>>> On 16.04.13 at 19:13, David Vrabel <david.vrabel at citrix.com> wrote: > -static int kexec_exec(XEN_GUEST_HANDLE_PARAM(void) uarg) > +static int kexec_load(XEN_GUEST_HANDLE_PARAM(void) uarg) > { > - xen_kexec_exec_t exec; > - xen_kexec_image_t *image; > - int base, bit, pos, ret = -EINVAL; > + xen_kexec_load_t load; > + xen_kexec_segment_t *segments; > + struct kexec_image *kimage = NULL; > + int ret; > > - if ( unlikely(copy_from_guest(&exec, uarg, 1)) ) > + if ( copy_from_guest(&load, uarg, 1) ) > return -EFAULT; > > - if ( kexec_load_get_bits(exec.type, &base, &bit) ) > + if ( load.nr_segments >= KEXEC_SEGMENT_MAX ) > return -EINVAL; Especially since you named the padding field _rsvd, you ought to verify it to be zero somewhere here. Or if you're really sure that nobody will ever want to make use of the field, name it _pad instead. Jan