Commit 58c6d3df authored by Johannes Weiner's avatar Johannes Weiner Committed by Linus Torvalds
Browse files

dma-coherent: catch oversized requests to dma_alloc_from_coherent()

Prevent passing an order to bitmap_find_free_region() that is larger than
the actual bitmap can represent.

These requests can come from device drivers that have no idea how big the
dma region is and need to rely on dma_alloc_from_coherent() to sort it out
for them.
Reported-by: default avatarGuennadi Liakhovetski <>
Signed-off-by: default avatarJohannes Weiner <>
Cc: Pekka Enberg <>
Cc: Dmitry Baryshkov <>
Cc: Jesse Barnes <>
Cc: Tetsuo Handa <>
Signed-off-by: default avatarAndrew Morton <>
Signed-off-by: default avatarLinus Torvalds <>
parent eccd83e1
......@@ -118,6 +118,8 @@ int dma_alloc_from_coherent(struct device *dev, ssize_t size,
mem = dev->dma_mem;
if (!mem)
return 0;
if (unlikely(size > mem->size))
return 0;
pageno = bitmap_find_free_region(mem->bitmap, mem->size, order);
if (pageno >= 0) {
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment