From 9633929824204ca7a6d60d083466de79993d60f1 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Fri, 25 Oct 2019 10:38:58 +0200 Subject: [PATCH] x86: fix off-by-one in is_xen_fixed_mfn() __2M_rwdata_end marks the first byte after the Xen image, not its last byte. Subtract 1 to obtain the upper bound to compare against. (Note that instead switching from <= to < is less desirable, as in principle __pa() might return rubbish for addresses outside of the Xen image.) Since the & needs to be dropped from the line in question, also drop it from the adjacent one. Reported-by: Julien Grall Signed-off-by: Jan Beulich Acked-by: Andrew Cooper Release-acked-by: Juergen Gross --- xen/include/asm-x86/mm.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xen/include/asm-x86/mm.h b/xen/include/asm-x86/mm.h index 3863e4ce57..f2306e56ed 100644 --- a/xen/include/asm-x86/mm.h +++ b/xen/include/asm-x86/mm.h @@ -283,8 +283,8 @@ struct page_info #define is_xen_heap_mfn(mfn) \ (mfn_valid(mfn) && is_xen_heap_page(mfn_to_page(mfn))) #define is_xen_fixed_mfn(mfn) \ - (((mfn_to_maddr(mfn)) >= __pa(&_stext)) && \ - ((mfn_to_maddr(mfn)) <= __pa(&__2M_rwdata_end))) + (((mfn_to_maddr(mfn)) >= __pa(_stext)) && \ + ((mfn_to_maddr(mfn)) <= __pa(__2M_rwdata_end - 1))) #define PRtype_info "016lx"/* should only be used for printk's */ -- 2.39.5