Jan Beulich
2012-Oct-16 12:18 UTC
[PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/drivers/xen/xenbus/xenbus_dev.c
+++ b/drivers/xen/xenbus/xenbus_dev.c
@@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
if (!is_xenstored_ready())
return -ENODEV;
- if ((len + u->len) > sizeof(u->u.buffer)) {
+ if (len > sizeof(u->u.buffer) - u->len) {
rc = -EINVAL;
goto out;
}
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
Ian Campbell
2012-Oct-16 13:00 UTC
Re: [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
On Tue, 2012-10-16 at 13:18 +0100, Jan Beulich wrote:> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > Signed-off-by: Jan Beulich <jbeulich@suse.com>Acked-by: Ian Campbell <ian.campbell@citrix.com> CC-ing Konrad since I think that modulo tweaking the path this ought to apply as is to upstream kernels.> > --- a/drivers/xen/xenbus/xenbus_dev.c > +++ b/drivers/xen/xenbus/xenbus_dev.c > @@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f > if (!is_xenstored_ready()) > return -ENODEV; > > - if ((len + u->len) > sizeof(u->u.buffer)) { > + if (len > sizeof(u->u.buffer) - u->len) { > rc = -EINVAL; > goto out; > } > > >
Konrad Rzeszutek Wilk
2012-Oct-17 16:26 UTC
Re: [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
On Tue, Oct 16, 2012 at 02:00:03PM +0100, Ian Campbell wrote:> On Tue, 2012-10-16 at 13:18 +0100, Jan Beulich wrote: > > Reported-by: Dan Carpenter <dan.carpenter@oracle.com> > > Signed-off-by: Jan Beulich <jbeulich@suse.com> > > Acked-by: Ian Campbell <ian.campbell@citrix.com> > > CC-ing Konrad since I think that modulo tweaking the path this ought to > apply as is to upstream kernels. > > > > > --- a/drivers/xen/xenbus/xenbus_dev.c > > +++ b/drivers/xen/xenbus/xenbus_dev.c > > @@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f > > if (!is_xenstored_ready()) > > return -ENODEV; > > > > - if ((len + u->len) > sizeof(u->u.buffer)) { > > + if (len > sizeof(u->u.buffer) - u->len) { > > rc = -EINVAL; > > goto out; > > } > > > > > >Like this: diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index 89f7625..ac72702 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp, goto out; /* Can''t write a xenbus message larger we can buffer */ - if ((len + u->len) > sizeof(u->u.buffer)) { + if (len > sizeof(u->u.buffer) - u->len) { /* On error, dump existing buffer */ u->len = 0; rc = -EINVAL;