From 9b156bcc3ffcc7949edd4460b718a241e87ae302 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 24 Nov 2020 14:01:31 +0100 Subject: memory: fix off-by-one in XSA-346 change The comparison against ARRAY_SIZE() needs to be >= in order to avoid overrunning the pages[] array. This is XSA-355. Fixes: 5777a3742d88 ("IOMMU: hold page ref until after deferred TLB flush") Signed-off-by: Jan Beulich Reviewed-by: Julien Grall --- xen/common/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'xen') diff --git a/xen/common/memory.c b/xen/common/memory.c index df85b550a1..2c86934ae8 100644 --- a/xen/common/memory.c +++ b/xen/common/memory.c @@ -854,7 +854,7 @@ int xenmem_add_to_physmap(struct domain *d, struct xen_add_to_physmap *xatp, ++extra.ppage; /* Check for continuation if it's not the last iteration. */ - if ( (++done > ARRAY_SIZE(pages) && extra.ppage) || + if ( (++done >= ARRAY_SIZE(pages) && extra.ppage) || (xatp->size > done && hypercall_preempt_check()) ) { rc = start + done; -- cgit v1.2.3