Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2c53d910 authored by Aravind Srinivasan's avatar Aravind Srinivasan Committed by Linus Torvalds
Browse files

relay: fix for possible loss/corruption of produced subbufs 



Fix possible loss/corruption of produced subbufs in
relay_subbufs_consumed().

When buf->subbufs_produced wraps around after UINT_MAX and
buf->subbufs_consumed is still < UINT_MAX, the condition

	if (buf->subbufs_consumed > buf->subbufs_produced)

will be true even for certain valid values of subbufs_consumed.  This may
lead to loss or corruption of produced subbufs.

Signed-off-by: default avatarAravind Srinivasan <raa.aars@gmail.com>
Cc: Tom Zanussi <tzanussi@gmail.com>
Cc: Tom Zanussi <zanussi@us.ibm.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent edb79a21

kernel/relay.c

+5 −3
Original line number Diff line number Diff line
@@ -797,13 +797,15 @@ void relay_subbufs_consumed(struct rchan *chan, 
	if (!chan)

		return;



	if (cpu >= NR_CPUS || !chan->buf[cpu])

	if (cpu >= NR_CPUS || !chan->buf[cpu] ||

					subbufs_consumed > chan->n_subbufs)

		return;



	buf = chan->buf[cpu];

	buf->subbufs_consumed += subbufs_consumed;

	if (buf->subbufs_consumed > buf->subbufs_produced)

	if (subbufs_consumed > buf->subbufs_produced - buf->subbufs_consumed)

		buf->subbufs_consumed = buf->subbufs_produced;

	else

		buf->subbufs_consumed += subbufs_consumed;

}

EXPORT_SYMBOL_GPL(relay_subbufs_consumed);