From f832a2ef4a13dffbb56f74183a794ff58f5cc0ab Mon Sep 17 00:00:00 2001 From: Andrew Cooper Date: Tue, 6 Dec 2011 10:53:12 +0000 Subject: [PATCH] KEXEC: fix kexec_get_range_compat to fail vocally. Fail with -ERANGE rather than silently truncating 64bit values (a physical address and size) into 32bit integers for dom0 to consume. Signed-off-by: Andrew Cooper Simplify the bitwise arithmetic a bit. Signed-off-by: Keir Fraser xen-unstable changeset: 24358:9961a6d5356a xen-unstable date: Mon Dec 05 19:42:46 2011 +0000 --- xen/common/kexec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/common/kexec.c b/xen/common/kexec.c index bddf23c535..c956a07787 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -395,6 +395,10 @@ static int kexec_get_range_compat(XEN_GUEST_HANDLE(void) uarg) ret = kexec_get_range_internal(&range); + /* Dont silently truncate physical addresses or sizes. */ + if ( (range.start | range.size) & ~(unsigned long)(~0u) ) + return -ERANGE; + if ( ret == 0 ) { XLAT_kexec_range(&compat_range, &range); if ( unlikely(copy_to_guest(uarg, &compat_range, 1)) )