diff options
| author |   Mario Preksavec <mario@slackware.hr> | 2017-06-23 20:07:23 +0200 |
|---|---|---|
| committer |   Willy Sudiarto Raharjo <willysr@slackbuilds.org> | 2017-06-24 08:32:06 +0700 |
| commit | e5517c1db9c7f5937b48cd95d49e715c83335c3d (patch) | |
| tree | 40ca46d9b08b4247f036819fb32b5fbc34270125 /system/xen/xsa/xsa225.patch | |
| parent | 78963fb4fa21eb490dd39b9efb6a6a8bdfda4b3a (diff) | |
| download | slackbuilds-e5517c1db9c7f5937b48cd95d49e715c83335c3d.tar.gz slackbuilds-e5517c1db9c7f5937b48cd95d49e715c83335c3d.tar.xz | |
system/xen: XSA 216-225 update.
Signed-off-by: Mario Preksavec <mario@slackware.hr>
Diffstat (limited to '')
| -rw-r--r-- | system/xen/xsa/xsa225.patch | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/system/xen/xsa/xsa225.patch b/system/xen/xsa/xsa225.patch new file mode 100644 index 0000000000..900487a631 --- /dev/null +++ b/system/xen/xsa/xsa225.patch @@ -0,0 +1,35 @@ +From b0547f9c9707e0dc473601a166da32dfec1f526e Mon Sep 17 00:00:00 2001 +From: Julien Grall <julien.grall@arm.com> +Date: Tue, 6 Jun 2017 15:35:42 +0100 +Subject: [PATCH] xen/arm: vgic: Sanitize target mask used to send SGI + +The current function vgic_to_sgi does not sanitize the target mask and +may therefore get an invalid vCPU ID. This will result to an out of +bound access of d->vcpu[...] as there is no check whether the vCPU ID is +within the maximum supported by the guest. + +This was introduced by commit ea37fd2111 "xen/arm: split vgic driver +into generic and vgic-v2 driver". + +Signed-off-by: Julien Grall <julien.grall@arm.com> +Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> +--- + xen/arch/arm/vgic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c +index 83569b09e7..c6c6f8cb66 100644 +--- a/xen/arch/arm/vgic.c ++++ b/xen/arch/arm/vgic.c +@@ -399,7 +399,8 @@ bool vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode, + for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 ) + { + vcpuid = base + i; +- if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) ) ++ if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL || ++ !is_vcpu_online(d->vcpu[vcpuid]) ) + { + gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \ + target->list=%hx, wrong CPUTargetList \n", +-- +2.11.0 |