Skip to content

Commit

Permalink
mm: Fix incorrect type conversion for size during dma allocation
Browse files Browse the repository at this point in the history
This was found during userspace fuzzing test when a large size
allocation is made from ion

[<ffffffc00008a098>] show_stack+0x10/0x1c
[<ffffffc00119c390>] dump_stack+0x74/0xc8
[<ffffffc00020d9a0>] kasan_report_error+0x2b0/0x408
[<ffffffc00020dbd4>] kasan_report+0x34/0x40
[<ffffffc00020cfec>] __asan_storeN+0x15c/0x168
[<ffffffc00020d228>] memset+0x20/0x44
[<ffffffc00009b730>] __dma_alloc_coherent+0x114/0x18c
[<ffffffc00009c6e8>] __dma_alloc_noncoherent+0xbc/0x19c
[<ffffffc000c2b3e0>] ion_cma_allocate+0x178/0x2f0
[<ffffffc000c2b750>] ion_secure_cma_allocate+0xdc/0x190
[<ffffffc000c250dc>] ion_alloc+0x264/0xb88
[<ffffffc000c25e94>] ion_ioctl+0x1f4/0x480
[<ffffffc00022f650>] do_vfs_ioctl+0x67c/0x764
[<ffffffc00022f790>] SyS_ioctl+0x58/0x8c

FPIIM-1543

Change-Id: Idc9c19977a8cc62c7d092f689d30368704b400bc
Signed-off-by: Rohit Vaswani <[email protected]>
Signed-off-by: Francisco Franco <[email protected]>
  • Loading branch information
Rohit Vaswani authored and franciscofranco committed Sep 16, 2017
1 parent bab4c0f commit a7fee3f
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion drivers/base/dma-contiguous.c
Original file line number Diff line number Diff line change
Expand Up @@ -458,7 +458,7 @@ core_initcall(cma_init_reserved_areas);
* global one. Requires architecture specific get_dev_cma_area() helper
* function.
*/
struct page *dma_alloc_from_contiguous(struct device *dev, int count,
struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
unsigned int align)
{
unsigned long mask, pfn, pageno, start = 0;
Expand Down
4 changes: 2 additions & 2 deletions include/linux/dma-contiguous.h
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ static inline int dma_declare_contiguous(struct device *dev, phys_addr_t size,
return ret;
}

struct page *dma_alloc_from_contiguous(struct device *dev, int count,
struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
unsigned int order);
bool dma_release_from_contiguous(struct device *dev, struct page *pages,
int count);
Expand All @@ -116,7 +116,7 @@ int dma_declare_contiguous(struct device *dev, phys_addr_t size,
}

static inline
struct page *dma_alloc_from_contiguous(struct device *dev, int count,
struct page *dma_alloc_from_contiguous(struct device *dev, size_t count,
unsigned int order)
{
return NULL;
Expand Down

0 comments on commit a7fee3f

Please sign in to comment.