Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fb67acc3 authored by Liam Mark's avatar Liam Mark
Browse files

ion: disable system contig heap 



A malicious application can take advantage of the ION contig heap to
create a specific memory chunk size to exercise a rowhammer attack on the
physical hardware.
So remove support for the ION contig heap.

Change-Id: I9cb454cebb74df291479cecc3533d2c684363f77
Signed-off-by: default avatarLiam Mark <lmark@codeaurora.org>
parent 773f15cd

arch/arm/boot/dts/qcom/msm8996-ion.dtsi

+1 −6
Original line number Diff line number Diff line 
/* Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

/* Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -21,11 +21,6 @@ 
			qcom,ion-heap-type = "SYSTEM";

		};



		system_contig_heap: qcom,ion-heap@21 {

			reg = <21>;

			qcom,ion-heap-type = "SYSTEM_CONTIG";

		};



		qcom,ion-heap@22 { /* ADSP HEAP */

			reg = <22>;

			memory-region = <&adsp_mem>;

arch/arm/boot/dts/qcom/msmcobalt-ion.dtsi

+0 −5
Original line number Diff line number Diff line
@@ -21,11 +21,6 @@ 
			qcom,ion-heap-type = "SYSTEM";

		};



		system_contig_heap: qcom,ion-heap@21 {

			reg = <21>;

			qcom,ion-heap-type = "SYSTEM_CONTIG";

		};



		qcom,ion-heap@22 { /* ADSP HEAP */

			reg = <22>;

			memory-region = <&adsp_mem>;

arch/arm/boot/dts/qcom/msmfalcon-ion.dtsi

+0 −5
Original line number Diff line number Diff line
@@ -21,11 +21,6 @@ 
			qcom,ion-heap-type = "SYSTEM";

		};



		system_contig_heap: qcom,ion-heap@21 {

			reg = <21>;

			qcom,ion-heap-type = "SYSTEM_CONTIG";

		};



		qcom,ion-heap@22 { /* ADSP HEAP */

			reg = <22>;

			memory-region = <&adsp_mem>;

arch/arm/boot/dts/qcom/msmtriton-ion.dtsi

+0 −5
Original line number Diff line number Diff line
@@ -21,11 +21,6 @@ 
			qcom,ion-heap-type = "SYSTEM";

		};



		system_contig_heap: qcom,ion-heap@21 {

			reg = <21>;

			qcom,ion-heap-type = "SYSTEM_CONTIG";

		};



		qcom,ion-heap@22 { /* ADSP HEAP */

			reg = <22>;

			memory-region = <&adsp_mem>;

drivers/staging/android/ion/ion_heap.c

+6 −4
Original line number Diff line number Diff line
@@ -2,7 +2,7 @@ 
 * drivers/staging/android/ion/ion_heap.c

 *

 * Copyright (C) 2011 Google, Inc.

 * Copyright (c) 2011-2015, The Linux Foundation. All rights reserved.

 * Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.

 *

 * This software is licensed under the terms of the GNU General Public

 * License version 2, as published by the Free Software Foundation, and
@@ -325,8 +325,9 @@ struct ion_heap *ion_heap_create(struct ion_platform_heap *heap_data) 


	switch (heap_data->type) {

	case ION_HEAP_TYPE_SYSTEM_CONTIG:

		heap = ion_system_contig_heap_create(heap_data);

		break;

		pr_err("%s: Heap type is disabled: %d\n", __func__,

		       heap_data->type);

		return ERR_PTR(-EINVAL);

	case ION_HEAP_TYPE_SYSTEM:

		heap = ion_system_heap_create(heap_data);

		break;
@@ -366,7 +367,8 @@ void ion_heap_destroy(struct ion_heap *heap) 


	switch (heap->type) {

	case ION_HEAP_TYPE_SYSTEM_CONTIG:

		ion_system_contig_heap_destroy(heap);

		pr_err("%s: Heap type is disabled: %d\n", __func__,

		       heap->type);

		break;

	case ION_HEAP_TYPE_SYSTEM:

		ion_system_heap_destroy(heap);