potential integer overflow in xenbus_file_write()

[Dan Carpenter <dan.carpenter@oracle.com>]

Hi,

I was reading some code and had a question in xenbus_file_write()

drivers/xen/xenbus/xenbus_dev_frontend.c
   461          if ((len + u->len) > sizeof(u->u.buffer)) {
                     ^^^^^^^^^^^^
Can this addition overflow?  Should the test be something like:

	if (len > sizeof(u->u.buffer) || len + u->len > sizeof(u->u.buffer)) {

   462                  /* On error, dump existing buffer */
   463                  u->len = 0;
   464                  rc = -EINVAL;
   465                  goto out;
   466          }
   467  
   468          ret = copy_from_user(u->u.buffer + u->len, ubuf, len);
   469  

regards,
dan carpenter