diff options
| author | Vlad Tsyrklevich <vlad@tsyrklevich.net> | 2017-03-24 15:55:17 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-03-24 10:58:43 +0100 |
| commit | 6386bb00d5cb774aec6941e53435ddda46643305 (patch) | |
| tree | d803d7d6d94fec94fe86a2ead292bf26601bae57 /tools/perf/scripts/python/export-to-postgresql.py | |
| parent | 334259786f5d57491b54a2bb6f9ffa4b98abc0b2 (diff) | |
infiniband/uverbs: Fix integer overflows
[ Upstream commit 4f7f4dcfff2c19debbcdbcc861c325610a15e0c5 ]
The 'num_sge' variable is verfied to be smaller than the 'sge_count'
variable; however, since both are user-controlled it's possible to cause
an integer overflow for the kmalloc multiply on 32-bit platforms
(num_sge and sge_count are both defined u32). By crafting an input that
causes a smaller-than-expected allocation it's possible to write
controlled data out-of-bounds.
Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/perf/scripts/python/export-to-postgresql.py')
0 files changed, 0 insertions, 0 deletions