* xen: Fix off-by-one error when parsing command line arguments
@ 2012-07-02 12:52 Andrew Cooper
2012-07-03 9:34 ` Jan Beulich
0 siblings, 1 reply; 2+ messages in thread
From: Andrew Cooper @ 2012-07-02 12:52 UTC (permalink / raw)
To: xen-de >> "xen-devel@lists.xen.org",
Keir Fraser, Jan Beulich, Ian Campbell
[-- Attachment #1: Type: text/plain, Size: 261 bytes --]
This is a bug which is present in at least unstable and 4.1, so should
be considered for 4.2, as well as being considered for backport to older
versions.
--
Andrew Cooper - Dom0 Kernel Engineer, Citrix XenServer
T: +44 (0)1223 225 900, http://www.citrix.com
[-- Attachment #2: xen-fix-cmdline-parsing.patch --]
[-- Type: text/x-patch, Size: 1239 bytes --]
# HG changeset patch
# Parent 4f92bdf3370c4fe5ed0f00cdeaf8156e4818ecb5
xen: Fix off-by-one error when parsing command line arguments
As Xen currently stands, it will attempt to interpret the first few bytes of the
initcall section as a struct kernel_param.
This can be verified as
for ( param = &__setup_start; param <= &__setup_end; param++ )
{
+ if ( (unsigned long)param == (unsigned long)&__initcall_start )
+ BUG();
causes Xen to BUG() during early boot.
The reason that this not caused problems is because in the overflow case,
param->name is actually a function pointer to the first initcall, and
intepreting it as string is very unlikely to match an ASCII command line
parameter name.
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
diff -r 4f92bdf3370c xen/common/kernel.c
--- a/xen/common/kernel.c
+++ b/xen/common/kernel.c
@@ -90,7 +90,7 @@ void __init cmdline_parse(const char *cm
if ( !bool_assert )
optkey += 3;
- for ( param = &__setup_start; param <= &__setup_end; param++ )
+ for ( param = &__setup_start; param < &__setup_end; param++ )
{
if ( strcmp(param->name, optkey) )
continue;
[-- Attachment #3: Type: text/plain, Size: 126 bytes --]
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
http://lists.xen.org/xen-devel
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: xen: Fix off-by-one error when parsing command line arguments
2012-07-02 12:52 xen: Fix off-by-one error when parsing command line arguments Andrew Cooper
@ 2012-07-03 9:34 ` Jan Beulich
0 siblings, 0 replies; 2+ messages in thread
From: Jan Beulich @ 2012-07-03 9:34 UTC (permalink / raw)
To: Andrew Cooper, KeirFraser; +Cc: Ian Campbell, xen-devel
>>> On 02.07.12 at 14:52, Andrew Cooper <andrew.cooper3@citrix.com> wrote:
> This is a bug which is present in at least unstable and 4.1, so should
> be considered for 4.2, as well as being considered for backport to older
> versions.
Indeed, the problem goes back to at least 3.2.0.
Keir, if you would ack this I could push it into -unstable at least
(pulling over into 4.1 and 4.0 would still need to be done later
by you).
Jan
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-07-03 9:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-07-02 12:52 xen: Fix off-by-one error when parsing command line arguments Andrew Cooper
2012-07-03 9:34 ` Jan Beulich
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.