32 lines
981 B
Diff
32 lines
981 B
Diff
|
# HG changeset patch
|
||
|
|
# User Matthew Daley <mattjd@gmail.com>
|
||
|
|
# Date 1352709297 -3600
|
||
|
|
# Node ID 286ef4ced2164f4e9bf52fd0c52248182e69a6e6
|
||
|
|
# Parent 62885b3c34c84354ead017703a86f0465cb58cf7
|
||
|
|
tmem: Prevent NULL dereference on error case
|
||
|
|
|
||
|
|
If the client / pool IDs given to tmemc_save_get_next_page are invalid,
|
||
|
|
the calculation of pagesize will dereference NULL.
|
||
|
|
|
||
|
|
Fix this by moving the calculation below the appropriate NULL check.
|
||
|
|
|
||
|
|
Signed-off-by: Matthew Daley <mattjd@gmail.com>
|
||
|
|
Committed-by: Jan Beulich <jbeulich@suse.com>
|
||
|
|
|
||
|
|
--- a/xen/common/tmem.c
|
||
|
|
+++ b/xen/common/tmem.c
|
||
|
|
@@ -2446,10 +2446,12 @@ static NOINLINE int tmemc_save_get_next_
|
||
|
|
OID oid;
|
||
|
|
int ret = 0;
|
||
|
|
struct tmem_handle h;
|
||
|
|
- unsigned int pagesize = 1 << (pool->pageshift+12);
|
||
|
|
+ unsigned int pagesize;
|
||
|
|
|
||
|
|
if ( pool == NULL || is_ephemeral(pool) )
|
||
|
|
return -1;
|
||
|
|
+
|
||
|
|
+ pagesize = 1 << (pool->pageshift + 12);
|
||
|
|
if ( bufsize < pagesize + sizeof(struct tmem_handle) )
|
||
|
|
return -ENOMEM;
|
||
|
|
|