Merge "msm: adsprpc: Fix integer overflow in refcount of map" (5d4f02c9) · Commits · e / devices / android_kernel_oneplus_sm7250

drivers/char/adsprpc.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -609,8 +609,13 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX) {
		spin_unlock(&me->hlock);
		return -ETOOMANYREFS;
		}
		map->refs++;
		}
		match = map;
		break;
		}
		@@ -621,8 +626,11 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX)
		return -ETOOMANYREFS;
		map->refs++;
		}
		match = map;
		break;
		}