| Message ID | 20170504193641.26469-1-julien.grall@arm.com |
|---|---|
| State | New |
| Headers | show |
On Thu, 4 May 2017, Julien Grall wrote: > Commit 2c77db77 "xen/arm: efi: Avoid duplicating the addition of a new > bank", introduced a new function meminfo_add_bank that add a new bank. > This new code fails to check correctly the size of the array which may > result to an out-of-bounds write. > > Coverity-ID: 1433183 > Signed-off-by: Julien Grall <julien.grall@arm.com> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> > --- > The new function was introduced during the development of Xen 4.9 > and should be fixed before the release. > --- > xen/arch/arm/efi/efi-boot.h | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/xen/arch/arm/efi/efi-boot.h b/xen/arch/arm/efi/efi-boot.h > index e1e447ac8e..2986c83447 100644 > --- a/xen/arch/arm/efi/efi-boot.h > +++ b/xen/arch/arm/efi/efi-boot.h > @@ -128,7 +128,7 @@ static bool __init meminfo_add_bank(struct meminfo *mem, > { > struct membank *bank; > > - if ( mem->nr_banks > NR_MEM_BANKS ) > + if ( mem->nr_banks >= NR_MEM_BANKS ) > return false; > > bank = &mem->bank[mem->nr_banks]; > -- > 2.11.0 >
diff --git a/xen/arch/arm/efi/efi-boot.h b/xen/arch/arm/efi/efi-boot.h index e1e447ac8e..2986c83447 100644 --- a/xen/arch/arm/efi/efi-boot.h +++ b/xen/arch/arm/efi/efi-boot.h @@ -128,7 +128,7 @@ static bool __init meminfo_add_bank(struct meminfo *mem, { struct membank *bank; - if ( mem->nr_banks > NR_MEM_BANKS ) + if ( mem->nr_banks >= NR_MEM_BANKS ) return false; bank = &mem->bank[mem->nr_banks];
Commit 2c77db77 "xen/arm: efi: Avoid duplicating the addition of a new bank", introduced a new function meminfo_add_bank that add a new bank. This new code fails to check correctly the size of the array which may result to an out-of-bounds write. Coverity-ID: 1433183 Signed-off-by: Julien Grall <julien.grall@arm.com> --- The new function was introduced during the development of Xen 4.9 and should be fixed before the release. --- xen/arch/arm/efi/efi-boot.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)