Re: [Xen-devel] [PATCH 03/11] tmem: check the pool_id is valid when destroying a tmem pool

[Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>]

> From: Jan Beulich [mailto:JBeulich@xxxxxxxx]
> Sent: Wednesday, September 05, 2012 6:35 AM
> To: xen-devel
> Cc: Dan Magenheimer; Zhenzhong Duan
> Subject: [PATCH 03/11] tmem: check the pool_id is valid when destroying a 
> tmem pool
> 
> This is part of XSA-15 / CVE-2012-3497.
> 
> Signed-off-by: Ian Campbell <ian.campbell@xxxxxxxxxx>
> Acked-by: Jan Beulich <jbeulich@xxxxxxxx>

Acked-by: Dan Magenheimer <dan.magenheimer@xxxxxxxxxx>

> --- a/xen/common/tmem.c
> +++ b/xen/common/tmem.c
> @@ -1870,6 +1870,8 @@ static NOINLINE int do_tmem_destroy_pool
> 
>      if ( client->pools == NULL )
>          return 0;
> +    if ( pool_id >= MAX_POOLS_PER_DOMAIN )
> +        return 0;
>      if ( (pool = client->pools[pool_id]) == NULL )
>          return 0;
>      client->pools[pool_id] = NULL;
> 
> 
> 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel