Check that the total number of states passed in and hence the size of
buffers is sufficient to avoid writing more than the caller has
allocated.
The interface is not explicit about whether getpx.total is expected to
be set by the caller in this case but since it is always set in
libxenctrl it seems reasonable to check it.
Signed-off-by: Ross Lagerwall <ross.lagerw...@citrix.com>
Fixes: c06a7db0c547 ("X86 and IA64: Update cpufreq statistic logic for
supporting both x86 and ia64")
---
In v2: Rather than erroring out, copy as much as possible.
xen/drivers/acpi/pmstat.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/xen/drivers/acpi/pmstat.c b/xen/drivers/acpi/pmstat.c
index c51b9ca358c2..4736a84d1256 100644
--- a/xen/drivers/acpi/pmstat.c
+++ b/xen/drivers/acpi/pmstat.c
@@ -103,8 +103,10 @@ int do_get_pm_info(struct xen_sysctl_get_pmstat *op)
cpufreq_residency_update(op->cpuid, pxpt->u.cur);
- ct = pmpt->perf.state_count;
- if ( copy_to_guest(op->u.getpx.trans_pt, pxpt->u.trans_pt, ct*ct) )
+ ct = min_t(uint32_t, pmpt->perf.state_count, op->u.getpx.total);
+
+ if ( ct <= op->u.getpx.total &&
+ copy_to_guest(op->u.getpx.trans_pt, pxpt->u.trans_pt, ct * ct) )
{
spin_unlock(cpufreq_statistic_lock);
ret = -EFAULT;
--
2.49.0
