[xen stable-4.20] arinc653: avoid array overrun

[patchbot@xxxxxxx]

commit f1826fa6ebe273b17980573208b705e270689474
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Apr 20 12:33:18 2026 +0200
Commit:     Jan Beulich <jbeulich@xxxxxxxx>
CommitDate: Mon Apr 20 12:33:18 2026 +0200

    arinc653: avoid array overrun
    
    Incrementing ->sched_index between bounds check and array access may
    result in accessing one past the array when that is fully filled
    (->num_schedule_entries == ARINC653_MAX_DOMAINS_PER_SCHEDULE).
    
    Fixes: 22787f2e107c ("ARINC 653 scheduler")
    Reported-by: Kamil Frankowicz <kamil.frankowicz@xxxxxxx>
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    Reviewed-by: Stewart Hildebrand <stewart@xxxxxxx>
    master commit: 5a1121633f2ae97d96d3e66472cf373a6caa3d51
    master date: 2026-03-26 10:47:41 +0100
---
 xen/common/sched/arinc653.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c
index bedd6d4007..0cc565f2c8 100644
--- a/xen/common/sched/arinc653.c
+++ b/xen/common/sched/arinc653.c
@@ -550,12 +550,9 @@ a653sched_do_schedule(
 
     /* Switch minor frame or find correct minor frame after a miss */
     while ( (now >= sched_priv->next_switch_time) &&
-        (sched_priv->sched_index < sched_priv->num_schedule_entries) )
-    {
-        sched_priv->sched_index++;
+            (++sched_priv->sched_index < sched_priv->num_schedule_entries) )
         sched_priv->next_switch_time +=
             sched_priv->schedule[sched_priv->sched_index].runtime;
-    }
 
     /*
      * If we exhausted the domains in the schedule and still have time left
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20