On 2019/9/23 下午5:12, wangxu (AE) wrote:
Hi Michael
Thanks for your fast reply.
As the following code, the 2nd branch of iov_iter_advance() does not check if
i->count < size, when this happens, i->count -= size may cause len exceed
INT_MAX, and then total_len exceed INT_MAX.
Hi Michael
Thanks for your fast reply.
As the following code, the 2nd branch of iov_iter_advance() does not
check if i->count < size, when this happens, i->count -= size may cause len
exceed INT_MAX, and then total_len exceed INT_MAX.
handle_tx_copy() ->
On Mon, Sep 23, 2019 at 03:46:41PM +0800, wangxu wrote:
> From: Wang Xu
>
> Caller of vhost_exceeds_weight(..., total_len) in drivers/vhost/net.c
> usually pass size_t total_len, which may be affected by rx/tx package.
>
> Signed-off-by: Wang Xu
Puts a bit more pressure on the register file
3 matches
Mail list logo