diff options
| author | Jan Beulich <jbeulich@suse.com> | 2013-03-01 16:59:49 +0100 |
|---|---|---|
| committer | Jan Beulich <jbeulich@suse.com> | 2013-03-01 16:59:49 +0100 |
| commit | 53decd322157e922cac2988e07da6d39538c8033 (patch) | |
| tree | d84275b42c6139f6b08412d08aa2db325aaceb70 /xen/common/compat | |
| parent | 2f80ac9c0e8fe117b3e9cf71f799b482c6ca312f (diff) | |
| download | xen-53decd322157e922cac2988e07da6d39538c8033.tar.gz xen-53decd322157e922cac2988e07da6d39538c8033.tar.bz2 xen-53decd322157e922cac2988e07da6d39538c8033.zip | |
fix compat memory exchange op splitting
A shift with a negative count was erroneously used here, yielding
undefined behavior.
Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
Diffstat (limited to 'xen/common/compat')
| -rw-r--r-- | xen/common/compat/memory.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c index e0fc20524c..caa24ccbe6 100644 --- a/xen/common/compat/memory.c +++ b/xen/common/compat/memory.c @@ -172,7 +172,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat) if ( order_delta >= 0 ) nat.xchg->out.nr_extents = end_extent >> order_delta; else - nat.xchg->out.nr_extents = end_extent << order_delta; + nat.xchg->out.nr_extents = end_extent << -order_delta; ++split; } |