mm/cma.c: check the max limit for cma allocation
authorShiraz Hashim <shashim@codeaurora.org>
Thu, 10 Nov 2016 18:46:16 +0000 (10:46 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 11 Nov 2016 16:12:37 +0000 (08:12 -0800)
commit6b36ba599d602d8a73920fb5c470fe272fac49c1
tree013d0a9d0eb45539fe656545edcfded22e2ee37f
parenteef06b82f16c78dc0197e3e9d5b2230647a890ff
mm/cma.c: check the max limit for cma allocation

CMA allocation request size is represented by size_t that gets truncated
when same is passed as int to bitmap_find_next_zero_area_off.

We observe that during fuzz testing when cma allocation request is too
high, bitmap_find_next_zero_area_off still returns success due to the
truncation.  This leads to kernel crash, as subsequent code assumes that
requested memory is available.

Fail cma allocation in case the request breaches the corresponding cma
region size.

Link: http://lkml.kernel.org/r/1478189211-3467-1-git-send-email-shashim@codeaurora.org
Signed-off-by: Shiraz Hashim <shashim@codeaurora.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
mm/cma.c