xsm/flask: correct off-by-one in flask_security_avc_cachestats cpu id check

This is XSA-85.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com>
Reviewed-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Ian Campbell <ian.campbell@citrix.com>

diff --git a/xen/xsm/flask/flask_op.c b/xen/xsm/flask/flask_op.c
index f8deb37028c1c926764adef0986a6fcff098a00d..4b93e71e77e367e582da15cdb3d9aadc3f95b86f 100644 (file)
--- a/xen/xsm/flask/flask_op.c
+++ b/xen/xsm/flask/flask_op.c
@@ -464,7 +464,7 @@ static int flask_security_avc_cachestats(struct xen_flask_cache_stats *arg)
 {
     struct avc_cache_stats *st;
 
-    if ( arg->cpu > nr_cpu_ids )
+    if ( arg->cpu >= nr_cpu_ids )
         return -ENOENT;
     if ( !cpu_online(arg->cpu) )
         return -ENOENT;