From mboxrd@z Thu Jan  1 00:00:00 1970
From: Matthew Daley <mattjd@gmail.com>
Subject: [PATCH] tmem: Prevent NULL dereference on error case
Date: Mon, 12 Nov 2012 16:17:22 +1300
Message-ID: <1352690242-28761-1-git-send-email-mattjd@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: xen-devel@lists.xen.org
Cc: Dan Magenheimer <dan.magenheimer@oracle.com>, Matthew Daley <mattjd@gmail.com>
List-Id: xen-devel@lists.xenproject.org

If the client / pool IDs given to tmemc_save_get_next_page are invalid,
the calculation of pagesize will dereference NULL.

Fix this by moving the calculation below the appropriate NULL check.

Signed-off-by: Matthew Daley <mattjd@gmail.com>

diff --git a/xen/common/tmem.c b/xen/common/tmem.c
index 1280537..ec59009 100644
--- a/xen/common/tmem.c
+++ b/xen/common/tmem.c
@@ -2436,10 +2436,13 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id,
     OID oid;
     int ret = 0;
     struct tmem_handle h;
-    unsigned int pagesize = 1 << (pool->pageshift+12);
+    unsigned int pagesize;
 
     if ( pool == NULL || is_ephemeral(pool) )
         return -1;
+
+    pagesize = 1 << (pool->pageshift + 12);
+
     if ( bufsize < pagesize + sizeof(struct tmem_handle) )
         return -ENOMEM;
 
-- 
1.7.10.4