Re: [Xen-devel] [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()

[Ian Campbell <Ian.Campbell@xxxxxxxxxx>]

On Tue, 2012-10-16 at 13:18 +0100, Jan Beulich wrote:
> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>

CC-ing Konrad since I think that modulo tweaking the path this ought to
apply as is to upstream kernels.

> 
> --- a/drivers/xen/xenbus/xenbus_dev.c
> +++ b/drivers/xen/xenbus/xenbus_dev.c
> @@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
>       if (!is_xenstored_ready())
>               return -ENODEV;
>  
> -     if ((len + u->len) > sizeof(u->u.buffer)) {
> +     if (len > sizeof(u->u.buffer) - u->len) {
>               rc = -EINVAL;
>               goto out;
>       }
> 
> 
> 



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel