fix compat memory exchange op splitting

A shift with a negative count was erroneously used here, yielding
undefined behavior.

Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
master changeset: 53decd322157e922cac2988e07da6d39538c8033
master date: 2013-03-01 16:59:49 +0100

diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
index 1d877fc0219770059e1d8623693356b17990c3a3..5f494eb1b18679b5c992eda7e8984b54d7f54ec3 100644 (file)
--- a/xen/common/compat/memory.c
+++ b/xen/common/compat/memory.c
@@ -171,7 +171,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat)
                 if ( order_delta >= 0 )
                     nat.xchg->out.nr_extents = end_extent >> order_delta;
                 else
-                    nat.xchg->out.nr_extents = end_extent << order_delta;
+                    nat.xchg->out.nr_extents = end_extent << -order_delta;
                 ++split;
             }