fix compat memory exchange op splitting

A shift with a negative count was erroneously used here, yielding
undefined behavior.

Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>

diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
index e0fc20524cd0bc8eda25382d863c50417a7860b5..caa24ccbe6a7ee6af32b888adcb88872c1e2c6fa 100644 (file)
--- a/xen/common/compat/memory.c
+++ b/xen/common/compat/memory.c
@@ -172,7 +172,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat)
                 if ( order_delta >= 0 )
                     nat.xchg->out.nr_extents = end_extent >> order_delta;
                 else
-                    nat.xchg->out.nr_extents = end_extent << order_delta;
+                    nat.xchg->out.nr_extents = end_extent << -order_delta;
                 ++split;
             }