add bounds checking for getcpuidletime

PATCH In review Mark Langsdorf 2 participants 3 messages Dec 3, 2007 – Dec 4, 2007

Share & tools

Mark Langsdorf

author

2007-12-03 16:48 UTC #0 lore raw

PATCH 1/1 add bounds checking for getcpuidletime

The Xen platform hypercall for getting the cpu idletime does not check to make sure that all cpus in the map have indexes less than the size of the array that it writes the data into. Add bounds checking to avoid memory corruption.

Signed-off-by Mark Langsdorf <[email protected]>

xen/arch/x86/platform_hypercall.c +3 -0

diff -r d40788f07a4f xen/arch/x86/platform_hypercall.c
@@ -326,6 +326,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE(xe
                 cpu_clear(cpu, cpumap);
             }
 
+            if (cpu >= ctlmap.nr_cpus) 
+                continue;
+
             ret = -EFAULT;
             if ( copy_to_guest_offset(idletimes, cpu, &idletime, 1) )
                 goto out;

Keir Fraser

2007-12-04 11:53 UTC #1 lore raw

This is supposed to be handled by xenctl_cpumap_to_cpumask, but it looks like it's buggy. I checked in a fix as changeset 16519. Can you please try with that and see if it fixes your problem?

-- Keir

Quoted 27 lines · Mark Langsdorf

The Xen platform hypercall for getting the cpu idletime does not check to make sure that all cpus in the map have indexes less than the size of the array that it writes the data into. Add bounds checking to avoid memory corruption.
Signed-off-by Mark Langsdorf <[email protected]>
diff -r d40788f07a4f xen/arch/x86/platform_hypercall.c
xen/arch/x86/platform_hypercall.c Mon Dec 03 10:25:23 2007 -0600 renamed from xen/arch/x86/platform_hypercall.c Sun Nov 25 12:43:13 2007 +0000 +3 -0
@@ -326,6 +326,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE(xe
                 cpu_clear(cpu, cpumap);
             }
 
+            if (cpu >= ctlmap.nr_cpus)
+                continue;
+
             ret = -EFAULT;
             if ( copy_to_guest_offset(idletimes, cpu, &idletime, 1) )
                 goto out;
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel

Langsdorf, Mark

author

2007-12-04 16:51 UTC #2 lore raw

16519 fixes my problem. Thanks!

-Mark Langsdorf
Operating System Research Center
AMD

Quoted 52 lines

-----Original Message-----
From: Keir Fraser [mailto:[email protected]]
Sent: Tuesday, December 04, 2007 5:54 AM
To: Langsdorf, Mark; [email protected]
Subject: Re: [Xen-devel] [PATCH][cpufreq] add bounds checking for getcpuidletime
This is supposed to be handled by xenctl_cpumap_to_cpumask, but it looks
like it's buggy. I checked in a fix as changeset 16519. Can you please try
with that and see if it fixes your problem?
-- Keir
Quoted 9 lines · Mark Langsdorf
The Xen platform hypercall for getting the cpu idletime does not check to make sure that all cpus in the map have indexes less than the size of the array that it writes the data into. Add bounds checking to avoid memory corruption.
Signed-off-by Mark Langsdorf <[email protected]>
diff -r d40788f07a4f xen/arch/x86/platform_hypercall.c --- a/xen/arch/x86/platform_hypercall.c Sun Nov 25 12:43:13
2007 +0000
Quoted 1 line
+++ b/xen/arch/x86/platform_hypercall.c Mon Dec 03 10:25:23
2007 -0600
xen/arch/x86/platform_hypercall.c ret_t do_platform_op(XEN_GUEST_HANDLE(xe · line 333
Quoted 9 lines
xen/arch/x86/platform_hypercall.c +3 -0
@@ -326,6 +326,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE(xe
                 cpu_clear(cpu, cpumap);
             }
 
+            if (cpu >= ctlmap.nr_cpus)
+                continue;
+
             ret = -EFAULT;
             if ( copy_to_guest_offset(idletimes, cpu, 
&idletime, 1) )
Quoted 8 lines
xen/arch/x86/platform_hypercall.c +0 -0
                 goto out;
_______________________________________________
Xen-devel mailing list
[email protected]
http://lists.xensource.com/xen-devel