From: Jan Beulich <jbeulich@suse.com>
Date: Fri, 1 Mar 2013 15:59:49 +0000 (+0100)
Subject: fix compat memory exchange op splitting
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~7152
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=53decd322157e922cac2988e07da6d39538c8033;p=xen.git

fix compat memory exchange op splitting

A shift with a negative count was erroneously used here, yielding
undefined behavior.

Reported-by: Xi Wang <xi@mit.edu>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Keir Fraser <keir@xen.org>
---

diff --git a/xen/common/compat/memory.c b/xen/common/compat/memory.c
index e0fc20524c..caa24ccbe6 100644
--- a/xen/common/compat/memory.c
+++ b/xen/common/compat/memory.c
@@ -172,7 +172,7 @@ int compat_memory_op(unsigned int cmd, XEN_GUEST_HANDLE_PARAM(void) compat)
                 if ( order_delta >= 0 )
                     nat.xchg->out.nr_extents = end_extent >> order_delta;
                 else
-                    nat.xchg->out.nr_extents = end_extent << order_delta;
+                    nat.xchg->out.nr_extents = end_extent << -order_delta;
                 ++split;
             }