diff options
Diffstat (limited to 'system/xen/xsa/xsa225.patch')
| -rw-r--r-- | system/xen/xsa/xsa225.patch | 35 |
1 files changed, 0 insertions, 35 deletions
diff --git a/system/xen/xsa/xsa225.patch b/system/xen/xsa/xsa225.patch deleted file mode 100644 index 900487a631cf..000000000000 --- a/system/xen/xsa/xsa225.patch +++ /dev/null @@ -1,35 +0,0 @@ -From b0547f9c9707e0dc473601a166da32dfec1f526e Mon Sep 17 00:00:00 2001 -From: Julien Grall <julien.grall@arm.com> -Date: Tue, 6 Jun 2017 15:35:42 +0100 -Subject: [PATCH] xen/arm: vgic: Sanitize target mask used to send SGI - -The current function vgic_to_sgi does not sanitize the target mask and -may therefore get an invalid vCPU ID. This will result to an out of -bound access of d->vcpu[...] as there is no check whether the vCPU ID is -within the maximum supported by the guest. - -This was introduced by commit ea37fd2111 "xen/arm: split vgic driver -into generic and vgic-v2 driver". - -Signed-off-by: Julien Grall <julien.grall@arm.com> -Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> ---- - xen/arch/arm/vgic.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c -index 83569b09e7..c6c6f8cb66 100644 ---- a/xen/arch/arm/vgic.c -+++ b/xen/arch/arm/vgic.c -@@ -399,7 +399,8 @@ bool vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode, - for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 ) - { - vcpuid = base + i; -- if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) ) -+ if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL || -+ !is_vcpu_online(d->vcpu[vcpuid]) ) - { - gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \ - target->list=%hx, wrong CPUTargetList \n", --- -2.11.0 |