From: Ian Jackson <Ian.Jackson@eu.citrix.com>
Date: Wed, 5 Sep 2012 11:29:52 +0000 (+0100)
Subject: x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI
X-Git-Tag: archive/raspbian/4.8.0-1+rpi1~1^2~7988
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=76ea16276c15d89c3b1d67a58e55fa11cf42a1d7;p=xen.git

x86/pvhvm: properly range-check PHYSDEVOP_map_pirq/MAP_PIRQ_TYPE_GSI

This is being used as a array index, and hence must be validated before
use.

This is XSA-16 / CVE-2012-3498.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
---

diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c
index b0458fdec5..3aa157f706 100644
--- a/xen/arch/x86/physdev.c
+++ b/xen/arch/x86/physdev.c
@@ -42,11 +42,18 @@ static int physdev_hvm_map_pirq(
         struct hvm_girq_dpci_mapping *girq;
         uint32_t machine_gsi = 0;
 
+        if ( *index < 0 || *index >= NR_HVM_IRQS )
+        {
+            ret = -EINVAL;
+            break;
+        }
+
         /* find the machine gsi corresponding to the
          * emulated gsi */
         hvm_irq_dpci = domain_get_irq_dpci(d);
         if ( hvm_irq_dpci )
         {
+            BUILD_BUG_ON(ARRAY_SIZE(hvm_irq_dpci->girq) < NR_HVM_IRQS);
             list_for_each_entry ( girq,
                                   &hvm_irq_dpci->girq[*index],
                                   list )