ion: chunk_heap: fix leak in allocated counter

buffer->size is controlled by the outer ion layer, don't modify it
inside the heap.  Instead, compute the rounded up allocated size
on demand.

Signed-off-by: Colin Cross <ccross@android.com>
[jstultz: modified patch to apply to staging directory]
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/android/ion/ion_chunk_heap.c b/drivers/staging/android/ion/ion_chunk_heap.c
index 410c08e4028f4f1cb653498c3b2325af0c15a44e..85fefe7788454417358a75fdc43f6d4031b6d568 100644 (file)
--- a/drivers/staging/android/ion/ion_chunk_heap.c
+++ b/drivers/staging/android/ion/ion_chunk_heap.c
@@ -47,15 +47,15 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
        struct scatterlist *sg;
        int ret, i;
        unsigned long num_chunks;
+       unsigned long allocated_size;
 
        if (ion_buffer_fault_user_mappings(buffer))
                return -ENOMEM;
 
-       num_chunks = ALIGN(size, chunk_heap->chunk_size) /
-               chunk_heap->chunk_size;
-       buffer->size = num_chunks * chunk_heap->chunk_size;
+       allocated_size = ALIGN(size, chunk_heap->chunk_size);
+       num_chunks = allocated_size / chunk_heap->chunk_size;
 
-       if (buffer->size > chunk_heap->size - chunk_heap->allocated)
+       if (allocated_size > chunk_heap->size - chunk_heap->allocated)
                return -ENOMEM;
 
        table = kzalloc(sizeof(struct sg_table), GFP_KERNEL);
@@ -78,7 +78,7 @@ static int ion_chunk_heap_allocate(struct ion_heap *heap,
        }
 
        buffer->priv_virt = table;
-       chunk_heap->allocated += buffer->size;
+       chunk_heap->allocated += allocated_size;
        return 0;
 err:
        sg = table->sgl;
@@ -100,6 +100,9 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
        struct sg_table *table = buffer->priv_virt;
        struct scatterlist *sg;
        int i;
+       unsigned long allocated_size;
+
+       allocated_size = ALIGN(buffer->size, chunk_heap->chunk_size);
 
        ion_heap_buffer_zero(buffer);
 
@@ -111,7 +114,7 @@ static void ion_chunk_heap_free(struct ion_buffer *buffer)
                gen_pool_free(chunk_heap->pool, page_to_phys(sg_page(sg)),
                              sg_dma_len(sg));
        }
-       chunk_heap->allocated -= buffer->size;
+       chunk_heap->allocated -= allocated_size;
        sg_free_table(table);
        kfree(table);
 }