xen/events: prevent calling evtchn_get on invalid channels

The event channel number provided to evtchn_get can be provided by userspace, so needs to be checked against the maximum number of event channels prior to using it to index into evtchn_to_irq. Signed-off-by: Daniel De Graaf <[email protected]> Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>
goeke · Dec 16, 2011 · c3b3f16 · c3b3f16
1 parent 9438ce9
commit c3b3f16
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
@@ -1104,6 +1104,9 @@ int evtchn_get(unsigned int evtchn)
 	struct irq_info *info;
 	int err = -ENOENT;
 
+	if (evtchn >= NR_EVENT_CHANNELS)
+		return -EINVAL;
+
 	mutex_lock(&irq_mapping_update_lock);
 
 	irq = evtchn_to_irq[evtchn];