tree 52bc7616461aff96f0a889317b2861ec8d301eab
parent 0c8d087c04cdcef501064552149289866e53aa6c
author Wenliang Fan <fanwlexca@gmail.com> 1387250728 +0800
committer David S. Miller <davem@davemloft.net> 1387483334 -0500

drivers/net/hamradio: Integer overflow in hdlcdrv_ioctl()

The local variable 'bi' comes from userspace. If userspace passed a
large number to 'bi.data.calibrate', there would be an integer overflow
in the following line:
	s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;

Signed-off-by: Wenliang Fan <fanwlexca@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>