[Xen-changelog] [xen stable-4.9] x86/E820: don't overrun array

[patchbot@xxxxxxx]

commit f559d506f321ba6b6464a42881cf8fb516daebe1
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Wed Jan 17 17:02:43 2018 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Wed Jan 17 17:02:43 2018 +0100

    x86/E820: don't overrun array
    
    The bounds check needs to be done after the increment, not before, or
    else it needs to use a one lower immediate. Also use word operations
    rather than byte ones for both the increment and the compare (allowing
    E820_BIOS_MAX to be more easily bumped, should the need ever arise).
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    master commit: 0036c9dbcd8b52316aeebb475929d3a36cf5e514
    master date: 2018-01-03 11:03:56 +0100
---
 xen/arch/x86/boot/mem.S | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/boot/mem.S b/xen/arch/x86/boot/mem.S
index 4b1fa4d..ca90db0 100644
--- a/xen/arch/x86/boot/mem.S
+++ b/xen/arch/x86/boot/mem.S
@@ -22,11 +22,10 @@ get_memory_map:
         cmpl    $SMAP,%eax                      # check the return is `SMAP'
         jne     .Lmem88
 
-        movb    bootsym(e820nr),%al             # up to 128 entries
-        cmpb    $E820_BIOS_MAX,%al
+        incw    bootsym(e820nr)
+        cmpw    $E820_BIOS_MAX,bootsym(e820nr)  # up to this many entries
         jae     .Lmem88
 
-        incb    bootsym(e820nr)
         movw    %di,%ax
         addw    $20,%ax
         movw    %ax,%di
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.9

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog