Re: some bluetooth fixes

[Marcel Holtmann <marcel@xxxxxxxxxxxx>]

Hi Andi,

> +     if (req.conn_num * sizeof(*ci) > PAGE_SIZE * 2)
> +             return -EINVAL;
> 
> This can still overflow. It should be 
> 
>       if (req.conn_num > (PAGE_SIZE * 2)/sizeof(*ci))
>               return -EINVAL

thanks for reviewing the patch again. The fixed version is only attached
for control. It goes out to Dave in the next minutes.

Regards

Marcel

patch
Description: Text document