[Xen-changelog] [xen-unstable] x86: secure ioapic_guest_write() against FREE_TO_ASSIGN irq values

[Xen patchbot-unstable <patchbot-unstable@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1227111099 0
# Node ID bddd2d344c5425bfd25564bc20f90c3776552c6e
# Parent  4107618ee0d8aceb517f43ffa79197a041ed4bcf
x86: secure ioapic_guest_write() against FREE_TO_ASSIGN irq values

Signed-off-by: Jan Beulich <jbeulich@xxxxxxxxxx>
---
 xen/arch/x86/io_apic.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff -r 4107618ee0d8 -r bddd2d344c54 xen/arch/x86/io_apic.c
--- a/xen/arch/x86/io_apic.c    Wed Nov 19 16:10:39 2008 +0000
+++ b/xen/arch/x86/io_apic.c    Wed Nov 19 16:11:39 2008 +0000
@@ -2196,7 +2196,7 @@ int ioapic_guest_write(unsigned long phy
     if ( new_rte.vector >= FIRST_DYNAMIC_VECTOR )
         new_irq = vector_irq[new_rte.vector];
 
-    if ( (old_irq != new_irq) && (old_irq != -1) && IO_APIC_IRQ(old_irq) )
+    if ( (old_irq != new_irq) && (old_irq >= 0) && IO_APIC_IRQ(old_irq) )
     {
         if ( irq_desc[IO_APIC_VECTOR(old_irq)].action )
         {
@@ -2208,7 +2208,7 @@ int ioapic_guest_write(unsigned long phy
         remove_pin_at_irq(old_irq, apic, pin);
     }
 
-    if ( (new_irq != -1) && IO_APIC_IRQ(new_irq) )
+    if ( (new_irq >= 0) && IO_APIC_IRQ(new_irq) )
     {
         if ( irq_desc[IO_APIC_VECTOR(new_irq)].action )
         {

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog