From: Jan Beulich <jbeulich@suse.com>
Date: Wed, 25 Nov 2020 13:07:36 +0000 (+0100)
Subject: mm: check for truncation in vmalloc_type()
X-Git-Tag: archive/raspbian/4.16.0+51-g0941d6cb-1+rpi1~2^2~42^2~1381
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=500516fcb9e1c09eae9bbbd3b30bb294c6993853;p=xen.git

mm: check for truncation in vmalloc_type()

While it's currently implied from the checking xmalloc_array() does,
let's make this more explicit in the function itself. As a result both
involved local variables don't need to have size_t type anymore. This
brings them in line with the rest of the code in this file.

Requested-by: Julien Grall <julien@xen.org>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Julien Grall <jgrall@amazon.com>
---

diff --git a/xen/common/vmap.c b/xen/common/vmap.c
index faebc1ddf1..4fd6b3067e 100644
--- a/xen/common/vmap.c
+++ b/xen/common/vmap.c
@@ -242,13 +242,15 @@ void vunmap(const void *va)
 static void *vmalloc_type(size_t size, enum vmap_region type)
 {
     mfn_t *mfn;
-    size_t pages, i;
+    unsigned int i, pages = PFN_UP(size);
     struct page_info *pg;
     void *va;
 
     ASSERT(size);
 
-    pages = PFN_UP(size);
+    if ( PFN_DOWN(size) > pages )
+        return NULL;
+
     mfn = xmalloc_array(mfn_t, pages);
     if ( mfn == NULL )
         return NULL;