From: Julien Grall <julien.grall@arm.com>
Date: Tue, 6 Jun 2017 14:35:42 +0000 (+0100)
Subject: xen/arm: vgic: Sanitize target mask used to send SGI
X-Git-Tag: archive/raspbian/4.8.1-1+rpi1+deb9u3^2~7
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=0b05e37ddc3972f942cccdecc3b0284dc2718112;p=xen.git

xen/arm: vgic: Sanitize target mask used to send SGI

The current function vgic_to_sgi does not sanitize the target mask and
may therefore get an invalid vCPU ID. This will result to an out of
bound access of d->vcpu[...] as there is no check whether the vCPU ID is
within the maximum supported by the guest.

This was introduced by commit ea37fd2111 "xen/arm: split vgic driver
into generic and vgic-v2 driver".

Signed-off-by: Julien Grall <julien.grall@arm.com>
Reviewed-by: Stefano Stabellini <sstabellini@kernel.org>


Gbp-Pq: Name xenarm-vgic-sanitize-target-mask-used-to
---

diff --git a/xen/arch/arm/vgic.c b/xen/arch/arm/vgic.c
index d12e6f05ee..d800afed3b 100644
--- a/xen/arch/arm/vgic.c
+++ b/xen/arch/arm/vgic.c
@@ -396,7 +396,8 @@ int vgic_to_sgi(struct vcpu *v, register_t sgir, enum gic_sgi_mode irqmode, int
         for_each_set_bit( i, &bitmap, sizeof(target->list) * 8 )
         {
             vcpuid = base + i;
-            if ( d->vcpu[vcpuid] == NULL || !is_vcpu_online(d->vcpu[vcpuid]) )
+            if ( vcpuid >= d->max_vcpus || d->vcpu[vcpuid] == NULL ||
+                 !is_vcpu_online(d->vcpu[vcpuid]) )
             {
                 gprintk(XENLOG_WARNING, "VGIC: write r=%"PRIregister" \
                         target->list=%hx, wrong CPUTargetList \n",