Re: [Xen-devel] Out of bounds access in early boot code related to GRUB

[Daniel Kiper <daniel.kiper@xxxxxxxxxx>]

On Wed, Sep 19, 2018 at 10:34:47AM +0100, Wei Liu wrote:
> Hi Daniel,
>
> I discovered an out of bounds access issue related to GRUB relocation
> code path when inspecting early boot code.
>
> 9589927e5b changed an EFI only path to work with GRUB. Yet the following
> two lines within an if condition remained untouched.
>
>     mod[mbi->mods_count].mod_start = virt_to_mfn(_stext);
>     mod[mbi->mods_count].mod_end = __2M_rwdata_end - _stext;
>
> Before your change they were fine because the mod array was created one
> element larger in Xen (see e22e1c47958a). I don't think GRUB does the
> same. So this is an out of bounds access for GRUB case.

You are right! I will post a fix next week.

Have a nice weekend,

Daniel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel