Commit 6b36ba59 authored Nov 10, 2016 by Shiraz Hashim Committed by Linus Torvalds Nov 11, 2016

mm/cma.c: check the max limit for cma allocation

CMA allocation request size is represented by size_t that gets truncated
when same is passed as int to bitmap_find_next_zero_area_off.

We observe that during fuzz testing when cma allocation request is too
high, bitmap_find_next_zero_area_off still returns success due to the
truncation.  This leads to kernel crash, as subsequent code assumes that
requested memory is available.

Fail cma allocation in case the request breaches the corresponding cma
region size.

Link: http://lkml.kernel.org/r/1478189211-3467-1-git-send-email-shashim@codeaurora.org


Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent eef06b82

mm/cma.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -385,6 +385,9 @@ struct page cma_alloc(struct cma cma, size_t count, unsigned int align)
		bitmap_maxno = cma_bitmap_maxno(cma);
		bitmap_count = cma_bitmap_pages_to_bits(cma, count);

		if (bitmap_count > bitmap_maxno)
		return NULL;

		for (;;) {
		mutex_lock(&cma->lock);
		bitmap_no = bitmap_find_next_zero_area_off(cma->bitmap,

Admin message