Re: [Xen-devel] Bug in smpboot.c?

To:	"John McDermott (U.S. Navy Employee)" <john.mcdermott@xxxxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject:	Re: [Xen-devel] Bug in smpboot.c?
From:	Keir Fraser <keir@xxxxxxx>
Date:	Fri, 10 Jun 2011 08:30:10 +0100
Cc:
Delivery-date:	Fri, 10 Jun 2011 00:32:32 -0700
Dkim-signature:	v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:user-agent:date:subject:from:to :message-id:thread-topic:thread-index:in-reply-to:mime-version :content-type:content-transfer-encoding; bh=Q3SB3CDZaTOnhoS3LHPZzzubFPdni7sE6CbAKMqzfOk=; b=mRmKCaXxhHZ8W9qZYAMMx95SBFl9q0i9hw/08iUr6Xfl8dEofJVE2xPrRvCaCT2tWO Y/FER5OHVxyJR6ah/Mv+e2W3Hkk4WVZhs8StLO+SJZLi/B39ecIlCpsRLUe0L4Y1THYN vh2jK0SBR28k2fsluyQlrOXRVfawp9pj0U6+g=
Domainkey-signature:	a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:user-agent:date:subject:from:to:message-id:thread-topic :thread-index:in-reply-to:mime-version:content-type :content-transfer-encoding; b=csp+NcSlLYeIoEr8fqHjBED46Mr7Fkf5H+Mqxb5wgRgegllGDHt1jLxIzuQIpiZ4cB ly1D4PX0zjHnPpsltOMPZF93ZuSX4RchfIeNtEBReYkV1YngjKZrnZ6pmtoGyGITuci5 XGDLdyLGiJHRqiPWAGPaVYe4s/sF0GTX+WH0s=
Envelope-to:	www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to:	<FF7C94F8-BCD0-4B8F-8574-201BAF6C3FA2@xxxxxxxxxxxx>
List-help:	<mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id:	Xen developer discussion <xen-devel.lists.xensource.com>
List-post:	<mailto:xen-devel@lists.xensource.com>
List-subscribe:	<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe:	<http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender:	xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index:	AcwnQDqDU4TmSRUxZkeRBfYm2GNHZA==
Thread-topic:	[Xen-devel] Bug in smpboot.c?
User-agent:	Microsoft-Entourage/12.29.0.110113

On 09/06/2011 16:49, "John McDermott (U.S. Navy Employee)"
<john.mcdermott@xxxxxxxxxxxx> wrote:

> Xen Developers,
> 
> In C function cpu_add(), in xen/arch/x86/smpboot.c, if acpi_id ==
> MAX_MADT_ENTRIES, won't this write past the end of array
> x86_acpiid_toapicid[MAX_MADT_ENTRIES]? I am looking at xen-unstable. It looks
> like the guard is not catching this 1 case?

Fixed in xen-unstable:23505. Fortunately this function is only accessible
from the TCB so it's not exploitable.

 Thanks,
 -- Keir

> Sincerely,
> 
> John McDermott
> ----
> What is the formal meaning of the one-line program
> #include "/dev/tty"
> 
> J.P. McDermott   building 12
> Code 5542   mcdermott@xxxxxxxxxxxxxxxx
> Naval Research Laboratory voice: +1 202.404.8301
> Washington, DC 20375, US fax:   +1 202.404.7942
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel

WARNING - OLD ARCHIVES

xen-devel

Re: [Xen-devel] Bug in smpboot.c?