Skip to content
Snippets Groups Projects
Forked from drm / msm
Loading
user avatar
Gavrilov Ilia authored
The 'padding' field of the 'rchan_buf' structure is an array of 'size_t'
elements, but the memory is allocated for an array of 'size_t *' elements.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Link: https://lkml.kernel.org/r/20221129092002.3538384-1-Ilia.Gavrilov@infotecs.ru


Fixes: b86ff981 ("[PATCH] relay: migrate from relayfs to a generic relay API")
Signed-off-by: default avatarIlia.Gavrilov <Ilia.Gavrilov@infotecs.ru>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: wuchi <wuchi.zero@gmail.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
4d8586e0
History