online_cpus is misdeclared as a 64 *byte* variable instead of a 64 *bit*
variable. This causes init_apic_map() to test random bytes when it
iterates over online_cpus, which in turn can cause it to overflow id_map
and corrupt rnadom memory, e.g. pg_base. Declare online_cpus using
MAX_TEST_CPUS, which presumably is set explicitly to match the storage
size of online_cpus (64-bit values == max of 64 CPUS).
Reported-by: Evgeny Yakovlev <wrfsh@xxxxxxxxxxxxxx>
Signed-off-by: Sean Christopherson <sean.j.christopherson@xxxxxxxxx>
---
lib/x86/apic.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/lib/x86/apic.c b/lib/x86/apic.c
index b3e39ae..f43e9ef 100644
--- a/lib/x86/apic.c
+++ b/lib/x86/apic.c
@@ -232,13 +232,13 @@ void mask_pic_interrupts(void)
outb(0xff, 0xa1);
}
-extern unsigned char online_cpus[256 / 8];
+extern unsigned char online_cpus[MAX_TEST_CPUS / 8];
void init_apic_map(void)
{
unsigned int i, j = 0;
- for (i = 0; i < sizeof(online_cpus) * 8; i++) {
+ for (i = 0; i < MAX_TEST_CPUS; i++) {
if ((1ul << (i % 8)) & (online_cpus[i / 8]))
id_map[j++] = i;
}
--
2.22.0
