Re: [Xen-devel] [PATCH] xen: arm: Avoid reading beyond the last module

[Ian Campbell <ian.campbell@xxxxxxxxxx>]

On Mon, 2015-07-20 at 13:32 +0100, Julien Grall wrote:
> Hi Chris,
> 
> On 17/07/15 21:48, Chris (Christopher) Brand wrote:
> > nr_mods is set in add_boot_module() to the number of module
> > array elements used. This function also ensures that nr_mods
> > never exceeds MAX_MODULES (the size of the array). When looping
> > through the array, the correct maximum index is "nr_mods-1",
> > not "nr_mods". If the array is full, using the latter will in
> > fact access beyond the end of the array.
> > This was done correctly in boot_module_find_by_kind() and
> > consider_modules() but incorrectly in discard_initial_modules()
> > and next_module().
> > 
> > Signed-off-by: Chris Brand <chris.brand@xxxxxxxxxxxx>
> 
> Reviewed-by: Julien Grall <julien.grall@xxxxxxxxxx>

Acked + applied.

Care should be taken when backporting since I think this off-by-one was
the result of us previously not including Xen in nr_mods despite it
being in the array or something like that (i..e the off-by-one used to
be correct).

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel