From patchwork Fri Dec 13 22:24:37 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: John Stultz X-Patchwork-Id: 22428 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-pb0-f71.google.com (mail-pb0-f71.google.com [209.85.160.71]) by ip-10-151-82-157.ec2.internal (Postfix) with ESMTPS id AA1A523FBA for ; Fri, 13 Dec 2013 22:27:48 +0000 (UTC) Received: by mail-pb0-f71.google.com with SMTP id uo5sf7436181pbc.6 for ; Fri, 13 Dec 2013 14:27:47 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:x-original-sender :x-original-authentication-results:precedence:mailing-list:list-id :list-post:list-help:list-archive:list-unsubscribe; bh=b33aZBjkJuY9sDW9bvlhls+ECpJkgEXT/EVaRMRqcVA=; b=QhruWpIO7lgimI5PGgx/Jf0sTWd25+9ZI81It4oZZIzPPuc9+m+lOpmRxj9IenZ2I9 dcCSt2hUIXMKElr+z8zeCOivBUbbKqs/Y1Rs5z0TwjUSo4jXG10YmJNsucZWflg8njbe MfTCS5aJnyQ8LoGqEq2szP6V/gMAcxwny3JNfWukPVDmc68Ttj7sKSDgX9Vwk0yBJ7hK N97UqaavVmWHW4rD1U2RQ6bgMYzIfFBtkpQefrrLwIZ20sHUdbOkoF7VRxdsGNNdShZ+ PsAvd+dIs8VEtn22X2buQUYyqOAkZje2ECB3xJA05TFcrgawmcMI10HPP30h3NumC/uO xRpA== X-Gm-Message-State: ALoCoQmX5NUNm6eGdoI6Wlmtb6/a2vniRi4Sbr4VWbFrorrWaED7n+ZL5qDBq3A+/Hh/GXoe/s+m X-Received: by 10.66.141.231 with SMTP id rr7mr2233277pab.47.1386973667969; Fri, 13 Dec 2013 14:27:47 -0800 (PST) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.49.94.41 with SMTP id cz9ls1259888qeb.57.gmail; Fri, 13 Dec 2013 14:27:47 -0800 (PST) X-Received: by 10.58.210.39 with SMTP id mr7mr2219074vec.18.1386973667742; Fri, 13 Dec 2013 14:27:47 -0800 (PST) Received: from mail-vc0-f178.google.com (mail-vc0-f178.google.com [209.85.220.178]) by mx.google.com with ESMTPS id dp7si1187880ved.149.2013.12.13.14.27.47 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:27:47 -0800 (PST) Received-SPF: neutral (google.com: 209.85.220.178 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) client-ip=209.85.220.178; Received: by mail-vc0-f178.google.com with SMTP id lh4so1720623vcb.23 for ; Fri, 13 Dec 2013 14:27:47 -0800 (PST) X-Received: by 10.52.160.130 with SMTP id xk2mr1880220vdb.24.1386973667657; Fri, 13 Dec 2013 14:27:47 -0800 (PST) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patches@linaro.org Received: by 10.220.174.196 with SMTP id u4csp73571vcz; Fri, 13 Dec 2013 14:27:47 -0800 (PST) X-Received: by 10.66.216.193 with SMTP id os1mr6137813pac.29.1386973666694; Fri, 13 Dec 2013 14:27:46 -0800 (PST) Received: from mail-pa0-f44.google.com (mail-pa0-f44.google.com [209.85.220.44]) by mx.google.com with ESMTPS id xu5si2426814pab.51.2013.12.13.14.27.46 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:27:46 -0800 (PST) Received-SPF: neutral (google.com: 209.85.220.44 is neither permitted nor denied by best guess record for domain of john.stultz@linaro.org) client-ip=209.85.220.44; Received: by mail-pa0-f44.google.com with SMTP id fa1so597193pad.3 for ; Fri, 13 Dec 2013 14:27:46 -0800 (PST) X-Received: by 10.66.141.231 with SMTP id rr7mr5901203pab.41.1386973666324; Fri, 13 Dec 2013 14:27:46 -0800 (PST) Received: from localhost.localdomain (c-67-170-153-23.hsd1.or.comcast.net. [67.170.153.23]) by mx.google.com with ESMTPSA id qz9sm7457908pbc.3.2013.12.13.14.27.44 for (version=TLSv1.1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 13 Dec 2013 14:27:45 -0800 (PST) From: John Stultz To: LKML Cc: Greg KH , Android Kernel Team , Sumit Semwal , Jesse Barker , Colin Cross , Rebecca Schultz Zavin , John