From: "Mark Langsdorf" <mark.langsdorf@amd.com>
Subject: [PATCH][cpufreq] add bounds checking for getcpuidletime
Date: Mon, 3 Dec 2007 10:48:42 -0600
Message-ID: <200712031048.42551.mark.langsdorf@amd.com>
Mime-Version: 1.0
Content-Type: text/plain;
 charset=us-ascii
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
Content-Disposition: inline
List-Unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

The Xen platform hypercall for getting the cpu idletime does not
check to make sure that all cpus in the map have indexes less 
than the size of the array that it writes the data into.  Add
bounds checking to avoid memory corruption.

Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>

diff -r d40788f07a4f xen/arch/x86/platform_hypercall.c
--- a/xen/arch/x86/platform_hypercall.c	Sun Nov 25 12:43:13 2007 +0000
+++ b/xen/arch/x86/platform_hypercall.c	Mon Dec 03 10:25:23 2007 -0600
@@ -326,6 +326,9 @@ ret_t do_platform_op(XEN_GUEST_HANDLE(xe
                 cpu_clear(cpu, cpumap);
             }
 
+            if (cpu >= ctlmap.nr_cpus) 
+                continue;
+
             ret = -EFAULT;
             if ( copy_to_guest_offset(idletimes, cpu, &idletime, 1) )
                 goto out;