summaryrefslogtreecommitdiff
path: root/include/keys/system_keyring.h
diff options
context:
space:
mode:
authorEyal Itkin <eyal.itkin@gmail.com>2017-02-07 16:45:19 +0300
committerDoug Ledford <dledford@redhat.com>2017-02-08 12:28:30 -0500
commit647bf3d8a8e5777319da92af672289b2a6c4dc66 (patch)
tree8d9a8e7885ba0e86ef6d52b1feffb3b698fc42ba /include/keys/system_keyring.h
parent628f07d33c1f2e7bf31e0a4a988bb07914bd5e73 (diff)
IB/rxe: Fix mem_check_range integer overflow
Update the range check to avoid integer-overflow in edge case. Resolves CVE 2016-8636. Signed-off-by: Eyal Itkin <eyal.itkin@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Reviewed-by: Leon Romanovsky <leonro@mellanox.com> Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'include/keys/system_keyring.h')
0 files changed, 0 insertions, 0 deletions
larly `pch->cyclic' is written by `pl330_alloc_chan_resources' under `pl330->lock' but read by `pl330_tx_submit' under `pch->lock'. Second, I have removed locking from `pl330_request_channel' and `pl330_release_channel' functions. Function `pl330_request_channel' is only called from `pl330_alloc_chan_resources', so the lock is already held. Function `pl330_release_channel' is called from `pl330_free_chan_resources', which already holds the lock, and from `pl330_del'. Function `pl330_del' is called in an error path of `pl330_probe' and at the end of `pl330_remove', but I assume that there cannot be concurrent accesses to the protected data at those points. Signed-off-by: Iago Abal <mail@iagoabal.eu> Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'drivers/usb/host/fhci-q.c')