diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-10-24 05:19:52 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-10-24 05:19:51 -0700 |
| commit | 26e794c1c07f523c8ef15352dff9b830ec0e3f88 (patch) | |
| tree | 753ee37cdca94c033dcd0e6c0a7e526116b44c58 | |
| parent | 62e3c602647d6d2640037ac1d14a09c5dccb17c6 (diff) | |
| parent | fab8f054af1ba6f5026e3807d4fefb009436698e (diff) | |
Merge "msm: adsprpc: Fix integer overflow in refcount of map"
| -rw-r--r-- | drivers/char/adsprpc.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/char/adsprpc.c b/drivers/char/adsprpc.c index b898007c63d9..23b48dc6981b 100644 --- a/drivers/char/adsprpc.c +++ b/drivers/char/adsprpc.c @@ -479,6 +479,10 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, uintptr_t va, if (va >= map->va && va + len <= map->va + map->len && map->fd == fd) { + if (map->refs + 1 == INT_MAX) { + spin_unlock(&me->hlock); + return -ETOOMANYREFS; + } map->refs++; match = map; break; @@ -491,6 +495,10 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd, uintptr_t va, if (va >= map->va && va + len <= map->va + map->len && map->fd == fd) { + if (map->refs + 1 == INT_MAX) { + spin_unlock(&fl->hlock); + return -ETOOMANYREFS; + } map->refs++; match = map; break; |