Skip to content

Commit 9469d08

Browse files
kerneltoastZile995
authored andcommitted
ion: system_heap: Fix uninitialized sg-table usage
The table_sync sg-table is used uninitialized when nents_sync is zero. Fix it by only using it when it's allocated. Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com> Signed-off-by: Zile995 <stefan.zivkovic995@gmail.com>
1 parent 34bce59 commit 9469d08

File tree

1 file changed

+7
-3
lines changed

1 file changed

+7
-3
lines changed

drivers/staging/android/ion/ion_system_heap.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -287,11 +287,13 @@ static int ion_system_heap_allocate(struct ion_heap *heap,
287287
ret = sg_alloc_table(&table_sync, nents_sync, GFP_KERNEL);
288288
if (ret)
289289
goto err_free_sg;
290+
sg_sync = table_sync.sgl;
291+
} else {
292+
sg_sync = NULL;
290293
}
291294

292295
i = 0;
293296
sg = table->sgl;
294-
sg_sync = table_sync.sgl;
295297

296298
/*
297299
* We now have two separate lists. One list contains pages from the
@@ -306,13 +308,15 @@ static int ion_system_heap_allocate(struct ion_heap *heap,
306308
if (info && tmp_info) {
307309
if (info->order >= tmp_info->order) {
308310
i = process_info(info, sg, sg_sync, &data, i);
309-
sg_sync = sg_next(sg_sync);
311+
if (sg_sync)
312+
sg_sync = sg_next(sg_sync);
310313
} else {
311314
i = process_info(tmp_info, sg, 0, 0, i);
312315
}
313316
} else if (info) {
314317
i = process_info(info, sg, sg_sync, &data, i);
315-
sg_sync = sg_next(sg_sync);
318+
if (sg_sync)
319+
sg_sync = sg_next(sg_sync);
316320
} else if (tmp_info) {
317321
i = process_info(tmp_info, sg, 0, 0, i);
318322
} else {

0 commit comments

Comments
 (0)