Commit 20167609 authored Mar 07, 2019 by Dan Carpenter Committed by Juergen Gross Mar 08, 2019

xen, cpu_hotplug: Prevent an out of bounds access



The "cpu" variable comes from the sscanf() so Smatch marks it as
untrusted data.  We can't pass a higher value than "nr_cpu_ids" to
cpu_possible() or it results in an out of bounds access.

Fixes: d68d82af ("xen: implement CPU hotplugging")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Juergen Gross <jgross@suse.com>

parent b1ddd406

drivers/xen/cpu_hotplug.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -54,7 +54,7 @@ static int vcpu_online(unsigned int cpu)
		}
		static void vcpu_hotplug(unsigned int cpu)
		{
		if (!cpu_possible(cpu))
		if (cpu >= nr_cpu_ids \|\| !cpu_possible(cpu))
		return;

		switch (vcpu_online(cpu)) {

Admin message