Subject: CVE-2024-46852: dma-buf: heaps: Fix off-by-one in CMA heap fault handler

From: Greg Kroah-Hartman <[email-masked]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dma-buf: heaps: Fix off-by-one in CMA heap fault handler

Until VM_DONTEXPAND was added in commit 1c1914d6e8c6 ("dma-buf: heaps:
Don't track CMA dma-buf pages under RssFile") it was possible to obtain
a mapping larger than the buffer size via mremap and bypass the overflow
check in dma_buf_mmap_internal. When using such a mapping to attempt to
fault past the end of the buffer, the CMA heap fault handler also checks
the fault offset against the buffer size, but gets the boundary wrong by
1. Fix the boundary check so that we don't read off the end of the pages
array and insert an arbitrary page in the mapping.

The Linux kernel CVE team has assigned CVE-2024-46852 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 5.10.227 with commit 007180fcb6cc
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 5.15.168 with commit 79cce5e81d20
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.1.111 with commit 84175dc5b2c9
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.6.52 with commit eb7fc8b65cea
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.10.11 with commit e79050882b85
	Issue introduced in 5.11 with commit a5d2d29e24be and fixed in 6.11 with commit ea5ff5d351b5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46852
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/dma-buf/heaps/cma_heap.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/007180fcb6cc4a93211d4cc45fef3f5ccccd56ae
	https://git.kernel.org/stable/c/79cce5e81d20fa9ad553be439d665ac3302d3c95
	https://git.kernel.org/stable/c/84175dc5b2c932266a50c04e5ce342c30f817a2f
	https://git.kernel.org/stable/c/eb7fc8b65cea22f9038c52398c8b22849e9620ea
	https://git.kernel.org/stable/c/e79050882b857c37634baedbdcf7c2047c24cbff
	https://git.kernel.org/stable/c/ea5ff5d351b520524019f7ff7f9ce418de2dad87