tree c1f3e2c8ba7fb2e5f96070f8125003730a71d222
parent 25e9789ddd9d14a8971f4a421d04f282719ab733
author Alex Williamson <alex.williamson@redhat.com> 1364319196 -0600
committer Alex Williamson <alex.williamson@redhat.com> 1364319196 -0600

vfio-pci: Fix possible integer overflow

The VFIO_DEVICE_SET_IRQS ioctl takes a start and count parameter, both
of which are unsigned.  We attempt to bounds check these, but fail to
account for the case where start is a very large number, allowing
start + count to wrap back into the valid range.  Bounds check both
start and start + count.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>