From 7be78546fb2d3e05e28cbe0a7525e85cc652ff08 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 19 Sep 2012 09:27:55 +0200 Subject: [PATCH] x86: properly check XEN_DOMCTL_ioport_mapping arguments for invalid range In particular, the case of "np" being a very large value wasn't handled correctly. The range start checks also were off by one (except that in practice, when "np" is properly range checked, this would still have been caught by the range end checks). Also, is a GFN wrap in XEN_DOMCTL_memory_mapping really okay? Signed-off-by: Jan Beulich Acked-by: Keir Fraser --- xen/arch/x86/domctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/xen/arch/x86/domctl.c b/xen/arch/x86/domctl.c index f4e57051e0..c7f3965b70 100644 --- a/xen/arch/x86/domctl.c +++ b/xen/arch/x86/domctl.c @@ -884,7 +884,7 @@ long arch_do_domctl( int found = 0; ret = -EINVAL; - if ( (np == 0) || (fgp > MAX_IOPORTS) || (fmp > MAX_IOPORTS) || + if ( ((fgp | fmp | (np - 1)) >= MAX_IOPORTS) || ((fgp + np) > MAX_IOPORTS) || ((fmp + np) > MAX_IOPORTS) ) { printk(XENLOG_G_ERR -- 2.39.5