mm: cma: check the max limit for cma allocation
CMA allocation request size is represented by size_t that
gets truncated when same is passed as int to
bitmap_find_next_zero_area_off.
We observe that during fuzz testing when cma allocation
request is too high, bitmap_find_next_zero_area_off still
returns success due to the truncation. This leads to
kernel crash, as subsequent code assumes that requested
memory is available.
Fail cma allocation in case the request breaches the
corresponding cma region size.
Change-Id: Ieb5fd8429726efd7686387bccb55952fb053280a
Signed-off-by:
Shiraz Hashim <shashim@codeaurora.org>
Loading
Please register or sign in to comment