Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") the CMA API is now used directly and therefore the allocated memory is no longer automatically zeroed.
Explicitly zero CMA allocated memory to ensure that no data is exposed to userspace.
Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") Signed-off-by: Liam Mark lmark@codeaurora.org --- Changes in v2: - Clean up the commit message. - Add 'Fixes:'
drivers/staging/android/ion/ion_cma_heap.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c index 86196ffd2faf..91a98785607a 100644 --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -51,6 +51,8 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, if (!pages) return -ENOMEM;
+ memset(page_address(pages), 0, size); + table = kmalloc(sizeof(*table), GFP_KERNEL); if (!table) goto err;
On 01/22/2018 09:46 AM, Liam Mark wrote:
Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") the CMA API is now used directly and therefore the allocated memory is no longer automatically zeroed.
Explicitly zero CMA allocated memory to ensure that no data is exposed to userspace.
Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") Signed-off-by: Liam Mark lmark@codeaurora.org
Changes in v2:
- Clean up the commit message.
- Add 'Fixes:'
drivers/staging/android/ion/ion_cma_heap.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c index 86196ffd2faf..91a98785607a 100644 --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -51,6 +51,8 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, if (!pages) return -ENOMEM;
- memset(page_address(pages), 0, size);
This won't work for highmem pages. You need to zero by page via kmap_atomic in that case. You can use PageHighMem to separate the paths.
Thanks, Laura
table = kmalloc(sizeof(*table), GFP_KERNEL); if (!table) goto err;
On Wed, 24 Jan 2018, Laura Abbott wrote:
On 01/22/2018 09:46 AM, Liam Mark wrote:
Since commit 204f672255c2 ("staging: android: ion: Use CMA APIs directly") the CMA API is now used directly and therefore the allocated memory is no longer automatically zeroed.
Explicitly zero CMA allocated memory to ensure that no data is exposed to userspace.
Fixes: 204f672255c2 ("staging: android: ion: Use CMA APIs directly") Signed-off-by: Liam Mark lmark@codeaurora.org
Changes in v2:
- Clean up the commit message.
- Add 'Fixes:'
drivers/staging/android/ion/ion_cma_heap.c | 2 ++ 1 file changed, 2 insertions(+)
diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c index 86196ffd2faf..91a98785607a 100644 --- a/drivers/staging/android/ion/ion_cma_heap.c +++ b/drivers/staging/android/ion/ion_cma_heap.c @@ -51,6 +51,8 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, if (!pages) return -ENOMEM;
- memset(page_address(pages), 0, size);
This won't work for highmem pages. You need to zero by page via kmap_atomic in that case. You can use PageHighMem to separate the paths.
Thanks for catching that, I will update the patch.
Qualcomm Innovation Center, Inc. is a member of Code Aurora Forum, a Linux Foundation Collaborative Project
linaro-mm-sig@lists.linaro.org
-
Laura Abbott -
Liam Mark