summaryrefslogtreecommitdiff
path: root/drivers/xen/xenbus
diff options
context:
space:
mode:
authorJan Beulich <JBeulich@suse.com>2012-10-17 21:14:09 +0400
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>2012-10-30 17:57:49 +0400
commit1bcaba51eba549748917f7d6eb41900ff9ee3d5f (patch)
tree60eecbbc556d220d66cd045d5f2fa0f05e0bca96 /drivers/xen/xenbus
parent2ebb939ab9c6a2484866c5eae4184c83c2b21af8 (diff)
downloadlinux-1bcaba51eba549748917f7d6eb41900ff9ee3d5f.tar.xz
xen/xenbus: fix overflow check in xenbus_file_write()
Acked-by: Ian Campbell <ian.campbell@citrix.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jan Beulich <jbeulich@suse.com> [v1: Rebased on upstream] Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Diffstat (limited to 'drivers/xen/xenbus')
-rw-r--r--drivers/xen/xenbus/xenbus_dev_frontend.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 89f76252a16f..ac727028e658 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -458,7 +458,7 @@ static ssize_t xenbus_file_write(struct file *filp,
goto out;
/* Can't write a xenbus message larger we can buffer */
- if ((len + u->len) > sizeof(u->u.buffer)) {
+ if (len > sizeof(u->u.buffer) - u->len) {
/* On error, dump existing buffer */
u->len = 0;
rc = -EINVAL;