mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
![]() In the current code "ent_per_page" could be more than "conn_num" making
"conn_num" negative after the subtraction. In the next iteration
through the loop then the negative is treated as a very high positive
meaning we don't put a limit on "ent_num". It could lead to memory
corruption.
Fixes:
|
||
---|---|---|
.. | ||
netxen | ||
qed | ||
qede | ||
qlcnic | ||
qlge | ||
Kconfig | ||
Makefile | ||
qla3xxx.c | ||
qla3xxx.h |