Fix off-by-one error in do_memory_op()'s start_extent range check

Signed-off-by: Jan Beulich <jbeulich@novell.com>

diff --git a/xen/common/memory.c b/xen/common/memory.c
index b1db5f58885aede5a32be8359d2676fa667e9fe4..c7caa074c056021cf6b290bb8c5f98315e1b1e12 100644 (file)
--- a/xen/common/memory.c
+++ b/xen/common/memory.c
@@ -525,7 +525,7 @@ long do_memory_op(unsigned long cmd, XEN_GUEST_HANDLE(void) arg)
         if ( reservation.nr_extents > (ULONG_MAX >> MEMOP_EXTENT_SHIFT) )
             return start_extent;
 
-        if ( unlikely(start_extent > reservation.nr_extents) )
+        if ( unlikely(start_extent >= reservation.nr_extents) )
             return start_extent;
 
         args.extent_list  = reservation.extent_start;