Add error check to:
- free_buffer_page
- alloc_buffer_page
after calling order_to_index, due to converting BUG to WARN at
order_to_index.

Signed-off-by: Tomer Samara <tomersamar...@gmail.com>
---
 drivers/staging/android/ion/ion_system_heap.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/android/ion/ion_system_heap.c 
b/drivers/staging/android/ion/ion_system_heap.c
index 37065a59ca69..1e73bfc88884 100644
--- a/drivers/staging/android/ion/ion_system_heap.c
+++ b/drivers/staging/android/ion/ion_system_heap.c
@@ -49,8 +49,13 @@ static struct page *alloc_buffer_page(struct ion_system_heap 
*heap,
                                      struct ion_buffer *buffer,
                                      unsigned long order)
 {
-       struct ion_page_pool *pool = heap->pools[order_to_index(order)];
+       struct ion_page_pool *pool;
+       int index = order_to_index(order);
+
+       if (index < 0)
+               return NULL;
 
+       pool = heap->pools[index];
        return ion_page_pool_alloc(pool);
 }
 
@@ -59,6 +64,7 @@ static void free_buffer_page(struct ion_system_heap *heap,
 {
        struct ion_page_pool *pool;
        unsigned int order = compound_order(page);
+       int index;
 
        /* go to system */
        if (buffer->private_flags & ION_PRIV_FLAG_SHRINKER_FREE) {
@@ -66,8 +72,11 @@ static void free_buffer_page(struct ion_system_heap *heap,
                return;
        }
 
-       pool = heap->pools[order_to_index(order)];
+       index = order_to_index(order);
+       if (index < 0)
+               return;
 
+       pool = heap->pools[index];
        ion_page_pool_free(pool, page);
 }
 
-- 
2.25.1

Reply via email to