diff options
| author | Vlad Tsyrklevich <[email protected]> | 2017-03-24 15:55:17 -0400 |
|---|---|---|
| committer | Doug Ledford <[email protected]> | 2017-04-25 15:18:02 -0400 |
| commit | 4f7f4dcfff2c19debbcdbcc861c325610a15e0c5 (patch) | |
| tree | b524532d61b62026a90ba8c21d44e58ae4c6dba4 /tools/perf/scripts/python/stackcollapse.py | |
| parent | 5b0ff9a00755d4d9c209033a77f1ed8f3186fe5c (diff) | |
infiniband/uverbs: Fix integer overflows
The 'num_sge' variable is verfied to be smaller than the 'sge_count'
variable; however, since both are user-controlled it's possible to cause
an integer overflow for the kmalloc multiply on 32-bit platforms
(num_sge and sge_count are both defined u32). By crafting an input that
causes a smaller-than-expected allocation it's possible to write
controlled data out-of-bounds.
Signed-off-by: Vlad Tsyrklevich <[email protected]>
Signed-off-by: Doug Ledford <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/stackcollapse.py')
0 files changed, 0 insertions, 0 deletions