[Xen-devel] [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()

["Jan Beulich" <JBeulich@xxxxxxxx>]

Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>

--- a/drivers/xen/xenbus/xenbus_dev.c
+++ b/drivers/xen/xenbus/xenbus_dev.c
@@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
        if (!is_xenstored_ready())
                return -ENODEV;
 
-       if ((len + u->len) > sizeof(u->u.buffer)) {
+       if (len > sizeof(u->u.buffer) - u->len) {
                rc = -EINVAL;
                goto out;
        }

Attachment: xen-xenbus-dev-write-buflen.patch
Description: Text document

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel