Re: [Xen-devel] [PATCH 3/3] domctl: tighten XEN_DOMCTL_*_permission

[Tim Deegan <tim@xxxxxxx>]

At 15:24 +0100 on 30 Apr (1398867864), Jan Beulich wrote:
> @@ -72,13 +72,11 @@ long arch_do_domctl(
>          unsigned int np = domctl->u.ioport_permission.nr_ports;
>          int allow = domctl->u.ioport_permission.allow_access;
>  
> -        ret = -EINVAL;
> -        if ( (fp + np) > 65536 )
> -            break;
> -
> -        if ( np == 0 )
> -            ret = 0;
> -        else if ( xsm_ioport_permission(XSM_HOOK, d, fp, fp + np - 1, allow) 
> )
> +        if ( (fp + np - 1) < fp || (fp + np) > 0x10000 )
> +            ret = -EINVAL;

I think this fails if (fp + np) overflows exactly to 0.
How about 'if ( (fp + np) <= fp || (fp + np) > 0x10000 )' ?

Tim.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel