| commit | fc6e0c3b909157748ce1c0c0f2a9935a5ee3c812 | [log] [tgz] |
|---|---|---|
| author | Dan Carpenter <dan.carpenter@oracle.com> | Fri Nov 04 21:23:32 2011 +0300 |
| committer | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | Wed Nov 16 12:13:46 2011 -0500 |
| tree | fb1829a10aead11d62b4ca6c873936e63c06cbb7 | |
| parent | 90d4f5534d14815bd94c10e8ceccc57287657ecc [diff] |
xen-gntdev: integer overflow in gntdev_alloc_map() The multiplications here can overflow resulting in smaller buffer sizes than expected. "count" comes from a copy_from_user(). Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>