diff options
| author | Siena Richard <sienar@codeaurora.org> | 2017-01-11 11:09:24 -0800 |
|---|---|---|
| committer | Siena Richard <sienar@codeaurora.org> | 2017-01-16 11:55:40 -0800 |
| commit | 3460635526f7a293dc4481cc140e0cd60f5914ed (patch) | |
| tree | 9d2756d318d408396748ee75a00205d96216a5cf /drivers/misc/qcom | |
| parent | 2f817b68f06ed866aa2c4cc35b2e4293aeb1ef99 (diff) | |
ASoC: msm: qdsp6v2: extend validation of virtual address
Validate a buffer virtual address is fully within the region before
returning the region to ensure functionality for an extended edge
case.
Change-Id: Iba3e080889980f393d6a9f0afe0231408b92d654
Signed-off-by: Siena Richard <sienar@codeaurora.org>
CRs-fixed: 1108461
Diffstat (limited to 'drivers/misc/qcom')
| -rw-r--r-- | drivers/misc/qcom/qdsp6v2/audio_utils_aio.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c index c963280e5bf5..b7af80854420 100644 --- a/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c +++ b/drivers/misc/qcom/qdsp6v2/audio_utils_aio.c @@ -1,6 +1,6 @@ /* Copyright (C) 2008 Google, Inc. * Copyright (C) 2008 HTC Corporation - * Copyright (c) 2009-2016, The Linux Foundation. All rights reserved. + * Copyright (c) 2009-2017, The Linux Foundation. All rights reserved. * * This software is licensed under the terms of the GNU General Public * License version 2, as published by the Free Software Foundation, and @@ -119,7 +119,10 @@ static int audio_aio_ion_lookup_vaddr(struct q6audio_aio *audio, void *addr, list_for_each_entry(region_elt, &audio->ion_region_queue, list) { if (addr >= region_elt->vaddr && addr < region_elt->vaddr + region_elt->len && - addr + len <= region_elt->vaddr + region_elt->len) { + addr + len <= region_elt->vaddr + region_elt->len && + addr + len > addr) { + /* to avoid integer addition overflow */ + /* offset since we could pass vaddr inside a registerd * ion buffer */ |