Merge remote-tracking branches 'spi/topic/res', 'spi/topic/rockchip', 'spi/topic...

[mirror_ubuntu-jammy-kernel.git] / drivers / xen / xenbus / xenbus_dev_frontend.c

diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c
index 9433e46518c8dc8680fd1e5a44d823aa7f65fdb0..912b64edb42b4a016201b4e7d1a695ca25056610 100644 (file)
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -188,6 +188,8 @@ static int queue_reply(struct list_head *queue, const void *data, size_t len)
 
        if (len == 0)
                return 0;
+       if (len > XENSTORE_PAYLOAD_MAX)
+               return -EINVAL;
 
        rb = kmalloc(sizeof(*rb) + len, GFP_KERNEL);
        if (rb == NULL)