[Xen-changelog] [xen-unstable] x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid range

[Xen patchbot-unstable <patchbot@xxxxxxx>]

# HG changeset patch
# User Jan Beulich <jbeulich@xxxxxxxx>
# Date 1348039675 -7200
# Node ID 3e3959413b2fbef584993beb434285d0691d5c67
# Parent  4a0438fe1e6afe01e46023bcb2c828c5aaeefb1d
x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid range

In particular, the case of "np" being a very large value wasn't handled
correctly. The range start checks also were off by one (except that in
practice, when "np" is properly range checked, this would still have
been caught by the range end checks).

Also, is a GFN wrap in XEN_DOMCTL_memory_mapping really okay?

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
Acked-by: Keir Fraser <keir@xxxxxxx>
---


diff -r 4a0438fe1e6a -r 3e3959413b2f xen/arch/x86/domctl.c
--- a/xen/arch/x86/domctl.c     Wed Sep 19 09:26:26 2012 +0200
+++ b/xen/arch/x86/domctl.c     Wed Sep 19 09:27:55 2012 +0200
@@ -884,7 +884,7 @@ long arch_do_domctl(
         int found = 0;
 
         ret = -EINVAL;
-        if ( (np == 0) || (fgp > MAX_IOPORTS) || (fmp > MAX_IOPORTS) ||
+        if ( ((fgp | fmp | (np - 1)) >= MAX_IOPORTS) ||
             ((fgp + np) > MAX_IOPORTS) || ((fmp + np) > MAX_IOPORTS) )
         {
             printk(XENLOG_G_ERR

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog