diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2022-09-03 13:23:11 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2022-09-03 13:23:11 -0700 |
| commit | 65eea2c060aee3bf6d27ea365360059fbd4eeff4 (patch) | |
| tree | 93b494c085cba42af9668d77bc2f29bc58b7dcbf /drivers/xen | |
| parent | f0c5f7ea81202e997f321d59bdd0c3f5c12ddea7 (diff) | |
| parent | e9ea0b30ada008f4e65933f449db6894832cb242 (diff) | |
| download | linux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.tar.gz linux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.tar.bz2 linux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.zip | |
Merge tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross:
- a minor fix for the Xen grant driver
- a small series fixing a recently introduced problem in the Xen
blkfront/blkback drivers with negotiation of feature usage
* tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
xen/grants: prevent integer overflow in gnttab_dma_alloc_pages()
xen-blkfront: Cache feature_persistent value before advertisement
xen-blkfront: Advertise feature-persistent as user requested
xen-blkback: Advertise feature-persistent as user requested
Diffstat (limited to 'drivers/xen')
| -rw-r--r-- | drivers/xen/grant-table.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c index 738029de3c67..e1ec725c2819 100644 --- a/drivers/xen/grant-table.c +++ b/drivers/xen/grant-table.c @@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args) size_t size; int i, ret; + if (args->nr_pages < 0 || args->nr_pages > (INT_MAX >> PAGE_SHIFT)) + return -ENOMEM; + size = args->nr_pages << PAGE_SHIFT; if (args->coherent) args->vaddr = dma_alloc_coherent(args->dev, size, |