From patchwork Tue Jan 12 15:11:45 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Pierre Morel X-Patchwork-Id: 566593 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 1CCB21402D9 for ; Wed, 13 Jan 2016 02:12:31 +1100 (AEDT) Received: from localhost ([::1]:60846 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJ0cW-0001KK-Mf for incoming@patchwork.ozlabs.org; Tue, 12 Jan 2016 10:12:28 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53055) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJ0bw-0000BT-KH for qemu-devel@nongnu.org; Tue, 12 Jan 2016 10:11:53 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aJ0bt-0003KH-Tu for qemu-devel@nongnu.org; Tue, 12 Jan 2016 10:11:52 -0500 Received: from e06smtp12.uk.ibm.com ([195.75.94.108]:55598) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aJ0bt-0003Iv-Kq for qemu-devel@nongnu.org; Tue, 12 Jan 2016 10:11:49 -0500 Received: from localhost by e06smtp12.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 12 Jan 2016 15:11:48 -0000 Received: from d06dlp01.portsmouth.uk.ibm.com (9.149.20.13) by e06smtp12.uk.ibm.com (192.168.101.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 12 Jan 2016 15:11:47 -0000 X-IBM-Helo: d06dlp01.portsmouth.uk.ibm.com X-IBM-MailFrom: pmorel@linux.vnet.ibm.com X-IBM-RcptTo: qemu-devel@nongnu.org Received: from b06cxnps4076.portsmouth.uk.ibm.com (d06relay13.portsmouth.uk.ibm.com [9.149.109.198]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id 47EC217D805F for ; Tue, 12 Jan 2016 15:11:48 +0000 (GMT) Received: from d06av03.portsmouth.uk.ibm.com (d06av03.portsmouth.uk.ibm.com [9.149.37.213]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id u0CFBkUY9503034 for ; Tue, 12 Jan 2016 15:11:46 GMT Received: from d06av03.portsmouth.uk.ibm.com (localhost [127.0.0.1]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id u0CFBkY6015522 for ; Tue, 12 Jan 2016 08:11:46 -0700 Received: from oc3773252478.ibm.com (dyn-9-152-224-135.boeblingen.de.ibm.com [9.152.224.135]) by d06av03.portsmouth.uk.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id u0CFBjoc015514; Tue, 12 Jan 2016 08:11:45 -0700 From: Pierre Morel To: alex.williamson@redhat.com Date: Tue, 12 Jan 2016 16:11:45 +0100 Message-Id: <1452611505-25478-1-git-send-email-pmorel@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.1 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16011215-0009-0000-0000-00000742FFF4 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-Received-From: 195.75.94.108 Cc: pbonzini@redhat.com, qemu-devel@nongnu.org, peter.maydell@linaro.org Subject: [Qemu-devel] [PATCH v3] vfio/common: Check iova with limit not with size X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org In vfio_listener_region_add(), we try to validate that the region is not zero sized and hasn't overflowed the addresses space. But the calculation uses the size of the region instead of using the region's limit (size - 1). This leads to Int128 overflow when the region has been initialized to UINT64_MAX because in this case memory_region_init() transform the size from UINT64_MAX to int128_2_64(). Let's really use the limit by sustracting one to the size and take care to use the limit for functions using limit and size to call functions which need size. Signed-off-by: Pierre Morel --- Changes from v2: - all, just ignore v2, sorry about this, this is build after v1 Changes from v1: - adjust the tests by knowing we already substracted one to end. hw/vfio/common.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) diff --git a/hw/vfio/common.c b/hw/vfio/common.c index 6797208..a5f6643 100644 --- a/hw/vfio/common.c +++ b/hw/vfio/common.c @@ -348,12 +348,12 @@ static void vfio_listener_region_add(MemoryListener *listener, if (int128_ge(int128_make64(iova), llend)) { return; } - end = int128_get64(llend); + end = int128_get64(int128_sub(llend, int128_one())); - if ((iova < container->min_iova) || ((end - 1) > container->max_iova)) { + if ((iova < container->min_iova) || (end > container->max_iova)) { error_report("vfio: IOMMU container %p can't map guest IOVA region" " 0x%"HWADDR_PRIx"..0x%"HWADDR_PRIx, - container, iova, end - 1); + container, iova, end); ret = -EFAULT; goto fail; } @@ -363,7 +363,7 @@ static void vfio_listener_region_add(MemoryListener *listener, if (memory_region_is_iommu(section->mr)) { VFIOGuestIOMMU *giommu; - trace_vfio_listener_region_add_iommu(iova, end - 1); + trace_vfio_listener_region_add_iommu(iova, end); /* * FIXME: We should do some checking to see if the * capabilities of the host VFIO IOMMU are adequate to model @@ -394,13 +394,13 @@ static void vfio_listener_region_add(MemoryListener *listener, section->offset_within_region + (iova - section->offset_within_address_space); - trace_vfio_listener_region_add_ram(iova, end - 1, vaddr); + trace_vfio_listener_region_add_ram(iova, end, vaddr); - ret = vfio_dma_map(container, iova, end - iova, vaddr, section->readonly); + ret = vfio_dma_map(container, iova, end - iova + 1, vaddr, section->readonly); if (ret) { error_report("vfio_dma_map(%p, 0x%"HWADDR_PRIx", " "0x%"HWADDR_PRIx", %p) = %d (%m)", - container, iova, end - iova, vaddr, ret); + container, iova, end - iova + 1, vaddr, ret); goto fail; }