From: Razvan Cojocaru <rcojocaru@bitdefender.com>
Date: Wed, 21 Jun 2017 16:37:31 +0000 (+0300)
Subject: x86/monitor: Fixed CID 1412966: Memory - corruptions (OVERRUN)
X-Git-Tag: archive/raspbian/4.11.1-1+rpi1~1^2~66^2~1933
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=b20f8cd11fbfc6e40a00b63e3c2d53549221def0;p=xen.git

x86/monitor: Fixed CID 1412966: Memory - corruptions (OVERRUN)

Fixed an issue where the maximum index allowed (31) goes beyond the
actual number of array elements (4) of ad->monitor.write_ctrlreg_mask.
Coverity-ID: 1412966

Signed-off-by: Razvan Cojocaru <rcojocaru@bitdefender.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
---

diff --git a/xen/arch/x86/monitor.c b/xen/arch/x86/monitor.c
index bedf13c74d..764195a7d1 100644
--- a/xen/arch/x86/monitor.c
+++ b/xen/arch/x86/monitor.c
@@ -132,8 +132,8 @@ int arch_monitor_domctl_event(struct domain *d,
         unsigned int ctrlreg_bitmask;
         bool_t old_status;
 
-        /* sanity check: avoid left-shift undefined behavior */
-        if ( unlikely(mop->u.mov_to_cr.index > 31) )
+        if ( unlikely(mop->u.mov_to_cr.index >=
+                      ARRAY_SIZE(ad->monitor.write_ctrlreg_mask)) )
             return -EINVAL;
 
         if ( unlikely(mop->u.mov_to_cr.pad1 || mop->u.mov_to_cr.pad2) )