x86: Fix guest-pointer-array memmove in __pirq_guest_unbind().

Thanks to Alex Zefefrt for finding this.

Signed-off-by: Keir Fraser <keir.fraser@citrix.com>

diff --git a/xen/arch/x86/irq.c b/xen/arch/x86/irq.c
index b18316e7da9c034d51b04988043145d488c747a0..a2e3e5d0ecc782399550e83132222dc8b9d19766 100644 (file)
--- a/xen/arch/x86/irq.c
+++ b/xen/arch/x86/irq.c
@@ -1243,7 +1243,8 @@ static irq_guest_action_t *__pirq_guest_unbind(
     for ( i = 0; (i < action->nr_guests) && (action->guest[i] != d); i++ )
         continue;
     BUG_ON(i == action->nr_guests);
-    memmove(&action->guest[i], &action->guest[i+1], IRQ_MAX_GUESTS-i-1);
+    memmove(&action->guest[i], &action->guest[i+1],
+            (action->nr_guests-i-1) * sizeof(action->guest[0]));
     action->nr_guests--;
 
     switch ( action->ack_type )