Stultz Subject: [PATCH 063/115] gpu: ion: ion_chunk_heap: Zero chunk heap memory at creation time Date: Fri, 13 Dec 2013 14:24:37 -0800 Message-Id: <1386973529-4884-64-git-send-email-john.stultz@linaro.org> X-Mailer: git-send-email 1.8.3.2 In-Reply-To: <1386973529-4884-1-git-send-email-john.stultz@linaro.org> References: <1386973529-4884-1-git-send-email-john.stultz@linaro.org> X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: john.stultz@linaro.org X-Original-Authentication-Results: mx.google.com; spf=neutral (google.com: 209.85.220.178 is neither permitted nor denied by best guess record for domain of patch+caf_=patchwork-forward=linaro.org@linaro.org) smtp.mail=patch+caf_=patchwork-forward=linaro.org@linaro.org Precedence: list Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org List-ID: X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Rebecca Schultz Zavin Allocations from the ion heap need to be zeroed to protect userspace from seeing memory belonging to other processes. First allocations from this heap were not zero'd allowing users to see memory from other processes on a warm reset. Signed-off-by: Rebecca Schultz Zavin [jstultz: modified patch to apply to staging directory] Signed-off-by: John Stultz --- drivers/staging/android/ion/ion_chunk_heap.c | 34 ++++++++++++++++++++++++++-- 1 file changed, 32 insertions(+), 2 deletions(-) diff --git a/drivers/staging/android/ion/ion_chunk_heap.c b/drivers/staging/android/ion/ion_chunk_heap.c index ac7cf13..4c2f223 100644 --- a/drivers/staging/android/ion/ion_chunk_heap.c +++ b/drivers/staging/android/ion/ion_chunk_heap.c @@ -140,6 +140,10 @@ static struct ion_heap_ops chunk_heap_ops = { struct ion_heap *ion_chunk_heap_create(struct ion_platform_heap *heap_data) { struct ion_chunk_heap *chunk_heap; + struct vm_struct *vm_struct; + pgprot_t pgprot = pgprot_writecombine(PAGE_KERNEL); + int i, ret; + chunk_heap = kzalloc(sizeof(struct ion_chunk_heap), GFP_KERNEL); if (!chunk_heap) @@ -149,12 +153,30 @@ struct ion_heap *ion_chunk_heap_create(struct ion_platform_heap *heap_data) chunk_heap->pool = gen_pool_create(get_order(chunk_heap->chunk_size) + PAGE_SHIFT, -1); if (!chunk_heap->pool) { - kfree(chunk_heap); - return ERR_PTR(-ENOMEM); + ret = -ENOMEM; + goto error_gen_pool_create; } chunk_heap->base = heap_data->base; chunk_heap->size = heap_data->size; chunk_heap->allocated = 0; + + vm_struct = get_vm_area(PAGE_SIZE, VM_ALLOC); + if (!vm_struct) { + ret = -ENOMEM; + goto error; + } + for (i = 0; i < chunk_heap->size; i += PAGE_SIZE) { + struct page *page = phys_to_page(chunk_heap->base + i); + struct page **pages = &page; + + ret = map_vm_area(vm_struct, pgprot, &pages); + if (ret) + goto error_map_vm_area; + memset(vm_struct->addr, 0, PAGE_SIZE); + unmap_kernel_range((unsigned long)vm_struct->addr, PAGE_SIZE); + } + free_vm_area(vm_struct); + __dma_page_cpu_to_dev(phys_to_page(heap_data->base), 0, heap_data->size, DMA_BIDIRECTIONAL); gen_pool_add(chunk_heap->pool, chunk_heap->base, heap_data->size, -1); @@ -165,6 +187,14 @@ struct ion_heap *ion_chunk_heap_create(struct ion_platform_heap *heap_data) heap_data->size, heap_data->align); return &chunk_heap->heap; + +error_map_vm_area: + free_vm_area(vm_struct); +error: + gen_pool_destroy(chunk_heap->pool); +error_gen_pool_create: + kfree(chunk_heap); + return ERR_PTR(ret); } void ion_chunk_heap_destroy(struct ion_heap *heap)