Vinayak Menon 6a14021cd6 ion: invalidate the pool pointers after free ...

ion_system_heap_destroy_pools frees the pool, but
does not invalidate the pointer. This can result in
a double free if ion_system_heap_create_pools fails,
and then causes ion_system_heap_create to call into
ion_system_heap_destroy_pools again from the error
path. This can happen in ion_system_heap_create when
one of the secure pool creation fails.

Change-Id: Ic73ca78722aa5a575cc4dd7c1caa560b518094f2
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
[haggertk: Backport to 3.4/msm8974]
CVE-2018-11987
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>

2019-08-09 11:42:04 +02:00

..

msm

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

tegra

…

ion_carveout_heap.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion_chunk_heap.c

gpu: ion: Make ion_free asynchronous

2013-04-16 11:11:54 -07:00

ion_cma_heap.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion_cma_secure_heap.c

ion: Skip zeroing on secure buffers

2014-05-27 09:34:02 -07:00

ion_cp_heap.c

gpu: ion: use a list instead of a tree for heap debug memory map

2013-11-19 14:01:21 -08:00

ion_heap.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion_iommu_heap.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion_page_pool.c

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

ion_priv.h

gpu: ion: Optimize zeroing when allocating from system heap

2014-07-08 17:39:30 +05:30

ion_removed_heap.c

gpu: ion: use a list instead of a tree for heap debug memory map

2013-11-19 14:01:21 -08:00

ion_system_heap.c

ion: invalidate the pool pointers after free

2019-08-09 11:42:04 +02:00

ion_system_mapper.c

…

ion.c

ANDROID: ion: Fix uninitialized variable

2019-08-08 16:37:16 +02:00

Kconfig

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

Makefile

misc: Import SM-G900H kernel source code

2019-08-02 15:14:10 +02:00

msm_ion_priv.h

gpu: ion: Add pooling of CMA allocations

2013-12-10 16:05:12 -08:00