[PATCH] fs/nilfs2: Integer overflow in nilfs_ioctl_wrap_copy()

The local variable 'pos' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: pos += n; Signed-off-by: Wenliang Fan --- fs/nilfs2/ioctl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c

[PATCH] fs/nilfs2: Integer overflow in nilfs_ioctl_wrap_copy()

The local variable 'pos' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: pos += n; Signed-off-by: Wenliang Fan fanwle...@gmail.com --- fs/nilfs2/ioctl.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/fs/nilfs2/ioctl.c b

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan --- drivers/staging/bcm/nvm.c | 9

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan --- drivers/staging/bcm/nvm.c | 5

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan fanwle...@gmail.com --- drivers

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan fanwle...@gmail.com --- drivers

[PATCH] fs/nilfs2: Integer overflow in nilfs_ioctl_wrap_copy()

The local variable 'pos' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: pos += n; Signed-off-by: Wenliang Fan --- fs/nilfs2/ioctl.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/fs/nilfs2/ioctl.c

[PATCH] fs/btrfs: Integer overflow in btrfs_ioctl_resize()

The local variable 'new_size' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: new_size = old_size + new_size; Signed-off-by: Wenliang Fan --- fs/btrfs/ioctl.c | 4 1 file changed, 4 insertions(+) diff --git a/fs/btrfs

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan --- drivers/staging/bcm/nvm.c | 4

[PATCH] drivers/staging/bcm: Integer overflow

The checking condition in 'validateFlash2xReadWrite()' is not sufficient. A large number invalid would cause an integer overflow and pass the condition, which could cause further integer overflows in 'Bcmchar.c:bcm_char_ioctl()'. Signed-off-by: Wenliang Fan fanwle...@gmail.com --- drivers

[PATCH] fs/btrfs: Integer overflow in btrfs_ioctl_resize()

The local variable 'new_size' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: new_size = old_size + new_size; Signed-off-by: Wenliang Fan fanwle...@gmail.com --- fs/btrfs/ioctl.c | 4 1 file changed, 4 insertions(+) diff

[PATCH] fs/nilfs2: Integer overflow in nilfs_ioctl_wrap_copy()

The local variable 'pos' comes from userspace. If a large number was passed, there would be an integer overflow in the following line: pos += n; Signed-off-by: Wenliang Fan fanwle...@gmail.com --- fs/nilfs2/ioctl.c | 7 ++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git

[PATCH] drivers/net/wireless/hostap: Integer overflow

terval * HZ Signed-off-by: Wenliang Fan --- drivers/net/wireless/hostap/hostap_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c index e509030..63e350a 100644 --- a/drivers/net/wi

[PATCH] drivers/net/wireless/hostap: Integer overflow

* HZ Signed-off-by: Wenliang Fan fanwle...@gmail.com --- drivers/net/wireless/hostap/hostap_ioctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c index e509030..63e350a 100644

[PATCH] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

The local variable 'bi' comes from userspace. If userspace passed a large number to 'bi.data.calibrate', there would be an integer overflow in the following line: s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16; Signed-off-by: Wenliang Fan --- drivers/net/ha

[PATCH] drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

The local variable 'bi' comes from userspace. If userspace passed a large number to 'bi.data.calibrate', there would be an integer overflow in the following line: s-hdlctx.calibrate = bi.data.calibrate * s-par.bitrate / 16; Signed-off-by: Wenliang Fan fanwle...@gmail.com --- drivers/net