From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Wed, 28 Jan 2015 15:52:35 +0000 (+0000)
Subject: tools/libxc: Don't leave scratch_pfn uninitialised if the domain has no memory
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~3808
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/success//%22http:/www.example.com/cgi/success/?a=commitdiff_plain;h=5b0447f647b1031595d24a8a50b362726c887d12;p=xen.git

tools/libxc: Don't leave scratch_pfn uninitialised if the domain has no memory

c/s 5b5c40c0d1 "libxc: introduce a per architecture scratch pfn for temporary
grant mapping" accidentally an issue whereby there were two paths out of
xc_core_arch_get_scratch_gpfn() which returned 0, but only one of which
assigned a value to the gpfn parameter.

xc_domain_maximum_gpfn() can validly return 0, at which point gpfn 1 is a
valid scratch page to use.

In addition, widen rc before adding 1 and possibly overflowing.

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
CC: Julien Grall <julien.grall@linaro.org>
CC: Jan Beulich <JBeulich@suse.com>
CC: Ian Campbell <Ian.Campbell@citrix.com>
CC: Ian Jackson <Ian.Jackson@eu.citrix.com>
CC: Wei Liu <wei.liu2@citrix.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
---

diff --git a/tools/libxc/xc_core_x86.c b/tools/libxc/xc_core_x86.c
index fac99ec947..d8846f1fc5 100644
--- a/tools/libxc/xc_core_x86.c
+++ b/tools/libxc/xc_core_x86.c
@@ -214,10 +214,10 @@ xc_core_arch_get_scratch_gpfn(xc_interface *xch, domid_t domid,
 
     rc = xc_domain_maximum_gpfn(xch, domid);
 
-    if ( rc <= 0 )
+    if ( rc < 0 )
         return rc;
 
-    *gpfn = rc + 1;
+    *gpfn = (xen_pfn_t)rc + 1;
 
     return 0;
 }