From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Yang, Xiaowei" <xiaowei.yang@intel.com>
Subject: [PATCH] Fix possible variable overflow in NUMA code
Date: Thu, 23 Apr 2009 17:58:30 +0800
Message-ID: <49F03BC6.7050901@intel.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: "xen-devel@lists.xensource.com" <xen-devel@lists.xensource.com>
List-Id: xen-devel@lists.xenproject.org

On PAE system, when "<<" operation is used on type "long" to get a 64-bit value, the 
result could be overflowed.

Signed-off-by: Yang Xiaowei <xiaowei.yang@intel.com>

Thanks,
xiaowei


diff -r dd91d71d4eca xen/arch/x86/numa.c
--- a/xen/arch/x86/numa.c       Tue Apr 21 17:03:23 2009 +0800
+++ b/xen/arch/x86/numa.c       Thu Apr 23 13:57:17 2009 +0800
@@ -74,7 +74,7 @@ populate_memnodemap(const struct node *n
                         if (memnodemap[addr >> shift] != 0xff)
                                 return -1;
                         memnodemap[addr >> shift] = i;
-                       addr += (1UL << shift);
+                       addr += (1ULL << shift);
                 } while (addr < end);
                 res = 1;
         }
@@ -290,7 +290,7 @@ static void dump_numa(unsigned char key)
                   (u32)(now>>32), (u32)now);

         for_each_online_node(i) {
-               paddr_t pa = (NODE_DATA(i)->node_start_pfn + 1)<< PAGE_SHIFT;
+               paddr_t pa = (paddr_t)(NODE_DATA(i)->node_start_pfn + 1) << PAGE_SHIFT;
                 printk("idx%d -> NODE%d start->%lu size->%lu\n",
                           i, NODE_DATA(i)->node_id,
                           NODE_DATA(i)->node_start_pfn,
@@ -314,7 +314,7 @@ static void dump_numa(unsigned char key)

                 page_list_for_each(page, &d->page_list)
                 {
-                       i = phys_to_nid(page_to_mfn(page) << PAGE_SHIFT);
+                       i = phys_to_nid((paddr_t)page_to_mfn(page) << PAGE_SHIFT);
                         page_num_node[i]++;
                 }