lkml.org 
[lkml]   [2020]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 096/271] xen, cpu_hotplug: Prevent an out of bounds access
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 201676095dda7e5b31a5e1d116d10fc22985075e ]

    The "cpu" variable comes from the sscanf() so Smatch marks it as
    untrusted data. We can't pass a higher value than "nr_cpu_ids" to
    cpu_possible() or it results in an out of bounds access.

    Fixes: d68d82afd4c8 ("xen: implement CPU hotplugging")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/xen/cpu_hotplug.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
    index f4e59c445964d..17054d6954117 100644
    --- a/drivers/xen/cpu_hotplug.c
    +++ b/drivers/xen/cpu_hotplug.c
    @@ -53,7 +53,7 @@ static int vcpu_online(unsigned int cpu)
    }
    static void vcpu_hotplug(unsigned int cpu)
    {
    - if (!cpu_possible(cpu))
    + if (cpu >= nr_cpu_ids || !cpu_possible(cpu))
    return;

    switch (vcpu_online(cpu)) {
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-01-28 15:19    [W:3.439 / U:0.548 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site