ashmem: Fix ASHMEM_SET_PROT_MASK.

Change-Id: I1412cc9560de8c4feb1162fc30922f0e3362a476
Signed-off-by: Arve Hjønnevåg <arve@android.com>

diff --git a/mm/ashmem.c b/mm/ashmem.c
index 04e886e..7b75f41 100644 (file)
--- a/mm/ashmem.c
+++ b/mm/ashmem.c
@@ -236,6 +236,14 @@ out:
        return ret;
 }
 
+static inline unsigned long
+calc_vm_may_flags(unsigned long prot)
+{
+       return _calc_vm_trans(prot, PROT_READ,  VM_MAYREAD ) |
+              _calc_vm_trans(prot, PROT_WRITE, VM_MAYWRITE) |
+              _calc_vm_trans(prot, PROT_EXEC,  VM_MAYEXEC);
+}
+
 static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
 {
        struct ashmem_area *asma = file->private_data;
@@ -250,10 +258,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
        }
 
        /* requested protection bits must match our allowed protection mask */
-       if (unlikely((vma->vm_flags & ~asma->prot_mask) & PROT_MASK)) {
+       if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask)) &
+                                               calc_vm_prot_bits(PROT_MASK))) {
                ret = -EPERM;
                goto out;
        }
+       vma->vm_flags &= ~calc_vm_may_flags(~asma->prot_mask);
 
        if (!asma->file) {
                char *name = ASHMEM_NAME_DEF;