From e8f7f42cdcbe3ae4c4bf719847369ddac44219a9 Mon Sep 17 00:00:00 2001 From: Colin Cross Date: Wed, 13 Nov 2013 14:46:06 -0800 Subject: ion: check invalid values in ion_system_heap ion_system_heap can only satisfy page alignment, and ion_system_contig_heap can only satisify alignment to the allocation size. Neither can support faulting user mappings because they use slab pages. Change-Id: I895c2d4184c672f647f83a17aeb862985dc92f2c Signed-off-by: Colin Cross --- drivers/staging/android/ion/ion_system_heap.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'drivers/staging/android/ion') diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index ecae16f2109..4eb0ae8c675 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -150,6 +150,12 @@ static int ion_system_heap_allocate(struct ion_heap *heap, long size_remaining = PAGE_ALIGN(size); unsigned int max_order = orders[0]; + if (align > PAGE_SIZE) + return -EINVAL; + + if (ion_buffer_fault_user_mappings(buffer)) + return -EINVAL; + INIT_LIST_HEAD(&pages); while (size_remaining > 0) { info = alloc_largest_available(sys_heap, buffer, size_remaining, max_order); @@ -362,6 +368,14 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap, unsigned long align, unsigned long flags) { + int order = get_order(len); + + if (align > (PAGE_SIZE << order)) + return -EINVAL; + + if (ion_buffer_fault_user_mappings(buffer)) + return -EINVAL; + buffer->priv_virt = kzalloc(len, GFP_KERNEL); if (!buffer->priv_virt) return -ENOMEM; -- cgit v1.2.3