diff options
author | Petr Matousek <pmatouse@redhat.com> | 2013-05-31 12:28:18 +0200 |
---|---|---|
committer | Jan Beulich <jbeulich@suse.com> | 2013-05-31 12:28:18 +0200 |
commit | 8dd9cde5d454e4cee55d0202abfd52ceeff1cd94 (patch) | |
tree | efb5641e2e30582804d80fd879707c437719fa45 /tools | |
parent | 360d23bfb87588809719ecd3c319f8b514034a04 (diff) | |
download | xen-8dd9cde5d454e4cee55d0202abfd52ceeff1cd94.tar.gz xen-8dd9cde5d454e4cee55d0202abfd52ceeff1cd94.tar.bz2 xen-8dd9cde5d454e4cee55d0202abfd52ceeff1cd94.zip |
libxc: limit cpu values when setting vcpu affinity
When support for pinning more than 64 cpus was added, check for cpu
out-of-range values was removed. This can lead to subsequent
out-of-bounds cpumap array accesses in case the cpu number is higher
than the actual count.
This patch returns the check.
This is CVE-2013-2072 / XSA-56
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
master commit: 41abbadef60e5fccdfd688579dd458f7f7887cf5
master date: 2013-05-29 15:49:22 +0100
Diffstat (limited to 'tools')
-rw-r--r-- | tools/python/xen/lowlevel/xc/xc.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c index 2600b90060..1c4ac93ba7 100644 --- a/tools/python/xen/lowlevel/xc/xc.c +++ b/tools/python/xen/lowlevel/xc/xc.c @@ -228,6 +228,7 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, int vcpu = 0, i; xc_cpumap_t cpumap; PyObject *cpulist = NULL; + int nr_cpus; static char *kwd_list[] = { "domid", "vcpu", "cpumap", NULL }; @@ -235,6 +236,10 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, &dom, &vcpu, &cpulist) ) return NULL; + nr_cpus = xc_get_max_cpus(self->xc_handle); + if ( nr_cpus == 0 ) + return pyxc_error_to_exception(self->xc_handle); + cpumap = xc_cpumap_alloc(self->xc_handle); if(cpumap == NULL) return pyxc_error_to_exception(self->xc_handle); @@ -244,6 +249,13 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, for ( i = 0; i < PyList_Size(cpulist); i++ ) { long cpu = PyInt_AsLong(PyList_GetItem(cpulist, i)); + if ( cpu < 0 || cpu >= nr_cpus ) + { + free(cpumap); + errno = EINVAL; + PyErr_SetFromErrno(xc_error_obj); + return NULL; + } cpumap[cpu / 8] |= 1 << (cpu % 8); } } |