[Xen-changelog] [xen stable-4.12] x86: fix off-by-one in is_xen_fixed_mfn()

[patchbot@xxxxxxx]

commit 08fde907aba44346fbf2834091dc4d19eca80e11
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Nov 25 15:53:11 2019 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Nov 25 15:53:11 2019 +0100

    x86: fix off-by-one in is_xen_fixed_mfn()
    
    __2M_rwdata_end marks the first byte after the Xen image, not its last
    byte. Subtract 1 to obtain the upper bound to compare against. (Note
    that instead switching from <= to < is less desirable, as in principle
    __pa() might return rubbish for addresses outside of the Xen image.)
    
    Since the & needs to be dropped from the line in question, also drop it
    from the adjacent one.
    
    Reported-by: Julien Grall <julien.grall@xxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Acked-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 9633929824204ca7a6d60d083466de79993d60f1
    master date: 2019-10-25 10:38:58 +0200
---
 xen/include/asm-x86/mm.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h
index f0fd35bf6b..845556eb6d 100644
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -295,8 +295,8 @@ struct page_info
 #define is_xen_heap_mfn(mfn) \
     (__mfn_valid(mfn) && is_xen_heap_page(mfn_to_page(_mfn(mfn))))
 #define is_xen_fixed_mfn(mfn)                     \
-    ((((mfn) << PAGE_SHIFT) >= __pa(&_stext)) &&  \
-     (((mfn) << PAGE_SHIFT) <= __pa(&__2M_rwdata_end)))
+    ((((mfn) << PAGE_SHIFT) >= __pa(_stext)) &&  \
+     (((mfn) << PAGE_SHIFT) <= __pa(__2M_rwdata_end - 1)))
 
 #define PRtype_info "016lx"/* should only be used for printk's */
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.12

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog