Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c9e8440e authored by Colin Cross's avatar Colin Cross Committed by Greg Kroah-Hartman
Browse files

staging: ion: Fix overflow and list bugs in system heap 



Fix a few bugs in ion_system_heap:

Initialize the list node in the info block.

Don't store size_remaining in a signed long, allocating >2GB
could overflow, resulting in a call to sg_alloc_table with
nents=0 which panics.  alloc_largest_available will never
return a block larger than size_remanining, so it can never
go negative.

Limit a single allocation to half of all memory.  Prevents a
large allocation from taking down the whole system.

Cc: Colin Cross <ccross@android.com>
Cc: Android Kernel Team <kernel-team@android.com>
Signed-off-by: default avatarColin Cross <ccross@android.com>
[jstultz: Minor commit subject tweak]
Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 077f6db9

drivers/staging/android/ion/ion_system_heap.c

+5 −1
Original line number Diff line number Diff line
@@ -124,6 +124,7 @@ static struct page_info *alloc_largest_available(struct ion_system_heap *heap, 


		info->page = page;

		info->order = orders[i];

		INIT_LIST_HEAD(&info->list);

		return info;

	}

	kfree(info);
@@ -145,12 +146,15 @@ static int ion_system_heap_allocate(struct ion_heap *heap, 
	struct list_head pages;

	struct page_info *info, *tmp_info;

	int i = 0;

	long size_remaining = PAGE_ALIGN(size);

	unsigned long size_remaining = PAGE_ALIGN(size);

	unsigned int max_order = orders[0];



	if (align > PAGE_SIZE)

		return -EINVAL;



	if (size / PAGE_SIZE > totalram_pages / 2)

		return -ENOMEM;



	INIT_LIST_HEAD(&pages);

	while (size_remaining > 0) {

		info = alloc_largest_available(sys_heap, buffer, size_remaining,