Merge "qcedev: check num_fds during unmap" (48ca3a82) · Commits · e / devices / android_kernel_fairphone_FP5

drivers/crypto/msm/qcedev.c

+9 −1

Original line number	Diff line number	Diff line
		@@ -1916,7 +1916,9 @@ long qcedev_ioctl(struct file *file,
		goto exit_free_qcedev_areq;
		}

		if (map_buf.num_fds > QCEDEV_MAX_BUFFERS) {
		if (map_buf.num_fds > ARRAY_SIZE(map_buf.fd)) {
		pr_err("%s: err: num_fds = %d exceeds max value\n",
		__func__, map_buf.num_fds);
		err = -EINVAL;
		goto exit_free_qcedev_areq;
		}
		@@ -1956,6 +1958,12 @@ long qcedev_ioctl(struct file *file,
		err = -EFAULT;
		goto exit_free_qcedev_areq;
		}
		if (unmap_buf.num_fds > ARRAY_SIZE(unmap_buf.fd)) {
		pr_err("%s: err: num_fds = %d exceeds max value\n",
		__func__, unmap_buf.num_fds);
		err = -EINVAL;
		goto exit_free_qcedev_areq;
		}

		for (i = 0; i < unmap_buf.num_fds; i++) {
		err = qcedev_check_and_unmap_buffer(handle,