From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Fri, 4 Nov 2011 18:23:32 +0000 (+0300)
Subject: xen-gntdev: integer overflow in gntdev_alloc_map()
X-Git-Tag: v3.2-rc3~38^2~2
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fc6e0c3b909157748ce1c0c0f2a9935a5ee3c812;p=pandora-kernel.git

xen-gntdev: integer overflow in gntdev_alloc_map()

The multiplications here can overflow resulting in smaller buffer
sizes than expected.  "count" comes from a copy_from_user().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
---

Reading git-diff-tree failed