From: Matthew Daley <mattjd@gmail.com>
To: xen-devel@lists.xen.org
Cc: Dan Magenheimer <dan.magenheimer@oracle.com>,
Matthew Daley <mattjd@gmail.com>
Subject: [PATCH] tmem: Prevent NULL dereference on error case
Date: Mon, 12 Nov 2012 16:17:22 +1300 [thread overview]
Message-ID: <1352690242-28761-1-git-send-email-mattjd@gmail.com> (raw)
If the client / pool IDs given to tmemc_save_get_next_page are invalid,
the calculation of pagesize will dereference NULL.
Fix this by moving the calculation below the appropriate NULL check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
diff --git a/xen/common/tmem.c b/xen/common/tmem.c
index 1280537..ec59009 100644
--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2436,10 +2436,13 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id,
OID oid;
int ret = 0;
struct tmem_handle h;
- unsigned int pagesize = 1 << (pool->pageshift+12);
+ unsigned int pagesize;
if ( pool == NULL || is_ephemeral(pool) )
return -1;
+
+ pagesize = 1 << (pool->pageshift + 12);
+
if ( bufsize < pagesize + sizeof(struct tmem_handle) )
return -ENOMEM;
--
1.7.10.4
next reply other threads:[~2012-11-12 3:17 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-12 3:17 Matthew Daley [this message]
[not found] <<1352690242-28761-1-git-send-email-mattjd@gmail.com>
2012-11-12 16:30 ` [PATCH] tmem: Prevent NULL dereference on error case Dan Magenheimer
2012-11-12 23:02 ` Matthew Daley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1352690242-28761-1-git-send-email-mattjd@gmail.com \
--to=mattjd@gmail.com \
--cc=dan.magenheimer@oracle.com \
--cc=xen-devel@lists.xen.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).