diff options
| author | Patrick Daly <pdaly@codeaurora.org> | 2016-03-18 17:37:35 -0700 |
|---|---|---|
| committer | Patrick Daly <pdaly@codeaurora.org> | 2016-03-30 15:50:56 -0700 |
| commit | cf0ce04ca28f0dc258146704ba97bbdded801209 (patch) | |
| tree | 4e9f398332368268e1020cd1691cd7e152fe0158 | |
| parent | c0fe3bde2a0cb060a9f42d17d670449503934361 (diff) | |
ion: Fix array-out-of-bounds in system heap error path
After creating all secure pools successfully, i == VMID_LAST.
If ion_system_heap_create_pools(), the error path will attempt to
destroy all secure pools, starting from i.
But this is one past the end of the array.
struct ion_page_pool **secure_pools[VMID_LAST];
Change-Id: Id97ab40a1dc0885f476f6e25cdd324f5ee3dcf04
Signed-off-by: Patrick Daly <pdaly@codeaurora.org>
| -rw-r--r-- | drivers/staging/android/ion/ion_system_heap.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index 1f18110f5ad4..c2a34c576905 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -708,12 +708,11 @@ err_create_cached_pools: err_create_uncached_pools: kfree(heap->cached_pools); err_create_secure_pools: - while (i >= 0) { + for (i = 0; i < VMID_LAST; i++) { if (heap->secure_pools[i]) { ion_system_heap_destroy_pools(heap->secure_pools[i]); kfree(heap->secure_pools[i]); } - i--; } err_alloc_cached_pools: kfree(heap->uncached_pools); |