Dan Carpenter 21643e69a4 xen-gntalloc: integer overflow in gntalloc_ioctl_alloc() ...

On 32 bit systems a high value of op.count could lead to an integer
overflow in the kzalloc() and gref_ids would be smaller than
expected.  If the you triggered another integer overflow in
"if (gref_size + op.count > limit)" then you'd probably get memory
corruption inside add_grefs().

CC: stable@kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

2011-11-16 12:13:47 -05:00

..

xen-pciback

xen: Add module.h to modular drivers/xen users.

2011-10-31 19:32:11 -04:00

xenbus

xen: map foreign pages for shared rings by updating the PTEs directly

2011-11-16 12:13:08 -05:00

xenfs

Merge branch 'xen/xenbus' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen

2011-01-20 16:37:28 -08:00

balloon.c

xen/balloon: Avoid OOM when requesting highmem

2011-11-16 12:13:43 -05:00

biomerge.c

xen: define BIOVEC_PHYS_MERGEABLE()

2010-10-18 10:40:28 -04:00

cpu_hotplug.c

Merge branch 'linux-next' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6

2009-12-11 12:18:16 -08:00

events.c

Merge branch 'stable/cleanups-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-11-06 20:13:34 -08:00

evtchn.c

treewide: remove extra semicolons

2011-04-10 17:01:05 +02:00

features.c

xen: clean up asm/xen/hypervisor.h

2008-12-16 21:50:31 +01:00

gntalloc.c

xen-gntalloc: integer overflow in gntalloc_ioctl_alloc()

2011-11-16 12:13:47 -05:00

gntdev.c

xen-gntdev: integer overflow in gntdev_alloc_map()

2011-11-16 12:13:46 -05:00

grant-table.c

Merge branch 'stable/cleanups-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-11-06 20:13:34 -08:00

Kconfig

xen: remove XEN_PLATFORM_PCI config option

2011-09-29 10:52:16 -04:00

Makefile

xen: remove XEN_PLATFORM_PCI config option

2011-09-29 10:52:16 -04:00

manage.c

xen: Add export.h for THIS_MODULE/EXPORT_SYMBOL to various xen users.

2011-10-31 19:32:11 -04:00

pci.c

Merge branch 'stable/cleanups-3.2' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-11-06 20:13:34 -08:00

platform-pci.c

xen: no need to delay xen_setup_shutdown_event for hvm guests anymore

2011-02-25 16:43:03 +00:00

swiotlb-xen.c

xen: Add export.h for THIS_MODULE/EXPORT_SYMBOL to various xen users.

2011-10-31 19:32:11 -04:00

sys-hypervisor.c

drivers/xen/sys-hypervisor: Cleanup code/data sections definitions

2011-05-19 11:30:41 -04:00

tmem.c

xen: prepare tmem shim to handle frontswap

2011-06-17 15:06:20 -06:00

xen-balloon.c

xen: use static initializers in xen-balloon.c

2011-07-29 13:45:45 -04:00

xen-selfballoon.c

Merge branches 'stable/bug.fixes-3.2' and 'stable/mmu.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

2011-10-25 09:17:47 +02:00

xencomm.c

include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h

2010-03-30 22:02:32 +09:00