x86: fix bug_line() Due to the packing into a bit field together with a relocated field, the computation can overflow when the relocated field ends up getting a negative value stored. Hence it isn't sufficient to correct the value by 1 in this case, but we also need to mask the result to the width of the original bit field. Signed-off-by: Jan Beulich --- a/xen/include/asm-x86/bug.h +++ b/xen/include/asm-x86/bug.h @@ -15,9 +15,11 @@ struct bug_frame { #define bug_loc(b) ((const void *)(b) + (b)->loc_disp) #define bug_ptr(b) ((const void *)(b) + (b)->ptr_disp) -#define bug_line(b) ((((b)->line_hi + ((b)->loc_disp < 0)) << \ +#define bug_line(b) (((((b)->line_hi + ((b)->loc_disp < 0)) & \ + ((1 << BUG_LINE_HI_WIDTH) - 1)) << \ BUG_LINE_LO_WIDTH) + \ - (b)->line_lo + ((b)->ptr_disp < 0)) + (((b)->line_lo + ((b)->ptr_disp < 0)) & \ + ((1 << BUG_LINE_LO_WIDTH) - 1))) #define bug_msg(b) ((const char *)(b) + (b)->msg_disp[1]) #define BUGFRAME_run_fn 0