Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ed5bf01a authored by Colin Cross's avatar Colin Cross Committed by Greg Kroah-Hartman
Browse files

ion: carveout heap: zero buffers on free, fix memory leak 



The carveout heap wasn't zeroing its buffers after use.
Create the sg_table during allocate instead of map_dma, to allow
using the sg_table during free, and call ion_heap_buffer_zero
during free.  Also fixes a missing kfree when destroying the
table.

Signed-off-by: default avatarColin Cross <ccross@android.com>
Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f63958d8

drivers/staging/android/ion/ion_carveout_heap.c

+48 −21
Original line number Original line Diff line number Diff line
@@ -14,7 +14,7 @@ 
 *

 *

 */

 */

#include <linux/spinlock.h>

#include <linux/spinlock.h>



#include <linux/dma-mapping.h>

#include <linux/err.h>

#include <linux/err.h>

#include <linux/genalloc.h>

#include <linux/genalloc.h>

#include <linux/io.h>

#include <linux/io.h>
@@ -60,7 +60,11 @@ static int ion_carveout_heap_phys(struct ion_heap *heap, 
				  struct ion_buffer *buffer,

				  struct ion_buffer *buffer,

				  ion_phys_addr_t *addr, size_t *len)

				  ion_phys_addr_t *addr, size_t *len)

{

{

	*addr = buffer->priv_phys;

	struct sg_table *table = buffer->priv_virt;

	struct page *page = sg_page(table->sgl);

	ion_phys_addr_t paddr = PFN_PHYS(page_to_pfn(page));



	*addr = paddr;

	*len = buffer->size;

	*len = buffer->size;

	return 0;

	return 0;

}

}
@@ -70,44 +74,66 @@ static int ion_carveout_heap_allocate(struct ion_heap *heap, 
				      unsigned long size, unsigned long align,

				      unsigned long size, unsigned long align,

				      unsigned long flags)

				      unsigned long flags)

{

{

	struct sg_table *table;

	ion_phys_addr_t paddr;

	int ret;



	if (align > PAGE_SIZE)

	if (align > PAGE_SIZE)

		return -EINVAL;

		return -EINVAL;





	buffer->priv_phys = ion_carveout_allocate(heap, size, align);

	table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);

	return buffer->priv_phys == ION_CARVEOUT_ALLOCATE_FAIL ? -ENOMEM : 0;

	if (!table)

		return -ENOMEM;

	ret = sg_alloc_table(table, 1, GFP_KERNEL);

	if (ret)

		goto err_free;



	paddr = ion_carveout_allocate(heap, size, align);

	if (paddr == ION_CARVEOUT_ALLOCATE_FAIL) {

		ret = -ENOMEM;

		goto err_free_table;

	}



	sg_set_page(table->sgl, pfn_to_page(PFN_DOWN(paddr)), size, 0);

	buffer->priv_virt = table;



	return 0;



err_free_table:

	sg_free_table(table);

err_free:

	kfree(table);

	return ret;

}

}





static void ion_carveout_heap_free(struct ion_buffer *buffer)

static void ion_carveout_heap_free(struct ion_buffer *buffer)

{

{

	struct ion_heap *heap = buffer->heap;

	struct ion_heap *heap = buffer->heap;

	struct sg_table *table = buffer->priv_virt;

	struct page *page = sg_page(table->sgl);

	ion_phys_addr_t paddr = PFN_PHYS(page_to_pfn(page));



	ion_heap_buffer_zero(buffer);





	ion_carveout_free(heap, buffer->priv_phys, buffer->size);

	if (ion_buffer_cached(buffer))

	buffer->priv_phys = ION_CARVEOUT_ALLOCATE_FAIL;

		dma_sync_sg_for_device(NULL, table->sgl, table->nents,

							DMA_BIDIRECTIONAL);



	ion_carveout_free(heap, paddr, buffer->size);

	sg_free_table(table);

	kfree(table);

}

}





static struct sg_table *ion_carveout_heap_map_dma(struct ion_heap *heap,

static struct sg_table *ion_carveout_heap_map_dma(struct ion_heap *heap,

						  struct ion_buffer *buffer)

						  struct ion_buffer *buffer)

{

{

	struct sg_table *table;

	return buffer->priv_virt;

	int ret;



	table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);

	if (!table)

		return ERR_PTR(-ENOMEM);

	ret = sg_alloc_table(table, 1, GFP_KERNEL);

	if (ret) {

		kfree(table);

		return ERR_PTR(ret);

	}

	sg_set_page(table->sgl, pfn_to_page(PFN_DOWN(buffer->priv_phys)),

			buffer->size, 0);

	return table;

}

}





static void ion_carveout_heap_unmap_dma(struct ion_heap *heap,

static void ion_carveout_heap_unmap_dma(struct ion_heap *heap,

					struct ion_buffer *buffer)

					struct ion_buffer *buffer)

{

{

	sg_free_table(buffer->sg_table);

	return;

}

}





static struct ion_heap_ops carveout_heap_ops = {

static struct ion_heap_ops carveout_heap_ops = {
@@ -139,6 +165,7 @@ struct ion_heap *ion_carveout_heap_create(struct ion_platform_heap *heap_data) 
		     -1);

		     -1);

	carveout_heap->heap.ops = &carveout_heap_ops;

	carveout_heap->heap.ops = &carveout_heap_ops;

	carveout_heap->heap.type = ION_HEAP_TYPE_CARVEOUT;

	carveout_heap->heap.type = ION_HEAP_TYPE_CARVEOUT;

	carveout_heap->heap.flags = ION_HEAP_FLAG_DEFER_FREE;





	return &carveout_heap->heap;

	return &carveout_heap->heap;

}

}