diff options
| author | Mateusz Guzik <mjg@FreeBSD.org> | 2020-01-19 21:35:51 +0000 |
|---|---|---|
| committer | Mateusz Guzik <mjg@FreeBSD.org> | 2020-01-19 21:35:51 +0000 |
| commit | 44c78346f638635f3909d21230b978113f3423e0 (patch) | |
| tree | c9cbcf94e1c9327d82a48b8ec84811645ddb2ab1 | |
| parent | 95a8fce118b24c0a7656f4ded4690210d9998e24 (diff) | |
| download | src-44c78346f638635f3909d21230b978113f3423e0.tar.gz src-44c78346f638635f3909d21230b978113f3423e0.zip | |
x86: fix assertion in ipi_send_cpu to range check the passed id
Prior to the change for sufficiently bad id (and in particular NOCPU which is -1)
it would access memory outside of the cpu_apic_ids array.
Notes
Notes:
svn path=/head/; revision=356897
| -rw-r--r-- | sys/x86/x86/mp_x86.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/sys/x86/x86/mp_x86.c b/sys/x86/x86/mp_x86.c index 8a3497cada54..efe221c86f24 100644 --- a/sys/x86/x86/mp_x86.c +++ b/sys/x86/x86/mp_x86.c @@ -1233,7 +1233,8 @@ ipi_send_cpu(int cpu, u_int ipi) u_int bitmap, old, new; u_int *cpu_bitmap; - KASSERT(cpu_apic_ids[cpu] != -1, ("IPI to non-existent CPU %d", cpu)); + KASSERT((u_int)cpu < MAXCPU && cpu_apic_ids[cpu] != -1, + ("IPI to non-existent CPU %d", cpu)); if (IPI_IS_BITMAPED(ipi)) { bitmap = 1 << ipi; |