-
Xi Wang authored
There are two potential integer overflows in private_ioctl() if userspace passes in a large sList.uItem / sNodeList.uItem. The subsequent call to kmalloc() would allocate a small buffer, leading to a memory corruption. Reported-by:
Dan Rosenberg <drosenberg@vsecurity.com> Signed-off-by:
Xi Wang <xi.wang@gmail.com> Signed-off-by:
Greg Kroah-Hartman <gregkh@suse.de>
20132043