summaryrefslogtreecommitdiffstats
path: root/mm/cma.c
diff options
context:
space:
mode:
authorRohit Vaswani <rvaswani@codeaurora.org>2015-10-22 13:32:11 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2015-10-23 17:55:10 +0900
commit67a2e213e7e937c41c52ab5bc46bf3f4de469f6e (patch)
tree7bc4c737953328c9deda1704bcfb1d7432b4b6b2 /mm/cma.c
parent5211613978cb7353a3237e4372958c0e7514683f (diff)
downloadlinux-stable-67a2e213e7e937c41c52ab5bc46bf3f4de469f6e.tar.gz
linux-stable-67a2e213e7e937c41c52ab5bc46bf3f4de469f6e.tar.bz2
linux-stable-67a2e213e7e937c41c52ab5bc46bf3f4de469f6e.zip
mm: cma: fix incorrect type conversion for size during dma allocation
This was found during userspace fuzzing test when a large size dma cma allocation is made by driver(like ion) through userspace. show_stack+0x10/0x1c dump_stack+0x74/0xc8 kasan_report_error+0x2b0/0x408 kasan_report+0x34/0x40 __asan_storeN+0x15c/0x168 memset+0x20/0x44 __dma_alloc_coherent+0x114/0x18c Signed-off-by: Rohit Vaswani <rvaswani@codeaurora.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/cma.c')
-rw-r--r--mm/cma.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/mm/cma.c b/mm/cma.c
index e7d1db533025..4eb56badf37e 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -361,7 +361,7 @@ err:
* This function allocates part of contiguous memory on specific
* contiguous memory area.
*/
-struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align)
+struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align)
{
unsigned long mask, offset, pfn, start = 0;
unsigned long bitmap_maxno, bitmap_no, bitmap_count;
@@ -371,7 +371,7 @@ struct page *cma_alloc(struct cma *cma, unsigned int count, unsigned int align)
if (!cma || !cma->count)
return NULL;
- pr_debug("%s(cma %p, count %d, align %d)\n", __func__, (void *)cma,
+ pr_debug("%s(cma %p, count %zu, align %d)\n", __func__, (void *)cma,
count, align);
if (!count)