From 646bcc17cea3d4d25348cd794a666c51f813c804 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Apr 2026 12:20:23 +0200 Subject: [PATCH] arinc653: avoid array overrun Incrementing ->sched_index between bounds check and array access may result in accessing one past the array when that is fully filled (->num_schedule_entries == ARINC653_MAX_DOMAINS_PER_SCHEDULE). Fixes: 22787f2e107c ("ARINC 653 scheduler") Reported-by: Kamil Frankowicz Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross Reviewed-by: Stewart Hildebrand master commit: 5a1121633f2ae97d96d3e66472cf373a6caa3d51 master date: 2026-03-26 10:47:41 +0100 --- xen/common/sched/arinc653.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/xen/common/sched/arinc653.c b/xen/common/sched/arinc653.c index bde15eb7e1..c35bfbd04e 100644 --- a/xen/common/sched/arinc653.c +++ b/xen/common/sched/arinc653.c @@ -552,12 +552,9 @@ a653sched_do_schedule( /* Switch minor frame or find correct minor frame after a miss */ while ( (now >= sched_priv->next_switch_time) && - (sched_priv->sched_index < sched_priv->num_schedule_entries) ) - { - sched_priv->sched_index++; + (++sched_priv->sched_index < sched_priv->num_schedule_entries) ) sched_priv->next_switch_time += sched_priv->schedule[sched_priv->sched_index].runtime; - } /* * If we exhausted the domains in the schedule and still have time left