Hi,
I was reading some code and had a question in xenbus_file_write()
drivers/xen/xenbus/xenbus_dev_frontend.c
461 if ((len + u->len) > sizeof(u->u.buffer)) {
^^^^^^^^^^^^
Can this addition overflow? Should the test be something like:
if (len > sizeof(u->u.buffer) || len + u->len > sizeof(u->u.buffer)) {
462 /* On error, dump existing buffer */
463 u->len = 0;
464 rc = -EINVAL;
465 goto out;
466 }
467
468 ret = copy_from_user(u->u.buffer + u->len, ubuf, len);
469
regards,
dan carpenter
_______________________________________________
Virtualization mailing list
[email protected]
https://lists.linuxfoundation.org/mailman/listinfo/virtualization
