evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ion: check invalid values in ion_system_heap

Browse source 
ion_system_heap can only satisfy page alignment, and
ion_system_contig_heap can only satisify alignment to the
allocation size.  Neither can support faulting user mappings
because they use slab pages.

Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Colin Cross 2013-12-13 14:25:03 -08:00 • committed by Greg Kroah-Hartman
parent 06e0dcaeb4
commit c13d1df947
1 changed files with 14 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/staging/android/ion/ion_system_heap.c
View file

@ -150,6 +150,12 @@ static int ion_system_heap_allocate(struct ion_heap *heap,
long size_remaining = PAGE_ALIGN(size); long size_remaining = PAGE_ALIGN(size);
unsigned int max_order = orders[0]; unsigned int max_order = orders[0];
if (align > PAGE_SIZE)
return -EINVAL;
if (ion_buffer_fault_user_mappings(buffer))
return -EINVAL;
INIT_LIST_HEAD(&pages); INIT_LIST_HEAD(&pages);
while (size_remaining > 0) { while (size_remaining > 0) {
info = alloc_largest_available(sys_heap, buffer, size_remaining, max_order); info = alloc_largest_available(sys_heap, buffer, size_remaining, max_order);
@ -362,6 +368,14 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap,
unsigned long align, unsigned long align,
unsigned long flags) unsigned long flags)
{ {
int order = get_order(len);
if (align > (PAGE_SIZE << order))
return -EINVAL;
if (ion_buffer_fault_user_mappings(buffer))
return -EINVAL;
buffer->priv_virt = kzalloc(len, GFP_KERNEL); buffer->priv_virt = kzalloc(len, GFP_KERNEL);
if (!buffer->priv_virt) if (!buffer->priv_virt)
return -ENOMEM; return -ENOMEM;