Commit f596c735 authored Mar 18, 2016 by Patrick Daly

ion: Fix array-out-of-bounds in system heap error path



After creating all secure pools successfully, i == VMID_LAST.
If ion_system_heap_create_pools(), the error path will attempt to
destroy all secure pools, starting from i.

But this is one past the end of the array.
struct ion_page_pool **secure_pools[VMID_LAST];

CRs-Fixed: 997730
Change-Id: Id97ab40a1dc0885f476f6e25cdd324f5ee3dcf04
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>

parent 241c08df

drivers/staging/android/ion/ion_system_heap.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -692,12 +692,11 @@ err_create_cached_pools:
		err_create_uncached_pools:
		kfree(heap->cached_pools);
		err_create_secure_pools:
		while (i >= 0) {
		for (i = 0; i < VMID_LAST; i++) {
		if (heap->secure_pools[i]) {
		ion_system_heap_destroy_pools(heap->secure_pools[i]);
		kfree(heap->secure_pools[i]);
		}
		i--;
		}
		err_alloc_cached_pools:
		kfree(heap->uncached_pools);