From: Nathan Studer Date: Mon, 4 Nov 2013 15:20:33 +0000 (+0100) Subject: ARINC653: fix sched_priv corruption in alloc_vdata X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~6072^2~1 X-Git-Url: https://dgit.raspbian.org/%22http:/www.example.com/cgi/%22https:/%22bookmarks://%22/%22http:/www.example.com/cgi/%22https:/%22bookmarks:/%22?a=commitdiff_plain;h=d8b037eaf34233791124bf4da1f7a22c98e42523;p=xen.git ARINC653: fix sched_priv corruption in alloc_vdata The ARINC653 scheduler was directly assigning and manipulating the sched_priv field of a vcpu in its alloc_vdata function. When creating a cpu pool, this resulted in the corruption of the sched_priv field of the vcpu, which was then passed to the initial scheduler's free_vdata function with disastrous results. Signed-off-by: Nathan Studer Reviewed-by: Andrew Cooper Acked-by: George Dunlap --- diff --git a/xen/common/sched_arinc653.c b/xen/common/sched_arinc653.c index 2502192226..e5a423f4a6 100644 --- a/xen/common/sched_arinc653.c +++ b/xen/common/sched_arinc653.c @@ -380,11 +380,14 @@ a653sched_deinit(const struct scheduler *ops) static void * a653sched_alloc_vdata(const struct scheduler *ops, struct vcpu *vc, void *dd) { - /* + arinc653_vcpu_t *svc; + + /* * Allocate memory for the ARINC 653-specific scheduler data information - * associated with the given VCPU (vc). - */ - if ( (vc->sched_priv = xmalloc(arinc653_vcpu_t)) == NULL ) + * associated with the given VCPU (vc). + */ + svc = xmalloc(arinc653_vcpu_t); + if ( svc == NULL ) return NULL; /* @@ -393,13 +396,13 @@ a653sched_alloc_vdata(const struct scheduler *ops, struct vcpu *vc, void *dd) * will call the vcpu_wake scheduler callback function and our scheduler * will mark the VCPU awake. */ - AVCPU(vc)->vc = vc; - AVCPU(vc)->awake = 0; + svc->vc = vc; + svc->awake = 0; if ( !is_idle_vcpu(vc) ) - list_add(&AVCPU(vc)->list, &SCHED_PRIV(ops)->vcpu_list); + list_add(&svc->list, &SCHED_PRIV(ops)->vcpu_list); update_schedule_vcpus(ops); - return AVCPU(vc); + return svc; } /**