diff options
| author | Jan Beulich <jbeulich@suse.com> | 2013-03-12 16:12:52 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-03-12 16:12:52 +0100 |
| commit | 79f0ba3e7dc6176fc44dad5093f981f9a230ac9e (patch) | |
| tree | 56569adf30711800e606fbc5ac58037e4838d9a6 | |
| parent | 590db529d38c872b82b92a5559f8072bec73892e (diff) | |
| download | xen-79f0ba3e7dc6176fc44dad5093f981f9a230ac9e.tar.gz xen-79f0ba3e7dc6176fc44dad5093f981f9a230ac9e.tar.bz2 xen-79f0ba3e7dc6176fc44dad5093f981f9a230ac9e.zip | |
fix compat memory exchange op splitting
A shift with a negative count was erroneously used here, yielding
undefined behavior.
Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
master changeset: 53decd322157e922cac2988e07da6d39538c8033
master date: 2013-03-01 16:59:49 +0100
| -rw-r--r-- | xen/common/compat/memory.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index 308017a95f..1f94d4f9c3 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -172,7 +172,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE(void) compat) if ( order_delta >= 0 ) nat.xchg->out.nr_extents = end_extent >> order_delta; else - nat.xchg->out.nr_extents = end_extent << order_delta; + nat.xchg->out.nr_extents = end_extent << -order_delta; ++split; } |