mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-02-07 18:35:07 +07:00
4f7f4dcfff
The 'num_sge' variable is verfied to be smaller than the 'sge_count' variable; however, since both are user-controlled it's possible to cause an integer overflow for the kmalloc multiply on 32-bit platforms (num_sge and sge_count are both defined u32). By crafting an input that causes a smaller-than-expected allocation it's possible to write controlled data out-of-bounds. Signed-off-by: Vlad Tsyrklevich <vlad@tsyrklevich.net> Signed-off-by: Doug Ledford <dledford@redhat.com> |
||
|---|---|---|
| .. | ||
| core | ||
| hw | ||
| sw | ||
| ulp | ||
| Kconfig | ||
| Makefile | ||