[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [XEN PATCH] tools/xl: Fix when config "cpus" is set, but "vcpus" is missing
- To: Anthony PERARD <anthony@xxxxxxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Jason Andryuk <jason.andryuk@xxxxxxx>
- Date: Wed, 17 Dec 2025 14:12:56 -0500
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=93Pg54C/Zq8Vgoxm6nxTM7ENl42znJcO3e1OP/RpM2A=; b=hXnIrjnnL/uISMb/ssy4pc6NCZjcJRocwbdIGMuCnEEdz7OcwYvBPUAXGYIZawjfETcz1Zf9gHq5UqDVbU8blFHM5/UqkSWbkgLcOVetIfB7bUmuYvNxAOTNDHjIYL9XQ9kUxqeKAGYORc5Jdo4iMhC15KwUBzdZjHkec/YObNEG9f29vsapizskFU7ZgMOZ2sXzi3dt0arr7yDnqrwPLNPxkA6h4R0XV6HHHHcROFnMLf9aPJtObrJfDSR7Wj+lYG/ZJEWC3z0hWmJai92T/kouT1i4i3VaZe6fpC+SzirBtaFN4C2ek1JHUZuDcz4JA6TDUDSYY+ewJQbyrJEdHg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mpHYu2CP47hyQ/e9Lv83gFLLJwIyG8Lpf3wLuFKvjHDlH3ddMT0ldgncj/dNXuLLxD4J4i0LByaboMg3DWokNmdzM7Ucvzl1KtUB5tQ9/kAKkzm3cPYROcJxja1klwL6qadytBAuDoOyq8HnSeLz+2HOSn4lm70QbkIliRB5HphKbbLYRO3omWXpf70KbPlxLO64ys7NWfs13ztHEmvLwFXpRsrHJTxdahAm8tJbPrSj2xhAzB4MIv0B9L31Qz6hcVJY1mkxBjiRf814+coLquVWpb6RS3EfWFrHk9pHjqoAFJlBLZb2o+ow1Snx9+vEWKuk0cCwEADuW+0gujOZmg==
- Cc: Anthony PERARD <anthony.perard@xxxxxxxxxx>
- Delivery-date: Wed, 17 Dec 2025 19:13:24 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 2025-12-17 12:26, Anthony PERARD wrote:
From: Anthony PERARD <anthony.perard@xxxxxxxxxx>
If we start a guest with 'cpus="all"' and without 'vcpus' or
'maxvcpus' (or sets them to 0), we execute parse_vcpu_affinity() with
`num_cpus=0`. This malloc "b_info->vcpu_hard_affinity" with a buffer
of size 0, which is implementation defined, and we still initialise
the "first" bitmap of this allocation, which mean we have a buffer
overflow.
On Alpine Linux, this result in a segv when the buffer is being
disposed of.
Since libxl will assume there's at least 1 vcpu, we default to 1 in
xl as well. (libxl sets max_vcpus to 1 if unset, and allocate
avail_vcpus if its size is 0.)
Link: https://gitlab.alpinelinux.org/alpine/aports/-/issues/17809
Fixes: a5dbdcf6743a ("libxl/xl: push VCPU affinity pinning down to libxl")
Signed-off-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
Reviewed-by: Jason Andryuk <jason.andryuk@xxxxxxx>
Thanks,
Jason
|
