Commit 67296874 authored by Olav Haugan's avatar Olav Haugan Committed by Greg Kroah-Hartman

staging: zsmalloc: Ensure handle is never 0 on success

zsmalloc encodes a handle using the pfn and an object
index. On hardware platforms with physical memory starting
at 0x0 the pfn can be 0. This causes the encoded handle to be
0 and is incorrectly interpreted as an allocation failure.

This issue affects all current and future SoCs with physical
memory starting at 0x0. All MSM8974 SoCs which includes
Google Nexus 5 devices are affected.

To prevent this false error we ensure that the encoded handle
will not be 0 when allocation succeeds.
Signed-off-by: default avatarOlav Haugan <ohaugan@codeaurora.org>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b39f15c9
...@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page) ...@@ -430,7 +430,12 @@ static struct page *get_next_page(struct page *page)
return next; return next;
} }
/* Encode <page, obj_idx> as a single handle value */ /*
* Encode <page, obj_idx> as a single handle value.
* On hardware platforms with physical memory starting at 0x0 the pfn
* could be 0 so we ensure that the handle will never be 0 by adjusting the
* encoded obj_idx value before encoding.
*/
static void *obj_location_to_handle(struct page *page, unsigned long obj_idx) static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
{ {
unsigned long handle; unsigned long handle;
...@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx) ...@@ -441,17 +446,21 @@ static void *obj_location_to_handle(struct page *page, unsigned long obj_idx)
} }
handle = page_to_pfn(page) << OBJ_INDEX_BITS; handle = page_to_pfn(page) << OBJ_INDEX_BITS;
handle |= (obj_idx & OBJ_INDEX_MASK); handle |= ((obj_idx + 1) & OBJ_INDEX_MASK);
return (void *)handle; return (void *)handle;
} }
/* Decode <page, obj_idx> pair from the given object handle */ /*
* Decode <page, obj_idx> pair from the given object handle. We adjust the
* decoded obj_idx back to its original value since it was adjusted in
* obj_location_to_handle().
*/
static void obj_handle_to_location(unsigned long handle, struct page **page, static void obj_handle_to_location(unsigned long handle, struct page **page,
unsigned long *obj_idx) unsigned long *obj_idx)
{ {
*page = pfn_to_page(handle >> OBJ_INDEX_BITS); *page = pfn_to_page(handle >> OBJ_INDEX_BITS);
*obj_idx = handle & OBJ_INDEX_MASK; *obj_idx = (handle & OBJ_INDEX_MASK) - 1;
} }
static unsigned long obj_idx_to_offset(struct page *page, static unsigned long obj_idx_to_offset(struct page *page,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment