Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea89faff authored by Colin Cross's avatar Colin Cross Committed by Greg Kroah-Hartman
Browse files

ion: chunk_heap: fix leak in allocated counter 



buffer->size is controlled by the outer ion layer, don't modify it
inside the heap.  Instead, compute the rounded up allocated size
on demand.

Signed-off-by: default avatarColin Cross <ccross@android.com>
[jstultz: modified patch to apply to staging directory]
Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent c13bd1c4

drivers/staging/android/ion/ion_chunk_heap.c

+9 −6
Original line number Diff line number Diff line
@@ -47,15 +47,15 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap, 
	struct scatterlist *sg;

	int ret, i;

	unsigned long num_chunks;

	unsigned long allocated_size;



	if (ion_buffer_fault_user_mappings(buffer))

		return -ENOMEM;



	num_chunks = ALIGN(size, chunk_heap->chunk_size) /

		chunk_heap->chunk_size;

	buffer->size = num_chunks * chunk_heap->chunk_size;

	allocated_size = ALIGN(size, chunk_heap->chunk_size);

	num_chunks = allocated_size / chunk_heap->chunk_size;



	if (buffer->size > chunk_heap->size - chunk_heap->allocated)

	if (allocated_size > chunk_heap->size - chunk_heap->allocated)

		return -ENOMEM;



	table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
@@ -78,7 +78,7 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap, 
	}



	buffer->priv_virt = table;

	chunk_heap->allocated += buffer->size;

	chunk_heap->allocated += allocated_size;

	return 0;

err:

	sg = table->sgl;
@@ -100,6 +100,9 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer) 
	struct sg_table *table = buffer->priv_virt;

	struct scatterlist *sg;

	int i;

	unsigned long allocated_size;



	allocated_size = ALIGN(buffer->size, chunk_heap->chunk_size);



	ion_heap_buffer_zero(buffer);
@@ -111,7 +114,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer) 
		gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),

			      sg_dma_len(sg));

	}

	chunk_heap->allocated -= buffer->size;

	chunk_heap->allocated -= allocated_size;

	sg_free_table(table);

	kfree(table);

}