diff options
| author | Keir Fraser <keir.fraser@citrix.com> | 2010-06-04 10:39:03 +0100 |
|---|---|---|
| committer | Keir Fraser <keir.fraser@citrix.com> | 2010-06-04 10:39:03 +0100 |
| commit | 525ed1c0a9aa4b120174962f348076b7b0256e40 (patch) | |
| tree | 18be207decddef590e599387181374d98677f52a | |
| parent | 78210cee6d119c6781d7eb935f561d479d367a47 (diff) | |
| download | xen-525ed1c0a9aa4b120174962f348076b7b0256e40.tar.gz xen-525ed1c0a9aa4b120174962f348076b7b0256e40.tar.bz2 xen-525ed1c0a9aa4b120174962f348076b7b0256e40.zip | |
x86: Fix guest-pointer-array memmove in __pirq_guest_unbind().
Thanks to Alex Zeffert for finding this.
Signed-off-by: Keir Fraser <keir.fraser@citrix.com>
xen-unstable changeset: 21492:96917cf25bf3
xen-unstable date: Fri May 28 10:54:07 2010 +0100
| -rw-r--r-- | xen/arch/x86/irq.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c index c0b4f2289d..36ad05f631 100644 --- a/xen/arch/x86/irq.c +++ b/xen/arch/x86/irq.c @@ -1242,7 +1242,8 @@ static irq_guest_action_t *__pirq_guest_unbind( for ( i = 0; (i < action->nr_guests) && (action->guest[i] != d); i++ ) continue; BUG_ON(i == action->nr_guests); - memmove(&action->guest[i], &action->guest[i+1], IRQ_MAX_GUESTS-i-1); + memmove(&action->guest[i], &action->guest[i+1], + (action->nr_guests-i-1) * sizeof(action->guest[0])); action->nr_guests--; switch ( action->ack_type ) |