diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2011-11-04 22:23:32 +0400 |
|---|---|---|
| committer | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 2011-11-16 21:13:46 +0400 |
| commit | fc6e0c3b909157748ce1c0c0f2a9935a5ee3c812 (patch) | |
| tree | fb1829a10aead11d62b4ca6c873936e63c06cbb7 /lib/mpi/mpiutil.c | |
| parent | 90d4f5534d14815bd94c10e8ceccc57287657ecc (diff) | |
| download | linux-fc6e0c3b909157748ce1c0c0f2a9935a5ee3c812.tar.xz | |
xen-gntdev: integer overflow in gntdev_alloc_map()
The multiplications here can overflow resulting in smaller buffer
sizes than expected. "count" comes from a copy_from_user().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Diffstat (limited to 'lib/mpi/mpiutil.c')
0 files changed, 0 insertions, 0 deletions