Merge "qcedev: check num_fds during unmap" (2dc5013d) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/crypto/msm/qcedev.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -2036,7 +2036,9 @@ static inline long qcedev_ioctl(struct file *file,
		goto exit_free_qcedev_areq;
		}

		if (map_buf.num_fds > QCEDEV_MAX_BUFFERS) {
		if (map_buf.num_fds > ARRAY_SIZE(map_buf.fd)) {
		pr_err("%s: err: num_fds = %d exceeds max value\n",
		__func__, map_buf.num_fds);
		err = -EINVAL;
		goto exit_free_qcedev_areq;
		}
		@@ -2076,6 +2078,12 @@ static inline long qcedev_ioctl(struct file *file,
		err = -EFAULT;
		goto exit_free_qcedev_areq;
		}
		if (unmap_buf.num_fds > ARRAY_SIZE(unmap_buf.fd)) {
		pr_err("%s: err: num_fds = %d exceeds max value\n",
		__func__, unmap_buf.num_fds);
		err = -EINVAL;
		goto exit_free_qcedev_areq;
		}

		for (i = 0; i < unmap_buf.num_fds; i++) {
		err = qcedev_check_and_unmap_buffer(handle,