From 3d85b42ad19d49ae40014746c3ea48a73c646eab Mon Sep 17 00:00:00 2001 From: "Isaac J. Manjarres" Date: Thu, 16 Apr 2020 10:08:05 -0700 Subject: [PATCH] ion: Ensure secure HLOS accessible buffers are zeroed when allocated Memory that is either pooled or permanently assigned to other VMIDs is not always cleared when it is released back into the pools. This is problematic when the memory is assigned such that HLOS can still access the memory, as a userspace process can reallocate the same buffer, and read data from when the buffer was previously allocated. Thus, clear secure ION buffers before freeing them, if they are HLOS accessible. Change-Id: Iaae14fc32b10e0c6afca007a5ee78aacd5e013e6 Signed-off-by: Isaac J. Manjarres --- drivers/staging/android/ion/heaps/ion_carveout_heap.c | 2 ++ drivers/staging/android/ion/heaps/ion_system_heap.c | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/staging/android/ion/heaps/ion_carveout_heap.c b/drivers/staging/android/ion/heaps/ion_carveout_heap.c index 7aaef6a9d6c8..53347da25295 100644 --- a/drivers/staging/android/ion/heaps/ion_carveout_heap.c +++ b/drivers/staging/android/ion/heaps/ion_carveout_heap.c @@ -379,6 +379,8 @@ static void ion_sc_heap_free(struct ion_buffer *buffer) return; } + if (hlos_accessible_buffer(buffer)) + ion_buffer_zero(buffer); ion_carveout_free(child, paddr, buffer->size); sg_free_table(table); kfree(table); diff --git a/drivers/staging/android/ion/heaps/ion_system_heap.c b/drivers/staging/android/ion/heaps/ion_system_heap.c index e0cc4bab86b8..6c9bfc8ff4b5 100644 --- a/drivers/staging/android/ion/heaps/ion_system_heap.c +++ b/drivers/staging/android/ion/heaps/ion_system_heap.c @@ -426,7 +426,7 @@ void ion_system_heap_free(struct ion_buffer *buffer) if (!(buffer->private_flags & ION_PRIV_FLAG_SHRINKER_FREE) && !(buffer->flags & ION_FLAG_POOL_FORCE_ALLOC)) { - if (vmid < 0) + if (hlos_accessible_buffer(buffer)) ion_buffer_zero(buffer); } else if (vmid > 0) { if (ion_hyp_unassign_sg(table, &vmid, 1, true))