Fix xencomm_copy_{from, to}_guest.

It should not call paddr_to_maddr() with invalid address.

Signed-off-by: Isaku Yamahata <yamahata@valinux.co.jp>

diff --git a/xen/common/xencomm.c b/xen/common/xencomm.c
index f33c753934b6310fd1b451bf73daedd5edca2a21..8b7e502869af1c3f411903cbb036c4967ce382b6 100644 (file)
--- a/xen/common/xencomm.c
+++ b/xen/common/xencomm.c
@@ -119,7 +119,7 @@ xencomm_copy_from_guest(void *to, const void *from, unsigned int n,
         chunksz -= chunk_skip;
         skip -= chunk_skip;
 
-        if (skip == 0) {
+        if (skip == 0 && chunksz > 0) {
             unsigned long src_maddr;
             unsigned long dest = (unsigned long)to + to_pos;
             unsigned int bytes = min(chunksz, n - to_pos);
@@ -225,7 +225,7 @@ xencomm_copy_to_guest(void *to, const void *from, unsigned int n,
         chunksz -= chunk_skip;
         skip -= chunk_skip;
 
-        if (skip == 0) {
+        if (skip == 0 && chunksz > 0) {
             unsigned long dest_maddr;
             unsigned long source = (unsigned long)from + from_pos;
             unsigned int bytes = min(chunksz, n - from_pos);