Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f31c85ef authored by Shiraz Hashim's avatar Shiraz Hashim
Browse files

mm: cma: check the max limit for cma allocation



CMA allocation request size is represented by size_t that
gets truncated when same is passed as int to
bitmap_find_next_zero_area_off.

We observe that during fuzz testing when cma allocation
request is too high, bitmap_find_next_zero_area_off still
returns success due to the truncation. This leads to
kernel crash, as subsequent code assumes that requested
memory is available.

Fail cma allocation in case the request breaches the
corresponding cma region size.

Change-Id: Ieb5fd8429726efd7686387bccb55952fb053280a
Signed-off-by: default avatarShiraz Hashim <shashim@codeaurora.org>
parent 133406eb
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment