From: Jan Beulich Date: Mon, 14 Oct 2013 06:52:18 +0000 (+0200) Subject: x86: fix bug_line() X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~6175 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks:///%22http:/www.example.com/cgi/%22https:/%22bookmarks:/?a=commitdiff_plain;h=48830988a28b7fb1eed225354e25572aa955749a;p=xen.git x86: fix bug_line() Due to the packing into a bit field together with a relocated field, the computation can overflow when the relocated field ends up getting a negative value stored. Hence it isn't sufficient to correct the value by 1 in this case, but we also need to mask the result to the width of the original bit field. Signed-off-by: Jan Beulich Acked-by: Keir Fraser --- diff --git a/xen/include/asm-x86/bug.h b/xen/include/asm-x86/bug.h index 956bfd231f..cd862e31a2 100644 --- a/xen/include/asm-x86/bug.h +++ b/xen/include/asm-x86/bug.h @@ -15,9 +15,11 @@ struct bug_frame { #define bug_loc(b) ((const void *)(b) + (b)->loc_disp) #define bug_ptr(b) ((const void *)(b) + (b)->ptr_disp) -#define bug_line(b) ((((b)->line_hi + ((b)->loc_disp < 0)) << \ +#define bug_line(b) (((((b)->line_hi + ((b)->loc_disp < 0)) & \ + ((1 << BUG_LINE_HI_WIDTH) - 1)) << \ BUG_LINE_LO_WIDTH) + \ - (b)->line_lo + ((b)->ptr_disp < 0)) + (((b)->line_lo + ((b)->ptr_disp < 0)) & \ + ((1 << BUG_LINE_LO_WIDTH) - 1))) #define bug_msg(b) ((const char *)(b) + (b)->msg_disp[1]) #define BUGFRAME_run_fn 0