Commit 56d21267 authored by Thomas Weißschuh's avatar Thomas Weißschuh Committed by Greg Kroah-Hartman
Browse files

binder: don't use %pK through printk 



In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log. Since commit ad67b74d ("printk: hash
addresses printed with %p") the regular %p has been improved to avoid
this issue. Furthermore, restricted pointers ("%pK") were never meant
to be used through printk(). They can still unintentionally leak raw
pointers or acquire sleeping locks in atomic contexts.

Switch to the regular pointer formatting which is safer and
easier to reason about.

There are still a few users of %pK left, but these use it through
seq_file, for which its usage is safe.

Signed-off-by: default avatarThomas Weißschuh <thomas.weissschuh@linutronix.de>
Acked-by: default avatarCarlos Llamas <cmllamas@google.com>
Reviewed-by: default avatarAlice Ryhl <aliceryhl@google.com>
Link: https://patch.msgid.link/20260107-restricted-pointers-binder-v1-1-181018bf3812@linutronix.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 68aabb29

drivers/android/binder.c

+1 −1
Original line number Diff line number Diff line
@@ -4510,7 +4510,7 @@ static int binder_thread_write(struct binder_proc *proc, 
				}

			}

			binder_debug(BINDER_DEBUG_DEAD_BINDER,

				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",

				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",

				     proc->pid, thread->pid, (u64)cookie,

				     death);

			if (death == NULL) {

drivers/android/binder_alloc.c

+3 −3
Original line number Diff line number Diff line
@@ -81,7 +81,7 @@ static void binder_insert_free_buffer(struct binder_alloc *alloc, 
	new_buffer_size = binder_alloc_buffer_size(alloc, new_buffer);



	binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: add free buffer, size %zd, at %pK\n",

		     "%d: add free buffer, size %zd, at %p\n",

		      alloc->pid, new_buffer_size, new_buffer);



	while (*p) {
@@ -572,7 +572,7 @@ static struct binder_buffer *binder_alloc_new_buf_locked( 
	}



	binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_alloc_buf size %zd got buffer %pK size %zd\n",

		     "%d: binder_alloc_buf size %zd got buffer %p size %zd\n",

		      alloc->pid, size, buffer, buffer_size);



	/*
@@ -748,7 +748,7 @@ static void binder_free_buf_locked(struct binder_alloc *alloc, 
		ALIGN(buffer->extra_buffers_size, sizeof(void *));



	binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,

		     "%d: binder_free_buf %pK size %zd buffer_size %zd\n",

		     "%d: binder_free_buf %p size %zd buffer_size %zd\n",

		      alloc->pid, buffer, size, buffer_size);



	BUG_ON(buffer->free);