d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xen/intr: fix overflow of Xen interrupt range

Browse Source 
The comparison was wrong.  Hopefully this never occurred in the wild,
but now ensure the error message will occur before damage is caused.
This appears non-exploitable as exploitation would require a guest to
force Domain 0 to allocate all event channels, which a guest shouldn't
be able to do.

Adjust the error message to better describe what has occurred.

Reviewed by: royger
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D30743
This commit is contained in:
Elliott Mitchell 2021-05-11 15:11:06 -07:00 committed by Roger Pau Monné
parent 2d5e325303
commit 0ebf9bb42d
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
sys/x86/xen/xen_intr.c
View File

@ -314,10 +314,10 @@ xen_intr_alloc_isrc(enum evtchn_type type)
KASSERT(mtx_owned(&xen_intr_isrc_lock), ("Evtchn alloc lock not held"));
if (xen_intr_auto_vector_count > NR_EVENT_CHANNELS) {
if (xen_intr_auto_vector_count >= NR_EVENT_CHANNELS) {
if (!warned) {
warned = 1;
printf("%s: Event channels exhausted.\n", __func__);
printf("%s: Xen interrupts exhausted.\n", __func__);
}
return (NULL);
}