[Xen-changelog] [xen-3.0.3-testing] [XENOPROF] Fix limit-check overflow.

["Xen patchbot-3.0.3-testing" <patchbot-3.0.3-testing@xxxxxxxxxxxxxxxxxxx>]

# HG changeset patch
# User kfraser@xxxxxxxxxxxxxxxxxxxxx
# Date 1160902353 -3600
# Node ID d30ed0e261aec5ab7ce1904ae1007f3af4898b92
# Parent  8631433e519586bb01276316a6d833a644871ea7
[XENOPROF] Fix limit-check overflow.

Fix code limiting XENOPROF_get_buffer and XENOPROF_set_passive
argument max_samples so that no more than MAX_OPROF_SHARED_PAGES are
used.

Signed-off-by: Markus Armbruster <armbru@xxxxxxxxxx>
---
 xen/arch/x86/oprofile/xenoprof.c |   17 ++++++++---------
 1 files changed, 8 insertions(+), 9 deletions(-)

diff -r 8631433e5195 -r d30ed0e261ae xen/arch/x86/oprofile/xenoprof.c
--- a/xen/arch/x86/oprofile/xenoprof.c  Sun Oct 15 09:21:49 2006 +0100
+++ b/xen/arch/x86/oprofile/xenoprof.c  Sun Oct 15 09:52:33 2006 +0100
@@ -122,6 +122,7 @@ int alloc_xenoprof_struct(struct domain 
 {
     struct vcpu *v;
     int nvcpu, npages, bufsize, max_bufsize;
+    unsigned max_max_samples;
     int i;
 
     d->xenoprof = xmalloc(struct xenoprof);
@@ -139,17 +140,15 @@ int alloc_xenoprof_struct(struct domain 
     for_each_vcpu ( d, v )
         nvcpu++;
 
-    /* reduce buffer size if necessary to limit pages allocated */
+    /* reduce max_samples if necessary to limit pages allocated */
+    max_bufsize = (MAX_OPROF_SHARED_PAGES * PAGE_SIZE) / nvcpu;
+    max_max_samples = ( (max_bufsize - sizeof(struct xenoprof_buf)) /
+                        sizeof(struct event_log) ) + 1;
+    if ( (unsigned)max_samples > max_max_samples )
+        max_samples = max_max_samples;
+
     bufsize = sizeof(struct xenoprof_buf) +
         (max_samples - 1) * sizeof(struct event_log);
-    max_bufsize = (MAX_OPROF_SHARED_PAGES * PAGE_SIZE) / nvcpu;
-    if ( bufsize > max_bufsize )
-    {
-        bufsize = max_bufsize;
-        max_samples = ( (max_bufsize - sizeof(struct xenoprof_buf)) /
-                        sizeof(struct event_log) ) + 1;
-    }
-
     npages = (nvcpu * bufsize - 1) / PAGE_SIZE + 1;
     
     d->xenoprof->rawbuf = alloc_xenoprof_buf(is_passive ? dom0 : d, npages);

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog