openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

ion: fix crash when alloc len is -1 

If userspace passes a length between -4095 and -1 to allocate it
will pass the len != 0 check, but when len is page aligned it will
be 0.  Check len after page aligning.

Drop the warning as well, userspace shouldn't be able to trigger
a warning in the kernel.

Signed-off-by: Colin Cross <ccross@android.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Colin Cross 2013-12-13 14:25:00 -08:00 committed by Greg Kroah-Hartman
parent 83271f6262
commit a14baf71b9
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/staging/android/ion/ion.c
View File

@ -485,11 +485,11 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len,
* request of the caller allocate from it. Repeat until allocate has * request of the caller allocate from it. Repeat until allocate has
* succeeded or all heaps have been tried * succeeded or all heaps have been tried
*/ */
if (WARN_ON(!len))
return ERR_PTR(-EINVAL);
len = PAGE_ALIGN(len); len = PAGE_ALIGN(len);
if (!len)
return ERR_PTR(-EINVAL);
down_read(&dev->lock); down_read(&dev->lock);
plist_for_each_entry(heap, &dev->heaps, node) { plist_for_each_entry(heap, &dev->heaps, node) {
/* if the caller didn't specify this heap id */ /* if the caller didn't specify this heap id */