evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ion: disable system contig heap

Browse source 
A malicious application can take advantage of the ION contig heap to
create a specific memory chunk size to exercise a rowhammer attack on the
physical hardware.
So remove support for the ION contig heap.

Change-Id: I9cb454cebb74df291479cecc3533d2c684363f77
Signed-off-by: Liam Mark <lmark@codeaurora.org>
This commit is contained in:
Liam Mark 2016-10-12 14:22:56 -07:00
parent 773f15cdab
commit fb67acc3ac
5 changed files with 7 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
arch/arm/boot/dts/qcom/msm8996-ion.dtsi
View file

@ -1,4 +1,4 @@
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@ -21,11 +21,6 @@
qcom,ion-heap-type = "SYSTEM";
};
system_contig_heap: qcom,ion-heap@21 {
reg = <21>;
qcom,ion-heap-type = "SYSTEM_CONTIG";
};
qcom,ion-heap@22 { /* ADSP HEAP */
reg = <22>;
memory-region = <&adsp_mem>;

5
arch/arm/boot/dts/qcom/msmcobalt-ion.dtsi
View file

@ -21,11 +21,6 @@
qcom,ion-heap-type = "SYSTEM";
};
system_contig_heap: qcom,ion-heap@21 {
reg = <21>;
qcom,ion-heap-type = "SYSTEM_CONTIG";
};
qcom,ion-heap@22 { /* ADSP HEAP */
reg = <22>;
memory-region = <&adsp_mem>;

5
arch/arm/boot/dts/qcom/msmfalcon-ion.dtsi
View file

@ -21,11 +21,6 @@
qcom,ion-heap-type = "SYSTEM";
};
system_contig_heap: qcom,ion-heap@21 {
reg = <21>;
qcom,ion-heap-type = "SYSTEM_CONTIG";
};
qcom,ion-heap@22 { /* ADSP HEAP */
reg = <22>;
memory-region = <&adsp_mem>;

5
arch/arm/boot/dts/qcom/msmtriton-ion.dtsi
View file

@ -21,11 +21,6 @@
qcom,ion-heap-type = "SYSTEM";
};
system_contig_heap: qcom,ion-heap@21 {
reg = <21>;
qcom,ion-heap-type = "SYSTEM_CONTIG";
};
qcom,ion-heap@22 { /* ADSP HEAP */
reg = <22>;
memory-region = <&adsp_mem>;

10
drivers/staging/android/ion/ion_heap.c
View file

@ -2,7 +2,7 @@
* drivers/staging/android/ion/ion_heap.c
*
* Copyright (C) 2011 Google, Inc.
* Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.
* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
*
* This software is licensed under the terms of the GNU General Public
* License version 2, as published by the Free Software Foundation, and
@ -325,8 +325,9 @@ struct ion_heap *ion_heap_create(struct ion_platform_heap *heap_data)
switch (heap_data->type) {
case ION_HEAP_TYPE_SYSTEM_CONTIG:
heap = ion_system_contig_heap_create(heap_data);
break;
pr_err("%s: Heap type is disabled: %d\n", __func__,
heap_data->type);
return ERR_PTR(-EINVAL);
case ION_HEAP_TYPE_SYSTEM:
heap = ion_system_heap_create(heap_data);
break;
@ -366,7 +367,8 @@ void ion_heap_destroy(struct ion_heap *heap)
switch (heap->type) {
case ION_HEAP_TYPE_SYSTEM_CONTIG:
ion_system_contig_heap_destroy(heap);
pr_err("%s: Heap type is disabled: %d\n", __func__,
heap->type);
break;
case ION_HEAP_TYPE_SYSTEM:
ion_system_heap_destroy(heap);