1 files changed, 2 insertions, 0 deletions

diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 9433e46518c8..912b64edb42b 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -188,6 +188,8 @@ static int queue_reply(struct list_head *queue, const void *data, size_t len)
 
         if (len == 0)
                 return 0;
+        if (len > XENSTORE_PAYLOAD_MAX)
+                return -EINVAL;
 
         rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
         if (rb == NULL)