evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ion: chunk_heap: fix leak in allocated counter

Browse source 
buffer->size is controlled by the outer ion layer, don't modify it
inside the heap.  Instead, compute the rounded up allocated size
on demand.

Signed-off-by: Colin Cross <ccross@android.com>
[jstultz: modified patch to apply to staging directory]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Colin Cross 2013-12-13 14:24:46 -08:00 • committed by Greg Kroah-Hartman
parent c13bd1c4eb
commit ea89faff84
1 changed files with 9 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
drivers/staging/android/ion/ion_chunk_heap.c
View file

@ -47,15 +47,15 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
struct scatterlist *sg;
int ret, i;
unsigned long num_chunks;
unsigned long allocated_size;
if (ion_buffer_fault_user_mappings(buffer))
return -ENOMEM;
num_chunks = ALIGN(size, chunk_heap->chunk_size) /
chunk_heap->chunk_size;
buffer->size = num_chunks * chunk_heap->chunk_size;
allocated_size = ALIGN(size, chunk_heap->chunk_size);
num_chunks = allocated_size / chunk_heap->chunk_size;
if (buffer->size > chunk_heap->size - chunk_heap->allocated)
if (allocated_size > chunk_heap->size - chunk_heap->allocated)
return -ENOMEM;
table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
@ -78,7 +78,7 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
}
buffer->priv_virt = table;
chunk_heap->allocated += buffer->size;
chunk_heap->allocated += allocated_size;
return 0;
err:
sg = table->sgl;
@ -100,6 +100,9 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
struct sg_table *table = buffer->priv_virt;
struct scatterlist *sg;
int i;
unsigned long allocated_size;
allocated_size = ALIGN(buffer->size, chunk_heap->chunk_size);
ion_heap_buffer_zero(buffer);
@ -111,7 +114,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
sg_dma_len(sg));
}
chunk_heap->allocated -= buffer->size;
chunk_heap->allocated -= allocated_size;
sg_free_table(table);
kfree(table);
}