c/s 5b5c40c0d1 "libxc: introduce a per architecture scratch pfn for temporary
grant mapping" accidentally an issue whereby there were two paths out of
xc_core_arch_get_scratch_gpfn() which returned 0, but only one of which
assigned a value to the gpfn parameter.
xc_domain_maximum_gpfn() can validly return 0, at which point gpfn 1 is a
valid scratch page to use.
In addition, widen rc before adding 1 and possibly overflowing.
Signed-off-by: Andrew Cooper <andrew.coop...@citrix.com>
CC: Julien Grall <julien.gr...@linaro.org>
CC: Jan Beulich <jbeul...@suse.com>
CC: Ian Campbell <ian.campb...@citrix.com>
CC: Ian Jackson <ian.jack...@eu.citrix.com>
CC: Wei Liu <wei.l...@citrix.com>
---
tools/libxc/xc_core_x86.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/libxc/xc_core_x86.c b/tools/libxc/xc_core_x86.c
index fac99ec..d8846f1 100644
--- a/tools/libxc/xc_core_x86.c
+++ b/tools/libxc/xc_core_x86.c
@@ -214,10 +214,10 @@ xc_core_arch_get_scratch_gpfn(xc_interface *xch, domid_t
domid,
rc = xc_domain_maximum_gpfn(xch, domid);
- if ( rc <= 0 )
+ if ( rc < 0 )
return rc;
- *gpfn = rc + 1;
+ *gpfn = (xen_pfn_t)rc + 1;
return 0;
}
--
1.7.10.4
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
