[Xen-changelog] [xen stable-4.1] x86: fix null pointer dereference in intel_get_extended_msrs()

[patchbot@xxxxxxx]

commit bbbeb7939e141c6cb29fd6f26beca68ffdfe9d46
Author:     Xi Wang <xi@xxxxxxx>
AuthorDate: Fri Mar 8 13:56:54 2013 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Fri Mar 8 13:56:54 2013 +0100

    x86: fix null pointer dereference in intel_get_extended_msrs()
    
    `memset(&mc_ext, 0, ...)' leads to a buffer overflow and a subsequent
    null pointer dereference.  Replace `&mc_ext' with `mc_ext'.
    
    Signed-off-by: Xi Wang <xi@xxxxxxx>
    master changeset: c40e24a8ef74f9d0ee59dd9b8ca890be08b0b874
    master date: 2013-02-25 12:44:25 +0100
---
 xen/arch/x86/cpu/mcheck/mce_intel.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/arch/x86/cpu/mcheck/mce_intel.c 
b/xen/arch/x86/cpu/mcheck/mce_intel.c
index 603acf7..b321a3f 100644
--- a/xen/arch/x86/cpu/mcheck/mce_intel.c
+++ b/xen/arch/x86/cpu/mcheck/mce_intel.c
@@ -512,7 +512,7 @@ intel_get_extended_msrs(struct mcinfo_global *mig, struct 
mc_info *mi)
     }
 
     /* this function will called when CAP(9).MCG_EXT_P = 1 */
-    memset(&mc_ext, 0, sizeof(struct mcinfo_extended));
+    memset(mc_ext, 0, sizeof(*mc_ext));
     mc_ext->common.type = MC_TYPE_EXTENDED;
     mc_ext->common.size = sizeof(struct mcinfo_extended);
 
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.1

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog