evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

goldfish: pipe: ANDROID: Do not crash

Browse source 
Return an error instead of crashing in signalled_pipes_add_locked.

Bug: 72717639
Bug: 66884503
Change-Id: I811ad1932f1600f8bbe4598cdaf206bd96ea921a
Signed-off-by: Roman Kiryanov <rkir@google.com>
This commit is contained in:
Roman Kiryanov 2018-04-30 14:32:34 -07:00 • committed by Greg Kroah-Hartman
parent 8b274c3897
commit 00b597e73d
1 changed files with 9 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
drivers/platform/goldfish/goldfish_pipe_v2.c
View file

@ -510,26 +510,30 @@ static unsigned int goldfish_pipe_poll(struct file *filp, poll_table *wait)
return mask;
}
static void signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
static int signalled_pipes_add_locked(struct goldfish_pipe_dev *dev,
u32 id, u32 flags)
{
struct goldfish_pipe *pipe;
BUG_ON(id >= dev->pipes_capacity);
if (id >= dev->pipes_capacity)
return -EINVAL;
pipe = dev->pipes[id];
if (!pipe)
return;
return -ENXIO;
pipe->signalled_flags |= flags;
if (pipe->prev_signalled || pipe->next_signalled
|| dev->first_signalled_pipe == pipe)
return; /* already in the list */
return 0; /* already in the list */
pipe->next_signalled = dev->first_signalled_pipe;
if (dev->first_signalled_pipe)
dev->first_signalled_pipe->prev_signalled = pipe;
dev->first_signalled_pipe = pipe;
return 0;
}
static void signalled_pipes_remove_locked(struct goldfish_pipe_dev *dev,