xen/arm: lr must be included in range [0-nr_lr(

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/xen/arch/arm/gic.c b/xen/arch/arm/gic.c
index 9ebfebea234f878712d73d36e8492dd1cc7c78e2..dd902d293cad7aba392455b4fb93fea3c7cd2fe6 100644 (file)
--- a/xen/arch/arm/gic.c
+++ b/xen/arch/arm/gic.c
@@ -510,7 +510,9 @@ static inline void gic_set_lr(int lr, unsigned int virtual_irq,
 {
     int maintenance_int = GICH_LR_MAINTENANCE_IRQ;
 
-    BUG_ON(lr > nr_lrs);
+    BUG_ON(lr >= nr_lrs);
+    BUG_ON(lr < 0);
+    BUG_ON(state & ~(GICH_LR_STATE_MASK<<GICH_LR_STATE_SHIFT));
 
     GICH[GICH_LR + lr] = state |
         maintenance_int |