mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
synced 2025-01-04 04:02:26 +00:00
fbbd84af6b
The "gl->tot_len" variable is controlled by the user. It comes from
process_responses(). On 32bit systems, the "gl->tot_len +
sizeof(struct cpl_pass_accept_req) + sizeof(struct rss_header)" addition
could have an integer wrapping bug. Use size_add() to prevent this.
Fixes:
|
||
---|---|---|
.. | ||
cxgb | ||
cxgb3 | ||
cxgb4 | ||
cxgb4vf | ||
inline_crypto | ||
libcxgb | ||
Kconfig | ||
Makefile |