evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "msm: adsprpc: Fix integer overflow in refcount of map"

Browse source
This commit is contained in:
Linux Build Service Account 2019-10-24 05:19:52 -07:00 • committed by Gerrit - the friendly Code Review server
commit 26e794c1c0
1 changed files with 8 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/char/adsprpc.c
View file

@ -479,6 +479,10 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, uintptr_t va,
if (va >= map->va && if (va >= map->va &&
va + len <= map->va + map->len && va + len <= map->va + map->len &&
map->fd == fd) { map->fd == fd) {
if (map->refs + 1 == INT_MAX) {
spin_unlock(&me->hlock);
return -ETOOMANYREFS;
}
map->refs++; map->refs++;
match = map; match = map;
break; break;
@ -491,6 +495,10 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, uintptr_t va,
if (va >= map->va && if (va >= map->va &&
va + len <= map->va + map->len && va + len <= map->va + map->len &&
map->fd == fd) { map->fd == fd) {
if (map->refs + 1 == INT_MAX) {
spin_unlock(&fl->hlock);
return -ETOOMANYREFS;
}
map->refs++; map->refs++;
match = map; match = map;
break; break;