forked from Minki/linux
tty: an overflow of multiplication in drivers/tty/cyclades.c
there is an overflow in the code : cyz_polling_cycle = (arg * HZ) / 1000, the multiplicator arg comes from user, so it may be an overflow if arg is a big number. And the value of cyc_polling_cycle will be wrong when it is used next time. Reported-by: Qixue Xiao <xiaoqixue_1@163.com> Suggested-by: Yongjian Xu <xuyongjiande@gmail.com> Suggested-by: Yu Chen <chyyuu@gmail.com> Signed-off-by: Qixue Xiao <xiaoqixue_1@163.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4903713cac
commit
351d6204bf
@ -2709,6 +2709,8 @@ cy_ioctl(struct tty_struct *tty,
|
||||
break;
|
||||
#ifndef CONFIG_CYZ_INTR
|
||||
case CYZSETPOLLCYCLE:
|
||||
if (arg > LONG_MAX / HZ)
|
||||
return -ENODEV;
|
||||
cyz_polling_cycle = (arg * HZ) / 1000;
|
||||
break;
|
||||
case CYZGETPOLLCYCLE:
|
||||
|
Loading…
Reference in New Issue
Block a user