File 5db2b4a2-x86-is_xen_fixed_mfn-off-by-1.patch of Package xen.13142
# Commit 9633929824204ca7a6d60d083466de79993d60f1
# Date 2019-10-25 10:38:58 +0200
# Author Jan Beulich <jbeulich@suse.com>
# Committer Jan Beulich <jbeulich@suse.com>
x86: fix off-by-one in is_xen_fixed_mfn()
__2M_rwdata_end marks the first byte after the Xen image, not its last
byte. Subtract 1 to obtain the upper bound to compare against. (Note
that instead switching from <= to < is less desirable, as in principle
__pa() might return rubbish for addresses outside of the Xen image.)
Since the & needs to be dropped from the line in question, also drop it
from the adjacent one.
Reported-by: Julien Grall <julien.grall@arm.com>
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Andrew Cooper <andrew.cooper3@citrix.com>
--- a/xen/include/asm-x86/mm.h
+++ b/xen/include/asm-x86/mm.h
@@ -280,8 +280,8 @@ struct page_info
#define is_xen_heap_mfn(mfn) \
(__mfn_valid(mfn) && is_xen_heap_page(mfn_to_page(_mfn(mfn))))
#define is_xen_fixed_mfn(mfn) \
- ((((mfn) << PAGE_SHIFT) >= __pa(&_stext)) && \
- (((mfn) << PAGE_SHIFT) <= __pa(&__2M_rwdata_end)))
+ ((((mfn) << PAGE_SHIFT) >= __pa(_stext)) && \
+ (((mfn) << PAGE_SHIFT) <= __pa(__2M_rwdata_end - 1)))
#define PRtype_info "016lx"/* should only be used for printk's */