mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2025-01-20 05:16:27 +07:00
42d8644bd7
The "call" variable comes from the user in privcmd_ioctl_hypercall().
It's an offset into the hypercall_page[] which has (PAGE_SIZE / 32)
elements. We need to put an upper bound on it to prevent an out of
bounds access.
Cc: stable@vger.kernel.org
Fixes:
|
||
---|---|---|
.. | ||
cpuid.h | ||
events.h | ||
hypercall.h | ||
hypervisor.h | ||
interface_32.h | ||
interface_64.h | ||
interface.h | ||
page-coherent.h | ||
page.h | ||
pci.h | ||
swiotlb-xen.h | ||
trace_types.h |