ashmem: Fix ASHMEM_SET_PROT_MASK.

Signed-off-by: Arve Hjønnevåg <arve@android.com>
CC: Brian Swetland <swetland@google.com>
CC: Colin Cross <ccross@android.com>
CC: Arve Hjønnevåg <arve@android.com>
CC: Dima Zavin <dima@android.com>
CC: Robert Love <rlove@google.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 10 insertions, 1 deletions

diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
index 6f1a0bbc9a5..0b923b01da5 100644
--- a/drivers/staging/android/ashmem.c
+++ b/drivers/staging/android/ashmem.c
@@ -236,6 +236,13 @@ out:
         return ret;
 }
 
+static inline unsigned long
+calc_vm_may_flags(unsigned long prot)
+{
+        return _calc_vm_trans(prot, PROT_READ,  VM_MAYREAD ) |
+               _calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) |
+               _calc_vm_trans(prot, PROT_EXEC,  VM_MAYEXEC);
+}
 
 static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
 {
@@ -251,10 +258,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
         }
 
         /* requested protection bits must match our allowed protection mask */
-        if (unlikely((vma->vm_flags & ~asma->prot_mask) & PROT_MASK)) {
+        if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &
+                                                calc_vm_prot_bits(PROT_MASK))) {
                 ret = -EPERM;
                 goto out;
         }
+        vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);
 
         if (!asma->file) {
                 char *name = ASHMEM_NAME_DEF;