diff options
| author | Matthew Daley <mattjd@gmail.com> | 2012-11-14 10:37:51 +0100 |
|---|---|---|
| committer | Matthew Daley <mattjd@gmail.com> | 2012-11-14 10:37:51 +0100 |
| commit | 312b245d24538efed2b1206185a4f6aa67593248 (patch) | |
| tree | d1c0b753e07664c00de182ed617c3908413c0bc5 | |
| parent | ca8ae5103f176bee871d9ab1557cb9b8586b9ec7 (diff) | |
| download | xen-312b245d24538efed2b1206185a4f6aa67593248.tar.gz xen-312b245d24538efed2b1206185a4f6aa67593248.tar.bz2 xen-312b245d24538efed2b1206185a4f6aa67593248.zip | |
tmem: Prevent NULL dereference on error case
If the client / pool IDs given to tmemc_save_get_next_page are invalid,
the calculation of pagesize will dereference NULL.
Fix this by moving the calculation below the appropriate NULL check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
xen-unstable changeset: 26132:286ef4ced216
xen-unstable date: Mon Nov 12 08:34:57 UTC 2012
| -rw-r--r-- | xen/common/tmem.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 8a43dedb6f..87542a9ec4 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -2446,10 +2446,12 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id, OID oid; int ret = 0; struct tmem_handle h; - unsigned int pagesize = 1 << (pool->pageshift+12); + unsigned int pagesize; if ( pool == NULL || is_ephemeral(pool) ) return -1; + + pagesize = 1 << (pool->pageshift + 12); if ( bufsize < pagesize + sizeof(struct tmem_handle) ) return -ENOMEM; |