From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Mon, 17 Sep 2018 15:30:53 +0000 (+0100)
Subject: x86/PoD: Avoid using variable length arrays in p2m_pod_zero_check()
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=21a488cbd483e5b5b75b088a8662d55c4c8332fa;p=people%2Froyger%2Fxen.git

x86/PoD: Avoid using variable length arrays in p2m_pod_zero_check()

Callers of p2m_pod_zero_check() pass a count of up to POD_SWEEP_STRIDE.
Move the definition of POD_SWEEP_STRIDE and give the arrays a fixed
bound.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Reviewed-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: George Dunlap <george.dunlap@citrix.com>
---

diff --git a/xen/arch/x86/mm/p2m-pod.c b/xen/arch/x86/mm/p2m-pod.c
index 5ad62d71c7..4c56cb58c6 100644
--- a/xen/arch/x86/mm/p2m-pod.c
+++ b/xen/arch/x86/mm/p2m-pod.c
@@ -862,15 +862,19 @@ out:
     return ret;
 }
 
+#define POD_SWEEP_LIMIT 1024
+#define POD_SWEEP_STRIDE  16
+
 static void
 p2m_pod_zero_check(struct p2m_domain *p2m, const gfn_t *gfns, unsigned int count)
 {
-    mfn_t mfns[count];
-    p2m_type_t types[count];
-    unsigned long *map[count];
+    mfn_t mfns[POD_SWEEP_STRIDE];
+    p2m_type_t types[POD_SWEEP_STRIDE];
+    unsigned long *map[POD_SWEEP_STRIDE];
     struct domain *d = p2m->domain;
     unsigned int i, j, max_ref = 1;
 
+    BUG_ON(count > POD_SWEEP_STRIDE);
 
     /* Allow an extra refcount for one shadow pt mapping in shadowed domains */
     if ( paging_mode_shadow(d) )
@@ -1012,8 +1016,6 @@ out_unmap:
             unmap_domain_page(map[i]);
 }
 
-#define POD_SWEEP_LIMIT 1024
-#define POD_SWEEP_STRIDE  16
 static void
 p2m_pod_emergency_sweep(struct p2m_domain *p2m)
 {