From: Stefano Stabellini Date: Mon, 12 Dec 2016 19:22:39 +0000 (-0800) Subject: fix potential pa_range_info out of bound access X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~3180 X-Git-Url: https://dgit.raspbian.org/%22http://www.example.com/cgi/%22/%22http:/www.example.com/cgi/%22?a=commitdiff_plain;h=7190f2d72441b7e5b32004e48398fa6830dd4d99;p=xen.git fix potential pa_range_info out of bound access pa_range_info has only 8 elements and is accessed using pa_range as index. pa_range is initialized to 16, potentially causing out of bound access errors. Fix the issue by checking that pa_range is not greater than the size of the array. Remove the now superfluous pa_range&0x8 check. Coverity-ID: 1381865 Signed-off-by: Stefano Stabellini Reviewed-by: Julien Grall --- diff --git a/xen/arch/arm/p2m.c b/xen/arch/arm/p2m.c index e4991df42f..5d5bb872d2 100644 --- a/xen/arch/arm/p2m.c +++ b/xen/arch/arm/p2m.c @@ -1639,7 +1639,7 @@ void __init setup_virt_paging(void) } /* pa_range is 4 bits, but the defined encodings are only 3 bits */ - if ( pa_range&0x8 || !pa_range_info[pa_range].pabits ) + if ( pa_range >= ARRAY_SIZE(pa_range_info) || !pa_range_info[pa_range].pabits ) panic("Unknown encoding of ID_AA64MMFR0_EL1.PARange %x\n", pa_range); val |= VTCR_PS(pa_range);