Fix off-by-one error in do_memory_op()'s start_extent range check

Signed-off-by: Jan Beulich <jbeulich@novell.com>
xen-unstable changeset:   21085:81d785fae7af
xen-unstable date:        Tue Mar 30 13:27:25 2010 +0100

diff --git a/xen/common/memory.c b/xen/common/memory.c
index 55e2d8a046ed6116d6d37a6731b1e0d3d3992449..fcb51648b0d524fdc2883913a66ef514a79d2275 100644 (file)
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -437,7 +437,7 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE(void) arg)
         if ( reservation.nr_extents > (ULONG_MAX >> MEMOP_EXTENT_SHIFT) )
             return start_extent;
 
-        if ( unlikely(start_extent > reservation.nr_extents) )
+        if ( unlikely(start_extent >= reservation.nr_extents) )
             return start_extent;
 
         args.extent_list  = reservation.extent_start;