Add error check to: - free_buffer_page - alloc_buffer_page after calling order_to_index, due to converting BUG to WARN at order_to_index.
Signed-off-by: Tomer Samara tomersamara98@gmail.com --- drivers/staging/android/ion/ion_system_heap.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c index 37065a59ca69..1e73bfc88884 100644 --- a/drivers/staging/android/ion/ion_system_heap.c +++ b/drivers/staging/android/ion/ion_system_heap.c @@ -49,8 +49,13 @@ static struct page *alloc_buffer_page(struct ion_system_heap *heap, struct ion_buffer *buffer, unsigned long order) { - struct ion_page_pool *pool = heap->pools[order_to_index(order)]; + struct ion_page_pool *pool; + int index = order_to_index(order); + + if (index < 0) + return NULL;
+ pool = heap->pools[index]; return ion_page_pool_alloc(pool); }
@@ -59,6 +64,7 @@ static void free_buffer_page(struct ion_system_heap *heap, { struct ion_page_pool *pool; unsigned int order = compound_order(page); + int index;
/* go to system */ if (buffer->private_flags & ION_PRIV_FLAG_SHRINKER_FREE) { @@ -66,8 +72,11 @@ static void free_buffer_page(struct ion_system_heap *heap, return; }
- pool = heap->pools[order_to_index(order)]; + index = order_to_index(order); + if (index < 0) + return;
+ pool = heap->pools[index]; ion_page_pool_free(pool, page); }