mm: cma: Fix incorrect type conversion for size during dma allocation
Subsystems (3)
PATCH 1/1 mm: cma: Fix incorrect type conversion for size during dma allocation
This was found during userspace fuzzing test when a large size dma cma allocation is made by driver(like ion) through userspace.
show_stack+0x10/0x1c dump_stack+0x74/0xc8 kasan_report_error+0x2b0/0x408 kasan_report+0x34/0x40 __asan_storeN+0x15c/0x168 memset+0x20/0x44 __dma_alloc_coherent+0x114/0x18c
Signed-off-by Rohit Vaswani <[email protected]>
--- drivers/base/dma-contiguous.c | 2 +- include/linux/cma.h | 2 +- include/linux/dma-contiguous.h | 4 ++-- mm/cma.c | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-)
drivers/base/dma-contiguous.c +1 -1
@@ -187,7 +187,7 @@ int __init dma_contiguous_reserve_area(phys_addr_t size, phys_addr_t base,* global one. Requires architecture specific dev_get_cma_area() helper * function. */ -struct page *dma_alloc_from_contiguous (struct device *dev,int count, +struct page *dma_alloc_from_contiguous (struct device *dev,size_t count,unsigned int align) {if (align >CONFIG_CMA_ALIGNMENT )
include/linux/cma.h +1 -1
@@ -26,6 +26,6 @@ extern int __init cma_declare_contiguous(phys_addr_t base,extern int cma_init_reserved_mem (phys_addr_t base,phys_addr_t size,unsigned int order_per_bit,struct cma **res_cma); -extern struct page *cma_alloc (struct cma *cma,unsigned int count,unsigned int align); +extern struct page *cma_alloc (struct cma *cma,size_t count,unsigned int align);extern bool cma_release (struct cma *cma,const struct page *pages,unsigned int count);#endif
include/linux/dma-contiguous.h +2 -2
@@ -111,7 +111,7 @@ static inline int dma_declare_contiguous(struct device *dev, phys_addr_t size,return ret; } -struct page *dma_alloc_from_contiguous (struct device *dev,int count, +struct page *dma_alloc_from_contiguous (struct device *dev,size_t count,unsigned int order);bool dma_release_from_contiguous (struct device *dev,struct page *pages,int count);
@@ -144,7 +144,7 @@ int dma_declare_contiguous(struct device *dev, phys_addr_t size, }static inline -struct page *dma_alloc_from_contiguous (struct device *dev,int count, +struct page *dma_alloc_from_contiguous (struct device *dev,size_t count,unsigned int order) {return NULL ;
mm/cma.c +2 -2
@@ -361,7 +361,7 @@ err:* This function allocates part of contiguous memory on specific * contiguous memory area. */ -struct page *cma_alloc (struct cma *cma,unsigned int count,unsigned int align) +struct page *cma_alloc (struct cma *cma,size_t count,unsigned int align) {unsigned long mask, offset, pfn, start =0 ;unsigned long bitmap_maxno, bitmap_no, bitmap_count;
@@ -371,7 +371,7 @@ struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align)if (!cma || !cma->count)return NULL ; -pr_debug ("%s(cma %p, count %d, align %d)\n" , __func__, (void *)cma, +pr_debug ("%s(cma %p, count %zu, align %d)\n" , __func__, (void *)cma, count, align);if (!count)
Signature · 8 lines
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum, hosted by The Linux Foundation -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Quoted 11 lines · Rohit Vaswani
This was found during userspace fuzzing test when a large size dma cma allocation is made by driver(like ion) through userspace.
show_stack+0x10/0x1c dump_stack+0x74/0xc8 kasan_report_error+0x2b0/0x408 kasan_report+0x34/0x40 __asan_storeN+0x15c/0x168 memset+0x20/0x44 __dma_alloc_coherent+0x114/0x18c
Quoted 1 line
Signed-off-by Rohit Vaswani <[email protected]>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>