[Xen-devel] [PATCH v3] fix potential pa_range_info out of bound access

[Stefano Stabellini <sstabellini@xxxxxxxxxx>]

pa_range_info has only 8 elements and is accessed using pa_range as
index. pa_range is initialized to 16, potentially causing out of bound
access errors. Fix the issue by checking that pa_range is not greater
than the size of the array. Remove the now superfluous pa_range&0x8
check. 

Coverity-ID: 1381865

Signed-off-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>

---
Changes in v3:
- remove the now superfluous pa_range&0x8 check

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index e4991df..5d5bb87 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -1639,7 +1639,7 @@ void __init setup_virt_paging(void)
     }
 
     /* pa_range is 4 bits, but the defined encodings are only 3 bits */
-    if ( pa_range&0x8 || !pa_range_info[pa_range].pabits )
+    if ( pa_range >= ARRAY_SIZE(pa_range_info) || 
!pa_range_info[pa_range].pabits )
         panic("Unknown encoding of ID_AA64MMFR0_EL1.PARange %x\n", pa_range);
 
     val |= VTCR_PS(pa_range);

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
https://lists.xen.org/xen-devel