @@ int send_voice_apr(u32 mode, void *buf, u32 opcode) memcpy(rtac_voice_buffer, &voice_params, sizeof(voice_params)); atomic_set(&rtac_voice_apr_data[mode].cmd_state, 1); - pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pa\n", + pr_debug("%s: Sending RTAC command ioctl 0x%x, paddr 0x%pK\n", __func__, opcode, &rtac_cal[VOICE_RTAC_CAL].cal_data.paddr);