[kvm-unit-tests,1/3] x86: Fix out of bounds access when processing online_cpus
diff mbox series

Message ID 20190906163450.30797-2-sean.j.christopherson@intel.com
State New
Headers show
Series
  • x86: Cleanup max test CPUs
Related show

Commit Message

Sean Christopherson Sept. 6, 2019, 4:34 p.m. UTC
online_cpus is misdeclared as a 64 *byte* variable instead of a 64 *bit*
variable.  This causes init_apic_map() to test random bytes when it
iterates over online_cpus, which in turn can cause it to overflow id_map
and corrupt rnadom memory, e.g. pg_base.  Declare online_cpus using
MAX_TEST_CPUS, which presumably is set explicitly to match the storage
size of online_cpus (64-bit values == max of 64 CPUS).

Reported-by: Evgeny Yakovlev <wrfsh@yandex-team.ru>
Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
---
 lib/x86/apic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch
diff mbox series

diff --git a/lib/x86/apic.c b/lib/x86/apic.c
index b3e39ae..f43e9ef 100644
--- a/lib/x86/apic.c
+++ b/lib/x86/apic.c
@@ -232,13 +232,13 @@  void mask_pic_interrupts(void)
     outb(0xff, 0xa1);
 }
 
-extern unsigned char online_cpus[256 / 8];
+extern unsigned char online_cpus[MAX_TEST_CPUS / 8];
 
 void init_apic_map(void)
 {
 	unsigned int i, j = 0;
 
-	for (i = 0; i < sizeof(online_cpus) * 8; i++) {
+	for (i = 0; i < MAX_TEST_CPUS; i++) {
 		if ((1ul << (i % 8)) & (online_cpus[i / 8]))
 			id_map[j++] = i;
 	}