diff options
| author | Jan Beulich <jbeulich@suse.com> | 2013-03-12 16:23:55 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-03-12 16:23:55 +0100 |
| commit | 6b2f399604ba0d46203855658b72b9fcba76a7ac (patch) | |
| tree | 2f2df2383b14f32ad9aac58332cf7c28d3c88b07 | |
| parent | 0ad719247a5072f3a1af6c77faf203e724acf2fd (diff) | |
| download | xen-6b2f399604ba0d46203855658b72b9fcba76a7ac.tar.gz xen-6b2f399604ba0d46203855658b72b9fcba76a7ac.tar.bz2 xen-6b2f399604ba0d46203855658b72b9fcba76a7ac.zip | |
fix compat memory exchange op splitting
A shift with a negative count was erroneously used here, yielding
undefined behavior.
Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
master changeset: 53decd322157e922cac2988e07da6d39538c8033
master date: 2013-03-01 16:59:49 +0100
| -rw-r--r-- | xen/common/compat/memory.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index 1d877fc021..5f494eb1b1 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -171,7 +171,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat) if ( order_delta >= 0 ) nat.xchg->out.nr_extents = end_extent >> order_delta; else - nat.xchg->out.nr_extents = end_extent << order_delta; + nat.xchg->out.nr_extents = end_extent << -order_delta; ++split; } |