Jan Beulich
2008-Nov-19 16:05 UTC
[Xen-devel] [PATCH] x86: secure ioapic_guest_write() against FREE_TO_ASSIGN irq values
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Index: 2008-10-27/xen/arch/x86/io_apic.c
==================================================================---
2008-10-27.orig/xen/arch/x86/io_apic.c 2008-11-19 15:41:31.000000000 +0100
+++ 2008-10-27/xen/arch/x86/io_apic.c 2008-11-19 16:56:51.000000000 +0100
@@ -2186,7 +2186,7 @@ int ioapic_guest_write(unsigned long phy
if ( new_rte.vector >= FIRST_DYNAMIC_VECTOR )
new_irq = vector_irq[new_rte.vector];
- if ( (old_irq != new_irq) && (old_irq != -1) &&
IO_APIC_IRQ(old_irq) )
+ if ( (old_irq != new_irq) && (old_irq >= 0) &&
IO_APIC_IRQ(old_irq) )
{
if ( irq_desc[IO_APIC_VECTOR(old_irq)].action )
{
@@ -2198,7 +2198,7 @@ int ioapic_guest_write(unsigned long phy
remove_pin_at_irq(old_irq, apic, pin);
}
- if ( (new_irq != -1) && IO_APIC_IRQ(new_irq) )
+ if ( (new_irq >= 0) && IO_APIC_IRQ(new_irq) )
{
if ( irq_desc[IO_APIC_VECTOR(new_irq)].action )
{
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xensource.com
http://lists.xensource.com/xen-devel