Fix an overflow on 32bits windows balloon driver.

On 32bits windows with PAE, the PPN_2_PA macro could overflow
since a PPN is represented by a 32bits integer. This could lead
to memory corruption since the ballooned page would be truncated
ones.

Signed-off-by: Dmitry Torokhov <dtor@vmware.com>

diff --git a/open-vm-tools/modules/shared/vmmemctl/balloonInt.h b/open-vm-tools/modules/shared/vmmemctl/balloonInt.h
index 8bdefa5a888b2c0035e1e6bb701414a6f997902e..684af098ec7a313f39ad3d949707ee12d7bb98d6 100644 (file)
--- a/open-vm-tools/modules/shared/vmmemctl/balloonInt.h
+++ b/open-vm-tools/modules/shared/vmmemctl/balloonInt.h
@@ -107,7 +107,7 @@
 #define        STATS_DEC(stat)
 #endif
 
-#define PPN_2_PA(_ppn)  ((_ppn) << PAGE_SHIFT)
+#define PPN_2_PA(_ppn)  ((PPN64)(_ppn) << PAGE_SHIFT)
 #define PA_2_PPN(_pa)   ((_pa) >> PAGE_SHIFT)
 
 #endif /* !BALLOONINT_H_ */