diff options
author | Ian Jackson <ian.jackson@eu.citrix.com> | 2013-05-29 15:48:11 +0100 |
---|---|---|
committer | Ian Jackson <Ian.Jackson@eu.citrix.com> | 2013-05-29 15:49:22 +0100 |
commit | 41abbadef60e5fccdfd688579dd458f7f7887cf5 (patch) | |
tree | 3e8ac2766d55e06f625edf85b99b1a8e46d791e4 /tools | |
parent | ae5092f420e87a4a6b541bf581378c8cc0ee3a99 (diff) | |
download | xen-41abbadef60e5fccdfd688579dd458f7f7887cf5.tar.gz xen-41abbadef60e5fccdfd688579dd458f7f7887cf5.tar.bz2 xen-41abbadef60e5fccdfd688579dd458f7f7887cf5.zip |
libxc: limit cpu values when setting vcpu affinity4.3.0-rc3
When support for pinning more than 64 cpus was added, check for cpu
out-of-range values was removed. This can lead to subsequent
out-of-bounds cpumap array accesses in case the cpu number is higher
than the actual count.
This patch returns the check.
This is CVE-2013-2072 / XSA-56
Signed-off-by: Petr Matousek <pmatouse@redhat.com>
Diffstat (limited to 'tools')
-rw-r--r-- | tools/python/xen/lowlevel/xc/xc.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/tools/python/xen/lowlevel/xc/xc.c b/tools/python/xen/lowlevel/xc/xc.c index e220f685a0..e611b2419f 100644 --- a/tools/python/xen/lowlevel/xc/xc.c +++ b/tools/python/xen/lowlevel/xc/xc.c @@ -228,6 +228,7 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, int vcpu = 0, i; xc_cpumap_t cpumap; PyObject *cpulist = NULL; + int nr_cpus; static char *kwd_list[] = { "domid", "vcpu", "cpumap", NULL }; @@ -235,6 +236,10 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, &dom, &vcpu, &cpulist) ) return NULL; + nr_cpus = xc_get_max_cpus(self->xc_handle); + if ( nr_cpus == 0 ) + return pyxc_error_to_exception(self->xc_handle); + cpumap = xc_cpumap_alloc(self->xc_handle); if(cpumap == NULL) return pyxc_error_to_exception(self->xc_handle); @@ -244,6 +249,13 @@ static PyObject *pyxc_vcpu_setaffinity(XcObject *self, for ( i = 0; i < PyList_Size(cpulist); i++ ) { long cpu = PyInt_AsLong(PyList_GetItem(cpulist, i)); + if ( cpu < 0 || cpu >= nr_cpus ) + { + free(cpumap); + errno = EINVAL; + PyErr_SetFromErrno(xc_error_obj); + return NULL; + } cpumap[cpu / 8] |= 1 << (cpu % 8); } } |