mirror of
https://github.com/opnsense/src.git
synced 2026-04-01 07:25:10 -04:00
e99c0c8b79
The "call" variable comes from the user in privcmd_ioctl_hypercall().
It's an offset into the hypercall_page[] which has (PAGE_SIZE / 32)
elements. We need to put an upper bound on it to prevent an out of
bounds access.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Signed-off-by: Juergen Gross <jgross@suse.com>
Obtained from: Linux
Linux commit: 42d8644bd77dd2d747e004e367cb0c895a606f39
Fixes:
|
||
|---|---|---|
| .. | ||
| pc | ||
| xen | ||
| _align.h | ||
| _bus.h | ||
| _inttypes.h | ||
| _limits.h | ||
| _stdint.h | ||
| _types.h | ||
| acpica_machdep.h | ||
| apm_bios.h | ||
| asan.h | ||
| asm.h | ||
| asmacros.h | ||
| atomic.h | ||
| bus.h | ||
| bus_dma.h | ||
| clock.h | ||
| counter.h | ||
| cpu.h | ||
| cpufunc.h | ||
| cputypes.h | ||
| csan.h | ||
| db_machdep.h | ||
| dump.h | ||
| efi.h | ||
| elf.h | ||
| endian.h | ||
| exec.h | ||
| fdt.h | ||
| float.h | ||
| floatingpoint.h | ||
| fpu.h | ||
| frame.h | ||
| gdb_machdep.h | ||
| ieeefp.h | ||
| in_cksum.h | ||
| intr_machdep.h | ||
| iodev.h | ||
| iommu.h | ||
| kdb.h | ||
| limits.h | ||
| md_var.h | ||
| memdev.h | ||
| metadata.h | ||
| minidump.h | ||
| mp_watchdog.h | ||
| msan.h | ||
| nexusvar.h | ||
| npx.h | ||
| ofw_machdep.h | ||
| param.h | ||
| pcb.h | ||
| pci_cfgreg.h | ||
| pcpu.h | ||
| pcpu_aux.h | ||
| pmap.h | ||
| pmc_mdep.h | ||
| ppireg.h | ||
| proc.h | ||
| procctl.h | ||
| profile.h | ||
| psl.h | ||
| ptrace.h | ||
| pvclock.h | ||
| reg.h | ||
| reloc.h | ||
| resource.h | ||
| runq.h | ||
| segments.h | ||
| setjmp.h | ||
| sf_buf.h | ||
| sgx.h | ||
| sgxreg.h | ||
| sigframe.h | ||
| signal.h | ||
| smp.h | ||
| specialreg.h | ||
| stack.h | ||
| stdarg.h | ||
| sysarch.h | ||
| timerreg.h | ||
| tls.h | ||
| trap.h | ||
| tss.h | ||
| ucontext.h | ||
| vdso.h | ||
| vm.h | ||
| vmm.h | ||
| vmm_dev.h | ||
| vmm_instruction_emul.h | ||
| vmm_snapshot.h | ||
| vmparam.h | ||