Piteball/android_kernel_google_msm
1
0
Fork 0
mirror of https://github.com/followmsi/android_kernel_google_msm.git synced 2024-11-06 23:17:41 +00:00
Code Issues Projects Releases Wiki Activity

msm: kgsl: Fix page align allocation overflow

Browse source 
KGSL does alignments for all user memory requests.  If the
requests is large enough the alignment operation will overflow
resulting in a valid request of size 0.  It's just a matter of
time until the kernel or user tries to then do something useful
with this buffer resulting in a hang.  Perform a sanity check
after doing the alignments to ensure the overflow did not occur.

Signed-off-by: Carter Cooper <ccooper@codeaurora.org>
This commit is contained in:
Carter Cooper 2013-09-04 17:03:32 -06:00 committed by Iliyan Malchev
parent 2733db668d
commit d1c3e29f79
1 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/gpu/msm/kgsl_sharedmem.c
View file

@ -747,6 +747,8 @@ kgsl_sharedmem_page_alloc(struct kgsl_memdesc *memdesc,
BUG_ON(size == 0);
size = ALIGN(size, PAGE_SIZE * 2);
if (size == 0)
return -EINVAL;
ret = _kgsl_sharedmem_page_alloc(memdesc, pagetable, size);
if (!ret)
@ -762,7 +764,11 @@ kgsl_sharedmem_page_alloc_user(struct kgsl_memdesc *memdesc,
struct kgsl_pagetable *pagetable,
size_t size)
{
return _kgsl_sharedmem_page_alloc(memdesc, pagetable, PAGE_ALIGN(size));
size = PAGE_ALIGN(size);
if (size == 0)
return -EINVAL;
return _kgsl_sharedmem_page_alloc(memdesc, pagetable, size);
}
EXPORT_SYMBOL(kgsl_sharedmem_page_alloc_user);
@ -772,6 +778,8 @@ kgsl_sharedmem_alloc_coherent(struct kgsl_memdesc *memdesc, size_t size)
int result = 0;
size = ALIGN(size, PAGE_SIZE);
if (size == 0)
return -EINVAL;
memdesc->size = size;
memdesc->ops = &kgsl_coherent_ops;
@ -858,6 +866,9 @@ kgsl_sharedmem_ebimem_user(struct kgsl_memdesc *memdesc,
size_t size)
{
size = ALIGN(size, PAGE_SIZE);
if (size == 0)
return -EINVAL;
return _kgsl_sharedmem_ebimem(memdesc, pagetable, size);
}
EXPORT_SYMBOL(kgsl_sharedmem_ebimem_user);
@ -868,6 +879,9 @@ kgsl_sharedmem_ebimem(struct kgsl_memdesc *memdesc,
{
int result;
size = ALIGN(size, 8192);
if (size == 0)
return -EINVAL;
result = _kgsl_sharedmem_ebimem(memdesc, pagetable, size);
if (result)