Merge "msm: adsprpc: Do length check to avoid arbitrary memory access" (6e701a80) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/char/adsprpc.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1846,7 +1846,8 @@ static int get_args(uint32_t kernel, struct smq_invoke_ctx *ctx)
		}
		offset = buf_page_start(buf) - vma->vm_start;
		up_read(&current->mm->mmap_sem);
		VERIFY(err, offset < (uintptr_t)map->size);
		VERIFY(err,
		offset + len <= (uintptr_t)map->size);
		if (err)
		goto bail;
		}