[Xen-changelog] [xen stable-4.6] x86/sysctl: don't clobber memory if NCAPINTS > ARRAY_SIZE(pi->hw_cap)

[patchbot@xxxxxxx]

commit 63e3edcc6c5f4ffcee7f0f63a161ba6f58ac99ed
Author:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
AuthorDate: Wed Sep 16 11:22:00 2015 +0200
Commit:     Ian Campbell <ian.campbell@xxxxxxxxxx>
CommitDate: Thu Sep 17 12:22:08 2015 +0100

    x86/sysctl: don't clobber memory if NCAPINTS > ARRAY_SIZE(pi->hw_cap)
    
    There is no current problem, as both NCAPINTS and pi->hw_cap are 8 entries,
    but the limit should be calculated appropriately so as to avoid hypervisor
    stack corruption if the two do get out of sync.
    
    Signed-off-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    (cherry picked from commit c373b912e74659f0e0898ae93e89513694cfd94e)
---
 xen/arch/x86/sysctl.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/xen/arch/x86/sysctl.c b/xen/arch/x86/sysctl.c
index f36b52f..38b5dcb 100644
--- a/xen/arch/x86/sysctl.c
+++ b/xen/arch/x86/sysctl.c
@@ -75,7 +75,8 @@ long cpu_down_helper(void *data)
 
 void arch_do_physinfo(xen_sysctl_physinfo_t *pi)
 {
-    memcpy(pi->hw_cap, boot_cpu_data.x86_capability, NCAPINTS*4);
+    memcpy(pi->hw_cap, boot_cpu_data.x86_capability,
+           min(sizeof(pi->hw_cap), sizeof(boot_cpu_data.x86_capability)));
     if ( hvm_enabled )
         pi->capabilities |= XEN_SYSCTL_PHYSCAP_hvm;
     if ( iommu_enabled )
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.6

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog