From: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Date: Thu, 26 Mar 2015 10:13:01 +0000 (+0100)
Subject: sysctl: don't overwrite array size variable when it is set on error earlier
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~3524
X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=26da081ac91a2caa661cb5fcb2aec6929b044a4b;p=xen.git

sysctl: don't overwrite array size variable when it is set on error earlier

When querying CPU topology, if caller-provided array size is smaller than
number of online CPUs then, in addition to returning -ENOBUFS, sysctl is
expected to provide back this number. However, this value, stored in 'i',
is overwritten in the subsequent loop's control statement.

Make sure we don't do this by converting the loop to 'while'.

Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/common/sysctl.c b/xen/common/sysctl.c
index a8c629f38d..70413cc5c9 100644
--- a/xen/common/sysctl.c
+++ b/xen/common/sysctl.c
@@ -338,8 +338,10 @@ long do_sysctl(XEN_GUEST_HANDLE_PARAM(xen_sysctl_t) u_sysctl)
                 ret = -ENOBUFS;
                 i = num_cpus;
             }
+            else
+                i = 0;
 
-            for ( i = 0; i < num_cpus; i++ )
+            for ( ; i < num_cpus; i++ )
             {
                 xen_sysctl_cputopo_t cputopo;