mirror of
https://github.com/Ponce/slackbuilds
synced 2024-11-14 21:56:41 +01:00
36 lines
1.5 KiB
Diff
36 lines
1.5 KiB
Diff
|
From b0547f9c9707e0dc473601a166da32dfec1f526e Mon Sep 17 00:00:00 2001
|
||
|
|
From: Julien Grall <julien.grall@arm.com>
|
||
|
|
Date: Tue, 6 Jun 2017 15:35:42 +0100
|
||
|
|
Subject: [PATCH] xen/arm: vgic: Sanitize target mask used to send SGI
|
||
|
|
|
||
|
|
The current function vgic_to_sgi does not sanitize the target mask and
|
||
|
|
may therefore get an invalid vCPU ID. This will result to an out of
|
||
|
|
bound access of d->vcpu[...] as there is no check whether the vCPU ID is
|
||
|
|
within the maximum supported by the guest.
|
||
|
|
|
||
|
|
This was introduced by commit ea37fd2111 "xen/arm: split vgic driver
|
||
|
|
into generic and vgic-v2 driver".
|
||
|
|
|
||
|
|
Signed-off-by: Julien Grall <julien.grall@arm.com>
|
||
|
|
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>
|
||
|
|
---
|
||
|
|
xen/arch/arm/vgic.c | 3 ++-
|
||
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
|
||
|
|
index 83569b09e7..c6c6f8cb66 100644
|
||
|
|
--- a/xen/arch/arm/vgic.c
|
||
|
|
+++ b/xen/arch/arm/vgic.c
|
||
|
|
@@ -399,7 +399,8 @@ bool vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode,
|
||
|
|
for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 )
|
||
|
|
{
|
||
|
|
vcpuid = base + i;
|
||
|
|
- if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) )
|
||
|
|
+ if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL ||
|
||
|
|
+ !is_vcpu_online(d->vcpu[vcpuid]) )
|
||
|
|
{
|
||
|
|
gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \
|
||
|
|
target->list=%hx, wrong CPUTargetList \n",
|
||
|
|
--
|
||
|
|
2.11.0
|