mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 02:01:24 +01:00
[XEN] Off-by one error in range checks translating gfns to mfns
Signed-off-by: Tim Deegan <Tim.Deegan@xensource.com>
This commit is contained in:
tdeegan@york.uk.xensource.com committed
1 parent
cd10a0a308
commit
f2e6577be4
3 files changed
+3
-3
No files matched your search
@@ -1121,7 +1121,7 @@ sh_gfn_to_mfn_foreign(struct domain *d, unsigned long gpfn)
|
||||
|
||||
|
||||
#if CONFIG_PAGING_LEVELS > 2
|
||||
if ( gpfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) )
|
||||
if ( gpfn >= (RO_MPT_VIRT_END-RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) )
|
||||
/* This pfn is higher than the p2m map can hold */
|
||||
return _mfn(INVALID_MFN);
|
||||
#endif
|
||||
|
||||
@@ -555,7 +555,7 @@ vcpu_gfn_to_mfn_nofault(struct vcpu *v, unsigned long gfn)
|
||||
return _mfn(gfn);
|
||||
|
||||
#if CONFIG_PAGING_LEVELS > 2
|
||||
if ( gfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) )
|
||||
if ( gfn >= (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) )
|
||||
/* This pfn is higher than the p2m map can hold */
|
||||
return _mfn(INVALID_MFN);
|
||||
#endif
|
||||
|
||||
@@ -368,7 +368,7 @@ static inline unsigned long get_mfn_from_gpfn(unsigned long pfn)
|
||||
int ret;
|
||||
|
||||
#if CONFIG_PAGING_LEVELS > 2
|
||||
if ( pfn > (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof (l1_pgentry_t) )
|
||||
if ( pfn >= (RO_MPT_VIRT_END - RO_MPT_VIRT_START) / sizeof(l1_pgentry_t) )
|
||||
/* This pfn is higher than the p2m map can hold */
|
||||
return INVALID_MFN;
|
||||
#endif
|
||||
|
||||