xen/events: prevent calling evtchn_get on invalid channels

The event channel number provided to evtchn_get can be provided by
userspace, so needs to be checked against the maximum number of event
channels prior to using it to index into evtchn_to_irq.

Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index b2d71266f6ed0ff8b589320688a8d67a26153917..f3ea75e53e089127f518256d341910d956e2b440 100644 (file)
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -1081,6 +1081,9 @@ int evtchn_get(unsigned int evtchn)
        struct irq_info *info;
        int err = -ENOENT;
 
+       if (evtchn >= NR_EVENT_CHANNELS)
+               return -EINVAL;
+
        mutex_lock(&irq_mapping_update_lock);
 
        irq = evtchn_to_irq[evtchn];