From a3fe90fbd3500e7ecaa32b9da5e582d78cb5cef9 Mon Sep 17 00:00:00 2001 From: Liam Mark Date: Wed, 12 Oct 2016 14:22:56 -0700 Subject: ion: disable system contig heap A malicious application can take advantage of the ION contig heap to create a specific memory chunk size to exercise a rowhammer attack on the physical hardware. So remove support for the ION contig heap. Change-Id: I9cb454cebb74df291479cecc3533d2c684363f77 Signed-off-by: Liam Mark Signed-off-by: Prakash Gupta Signed-off-by: Paresh Purabhiya --- arch/arm/boot/dts/qcom/apq8084-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8226-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8226-w-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8610-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8909-ion.dtsi | 5 ----- arch/arm/boot/dts/qcom/msm8916-512mb-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8916-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8939-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8974-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8992-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msm8994-ion.dtsi | 7 +------ arch/arm/boot/dts/qcom/msmtellurium-ion.dtsi | 7 +------ drivers/staging/android/ion/ion_heap.c | 10 ++++++---- 13 files changed, 17 insertions(+), 75 deletions(-) diff --git a/arch/arm/boot/dts/qcom/apq8084-ion.dtsi b/arch/arm/boot/dts/qcom/apq8084-ion.dtsi index bd649fe..436a966 100644 --- a/arch/arm/boot/dts/qcom/apq8084-ion.dtsi +++ b/arch/arm/boot/dts/qcom/apq8084-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2013-2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msm8226-ion.dtsi b/arch/arm/boot/dts/qcom/msm8226-ion.dtsi index b3c25a3..949f506 100644 --- a/arch/arm/boot/dts/qcom/msm8226-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8226-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - system_contig_heap: qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - cp_mm_heap: qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msm8226-w-ion.dtsi b/arch/arm/boot/dts/qcom/msm8226-w-ion.dtsi index 1ac36e0..e638bc5 100644 --- a/arch/arm/boot/dts/qcom/msm8226-w-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8226-w-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - system_contig_heap: qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qsecom_heap: qcom,ion-heap@27 { /* QSECOM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <27>; diff --git a/arch/arm/boot/dts/qcom/msm8610-ion.dtsi b/arch/arm/boot/dts/qcom/msm8610-ion.dtsi index a7a428b..22ba8c1 100644 --- a/arch/arm/boot/dts/qcom/msm8610-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8610-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@27 { /* QSECOM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <27>; diff --git a/arch/arm/boot/dts/qcom/msm8909-ion.dtsi b/arch/arm/boot/dts/qcom/msm8909-ion.dtsi index 509e361..7ec0690 100644 --- a/arch/arm/boot/dts/qcom/msm8909-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8909-ion.dtsi @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - system_contig_heap: qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qsecom_heap: qcom,ion-heap@27 { /* QSEECOM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <27>; diff --git a/arch/arm/boot/dts/qcom/msm8916-512mb-ion.dtsi b/arch/arm/boot/dts/qcom/msm8916-512mb-ion.dtsi index b688a10..2cebe62 100644 --- a/arch/arm/boot/dts/qcom/msm8916-512mb-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8916-512mb-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@27 { /* QSEECOM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <27>; diff --git a/arch/arm/boot/dts/qcom/msm8916-ion.dtsi b/arch/arm/boot/dts/qcom/msm8916-ion.dtsi index 80baf241..53e85b9 100644 --- a/arch/arm/boot/dts/qcom/msm8916-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8916-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msm8939-ion.dtsi b/arch/arm/boot/dts/qcom/msm8939-ion.dtsi index f5e7054..39e3fa5 100644 --- a/arch/arm/boot/dts/qcom/msm8939-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8939-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msm8974-ion.dtsi b/arch/arm/boot/dts/qcom/msm8974-ion.dtsi index de751a0..e9ead3c 100644 --- a/arch/arm/boot/dts/qcom/msm8974-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8974-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msm8992-ion.dtsi b/arch/arm/boot/dts/qcom/msm8992-ion.dtsi index b359777..ec9bdab 100644 --- a/arch/arm/boot/dts/qcom/msm8992-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8992-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@22 { /* adsp heap */ reg = <22>; linux,contiguous-region = <&adsp_mem>; diff --git a/arch/arm/boot/dts/qcom/msm8994-ion.dtsi b/arch/arm/boot/dts/qcom/msm8994-ion.dtsi index 16b920e..deea46f 100644 --- a/arch/arm/boot/dts/qcom/msm8994-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msm8994-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, The Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/arch/arm/boot/dts/qcom/msmtellurium-ion.dtsi b/arch/arm/boot/dts/qcom/msmtellurium-ion.dtsi index 79fc0e4..3e8058e 100644 --- a/arch/arm/boot/dts/qcom/msmtellurium-ion.dtsi +++ b/arch/arm/boot/dts/qcom/msmtellurium-ion.dtsi @@ -1,4 +1,4 @@ -/* Copyright (c) 2014, Linux Foundation. All rights reserved. +/* Copyright (c) 2014,2016, Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -21,11 +21,6 @@ qcom,ion-heap-type = "SYSTEM"; }; - qcom,ion-heap@21 { - reg = <21>; - qcom,ion-heap-type = "SYSTEM_CONTIG"; - }; - qcom,ion-heap@8 { /* CP_MM HEAP */ compatible = "qcom,msm-ion-reserve"; reg = <8>; diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c index 583774e..3026fbe 100644 --- a/drivers/staging/android/ion/ion_heap.c +++ b/drivers/staging/android/ion/ion_heap.c @@ -2,7 +2,7 @@ * drivers/gpu/ion/ion_heap.c * * Copyright (C) 2011 Google, Inc. - * Copyright (c) 2011-2014, The Linux Foundation. All rights reserved. + * Copyright (c) 2011-2016, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -302,8 +302,9 @@ struct ion_heap *ion_heap_create(struct ion_platform_heap *heap_data) switch (heap_data->type) { case ION_HEAP_TYPE_SYSTEM_CONTIG: - heap = ion_system_contig_heap_create(heap_data); - break; + pr_err("%s: Heap type is disabled: %d\n", __func__, + heap_data->type); + return ERR_PTR(-EINVAL); case ION_HEAP_TYPE_SYSTEM: heap = ion_system_heap_create(heap_data); break; @@ -342,7 +343,8 @@ void ion_heap_destroy(struct ion_heap *heap) switch (heap->type) { case ION_HEAP_TYPE_SYSTEM_CONTIG: - ion_system_contig_heap_destroy(heap); + pr_err("%s: Heap type is disabled: %d\n", __func__, + heap->type); break; case ION_HEAP_TYPE_SYSTEM: ion_system_heap_destroy(heap); -- cgit v1.1