Merge "msm: adsprpc: Fix integer overflow in refcount of map" (b998d670) · Commits · e / devices / android_kernel_oneplus_sm8150

drivers/char/adsprpc.c

+10 −2

Original line number	Diff line number	Diff line
		@@ -608,8 +608,13 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX) {
		spin_unlock(&me->hlock);
		return -ETOOMANYREFS;
		}
		map->refs++;
		}
		match = map;
		break;
		}
		@@ -620,8 +625,11 @@ static int fastrpc_mmap_find(struct fastrpc_file *fl, int fd,
		if (va >= map->va &&
		va + len <= map->va + map->len &&
		map->fd == fd) {
		if (refs)
		if (refs) {
		if (map->refs + 1 == INT_MAX)
		return -ETOOMANYREFS;
		map->refs++;
		}
		match = map;
		break;
		}