WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] Bug in smpboot.c?

To: "John McDermott (U.S. Navy Employee)" <john.mcdermott@xxxxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxx>
Subject: Re: [Xen-devel] Bug in smpboot.c?
From: Keir Fraser <keir@xxxxxxx>
Date: Fri, 10 Jun 2011 08:30:10 +0100
Cc:
Delivery-date: Fri, 10 Jun 2011 00:32:32 -0700
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:sender:user-agent:date:subject:from:to :message-id:thread-topic:thread-index:in-reply-to:mime-version :content-type:content-transfer-encoding; bh=Q3SB3CDZaTOnhoS3LHPZzzubFPdni7sE6CbAKMqzfOk=; b=mRmKCaXxhHZ8W9qZYAMMx95SBFl9q0i9hw/08iUr6Xfl8dEofJVE2xPrRvCaCT2tWO Y/FER5OHVxyJR6ah/Mv+e2W3Hkk4WVZhs8StLO+SJZLi/B39ecIlCpsRLUe0L4Y1THYN vh2jK0SBR28k2fsluyQlrOXRVfawp9pj0U6+g=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=sender:user-agent:date:subject:from:to:message-id:thread-topic :thread-index:in-reply-to:mime-version:content-type :content-transfer-encoding; b=csp+NcSlLYeIoEr8fqHjBED46Mr7Fkf5H+Mqxb5wgRgegllGDHt1jLxIzuQIpiZ4cB ly1D4PX0zjHnPpsltOMPZF93ZuSX4RchfIeNtEBReYkV1YngjKZrnZ6pmtoGyGITuci5 XGDLdyLGiJHRqiPWAGPaVYe4s/sF0GTX+WH0s=
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <FF7C94F8-BCD0-4B8F-8574-201BAF6C3FA2@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
Thread-index: AcwnQDqDU4TmSRUxZkeRBfYm2GNHZA==
Thread-topic: [Xen-devel] Bug in smpboot.c?
User-agent: Microsoft-Entourage/12.29.0.110113
On 09/06/2011 16:49, "John McDermott (U.S. Navy Employee)"
<john.mcdermott@xxxxxxxxxxxx> wrote:

> Xen Developers,
> 
> In C function cpu_add(), in xen/arch/x86/smpboot.c, if acpi_id ==
> MAX_MADT_ENTRIES, won't this write past the end of array
> x86_acpiid_toapicid[MAX_MADT_ENTRIES]? I am looking at xen-unstable. It looks
> like the guard is not catching this 1 case?

Fixed in xen-unstable:23505. Fortunately this function is only accessible
from the TCB so it's not exploitable.

 Thanks,
 -- Keir

> Sincerely,
> 
> John McDermott
> ----
> What is the formal meaning of the one-line program
> #include "/dev/tty"
> 
> J.P. McDermott   building 12
> Code 5542   mcdermott@xxxxxxxxxxxxxxxx
> Naval Research Laboratory voice: +1 202.404.8301
> Washington, DC 20375, US fax:   +1 202.404.7942
> 
> 
> 
> 
> 
> 
> 
> 
> 
> 
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel