Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f124c6ae authored by Dan Carpenter's avatar Dan Carpenter Committed by Konrad Rzeszutek Wilk
Browse files

xen: off by one errors in multicalls.c 



b->args[] has MC_ARGS elements, so the comparison here should be
">=" instead of ">".  Otherwise we read past the end of the array
one space.

CC: stable@kernel.org
Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: default avatarJeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
parent e5ac0bda

arch/x86/xen/multicalls.c

+6 −6
Original line number Diff line number Diff line
@@ -189,10 +189,10 @@ struct multicall_space __xen_mc_entry(size_t args) 
	unsigned argidx = roundup(b->argidx, sizeof(u64));



	BUG_ON(preemptible());

	BUG_ON(b->argidx > MC_ARGS);

	BUG_ON(b->argidx >= MC_ARGS);



	if (b->mcidx == MC_BATCH ||

	    (argidx + args) > MC_ARGS) {

	    (argidx + args) >= MC_ARGS) {

		mc_stats_flush(b->mcidx == MC_BATCH ? FL_SLOTS : FL_ARGS);

		xen_mc_flush();

		argidx = roundup(b->argidx, sizeof(u64));
@@ -206,7 +206,7 @@ struct multicall_space __xen_mc_entry(size_t args) 
	ret.args = &b->args[argidx];

	b->argidx = argidx + args;



	BUG_ON(b->argidx > MC_ARGS);

	BUG_ON(b->argidx >= MC_ARGS);

	return ret;

}
@@ -216,7 +216,7 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) 
	struct multicall_space ret = { NULL, NULL };



	BUG_ON(preemptible());

	BUG_ON(b->argidx > MC_ARGS);

	BUG_ON(b->argidx >= MC_ARGS);



	if (b->mcidx == 0)

		return ret;
@@ -224,14 +224,14 @@ struct multicall_space xen_mc_extend_args(unsigned long op, size_t size) 
	if (b->entries[b->mcidx - 1].op != op)

		return ret;



	if ((b->argidx + size) > MC_ARGS)

	if ((b->argidx + size) >= MC_ARGS)

		return ret;



	ret.mc = &b->entries[b->mcidx - 1];

	ret.args = &b->args[b->argidx];

	b->argidx += size;



	BUG_ON(b->argidx > MC_ARGS);

	BUG_ON(b->argidx >= MC_ARGS);

	return ret;

}