10 Mar
2021
10 Mar
'21
7:47 a.m.
On (21/03/10 00:43), Ricardo Ribalda wrote:
The plane_length is an unsigned integer. So, if we have a size of 0xffffffff bytes we incorrectly allocate 0 bytes instead of 1 << 32.
Cc: stable@vger.kernel.org Fixes: 7f8414594e47 ("[media] media: videobuf2: fix the length check for mmap") Signed-off-by: Ricardo Ribalda ribalda@chromium.org
Reviewed-by: Sergey Senozhatsky senozhatsky@chromium.org