diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-01-09 20:18:17 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-01-09 20:18:17 (GMT) |
commit | 12e55508921865aefdd80fd17afe70c191afbd1b (patch) | |
tree | 476b3226fd9602b36bed0934409959bdd24a7eb5 /drivers/staging/vt6656/ioctl.c | |
parent | 55b81e6f2795484ea8edf5805c95c007cacfa736 (diff) | |
parent | 4d447c9a6ebc0142d320f075c5bac6d202a79fd4 (diff) | |
download | linux-fsl-qoriq-12e55508921865aefdd80fd17afe70c191afbd1b.tar.xz |
Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging
* 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (466 commits)
net/hyperv: Add support for jumbo frame up to 64KB
net/hyperv: Add NETVSP protocol version negotiation
net/hyperv: Remove unnecessary kmap_atomic in netvsc driver
staging/rtl8192e: Register against lib80211
staging/rtl8192e: Convert to lib80211_crypt_info
staging/rtl8192e: Convert to lib80211_crypt_data and lib80211_crypt_ops
staging/rtl8192e: Add lib80211.h to rtllib.h
staging/mei: add watchdog device registration wrappers
drm/omap: GEM, deal with cache
staging: vt6656: int.c, int.h: Change return of function to void
staging: usbip: removed unused definitions from header
staging: usbip: removed dead code from receive function
staging:iio: Drop {mark,unmark}_in_use callbacks
staging:iio: Drop buffer mark_param_change callback
staging:iio: Drop the unused buffer enable() and is_enabled() callbacks
staging:iio: Drop buffer busy flag
staging:iio: Make sure a device is only opened once at a time
staging:iio: Disallow modifying buffer size when buffer is enabled
staging:iio: Disallow changing scan elements in all buffered modes
staging:iio: Use iio_buffer_enabled instead of open coding it
...
Fix up conflict in drivers/staging/iio/adc/ad799x_core.c (removal of
module_init due to using module_i2c_driver() helper, next to removal of
MODULE_ALIAS due to using MODULE_DEVICE_TABLE instead).
Diffstat (limited to 'drivers/staging/vt6656/ioctl.c')
-rw-r--r-- | drivers/staging/vt6656/ioctl.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/staging/vt6656/ioctl.c b/drivers/staging/vt6656/ioctl.c index 4939002..1463d76 100644 --- a/drivers/staging/vt6656/ioctl.c +++ b/drivers/staging/vt6656/ioctl.c @@ -295,6 +295,10 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) result = -EFAULT; break; } + if (sList.uItem > (ULONG_MAX - sizeof(SBSSIDList)) / sizeof(SBSSIDItem)) { + result = -EINVAL; + break; + } pList = (PSBSSIDList)kmalloc(sizeof(SBSSIDList) + (sList.uItem * sizeof(SBSSIDItem)), (int)GFP_ATOMIC); if (pList == NULL) { result = -ENOMEM; @@ -557,6 +561,10 @@ int private_ioctl(PSDevice pDevice, struct ifreq *rq) result = -EFAULT; break; } + if (sNodeList.uItem > (ULONG_MAX - sizeof(SNodeList)) / sizeof(SNodeItem)) { + result = -ENOMEM; + break; + } pNodeList = (PSNodeList)kmalloc(sizeof(SNodeList) + (sNodeList.uItem * sizeof(SNodeItem)), (int)GFP_ATOMIC); if (pNodeList == NULL) { result = -ENOMEM; |