Re: xen/mmu: Copy and revector the P2M tree.

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Konrad Rzeszutek Wilk,

The patch 7f9140626c75: "xen/mmu: Copy and revector the P2M tree."
from Jul 26, 2012, leads to the following static checker warning:

	arch/x86/xen/mmu.c:1105 xen_cleanhighmap()
	warn: potential pointer math issue ('level2_kernel_pgt' is pointer to unsigned long)

arch/x86/xen/mmu.c
  1096  #ifdef CONFIG_X86_64
  1097  static void __init xen_cleanhighmap(unsigned long vaddr,
  1098                                      unsigned long vaddr_end)
  1099  {
  1100          unsigned long kernel_end = roundup((unsigned long)_brk_end, PMD_SIZE) - 1;
  1101          pmd_t *pmd = level2_kernel_pgt + pmd_index(vaddr);
  1102  
  1103          /* NOTE: The loop is more greedy than the cleanup_highmap variant.
  1104           * We include the PMD passed in on _both_ boundaries. */
  1105          for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE));
                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
This pointer math is weird because we typically think of PAGE_SIZE as
a number of bytes but since level2_kernel_pgt is a pointer to unsigned
long, it looks like this loop can go through more iterations than
intended.

  1106                          pmd++, vaddr += PMD_SIZE) {
  1107                  if (pmd_none(*pmd))
  1108                          continue;
  1109                  if (vaddr < (unsigned long) _text || vaddr > kernel_end)
  1110                          set_pmd(pmd, __pmd(0));
  1111          }
  1112          /* In case we did something silly, we should crash in this function
  1113           * instead of somewhere later and be confusing. */
  1114          xen_mc_flush();
  1115  }

regards,
dan carpenter