[xen master] xen: fix buffer over-read in bitmap_to_xenctl_bitmap()

[patchbot@xxxxxxx]

commit cba90ddee086e8d26063d8de90e40a098395e99b
Author:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
AuthorDate: Thu Apr 24 12:23:14 2025 +0200
Commit:     Roger Pau Monne <roger.pau@xxxxxxxxxx>
CommitDate: Fri Apr 25 14:50:19 2025 +0200

    xen: fix buffer over-read in bitmap_to_xenctl_bitmap()
    
    There's an off-by-one when calculating the last byte in the input array to
    bitmap_to_xenctl_bitmap(), which leads to bitmaps with sizes multiple of 8
    to over-read and incorrectly use a byte past the end of the array.
    
    Fixes: 288c4641c80d ('xen: simplify bitmap_to_xenctl_bitmap for little 
endian')
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
---
 xen/common/bitmap.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/xen/common/bitmap.c b/xen/common/bitmap.c
index bf1a7fd91e..4f96fda389 100644
--- a/xen/common/bitmap.c
+++ b/xen/common/bitmap.c
@@ -369,6 +369,9 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap 
*xenctl_bitmap,
     const uint8_t *bytemap;
     uint8_t last, *buf = NULL;
 
+    if ( !nbits )
+        return 0;
+
     if ( !IS_ENABLED(LITTLE_ENDIAN) )
     {
         buf = xmalloc_array(uint8_t, xen_bytes);
@@ -396,7 +399,7 @@ int bitmap_to_xenctl_bitmap(struct xenctl_bitmap 
*xenctl_bitmap,
      * their loops to 8 bits. Ensure we clear those left over bits so as to
      * prevent surprises.
      */
-    last = bytemap[nbits / 8];
+    last = bytemap[(nbits - 1) / 8];
     if ( nbits % 8 )
         last &= (1U << (nbits % 8)) - 1;
 
--
generated by git-patchbot for /home/xen/git/xen.git#master