diff options
| author | kfraser@localhost.localdomain <kfraser@localhost.localdomain> | 2006-10-12 14:25:51 +0100 |
|---|---|---|
| committer | kfraser@localhost.localdomain <kfraser@localhost.localdomain> | 2006-10-12 14:25:51 +0100 |
| commit | 8b17a36d176b7164479b16cf4e539b899af0885e (patch) | |
| tree | b60ce1a8aeaa5967ef575fa453bd05621abb11eb | |
| parent | 0491bf8d2c4536ab3946e041a039f0e36d704935 (diff) | |
| download | xen-8b17a36d176b7164479b16cf4e539b899af0885e.tar.gz xen-8b17a36d176b7164479b16cf4e539b899af0885e.tar.bz2 xen-8b17a36d176b7164479b16cf4e539b899af0885e.zip | |
Fix privcmd mmap() on 64b architectures for regions larger than 2GB.
Signed-off-by: Xin Li <xin.b.li@intel.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
| -rw-r--r-- | linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c index 9459229664..ba67bec83e 100644 --- a/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c +++ b/linux-2.6-xen-sparse/drivers/xen/privcmd/privcmd.c @@ -139,7 +139,7 @@ static int privcmd_ioctl(struct inode *inode, struct file *file, /* Do not allow range to wrap the address space. */ rc = -EINVAL; - if ((msg.npages > (INT_MAX >> PAGE_SHIFT)) || + if ((msg.npages > (LONG_MAX >> PAGE_SHIFT)) || ((unsigned long)(msg.npages << PAGE_SHIFT) >= -va)) goto mmap_out; @@ -183,7 +183,7 @@ static int privcmd_ioctl(struct inode *inode, struct file *file, if (copy_from_user(&m, udata, sizeof(m))) return -EFAULT; - if ((m.num <= 0) || (m.num > (INT_MAX >> PAGE_SHIFT))) + if ((m.num <= 0) || (m.num > (LONG_MAX >> PAGE_SHIFT))) return -EINVAL; down_read(&mm->mmap_sem); @@ -191,7 +191,8 @@ static int privcmd_ioctl(struct inode *inode, struct file *file, vma = find_vma(mm, m.addr); if (!vma || (m.addr != vma->vm_start) || - ((m.addr + (m.num<<PAGE_SHIFT)) != vma->vm_end) || + ((m.addr + ((unsigned long)m.num<<PAGE_SHIFT)) != + vma->vm_end) || !privcmd_enforce_singleshot_mapping(vma)) { up_read(&mm->mmap_sem); return -EINVAL; |