From: Colin Cross <[email protected]> If userspace passes a length between -4095 and -1 to allocate it will pass the len != 0 check, but when len is page aligned it will be 0. Check len after page aligning.
Drop the warning as well, userspace shouldn't be able to trigger a warning in the kernel. Signed-off-by: Colin Cross <[email protected]> Signed-off-by: John Stultz <[email protected]> --- drivers/staging/android/ion/ion.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index cf9fc78..2e7be70 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -485,11 +485,11 @@ struct ion_handle *ion_alloc(struct ion_client *client, size_t len, * request of the caller allocate from it. Repeat until allocate has * succeeded or all heaps have been tried */ - if (WARN_ON(!len)) - return ERR_PTR(-EINVAL); - len = PAGE_ALIGN(len); + if (!len) + return ERR_PTR(-EINVAL); + down_read(&dev->lock); plist_for_each_entry(heap, &dev->heaps, node) { /* if the caller didn't specify this heap id */ -- 1.8.3.2 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
