Supply additional checks in order to prevent unexpected results.
Fixes: b892bf75b2034 ("ion: Switch ion to use dma-buf") Signed-off-by: Lee Jones lee.jones@linaro.org --- Should be back-ported from v4.9 and earlier.
drivers/staging/android/ion/ion.c | 5 +++++ 1 file changed, 5 insertions(+)
diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c index 806e9b30b9dc8..402b74f5d7e69 100644 --- a/drivers/staging/android/ion/ion.c +++ b/drivers/staging/android/ion/ion.c @@ -29,6 +29,7 @@ #include <linux/export.h> #include <linux/mm.h> #include <linux/mm_types.h> +#include <linux/overflow.h> #include <linux/rbtree.h> #include <linux/slab.h> #include <linux/seq_file.h> @@ -509,6 +510,10 @@ static void *ion_handle_kmap_get(struct ion_handle *handle) void *vaddr;
if (handle->kmap_cnt) { + if (check_add_overflow(handle->kmap_cnt, + (unsigned int) 1, &handle->kmap_cnt)) + return ERR_PTR(-EOVERFLOW); + handle->kmap_cnt++; return buffer->vaddr; }