Merge "msm: adsprpc: Fix integer overflow in refcount of map" (bcd925a9) · Commits · e / devices / android_kernel_fairphone_FP3

drivers/char/adsprpc.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -623,8 +623,13 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX) {
		spin_unlock(&me->hlock);
		return -ETOOMANYREFS;
		}
		map->refs++;
		}
		match = map;
		break;
		}
		@@ -635,8 +640,11 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX)
		return -ETOOMANYREFS;
		map->refs++;
		}
		match = map;
		break;
		}