On Mon, Jun 15, 2015 at 09:50:49AM +0800, Chen, Tiejun wrote:
[...]
> >>+                   uint32_t flag,
> >>+                   uint16_t seg,
> >>+                   uint8_t bus,
> >>+                   uint8_t devfn,
> >>+                   unsigned int *nr_entries)
> >>+{
> >>+    struct xen_reserved_device_memory *xrdm;
> >>+    int rc;
> >>+
> >>+    rc = xc_reserved_device_memory_map(CTX->xch, flag, seg, bus, devfn,
> >>+                                       NULL, nr_entries);
> >
> >xc_reserved_device_memory_map dereferences nr_entries. You need to make
> >sure there is no garbage value in nr_entries. I.e. you need to
> >initialise nr_entries to 0 before passing it in.
> 
> Sure, so what about this?
> 
> /*
>  * We really can't presume how many entries we can get in advance.
>  */
> if (*nr_entries)
>     *nr_entries = 0;
> 

You might just unconditionally set *nr_entries to 0.

Wei.

_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel

Reply via email to