power: supply: ltc2941-battery-gauge: fix use-after-free

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / mm / fadvise.c

diff --git a/mm/fadvise.c b/mm/fadvise.c
index b8a5bc6..001877e 100644 (file)
--- a/mm/fadvise.c
+++ b/mm/fadvise.c
@@ -68,8 +68,12 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
                goto out;
        }
 
-       /* Careful about overflows. Len == 0 means "as much as possible" */
-       endbyte = offset + len;
+       /*
+        * Careful about overflows. Len == 0 means "as much as possible".  Use
+        * unsigned math because signed overflows are undefined and UBSan
+        * complains.
+        */
+       endbyte = (u64)offset + (u64)len;
        if (!len || endbyte < len)
                endbyte = -1;
        else