[Xen-changelog] [linux-2.6.18-xen] xenbus_dev: add missing error checks to watch handling

[Xen patchbot-linux-2.6.18-xen <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1327491046 -3600
# Node ID 684281d7a1a3f2001047b59700408048b66da178
# Parent  712106b6b4d7cee855dcee46c34e9822da908a5f
xenbus_dev: add missing error checks to watch handling

So far only the watch path was checked to be zero terminated, while
the watch token was merely assumed to be.

Additionally, none of the three associated memory allocations got
checked for being successful.

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
---


diff -r 712106b6b4d7 -r 684281d7a1a3 drivers/xen/xenbus/xenbus_dev.c
--- a/drivers/xen/xenbus/xenbus_dev.c   Fri Jan 20 14:13:12 2012 +0100
+++ b/drivers/xen/xenbus/xenbus_dev.c   Wed Jan 25 12:30:46 2012 +0100
@@ -269,18 +269,24 @@
                        goto out;
                }
                token++;
+               if (memchr(token, 0, u->u.msg.len - (token - path)) == NULL) {
+                       rc = -EILSEQ;
+                       goto out;
+               }
 
                if (msg_type == XS_WATCH) {
                        watch = kzalloc(sizeof(*watch), GFP_KERNEL);
-                       watch->watch.node = kmalloc(strlen(path)+1,
-                                                    GFP_KERNEL);
-                       strcpy((char *)watch->watch.node, path);
+                       if (watch == NULL) {
+                               rc = -ENOMEM;
+                               goto out;
+                       }
+                       watch->watch.node = kstrdup(path, GFP_KERNEL);
                        watch->watch.callback = watch_fired;
-                       watch->token = kmalloc(strlen(token)+1, GFP_KERNEL);
-                       strcpy(watch->token, token);
+                       watch->token = kstrdup(token, GFP_KERNEL);
                        watch->dev_data = u;
 
-                       err = register_xenbus_watch(&watch->watch);
+                       err = watch->watch.node && watch->token
+                             ? register_xenbus_watch(&watch->watch) : -ENOMEM;
                        if (err) {
                                free_watch_adapter(watch);
                                rc = err;

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog