diff options
| author | Mohamed Ghannam <simo.ghannam@gmail.com> | 2018-01-02 19:44:34 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-01-03 11:23:05 -0500 |
| commit | c095508770aebf1b9218e77026e48345d719b17c (patch) | |
| tree | 1f112b635b9bde56a91b6b3de0045f3cbc8ff5ef /drivers/net/ethernet/intel | |
| parent | c0bace798436bca0fdc221ff61143f1376a9c3de (diff) | |
| download | linux-c095508770aebf1b9218e77026e48345d719b17c.tar.bz2 | |
RDS: Heap OOB write in rds_message_alloc_sgs()
When args->nr_local is 0, nr_pages gets also 0 due some size
calculation via rds_rm_size(), which is later used to allocate
pages for DMA, this bug produces a heap Out-Of-Bound write access
to a specific memory region.
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet/intel')
0 files changed, 0 insertions, 0 deletions