[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] Bug in smpboot.c?



Keir,

Thanks; yes, we see no way to unravel it. I'm just paranoid.

Sincerely,

John

On Jun 10, 2011, at 3:30 AM, Keir Fraser wrote:

> On 09/06/2011 16:49, "John McDermott (U.S. Navy Employee)"
> <john.mcdermott@xxxxxxxxxxxx> wrote:
> 
>> Xen Developers,
>> 
>> In C function cpu_add(), in xen/arch/x86/smpboot.c, if acpi_id ==
>> MAX_MADT_ENTRIES, won't this write past the end of array
>> x86_acpiid_toapicid[MAX_MADT_ENTRIES]? I am looking at xen-unstable. It looks
>> like the guard is not catching this 1 case?
> 
> Fixed in xen-unstable:23505. Fortunately this function is only accessible
> from the TCB so it's not exploitable.
> 
> Thanks,
> -- Keir
> 
>> Sincerely,
>> 
>> John McDermott
>> ----
>> What is the formal meaning of the one-line program
>> #include "/dev/tty"
>> 
>> J.P. McDermott   building 12
>> Code 5542   mcdermott@xxxxxxxxxxxxxxxx
>> Naval Research Laboratory voice: +1 202.404.8301
>> Washington, DC 20375, US fax:   +1 202.404.7942
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> _______________________________________________
>> Xen-devel mailing list
>> Xen-devel@xxxxxxxxxxxxxxxxxxx
>> http://lists.xensource.com/xen-devel
> 

----
What is the formal meaning of the one-line program
#include "/dev/tty"

J.P. McDermott                  building 12
Code 5542                       mcdermott@xxxxxxxxxxxxxxxx
Naval Research Laboratory       voice: +1 202.404.8301
Washington, DC 20375, US        fax:   +1 202.404.7942










_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.