mirror of
https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
synced 2024-11-01 02:21:16 +00:00
b62e408c05
It's problematic to allow signed element_nr's or total's to be passed as part of the flex array API. flex_array_alloc() allows total_nr_elements to be set to a negative quantity, which is obviously erroneous. flex_array_get() and flex_array_put() allows negative array indices in dereferencing an array part, which could address memory mapped before struct flex_array. The fix is to convert all existing element_nr formals to be qualified as unsigned. Existing checks to compare it to total_nr_elements or the max array size based on element_size need not be changed. Signed-off-by: David Rientjes <rientjes@google.com> Cc: Dave Hansen <dave@linux.vnet.ibm.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
lzo | ||
reed_solomon | ||
zlib_deflate | ||
zlib_inflate | ||
.gitignore | ||
argv_split.c | ||
atomic64.c | ||
audit.c | ||
bcd.c | ||
bitmap.c | ||
bitrev.c | ||
bug.c | ||
bust_spinlocks.c | ||
check_signature.c | ||
checksum.c | ||
cmdline.c | ||
cpumask.c | ||
crc-ccitt.c | ||
crc-itu-t.c | ||
crc-t10dif.c | ||
crc7.c | ||
crc16.c | ||
crc32.c | ||
crc32defs.h | ||
ctype.c | ||
debug_locks.c | ||
debugobjects.c | ||
dec_and_lock.c | ||
decompress.c | ||
decompress_bunzip2.c | ||
decompress_inflate.c | ||
decompress_unlzma.c | ||
devres.c | ||
div64.c | ||
dma-debug.c | ||
dump_stack.c | ||
dynamic_debug.c | ||
extable.c | ||
fault-inject.c | ||
find_last_bit.c | ||
find_next_bit.c | ||
flex_array.c | ||
gcd.c | ||
gen_crc32table.c | ||
genalloc.c | ||
halfmd4.c | ||
hexdump.c | ||
hweight.c | ||
idr.c | ||
inflate.c | ||
int_sqrt.c | ||
iomap.c | ||
iomap_copy.c | ||
iommu-helper.c | ||
ioremap.c | ||
irq_regs.c | ||
is_single_threaded.c | ||
kasprintf.c | ||
Kconfig | ||
Kconfig.debug | ||
Kconfig.kgdb | ||
Kconfig.kmemcheck | ||
kernel_lock.c | ||
klist.c | ||
kobject.c | ||
kobject_uevent.c | ||
kref.c | ||
libcrc32c.c | ||
list_debug.c | ||
lmb.c | ||
locking-selftest-hardirq.h | ||
locking-selftest-mutex.h | ||
locking-selftest-rlock-hardirq.h | ||
locking-selftest-rlock-softirq.h | ||
locking-selftest-rlock.h | ||
locking-selftest-rsem.h | ||
locking-selftest-softirq.h | ||
locking-selftest-spin-hardirq.h | ||
locking-selftest-spin-softirq.h | ||
locking-selftest-spin.h | ||
locking-selftest-wlock-hardirq.h | ||
locking-selftest-wlock-softirq.h | ||
locking-selftest-wlock.h | ||
locking-selftest-wsem.h | ||
locking-selftest.c | ||
Makefile | ||
nlattr.c | ||
parser.c | ||
percpu_counter.c | ||
plist.c | ||
prio_heap.c | ||
prio_tree.c | ||
proportions.c | ||
radix-tree.c | ||
random32.c | ||
ratelimit.c | ||
rational.c | ||
rbtree.c | ||
reciprocal_div.c | ||
rwsem-spinlock.c | ||
rwsem.c | ||
scatterlist.c | ||
sha1.c | ||
show_mem.c | ||
smp_processor_id.c | ||
sort.c | ||
spinlock_debug.c | ||
string.c | ||
string_helpers.c | ||
swiotlb.c | ||
syscall.c | ||
textsearch.c | ||
ts_bm.c | ||
ts_fsm.c | ||
ts_kmp.c | ||
vsprintf.c |