From: Jan Beulich Date: Fri, 25 Oct 2019 08:38:58 +0000 (+0200) Subject: x86: fix off-by-one in is_xen_fixed_mfn() X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=9633929824204ca7a6d60d083466de79993d60f1;p=people%2Froyger%2Fxen.git x86: fix off-by-one in is_xen_fixed_mfn() __2M_rwdata_end marks the first byte after the Xen image, not its last byte. Subtract 1 to obtain the upper bound to compare against. (Note that instead switching from <= to < is less desirable, as in principle __pa() might return rubbish for addresses outside of the Xen image.) Since the & needs to be dropped from the line in question, also drop it from the adjacent one. Reported-by: Julien Grall Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-acked-by: Juergen Gross --- diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h index 3863e4ce57..f2306e56ed 100644 --- a/xen/include/asm-x86/mm.h +++ b/xen/include/asm-x86/mm.h @@ -283,8 +283,8 @@ struct page_info #define is_xen_heap_mfn(mfn) \ (mfn_valid(mfn) && is_xen_heap_page(mfn_to_page(mfn))) #define is_xen_fixed_mfn(mfn) \ - (((mfn_to_maddr(mfn)) >= __pa(&_stext)) && \ - ((mfn_to_maddr(mfn)) <= __pa(&__2M_rwdata_end))) + (((mfn_to_maddr(mfn)) >= __pa(_stext)) && \ + ((mfn_to_maddr(mfn)) <= __pa(__2M_rwdata_end - 1))) #define PRtype_info "016lx"/* should only be used for printk's */