From patchwork Fri Dec 13 22:25:00 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 22451 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-ie0-f199.google.com (mail-ie0-f199.google.com [209.85.223.199]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id 925B923FBA for ; Fri, 13 Dec 2013 22:28:23 +0000 (UTC) Received: by mail-ie0-f199.google.com with SMTP id lx4sf8928086iec.10 for ; Fri, 13 Dec 2013 14:28:23 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :list-post:list-help:list-archive:list-unsubscribe; bh=l1irWr1I4cbm05NHUGgWhI4TPhLc7xIdEzCW7e4c+BA=; b=MK7nDZARTmLN2nq+eL2OztD5O7B27kN/fFzLgG0uWNTeplKDIVkVS31h5S8kpZAEdA TSB6c9I3CtyldbDMIhvkPgoHfi3s+5TG1cymURe/ZwqlZC/gHs2Xhgo6m1mipNS5Bfjg FIDTKSesM3t/F8nLD6zmmWjqNTugdFEKgiWlUGpcNKzqUxHhm/2EfxHvUletkrij4uL5 KHbqoBJ/hhrOlCkAdBasxmAyFgEiIIKnjuBn/TetGgRJXiLsdM04Cc3HajI32RLN0xoB KPefz0PLCY1EXbks81ky4z0+1zwZ/YtaFt/nqlLAuJHp/tbdGNq1AENGMftZJUXUsTg8 Jlsg== X-Gm-Message-State: ALoCoQmllZjIkXphTm6tFSSbuoFBI1Ftqh2ezfrlzHAL/kaWYM0sRvQCWLtpxXnNFsQdNbmCFDp5 X-Received: by 10.182.66.193 with SMTP id h1mr1550655obt.47.1386973703232; Fri, 13 Dec 2013 14:28:23 -0800 (PST) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.49.88.68 with SMTP id be4ls1206691qeb.46.gmail; Fri, 13 Dec 2013 14:28:23 -0800 (PST) X-Received: by 10.52.232.135 with SMTP id to7mr1854446vdc.58.1386973703122; Fri, 13 Dec 2013 14:28:23 -0800 (PST) Received: from mail-vb0-f49.google.com (mail-vb0-f49.google.com [209.85.212.49]) by mx.google.com with ESMTPS id p7si1198187vei.62.2013.12.13.14.28.23 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:28:23 -0800 (PST) Received-SPF: neutral (google.com: 209.85.212.49 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=209.85.212.49; Received: by mail-vb0-f49.google.com with SMTP id x11so1701289vbb.22 for ; Fri, 13 Dec 2013 14:28:23 -0800 (PST) X-Received: by 10.220.95.139 with SMTP id d11mr2221647vcn.21.1386973703054; Fri, 13 Dec 2013 14:28:23 -0800 (PST) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.220.174.196 with SMTP id u4csp73631vcz; Fri, 13 Dec 2013 14:28:22 -0800 (PST) X-Received: by 10.68.110.132 with SMTP id ia4mr5845297pbb.99.1386973702275; Fri, 13 Dec 2013 14:28:22 -0800 (PST) Received: from mail-pa0-f45.google.com (mail-pa0-f45.google.com [209.85.220.45]) by mx.google.com with ESMTPS id n8si2520947pax.44.2013.12.13.14.28.21 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:28:22 -0800 (PST) Received-SPF: neutral (google.com: 209.85.220.45 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) client-ip=209.85.220.45; Received: by mail-pa0-f45.google.com with SMTP id fb1so594075pad.32 for ; Fri, 13 Dec 2013 14:28:21 -0800 (PST) X-Received: by 10.68.252.161 with SMTP id zt1mr6101562pbc.130.1386973701792; Fri, 13 Dec 2013 14:28:21 -0800 (PST) Received: from localhost.localdomain (c-67-170-153-23.hsd1.or.comcast.net. [67.170.153.23]) by mx.google.com with ESMTPSA id qz9sm7457908pbc.3.2013.12.13.14.28.19 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:28:21 -0800 (PST) From: John Stultz To: LKML Cc: Greg KH , Android Kernel Team , Sumit Semwal , Jesse Barker , Colin Cross , John Stultz Subject: [PATCH 086/115] ion: fix crash when alloc len is -1 Date: Fri, 13 Dec 2013 14:25:00 -0800 Message-Id: <1386973529-4884-87-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 1.8.3.2 In-Reply-To: <1386973529-4884-1-git-send-email-john.stultz@linaro.org> References: <1386973529-4884-1-git-send-email-john.stultz@linaro.org> X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: john.stultz@linaro.org X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.212.49 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Colin Cross If userspace passes a length between -4095 and -1 to allocate it will pass the len != 0 check, but when len is page aligned it will be 0. Check len after page aligning. Drop the warning as well, userspace shouldn't be able to trigger a warning in the kernel. Signed-off-by: Colin Cross Signed-off-by: John Stultz --- drivers/staging/android/ion/ion.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index cf9fc78..2e7be70 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -485,11 +485,11 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, * request of the caller allocate from it. Repeat until allocate has * succeeded or all heaps have been tried */ - if (WARN_ON(!len)) - return ERR_PTR(-EINVAL); - len = PAGE_ALIGN(len); + if (!len) + return ERR_PTR(-EINVAL); + down_read(&dev->lock); plist_for_each_entry(heap, &dev->heaps, node) { /* if the caller didn't specify this heap id */