[Xen-changelog] [xen stable-4.3] fix off-by-one mistakes in vm_alloc()

[patchbot@xxxxxxx]

commit 5a9f5c558e5636f6c613f8f31b0911656e6af27f
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Aug 7 16:54:14 2013 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Aug 7 16:54:14 2013 +0200

    fix off-by-one mistakes in vm_alloc()
    
    Also add another pair of assertions to catch eventual further cases of
    incorrect accounting.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Keir Fraser <keir@xxxxxxx>
    master commit: b0e55bd49725c7c0183eb18670997b9e5930adac
    master date: 2013-08-05 18:40:23 +0200
---
 xen/common/vmap.c |   26 ++++++++++++++++++--------
 1 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/xen/common/vmap.c b/xen/common/vmap.c
index 5f92be4..783cea3 100644
--- a/xen/common/vmap.c
+++ b/xen/common/vmap.c
@@ -57,8 +57,8 @@ void *vm_alloc(unsigned int nr, unsigned int align)
     {
         struct page_info *pg;
 
-        ASSERT(!test_bit(vm_low, vm_bitmap));
-        for ( start = vm_low; ; )
+        ASSERT(vm_low == vm_top || !test_bit(vm_low, vm_bitmap));
+        for ( start = vm_low; start < vm_top; )
         {
             bit = find_next_bit(vm_bitmap, vm_top, start + 1);
             if ( bit > vm_top )
@@ -68,12 +68,18 @@ void *vm_alloc(unsigned int nr, unsigned int align)
              * corresponding page a guard one.
              */
             start = (start + align) & ~(align - 1);
-            if ( start + nr <= bit )
-                break;
-            start = bit < vm_top ?
-                    find_next_zero_bit(vm_bitmap, vm_top, bit + 1) : bit;
-            if ( start >= vm_top )
-                break;
+            if ( bit < vm_top )
+            {
+                if ( start + nr < bit )
+                    break;
+                start = find_next_zero_bit(vm_bitmap, vm_top, bit + 1);
+            }
+            else
+            {
+                if ( start + nr <= bit )
+                    break;
+                start = bit;
+            }
         }
 
         if ( start < vm_top )
@@ -115,6 +121,10 @@ void *vm_alloc(unsigned int nr, unsigned int align)
 
     for ( bit = start; bit < start + nr; ++bit )
         __set_bit(bit, vm_bitmap);
+    if ( bit < vm_top )
+        ASSERT(!test_bit(bit, vm_bitmap));
+    else
+        ASSERT(bit == vm_top);
     if ( start <= vm_low + 2 )
         vm_low = bit;
     spin_unlock(&vm_lock);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.3

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog