* [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
@ 2012-10-16 12:18 Jan Beulich
2012-10-16 13:00 ` Ian Campbell
0 siblings, 1 reply; 3+ messages in thread
From: Jan Beulich @ 2012-10-16 12:18 UTC (permalink / raw)
To: xen-devel
[-- Attachment #1: Type: text/plain, Size: 433 bytes --]
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/drivers/xen/xenbus/xenbus_dev.c
+++ b/drivers/xen/xenbus/xenbus_dev.c
@@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
if (!is_xenstored_ready())
return -ENODEV;
- if ((len + u->len) > sizeof(u->u.buffer)) {
+ if (len > sizeof(u->u.buffer) - u->len) {
rc = -EINVAL;
goto out;
}
[-- Attachment #2: xen-xenbus-dev-write-buflen.patch --]
[-- Type: text/plain, Size: 479 bytes --]
xenbus: fix overflow check in xenbus_dev_write()
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
--- a/drivers/xen/xenbus/xenbus_dev.c
+++ b/drivers/xen/xenbus/xenbus_dev.c
@@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
if (!is_xenstored_ready())
return -ENODEV;
- if ((len + u->len) > sizeof(u->u.buffer)) {
+ if (len > sizeof(u->u.buffer) - u->len) {
rc = -EINVAL;
goto out;
}
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
2012-10-16 12:18 [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write() Jan Beulich
@ 2012-10-16 13:00 ` Ian Campbell
2012-10-17 16:26 ` Konrad Rzeszutek Wilk
0 siblings, 1 reply; 3+ messages in thread
From: Ian Campbell @ 2012-10-16 13:00 UTC (permalink / raw)
To: Jan Beulich; +Cc: Konrad Rzeszutek Wilk, xen-devel
On Tue, 2012-10-16 at 13:18 +0100, Jan Beulich wrote:
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
CC-ing Konrad since I think that modulo tweaking the path this ought to
apply as is to upstream kernels.
>
> --- a/drivers/xen/xenbus/xenbus_dev.c
> +++ b/drivers/xen/xenbus/xenbus_dev.c
> @@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
> if (!is_xenstored_ready())
> return -ENODEV;
>
> - if ((len + u->len) > sizeof(u->u.buffer)) {
> + if (len > sizeof(u->u.buffer) - u->len) {
> rc = -EINVAL;
> goto out;
> }
>
>
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write()
2012-10-16 13:00 ` Ian Campbell
@ 2012-10-17 16:26 ` Konrad Rzeszutek Wilk
0 siblings, 0 replies; 3+ messages in thread
From: Konrad Rzeszutek Wilk @ 2012-10-17 16:26 UTC (permalink / raw)
To: Ian Campbell; +Cc: Jan Beulich, xen-devel
On Tue, Oct 16, 2012 at 02:00:03PM +0100, Ian Campbell wrote:
> On Tue, 2012-10-16 at 13:18 +0100, Jan Beulich wrote:
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > Signed-off-by: Jan Beulich <jbeulich@suse.com>
>
> Acked-by: Ian Campbell <ian.campbell@citrix.com>
>
> CC-ing Konrad since I think that modulo tweaking the path this ought to
> apply as is to upstream kernels.
>
> >
> > --- a/drivers/xen/xenbus/xenbus_dev.c
> > +++ b/drivers/xen/xenbus/xenbus_dev.c
> > @@ -239,7 +239,7 @@ static ssize_t xenbus_dev_write(struct f
> > if (!is_xenstored_ready())
> > return -ENODEV;
> >
> > - if ((len + u->len) > sizeof(u->u.buffer)) {
> > + if (len > sizeof(u->u.buffer) - u->len) {
> > rc = -EINVAL;
> > goto out;
> > }
> >
> >
> >
Like this:
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 89f7625..ac72702 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp,
goto out;
/* Can't write a xenbus message larger we can buffer */
- if ((len + u->len) > sizeof(u->u.buffer)) {
+ if (len > sizeof(u->u.buffer) - u->len) {
/* On error, dump existing buffer */
u->len = 0;
rc = -EINVAL;
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-10-17 16:26 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-10-16 12:18 [PATCH] linux-2.6.18/xenbus: fix overflow check in xenbus_dev_write() Jan Beulich
2012-10-16 13:00 ` Ian Campbell
2012-10-17 16:26 ` Konrad Rzeszutek Wilk
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).