From mboxrd@z Thu Jan 1 00:00:00 1970 From: Don Slutz Subject: [PATCH 1/1] x86/hvm: prevent hvm_free_ioreq_gmfn() clobber of arbitrary memory Date: Mon, 13 Apr 2015 12:01:43 -0400 Message-ID: <1428940903-18302-1-git-send-email-dslutz@verizon.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xen.org Errors-To: xen-devel-bounces@lists.xen.org To: xen-devel@lists.xen.org Cc: Andrew Cooper , Keir Fraser , Don Slutz , Jan Beulich List-Id: xen-devel@lists.xenproject.org This will prevent a hard to track down bug. It is related to commit ffdb781883abd3215287ba1b1853f3d437d1240c x86/hvm: prevent gcc uninitialised var warning Which will preset "gmfn" to ~0UL. This code will check if there is a path where bufioreq_pfn is passed to hvm_free_ioreq_gmfn() and it is uninitialised, the BUG_ON will report it. Reported-by: Andrew Cooper Signed-off-by: Don Slutz --- xen/arch/x86/hvm/hvm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c index ade99c0..0abac7c 100644 --- a/xen/arch/x86/hvm/hvm.c +++ b/xen/arch/x86/hvm/hvm.c @@ -536,8 +536,9 @@ static int hvm_alloc_ioreq_gmfn(struct domain *d, unsigned long *gmfn) static void hvm_free_ioreq_gmfn(struct domain *d, unsigned long gmfn) { - unsigned int i = gmfn - d->arch.hvm_domain.ioreq_gmfn.base; + unsigned long i = gmfn - d->arch.hvm_domain.ioreq_gmfn.base; + BUG_ON(i >= sizeof(d->arch.hvm_domain.ioreq_gmfn.mask) * 8); clear_bit(i, &d->arch.hvm_domain.ioreq_gmfn.mask); } -- 1.8.4