[Xen-changelog] [xen-4.0-testing] x86: Fix guest-pointer-array memmove in __pirq_guest_unbind().

["Xen patchbot-4.0-testing" <patchbot-4.0-testing@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User Keir Fraser <keir.fraser@xxxxxxxxxx>
# Date 1275644343 -3600
# Node ID 54e05a3f773da5b7b85db33ecc058f33e4dbf05e
# Parent  104e6ab14f40edb4e5934664670db319f20802c8
x86: Fix guest-pointer-array memmove in __pirq_guest_unbind().

Thanks to Alex Zeffert for finding this.

Signed-off-by: Keir Fraser <keir.fraser@xxxxxxxxxx>
xen-unstable changeset:   21492:96917cf25bf3
xen-unstable date:        Fri May 28 10:54:07 2010 +0100
---
 xen/arch/x86/irq.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletion(-)

diff -r 104e6ab14f40 -r 54e05a3f773d xen/arch/x86/irq.c
--- a/xen/arch/x86/irq.c        Fri Jun 04 10:38:21 2010 +0100
+++ b/xen/arch/x86/irq.c        Fri Jun 04 10:39:03 2010 +0100
@@ -1242,7 +1242,8 @@ static irq_guest_action_t *__pirq_guest_
     for ( i = 0; (i < action->nr_guests) && (action->guest[i] != d); i++ )
         continue;
     BUG_ON(i == action->nr_guests);
-    memmove(&action->guest[i], &action->guest[i+1], IRQ_MAX_GUESTS-i-1);
+    memmove(&action->guest[i], &action->guest[i+1],
+            (action->nr_guests-i-1) * sizeof(action->guest[0]));
     action->nr_guests--;
 
     switch ( action->ack_type )

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog