ANDROID: Incremental fs: Fix compound page usercopy crash
Bug: 153560805
Test: incfs_test passes on qemu and Pixel 4
Signed-off-by: Paul Lawrence <paullawrence@google.com>
Change-Id: I1b55341e4e4247a74f3f539b9d190fef0ca409b8
Git-commit: 580b23c95a
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
This commit is contained in:
committed by
Blagovest Kolenichev
parent
46c1f3f598
commit
67b3fcb242
@@ -507,7 +507,8 @@ int incfs_get_filled_blocks(struct data_file *df,
|
||||
return 0;
|
||||
}
|
||||
|
||||
bme = kzalloc(sizeof(*bme) * READ_BLOCKMAP_ENTRIES, GFP_NOFS);
|
||||
bme = kzalloc(sizeof(*bme) * READ_BLOCKMAP_ENTRIES,
|
||||
GFP_NOFS | __GFP_COMP);
|
||||
if (!bme)
|
||||
return -ENOMEM;
|
||||
|
||||
|
||||
@@ -858,7 +858,7 @@ static struct mem_range incfs_copy_signature_info_from_user(u8 __user *original,
|
||||
if (size > INCFS_MAX_SIGNATURE_SIZE)
|
||||
return range(ERR_PTR(-EFAULT), 0);
|
||||
|
||||
result = kzalloc(size, GFP_NOFS);
|
||||
result = kzalloc(size, GFP_NOFS | __GFP_COMP);
|
||||
if (!result)
|
||||
return range(ERR_PTR(-ENOMEM), 0);
|
||||
|
||||
@@ -1296,7 +1296,8 @@ static long ioctl_fill_blocks(struct file *f, void __user *arg)
|
||||
return -EFAULT;
|
||||
|
||||
usr_fill_block_array = u64_to_user_ptr(fill_blocks.fill_blocks);
|
||||
data_buf = (u8 *)__get_free_pages(GFP_NOFS, get_order(data_buf_size));
|
||||
data_buf = (u8 *)__get_free_pages(GFP_NOFS | __GFP_COMP,
|
||||
get_order(data_buf_size));
|
||||
if (!data_buf)
|
||||
return -ENOMEM;
|
||||
|
||||
@@ -1411,7 +1412,7 @@ static long ioctl_read_file_signature(struct file *f, void __user *arg)
|
||||
if (sig_buf_size > INCFS_MAX_SIGNATURE_SIZE)
|
||||
return -E2BIG;
|
||||
|
||||
sig_buffer = kzalloc(sig_buf_size, GFP_NOFS);
|
||||
sig_buffer = kzalloc(sig_buf_size, GFP_NOFS | __GFP_COMP);
|
||||
if (!sig_buffer)
|
||||
return -ENOMEM;
|
||||
|
||||
|
||||
Reference in New Issue
Block a user