| Message ID | 1498055322-32617-1-git-send-email-rcojocaru@bitdefender.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 21/06/17 15:28, Razvan Cojocaru wrote: > Fixed an issue where the maximum index allowed (31) goes beyond the > actual number of array elements (4) of ad->monitor.write_ctrlreg_mask. > Coverity-ID: 1412966 > > Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> > --- > xen/arch/x86/monitor.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c > index bedf13c..4620b15 100644 > --- a/xen/arch/x86/monitor.c > +++ b/xen/arch/x86/monitor.c > @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d, > bool_t old_status; > > /* sanity check: avoid left-shift undefined behavior */ > - if ( unlikely(mop->u.mov_to_cr.index > 31) ) > + if ( unlikely(mop->u.mov_to_cr.index > 3) ) >= ARRAY_SIZE(ad->monitor.write_ctrlreg_mask) ? ~Andrew > return -EINVAL; > > if ( unlikely(mop->u.mov_to_cr.pad1 || mop->u.mov_to_cr.pad2) )
On 21/06/17 15:33, Andrew Cooper wrote: > On 21/06/17 15:28, Razvan Cojocaru wrote: >> Fixed an issue where the maximum index allowed (31) goes beyond the >> actual number of array elements (4) of ad->monitor.write_ctrlreg_mask. >> Coverity-ID: 1412966 >> >> Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> >> --- >> xen/arch/x86/monitor.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c >> index bedf13c..4620b15 100644 >> --- a/xen/arch/x86/monitor.c >> +++ b/xen/arch/x86/monitor.c >> @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d, >> bool_t old_status; >> >> /* sanity check: avoid left-shift undefined behavior */ >> - if ( unlikely(mop->u.mov_to_cr.index > 31) ) >> + if ( unlikely(mop->u.mov_to_cr.index > 3) ) >> = ARRAY_SIZE(ad->monitor.write_ctrlreg_mask) > ? Sorry - that should be ">= ARRAY" when it doesn't get interpreted as an email quotation. ~Andrew
On 06/21/2017 05:33 PM, Andrew Cooper wrote: > On 21/06/17 15:28, Razvan Cojocaru wrote: >> Fixed an issue where the maximum index allowed (31) goes beyond the >> actual number of array elements (4) of ad->monitor.write_ctrlreg_mask. >> Coverity-ID: 1412966 >> >> Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> >> --- >> xen/arch/x86/monitor.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c >> index bedf13c..4620b15 100644 >> --- a/xen/arch/x86/monitor.c >> +++ b/xen/arch/x86/monitor.c >> @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d, >> bool_t old_status; >> >> /* sanity check: avoid left-shift undefined behavior */ >> - if ( unlikely(mop->u.mov_to_cr.index > 31) ) >> + if ( unlikely(mop->u.mov_to_cr.index > 3) ) > >> = ARRAY_SIZE(ad->monitor.write_ctrlreg_mask) > > ? Yes, that'd be the right way to do it. :) V2 coming up in a second. Thanks, Razvan
diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c index bedf13c..4620b15 100644 --- a/xen/arch/x86/monitor.c +++ b/xen/arch/x86/monitor.c @@ -133,7 +133,7 @@ int arch_monitor_domctl_event(struct domain *d, bool_t old_status; /* sanity check: avoid left-shift undefined behavior */ - if ( unlikely(mop->u.mov_to_cr.index > 31) ) + if ( unlikely(mop->u.mov_to_cr.index > 3) ) return -EINVAL; if ( unlikely(mop->u.mov_to_cr.pad1 || mop->u.mov_to_cr.pad2) )
Fixed an issue where the maximum index allowed (31) goes beyond the actual number of array elements (4) of ad->monitor.write_ctrlreg_mask. Coverity-ID: 1412966 Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com> --- xen/arch/x86/monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)