[PATCH 1/1] x86/hvm: prevent hvm_free_ioreq_gmfn() clobber of arbitrary memory

[Don Slutz <dslutz@verizon.com>]

This will prevent a hard to track down bug.  It is related to

commit ffdb781883abd3215287ba1b1853f3d437d1240c
x86/hvm: prevent gcc uninitialised var warning

Which will preset "gmfn" to ~0UL.

This code will check if there is a path where bufioreq_pfn is passed
to hvm_free_ioreq_gmfn() and it is uninitialised, the BUG_ON will
report it.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Don Slutz <dslutz@verizon.com>
---
 xen/arch/x86/hvm/hvm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index ade99c0..0abac7c 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -536,8 +536,9 @@ static int hvm_alloc_ioreq_gmfn(struct domain *d, unsigned long *gmfn)
 
 static void hvm_free_ioreq_gmfn(struct domain *d, unsigned long gmfn)
 {
-    unsigned int i = gmfn - d->arch.hvm_domain.ioreq_gmfn.base;
+    unsigned long i = gmfn - d->arch.hvm_domain.ioreq_gmfn.base;
 
+    BUG_ON(i >= sizeof(d->arch.hvm_domain.ioreq_gmfn.mask) * 8);
     clear_bit(i, &d->arch.hvm_domain.ioreq_gmfn.mask);
 }
 
-- 
1.8.4