When len is greater than UINT_MAX - sizeof(*rb), in next allocation,
it can overflow integer range and allocates small size of heap.
After that, memcpy will overflow the allocated heap.
Therefore, it needs to check the size of given length.
Signed-off-by: Insu Yun
---
drivers/xen/xenbus
When len is greater than UINT_MAX - sizeof(*rb), in next allocation,
it can overflow integer range and allocates small size of heap.
After that, memcpy will overflow the allocated heap.
Therefore, it needs to check the size of given length.
Signed-off-by: Insu Yun
---
drivers/xen/xenbus
, 2015 at 02:02:47PM -0400, Insu Yun wrote:
> >> I changed patch with valid format.
> >>
> >> On Thu, Oct 15, 2015 at 2:02 PM, Insu Yun wrote:
> >>
> >>> Since vzalloc can be failed in memory pressure,
> >>> writes -ENOM
Since vzalloc can be failed in memory pressure,
writes -ENOMEM to xenstore to indicate error.
Signed-off-by: Insu Yun
---
drivers/net/xen-netback/xenbus.c | 6 ++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index 929a6e7
Sorry for wrong format, I forgot to change my configuration.
On Thu, Oct 15, 2015 at 1:13 PM, Wei Liu wrote:
> On Thu, Oct 15, 2015 at 12:26:16PM -0400, Insu Yun wrote:
> > Since vzalloc can be failed in memory pressure,
> > return value should be checked and return ENOMEM.
&g
I changed patch with valid format.
On Thu, Oct 15, 2015 at 2:02 PM, Insu Yun wrote:
> Since vzalloc can be failed in memory pressure,
> writes -ENOMEM to xenstore to indicate error.
>
> Signed-off-by: Insu Yun
> ---
> drivers/net/xen-netback/xenbus.c | 6 ++
> 1 file
Since vzalloc can be failed in memory pressure,
return value should be checked and return ENOMEM.
Signed-off-by: Insu Yun
---
drivers/net/xen-netback/xenbus.c | 5 +
1 file changed, 5 insertions(+)
diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c
index
