From mboxrd@z Thu Jan  1 00:00:00 1970
From: Andrew Cooper <andrew.cooper3@citrix.com>
Subject: Re: [PATCH] gnttab: fix out of range shift count
Date: Wed, 17 Jun 2015 16:27:59 +0100
Message-ID: <558191FF.9080804@citrix.com>
References: <5581ADBC020000780008647D@mail.emea.novell.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Received: from mail6.bemta14.messagelabs.com ([193.109.254.103])
	by lists.xen.org with esmtp (Exim 4.72)
	(envelope-from <prvs=60365ba9d=Andrew.Cooper3@citrix.com>)
	id 1Z5FG5-0000lO-13
	for xen-devel@lists.xenproject.org; Wed, 17 Jun 2015 15:28:09 +0000
In-Reply-To: <5581ADBC020000780008647D@mail.emea.novell.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: Jan Beulich <JBeulich@suse.com>, xen-devel <xen-devel@lists.xenproject.org>
Cc: Ian Campbell <Ian.Campbell@eu.citrix.com>, Keir Fraser <keir@xen.org>, Ian Jackson <Ian.Jackson@eu.citrix.com>, Tim Deegan <tim@xen.org>
List-Id: xen-devel@lists.xenproject.org

On 17/06/15 16:26, Jan Beulich wrote:
> Commit 213f145114 ("gnttab: fix/adjust gnttab_transfer()") wasn't
> careful enough in this regard.
>
> Coverity ID: 1306859
> Signed-off-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

>
> --- a/xen/common/grant_table.c
> +++ b/xen/common/grant_table.c
> @@ -1726,7 +1726,8 @@ gnttab_transfer(
>          max_bitsize = domain_clamp_alloc_bitsize(
>              e, e->grant_table->gt_version > 1 || paging_mode_translate(e)
>                 ? BITS_PER_LONG + PAGE_SHIFT : 32 + PAGE_SHIFT);
> -        if ( (1UL << (max_bitsize - PAGE_SHIFT)) <= mfn )
> +        if ( max_bitsize < BITS_PER_LONG + PAGE_SHIFT &&
> +             (mfn >> (max_bitsize - PAGE_SHIFT)) )
>          {
>              struct page_info *new_page;
>  
>
>
>