summaryrefslogtreecommitdiffstats
path: root/drivers/xen/xenbus
diff options
context:
space:
mode:
authorJan Beulich <JBeulich@suse.com>2012-01-24 13:52:42 +0000
committerKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>2012-02-03 16:07:05 -0500
commita43a5ccdfa5bd5b2f00aa9b2321df268c2e5d6e2 (patch)
tree0269faaf39185a0945ce19fab91b9cfdeb0d05e2 /drivers/xen/xenbus
parente4de866a834620ef974f5ba86d394a13d2f0cf66 (diff)
downloadlinux-stable-a43a5ccdfa5bd5b2f00aa9b2321df268c2e5d6e2.tar.gz
linux-stable-a43a5ccdfa5bd5b2f00aa9b2321df268c2e5d6e2.tar.bz2
linux-stable-a43a5ccdfa5bd5b2f00aa9b2321df268c2e5d6e2.zip
xenbus_dev: add missing error check to watch handling
So far only the watch path was checked to be zero terminated, while the watch token was merely assumed to be. Signed-off-by: Jan Beulich <jbeulich@suse.com> Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Diffstat (limited to 'drivers/xen/xenbus')
-rw-r--r--drivers/xen/xenbus/xenbus_dev_frontend.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 527dc2a3b89f..89f76252a16f 100644
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -369,6 +369,10 @@ static int xenbus_write_watch(unsigned msg_type, struct xenbus_file_priv *u)
goto out;
}
token++;
+ if (memchr(token, 0, u->u.msg.len - (token - path)) == NULL) {
+ rc = -EILSEQ;
+ goto out;
+ }
if (msg_type == XS_WATCH) {
watch = alloc_watch_adapter(path, token);