Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Skip to content
Commit 8c08acaf authored by Shiraz Hashim's avatar Shiraz Hashim Committed by Gerrit - the friendly Code Review server
Browse files

mm: cma: check the max limit for cma allocation



CMA allocation request size is represented by size_t that
gets truncated when same is passed as int to
bitmap_find_next_zero_area_off.

We observe that during fuzz testing when cma allocation
request is too high, bitmap_find_next_zero_area_off still
returns success due to the truncation. This leads to
kernel crash, as subsequent code assumes that requested
memory is available.

Fail cma allocation in case the request breaches the
corresponding cma region size.

Change-Id: Ieb5fd8429726efd7686387bccb55952fb053280a
Signed-off-by: default avatarShiraz Hashim <shashim@codeaurora.org>
parent 587c023d
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment