diff mbox

fix potential pa_range_info out of bound access

Message ID alpine.DEB.2.10.1612081704150.22778@sstabellini-ThinkPad-X260 (mailing list archive)
State New, archived
Headers show

Commit Message

Stefano Stabellini Dec. 9, 2016, 1:10 a.m. UTC 
pa_range_info has only 8 elements and is accessed using pa_range as
index. pa_range is initialized to 16, potentially causing out of bound
access errors. Fix the issue by initializing pa_range to the effective
number of pa_range_info elements.

CID 1381865

Signed-off-by: Stefano Stabellini <sstabellini@kernel.org>
diff mbox

Patch

diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c
index e4991df..245fcd1 100644
--- a/xen/arch/arm/p2m.c
+++ b/xen/arch/arm/p2m.c
@@ -1629,7 +1629,7 @@  void __init setup_virt_paging(void)
     };
 
     unsigned int cpu;
-    unsigned int pa_range = 0x10; /* Larger than any possible value */
+    unsigned int pa_range = sizeof(pa_range_info) / sizeof(pa_range_info[0]);
 
     for_each_online_cpu ( cpu )
     {