xen/51ffd577-fix-off-by-one-mistakes-in-vm_alloc.patch
Charles Arnold 73291eb01a - bnc#836239 - SLES 11 SP3 Xen security patch does not
automatically update UEFI boot binary
  xen.spec

- Upstream patches from Jan
  51d5334e-x86-mm-Ensure-useful-progress-in-alloc_l2_table.patch
  51dd155c-adjust-x86-EFI-build.patch
  51e63d80-x86-cpuidle-Change-logging-for-unknown-APIC-IDs.patch
  51e6540d-x86-don-t-use-destroy_xen_mappings-for-vunmap.patch
  51e7963f-x86-time-Update-wallclock-in-shared-info-when-altering-domain-time-offset.patch
  51ffd577-fix-off-by-one-mistakes-in-vm_alloc.patch
  51ffd5fd-x86-refine-FPU-selector-handling-code-for-XSAVEOPT.patch
  520114bb-Nested-VMX-Flush-TLBs-and-Caches-if-paging-mode-changed.patch
  520a5504-VMX-add-boot-parameter-to-enable-disable-APIC-v-dynamically.patch
  520a24f6-x86-AMD-Fix-nested-svm-crash-due-to-assertion-in-__virt_to_maddr.patch
  520a2570-x86-AMD-Inject-GP-instead-of-UD-when-unable-to-map-vmcb.patch
  520b4b60-VT-d-protect-against-bogus-information-coming-from-BIOS.patch
  520b4bda-x86-MTRR-fix-range-check-in-mtrr_add_page.patch
  520cb8b6-x86-time-fix-check-for-negative-time-in-__update_vcpu_system_time.patch
  520d417d-xen-Add-stdbool.h-workaround-for-BSD.patch

OBS-URL: https://build.opensuse.org/package/show/Virtualization/xen?expand=0&rev=266
2013-08-29 18:19:23 +00:00

63 lines
2.0 KiB
Diff

# Commit b0e55bd49725c7c0183eb18670997b9e5930adac
# Date 2013-08-05 18:40:23 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
fix off-by-one mistakes in vm_alloc()
Also add another pair of assertions to catch eventual further cases of
incorrect accounting.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Keir Fraser <keir@xen.org>
--- a/xen/common/vmap.c
+++ b/xen/common/vmap.c
@@ -57,8 +57,8 @@ void *vm_alloc(unsigned int nr, unsigned
{
struct page_info *pg;
- ASSERT(!test_bit(vm_low, vm_bitmap));
- for ( start = vm_low; ; )
+ ASSERT(vm_low == vm_top || !test_bit(vm_low, vm_bitmap));
+ for ( start = vm_low; start < vm_top; )
{
bit = find_next_bit(vm_bitmap, vm_top, start + 1);
if ( bit > vm_top )
@@ -68,12 +68,18 @@ void *vm_alloc(unsigned int nr, unsigned
* corresponding page a guard one.
*/
start = (start + align) & ~(align - 1);
- if ( start + nr <= bit )
- break;
- start = bit < vm_top ?
- find_next_zero_bit(vm_bitmap, vm_top, bit + 1) : bit;
- if ( start >= vm_top )
- break;
+ if ( bit < vm_top )
+ {
+ if ( start + nr < bit )
+ break;
+ start = find_next_zero_bit(vm_bitmap, vm_top, bit + 1);
+ }
+ else
+ {
+ if ( start + nr <= bit )
+ break;
+ start = bit;
+ }
}
if ( start < vm_top )
@@ -115,6 +121,10 @@ void *vm_alloc(unsigned int nr, unsigned
for ( bit = start; bit < start + nr; ++bit )
__set_bit(bit, vm_bitmap);
+ if ( bit < vm_top )
+ ASSERT(!test_bit(bit, vm_bitmap));
+ else
+ ASSERT(bit == vm_top);
if ( start <= vm_low + 2 )
vm_low = bit;
spin_unlock(&vm_lock);