xen/arm: vgic: Check rank in GICD_ICFGR* emulation before locking
authorIan Campbell <ian.campbell@citrix.com>
Wed, 23 Apr 2014 15:32:45 +0000 (16:32 +0100)
committerIan Campbell <ian.campbell@citrix.com>
Wed, 23 Apr 2014 15:32:45 +0000 (16:32 +0100)
commitbf70db7cea3794cf2f3c8d714b460bba86b04791
tree9f894f2f4acecd778bcfd77aa4f4b6009bc4cc85
parent6475d700055fa952f7671cee982a23de2f5e4a7c
xen/arm: vgic: Check rank in GICD_ICFGR* emulation before locking

The function vgic_irq_rank may return NULL is the IRQ is not in range handled
by the guest. This will result to derefence a NULL pointer which will crash
Xen.

I've checked the rest of the emulation and this is only place where the lock
is taken before the rank is checked.

This is CVE-2014-2986 / XSA-94.

Signed-off-by: Julien Grall <julien.grall@linaro.org>
Reported-by: Thomas Leonard <talex5@gmail.com>
Reviewed-by: Jan Beulich <JBeulich@suse.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
xen/arch/arm/vgic.c