cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status

[mirror_ubuntu-bionic-kernel.git] / kernel / relay.c

diff --git a/kernel/relay.c b/kernel/relay.c
index 39a9dfc69486b57a85d115dcefee75d35907a74d..1537158c67b38e139dc20de59525e738c1f66f21 100644 (file)
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
        struct rchan_buf *buf;
 
-       if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+       if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
                return NULL;
 
        buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
@@ -611,7 +611,6 @@ free_bufs:
 
        kref_put(&chan->kref, relay_destroy_channel);
        mutex_unlock(&relay_channels_mutex);
-       kfree(chan);
        return NULL;
 }
 EXPORT_SYMBOL_GPL(relay_open);