summaryrefslogtreecommitdiffstats
path: root/drivers/xen
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2022-09-03 13:23:11 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2022-09-03 13:23:11 -0700
commit65eea2c060aee3bf6d27ea365360059fbd4eeff4 (patch)
tree93b494c085cba42af9668d77bc2f29bc58b7dcbf /drivers/xen
parentf0c5f7ea81202e997f321d59bdd0c3f5c12ddea7 (diff)
parente9ea0b30ada008f4e65933f449db6894832cb242 (diff)
downloadlinux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.tar.gz
linux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.tar.bz2
linux-stable-65eea2c060aee3bf6d27ea365360059fbd4eeff4.zip
Merge tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
Pull xen fixes from Juergen Gross: - a minor fix for the Xen grant driver - a small series fixing a recently introduced problem in the Xen blkfront/blkback drivers with negotiation of feature usage * tag 'for-linus-6.0-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/grants: prevent integer overflow in gnttab_dma_alloc_pages() xen-blkfront: Cache feature_persistent value before advertisement xen-blkfront: Advertise feature-persistent as user requested xen-blkback: Advertise feature-persistent as user requested
Diffstat (limited to 'drivers/xen')
-rw-r--r--drivers/xen/grant-table.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 738029de3c67..e1ec725c2819 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -1047,6 +1047,9 @@ int gnttab_dma_alloc_pages(struct gnttab_dma_alloc_args *args)
size_t size;
int i, ret;
+ if (args->nr_pages < 0 || args->nr_pages > (INT_MAX >> PAGE_SHIFT))
+ return -ENOMEM;
+
size = args->nr_pages << PAGE_SHIFT;
if (args->coherent)
args->vaddr = dma_alloc_coherent(args->dev, size,