From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konrad Rzeszutek Wilk Subject: [PATCH 2/2] xen/xenbus: fix overflow check in xenbus_file_write() Date: Mon, 29 Oct 2012 10:08:18 -0400 Message-ID: <1351519698-11069-3-git-send-email-konrad.wilk@oracle.com> References: <1351519698-11069-1-git-send-email-konrad.wilk@oracle.com> Return-path: In-Reply-To: <1351519698-11069-1-git-send-email-konrad.wilk@oracle.com> Sender: linux-kernel-owner@vger.kernel.org To: linux-kernel@vger.kernel.org, xen-devel@lists.xensource.com Cc: Jan Beulich , Jan Beulich , Konrad Rzeszutek Wilk List-Id: xen-devel@lists.xenproject.org From: Jan Beulich Acked-by: Ian Campbell Reported-by: Dan Carpenter Signed-off-by: Jan Beulich [v1: Rebased on upstream] Signed-off-by: Konrad Rzeszutek Wilk --- drivers/xen/xenbus/xenbus_dev_frontend.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c index 89f7625..ac72702 100644 --- a/drivers/xen/xenbus/xenbus_dev_frontend.c +++ b/drivers/xen/xenbus/xenbus_dev_frontend.c @@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp, goto out; /* Can't write a xenbus message larger we can buffer */ - if ((len + u->len) > sizeof(u->u.buffer)) { + if (len > sizeof(u->u.buffer) - u->len) { /* On error, dump existing buffer */ u->len = 0; rc = -EINVAL; -- 1.7.7.6