diff options
author | Jan Beulich <JBeulich@suse.com> | 2012-10-17 13:14:09 -0400 |
---|---|---|
committer | Konrad Rzeszutek Wilk <konrad.wilk@oracle.com> | 2012-10-30 09:57:49 -0400 |
commit | 1bcaba51eba549748917f7d6eb41900ff9ee3d5f (patch) | |
tree | 60eecbbc556d220d66cd045d5f2fa0f05e0bca96 /drivers/xen/xenbus | |
parent | 2ebb939ab9c6a2484866c5eae4184c83c2b21af8 (diff) |
xen/xenbus: fix overflow check in xenbus_file_write()
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
[v1: Rebased on upstream]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Diffstat (limited to 'drivers/xen/xenbus')
-rw-r--r-- | drivers/xen/xenbus/xenbus_dev_frontend.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index 89f76252a16f..ac727028e658 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c | |||
@@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp, | |||
458 | goto out; | 458 | goto out; |
459 | 459 | ||
460 | /* Can't write a xenbus message larger we can buffer */ | 460 | /* Can't write a xenbus message larger we can buffer */ |
461 | if ((len + u->len) > sizeof(u->u.buffer)) { | 461 | if (len > sizeof(u->u.buffer) - u->len) { |
462 | /* On error, dump existing buffer */ | 462 | /* On error, dump existing buffer */ |
463 | u->len = 0; | 463 | u->len = 0; |
464 | rc = -EINVAL; | 464 | rc = -EINVAL; |