[xen staging] arinc653: avoid array overrun

[patchbot@xxxxxxx]

commit 5a1121633f2ae97d96d3e66472cf373a6caa3d51
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Thu Mar 26 10:47:41 2026 +0100
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Thu Mar 26 10:47:41 2026 +0100

    arinc653: avoid array overrun
    
    Incrementing ->sched_index between bounds check and array access may
    result in accessing one past the array when that is fully filled
    (->num_schedule_entries == ARINC653_MAX_DOMAINS_PER_SCHEDULE).
    
    Fixes: 22787f2e107c ("ARINC 653 scheduler")
    Reported-by: Kamil Frankowicz <kamil.frankowicz@xxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    Reviewed-by: Stewart Hildebrand <stewart@xxxxxxx>
---
 xen/common/sched/arinc653.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c
index bde15eb7e1..c35bfbd04e 100644
--- a/xen/common/sched/arinc653.c
+++ b/xen/common/sched/arinc653.c
@@ -552,12 +552,9 @@ a653sched_do_schedule(
 
     /* Switch minor frame or find correct minor frame after a miss */
     while ( (now >= sched_priv->next_switch_time) &&
-        (sched_priv->sched_index < sched_priv->num_schedule_entries) )
-    {
-        sched_priv->sched_index++;
+            (++sched_priv->sched_index < sched_priv->num_schedule_entries) )
         sched_priv->next_switch_time +=
             sched_priv->schedule[sched_priv->sched_index].runtime;
-    }
 
     /*
      * If we exhausted the domains in the schedule and still have time left
--
generated by git-patchbot for /home/xen/git/xen.git#staging