diff options
| author | Jan Beulich <JBeulich@suse.com> | 2012-10-17 19:14:09 +0200 |
|---|---|---|
| committer | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 2012-10-30 14:57:49 +0100 |
| commit | 1bcaba51eba549748917f7d6eb41900ff9ee3d5f (patch) | |
| tree | 60eecbbc556d220d66cd045d5f2fa0f05e0bca96 /drivers/xen | |
| parent | xen-kbdfront: handle backend CLOSED without CLOSING (diff) | |
| download | linux-1bcaba51eba549748917f7d6eb41900ff9ee3d5f.tar.xz linux-1bcaba51eba549748917f7d6eb41900ff9ee3d5f.zip | |
xen/xenbus: fix overflow check in xenbus_file_write()
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
[v1: Rebased on upstream]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Diffstat (limited to 'drivers/xen')
| -rw-r--r-- | drivers/xen/xenbus/xenbus_dev_frontend.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index 89f76252a16f..ac727028e658 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp, goto out; /* Can't write a xenbus message larger we can buffer */ - if ((len + u->len) > sizeof(u->u.buffer)) { + if (len > sizeof(u->u.buffer) - u->len) { /* On error, dump existing buffer */ u->len = 0; rc = -EINVAL; |