Staging: comedi: fix integer overflow in do_insnlist_ioctl()
Staging: comedi: fix integer overflow in do_insnlist_ioctl()

There is a potential integer overflow in do_insnlist_ioctl() if
userspace passes in a large insnlist.n_insns.  The call to kmalloc()
would allocate a small buffer, leading to a memory corruption.

The bug was reported by Dan Carpenter <ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com>
and Haogang Chen <a43c3c780b4ed6eb73b773e57587039c18c08a28@gmail.com>.  The patch was suggested by
Ian Abbott <9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk> and Lars-Peter Clausen <3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de>.

Reported-by: Dan Carpenter <ff341aa343d564f9e53e9dcb6996be8c04859a66@oracle.com>
Reported-by: Haogang Chen <a43c3c780b4ed6eb73b773e57587039c18c08a28@gmail.com>.
Cc: Ian Abbott <9e6ba6483b6a3e14d61f7c987e72ecb5b46122d6@mev.co.uk>
Cc: Lars-Peter Clausen <3318dc5ce3e4fb7c28a0b841b6801c884e1d0896@metafoo.de>
Signed-off-by: Xi Wang <91e0ff19c25a4c90f9bdc24b1ac8e48e9177c077@gmail.com>
Signed-off-by: Greg Kroah-Hartman <4645f7897fd33786a2ee1264d590b3c400559d85@suse.de>

TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs,TeamVee-Kanas/android_kernel_samsung_kanas,TeamVee-Kanas/android_kernel_samsung_kanas,KristFoundation/Programs