221fd753dd
Variable IoBuffer.InputLength is chosen from userspace, and can therefore be less than the intended size. In this case,the memory from the kmalloc call is eventually cast to a PBULKWRM_BUFFER. If the IoBuffer.InputLength does not meet the minimum size of PBULKWRM_BUFFER, then we will get a kernel Oops. To resolve this issue, this patch verifies IoBuffer.InputLength meets the minimum size before invoking the kmalloc call. Signed-off-by: Kevin McKinney <klmckinney1@gmail.com> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
||
|---|---|---|
| .. | ||
| Adapter.h | ||
| Bcmchar.c | ||
| Bcmnet.c | ||
| CmHost.c | ||
| CmHost.h | ||
| cntrl_SignalingInterface.h | ||
| DDRInit.c | ||
| DDRInit.h | ||
| Debug.h | ||
| HandleControlPacket.c | ||
| headers.h | ||
| hostmibs.c | ||
| HostMIBSInterface.h | ||
| InterfaceAdapter.h | ||
| InterfaceDld.c | ||
| InterfaceIdleMode.c | ||
| InterfaceIdleMode.h | ||
| InterfaceInit.c | ||
| InterfaceInit.h | ||
| InterfaceIsr.c | ||
| InterfaceIsr.h | ||
| InterfaceMacros.h | ||
| InterfaceMisc.c | ||
| InterfaceMisc.h | ||
| InterfaceRx.c | ||
| InterfaceRx.h | ||
| InterfaceTx.c | ||
| InterfaceTx.h | ||
| Ioctl.h | ||
| IPv6Protocol.c | ||
| IPv6ProtocolHdr.h | ||
| Kconfig | ||
| LeakyBucket.c | ||
| led_control.c | ||
| led_control.h | ||
| Macros.h | ||
| Makefile | ||
| Misc.c | ||
| nvm.c | ||
| nvm.h | ||
| PHSDefines.h | ||
| PHSModule.c | ||
| PHSModule.h | ||
| Protocol.h | ||
| Prototypes.h | ||
| Qos.c | ||
| Queue.h | ||
| sort.c | ||
| target_params.h | ||
| TODO | ||
| Transmit.c | ||
| Typedefs.h | ||
| vendorspecificextn.c | ||
| vendorspecificextn.h | ||
| Version.h | ||