Priority LOW 35
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size.
2 records
dsp_mmap_single() validated the requested mapping by checking the sum of the user-supplied offset and length against the buffer size.
Second, the audio buffer backing a mapping could be freed when the device was closed even though the mapping remained valid.