Dan Carpenter e087f75191 genwqe: Prevent an integer overflow in the ioctl ... commit 110080cea0d0e4dfdb0b536e7f8a5633ead6a781 upstream. There are a couple potential integer overflows here. round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE); The first thing is that the "m->size + (...)" addition could overflow, and the second is that round_up() overflows to zero if the result is within PAGE_SIZE of the type max. In this code, the "m->size" variable is an u64 but we're saving the result in "map_size" which is an unsigned long and genwqe_user_vmap() takes an unsigned long as well. So I have used ULONG_MAX as the upper bound. From a practical perspective unsigned long is fine/better than trying to change all the types to u64. Fixes: eaf4722d46 ("GenWQE Character device and DDCB queue") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-06-11 12:24:13 +02:00
..
card_base.c
card_base.h	signal/GenWQE: Fix sending of SIGKILL	2018-11-21 09:27:34 +01:00
card_ddcb.c	misc/genwqe: get rid of atomic allocations	2015-10-04 12:42:33 +01:00
card_ddcb.h
card_debugfs.c
card_dev.c	genwqe: Prevent an integer overflow in the ioctl	2019-06-11 12:24:13 +02:00
card_sysfs.c	GenWQE: remove unnecessary version.h inclusion	2015-01-12 05:04:11 -08:00
card_utils.c	genwqe: Prevent an integer overflow in the ioctl	2019-06-11 12:24:13 +02:00
genwqe_driver.h
Kconfig
Makefile