Messages in this thread | | | Date | Mon, 05 Feb 2018 08:14:34 -0700 | From | "Jan Beulich" <> | Subject | Re: [Xen-devel] [PATCH] [v2] xen: hypercall: fix out-of-bounds memcpy |
| |
>>> On 05.02.18 at 16:03, <arnd@arndb.de> wrote: > int xen_event_channel_op_compat(int cmd, void *arg) > { > - struct evtchn_op op; > + struct evtchn_op op = { .cmd = cmd, }; > + size_t len; > int rc; > > - op.cmd = cmd; > - memcpy(&op.u, arg, sizeof(op.u)); > - rc = _hypercall1(int, event_channel_op_compat, &op); > - > - switch (cmd) { > - case EVTCHNOP_close: > - case EVTCHNOP_send: > - case EVTCHNOP_bind_vcpu: > - case EVTCHNOP_unmask: > - /* no output */ > - break; > + if (cmd > ARRAY_SIZE(evtchnop_len)) > + return -ENOSYS;
>= perhaps?
Jan
| |