[Xen-devel] [PATCH] xen: Fix memory hotplug epfn upper limit test for updating the compat M2P table

[Malcolm Crossley <malcolm.crossley@xxxxxxxxxx>]

The epfn is being compared to (RDWR_COMPAT_MPT_VIRT_END - 
RDWR_COMPAT_MPT_VIRT_START) without a 2 bit shift, resulting in the epfn being 
compared to the size of the RDWR_COMPAT_MPT table in bytes instead of the 
maximum page frame number that the RDWR_COMPAT_MPT table can map.

Signed-off-by: Malcolm Crossley <malcolm.crossley@xxxxxxxxxx>

diff -r 274e5accd62d -r 8b1e0a2ccd7f xen/arch/x86/x86_64/mm.c
--- a/xen/arch/x86/x86_64/mm.c
+++ b/xen/arch/x86/x86_64/mm.c
@@ -454,7 +454,7 @@ static int setup_compat_m2p_table(struct
     if   ((smap > ((RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 
2)) )
         return 0;
 
-    if (epfn > (RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START))
+    if ( epfn > ((RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2) 
)
         epfn = (RDWR_COMPAT_MPT_VIRT_END - RDWR_COMPAT_MPT_VIRT_START) >> 2;
 
     emap = ( (epfn + ((1UL << (L2_PAGETABLE_SHIFT - 2)) - 1 )) &

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel