diff options
| author | Matthew Daley <mattjd@gmail.com> | 2012-11-14 10:43:14 +0100 |
|---|---|---|
| committer | Matthew Daley <mattjd@gmail.com> | 2012-11-14 10:43:14 +0100 |
| commit | be6892c0e4d88a9db6f255804f5a143c5b74b7f3 (patch) | |
| tree | a4ad92ed06ed4441a2593b2455a5626df85b08d5 | |
| parent | 209b2a8df2c3be46b2dfcad18f91281f365291b0 (diff) | |
| download | xen-be6892c0e4d88a9db6f255804f5a143c5b74b7f3.tar.gz xen-be6892c0e4d88a9db6f255804f5a143c5b74b7f3.tar.bz2 xen-be6892c0e4d88a9db6f255804f5a143c5b74b7f3.zip | |
tmem: Prevent NULL dereference on error case
If the client / pool IDs given to tmemc_save_get_next_page are invalid,
the calculation of pagesize will dereference NULL.
Fix this by moving the calculation below the appropriate NULL check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
xen-unstable changeset: 26132:286ef4ced216
xen-unstable date: Mon Nov 12 08:34:57 UTC 2012
| -rw-r--r-- | xen/common/tmem.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 374f412878..f1c0468fc3 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -2449,10 +2449,12 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id, OID oid; int ret = 0; struct tmem_handle h; - unsigned int pagesize = 1 << (pool->pageshift+12); + unsigned int pagesize; if ( pool == NULL || is_ephemeral(pool) ) return -1; + + pagesize = 1 << (pool->pageshift + 12); if ( bufsize < pagesize + sizeof(struct tmem_handle) ) return -ENOMEM; |