[Xen-changelog] [xen stable-4.6] xen/arm: vgic: Sanitize target mask used to send SGI

[patchbot@xxxxxxx]

commit 4efd74db51d75f22b9c65e5f1dbe5332854ffa0a
Author:     Julien Grall <julien.grall@xxxxxxx>
AuthorDate: Tue Jun 20 16:44:06 2017 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Tue Jun 20 16:44:06 2017 +0200

    xen/arm: vgic: Sanitize target mask used to send SGI
    
    The current function vgic_to_sgi does not sanitize the target mask and
    may therefore get an invalid vCPU ID. This will result to an out of
    bound access of d->vcpu[...] as there is no check whether the vCPU ID is
    within the maximum supported by the guest.
    
    This was introduced by commit ea37fd2111 "xen/arm: split vgic driver
    into generic and vgic-v2 driver".
    
    Signed-off-by: Julien Grall <julien.grall@xxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    master commit: 6fb94196730f30929f1e617fd1d05daf55376664
    master date: 2017-06-20 14:47:07 +0200
---
 xen/arch/arm/vgic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
index a6835a8..55efa7f 100644
--- a/xen/arch/arm/vgic.c
+++ b/xen/arch/arm/vgic.c
@@ -340,7 +340,8 @@ int vgic_to_sgi(struct vcpu *v, register_t sgir, enum 
gic_sgi_mode irqmode, int
         for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 )
         {
             vcpuid = base + i;
-            if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) )
+            if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL ||
+                 !is_vcpu_online(d->vcpu[vcpuid]) )
             {
                 gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \
                         target->list=%hx, wrong CPUTargetList \n",
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
https://lists.xenproject.org/xen-changelog