diff options
| author | Matthew Daley <mattjd@gmail.com> | 2012-11-12 09:34:57 +0100 |
|---|---|---|
| committer | Matthew Daley <mattjd@gmail.com> | 2012-11-12 09:34:57 +0100 |
| commit | b85a0ab12280192fb864339543a942dbed90577c (patch) | |
| tree | d0d0177146e3137c5e7dc824c732914d8afc87d9 /xen/common/tmem.c | |
| parent | e99d45da8a95453a3f4a5433ba9e8cc524bf60d2 (diff) | |
| download | xen-b85a0ab12280192fb864339543a942dbed90577c.tar.gz xen-b85a0ab12280192fb864339543a942dbed90577c.tar.bz2 xen-b85a0ab12280192fb864339543a942dbed90577c.zip | |
tmem: Prevent NULL dereference on error case
If the client / pool IDs given to tmemc_save_get_next_page are invalid,
the calculation of pagesize will dereference NULL.
Fix this by moving the calculation below the appropriate NULL check.
Signed-off-by: Matthew Daley <mattjd@gmail.com>
Committed-by: Jan Beulich <jbeulich@suse.com>
Diffstat (limited to 'xen/common/tmem.c')
| -rw-r--r-- | xen/common/tmem.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/xen/common/tmem.c b/xen/common/tmem.c index 128053731d..44e27721a2 100644 --- a/xen/common/tmem.c +++ b/xen/common/tmem.c @@ -2436,10 +2436,12 @@ static NOINLINE int tmemc_save_get_next_page(int cli_id, uint32_t pool_id, OID oid; int ret = 0; struct tmem_handle h; - unsigned int pagesize = 1 << (pool->pageshift+12); + unsigned int pagesize; if ( pool == NULL || is_ephemeral(pool) ) return -1; + + pagesize = 1 << (pool->pageshift + 12); if ( bufsize < pagesize + sizeof(struct tmem_handle) ) return -ENOMEM; |