Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04cbd09f authored by Laura Abbott's avatar Laura Abbott Committed by Shalaj Jain
Browse files

ion: Don't free memory if unsecure fails 



If unsecure fails, this means the CPU cannot touch the
physical memory. This means if the memory is freed back to
the buddy allocator all accesses will trigger faults. If
unsecure fails, the only option is to leak the memory and
not free it.

Change-Id: I6a98761912598a9f8cdcc3914eca8e5e41147e55
Signed-off-by: default avatarLaura Abbott <lauraa@codeaurora.org>
parent 73a4f16f

drivers/staging/android/ion/ion_cma_secure_heap.c

+12 −2
Original line number Diff line number Diff line
@@ -87,6 +87,7 @@ struct ion_cma_secure_heap { 
	struct shrinker shrinker;

	atomic_t total_allocated;

	atomic_t total_pool_size;

	atomic_t total_leaked;

	unsigned long heap_size;

	unsigned long default_prefetch_size;

};
@@ -557,14 +558,20 @@ static void ion_secure_cma_free(struct ion_buffer *buffer) 
	struct ion_cma_secure_heap *sheap =

		container_of(buffer->heap, struct ion_cma_secure_heap, heap);

	struct ion_secure_cma_buffer_info *info = buffer->priv_virt;

	int ret = 0;



	dev_dbg(sheap->dev, "Release buffer %p\n", buffer);

	if (msm_secure_v2_is_supported())

		msm_ion_unsecure_table(info->table);

		ret = msm_ion_unsecure_table(info->table);

	atomic_sub(buffer->size, &sheap->total_allocated);

	BUG_ON(atomic_read(&sheap->total_allocated) < 0);

	/* release memory */

	if (!ret) {

		ion_secure_cma_free_from_pool(sheap, info->phys, buffer->size);

	} else {

		WARN(1, "Unsecure failed, can't free the memory. Leaking it!");

		atomic_add(buffer->size, &sheap->total_leaked);

	}

	/* release sg table */

	sg_free_table(info->table);

	kfree(info->table);
@@ -655,6 +662,9 @@ static int ion_secure_cma_print_debug(struct ion_heap *heap, struct seq_file *s, 
				atomic_read(&sheap->total_allocated));

	seq_printf(s, "Total pool size: 0x%x\n",

				atomic_read(&sheap->total_pool_size));

	seq_printf(s, "Total memory leaked due to unlock failures: 0x%x\n",

				atomic_read(&sheap->total_leaked));



	return 0;

}