32 lines
1.2 KiB
Diff
32 lines
1.2 KiB
Diff
# HG changeset patch
|
|
# User Keir Fraser <keir.fraser@citrix.com>
|
|
# Date 1227111099 0
|
|
# Node ID bddd2d344c5425bfd25564bc20f90c3776552c6e
|
|
# Parent 4107618ee0d8aceb517f43ffa79197a041ed4bcf
|
|
x86: secure ioapic_guest_write() against FREE_TO_ASSIGN irq values
|
|
|
|
Signed-off-by: Jan Beulich <jbeulich@novell.com>
|
|
|
|
Index: xen-3.3.1-testing/xen/arch/x86/io_apic.c
|
|
===================================================================
|
|
--- xen-3.3.1-testing.orig/xen/arch/x86/io_apic.c
|
|
+++ xen-3.3.1-testing/xen/arch/x86/io_apic.c
|
|
@@ -2196,7 +2196,7 @@ int ioapic_guest_write(unsigned long phy
|
|
if ( new_rte.vector >= FIRST_DYNAMIC_VECTOR )
|
|
new_irq = vector_irq[new_rte.vector];
|
|
|
|
- if ( (old_irq != new_irq) && (old_irq != -1) && IO_APIC_IRQ(old_irq) )
|
|
+ if ( (old_irq != new_irq) && (old_irq >= 0) && IO_APIC_IRQ(old_irq) )
|
|
{
|
|
if ( irq_desc[IO_APIC_VECTOR(old_irq)].action )
|
|
{
|
|
@@ -2208,7 +2208,7 @@ int ioapic_guest_write(unsigned long phy
|
|
remove_pin_at_irq(old_irq, apic, pin);
|
|
}
|
|
|
|
- if ( (new_irq != -1) && IO_APIC_IRQ(new_irq) )
|
|
+ if ( (new_irq >= 0) && IO_APIC_IRQ(new_irq) )
|
|
{
|
|
if ( irq_desc[IO_APIC_VECTOR(new_irq)].action )
|
|
{
|