[Qemu-devel] [PATCH v2] vfio/common: Check iova with limit not with size

[Pierre Morel]

In vfio_listener_region_add(), the code makes sure
that the offset in the section is lower than the size
of the section.
But the calculation uses size of the region instead of
the region's limit (size - 1).

This leads to Int128 overflow when the region has
been initialized to UINT64_MAX because in this case
memory_region_init() transform the size from UINT64_MAX
to int128_2_64().

Let's really use the limit by sustracting one to the size
and take care to use the limit for functions using limit
and size to call functions which need size.

Signed-off-by: Pierre Morel <address@hidden>
---
 hw/vfio/common.c |   15 ++++++++++-----
 1 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/common.c b/hw/vfio/common.c
index 6797208..fe4962a 100644
--- a/hw/vfio/common.c
+++ b/hw/vfio/common.c
@@ -342,18 +342,23 @@ static void vfio_listener_region_add(MemoryListener 
*listener,
 
     iova = TARGET_PAGE_ALIGN(section->offset_within_address_space);
     llend = int128_make64(section->offset_within_address_space);
-    llend = int128_add(llend, section->size);
+
+    if (int128_ge(llend, int128_2_64())) {
+        llend = int128_add(llend, int128_sub(section->size, int128_one()));
+    } else {
+        llend = int128_add(llend, section->size);
+    }
     llend = int128_and(llend, int128_exts64(TARGET_PAGE_MASK));
 
-    if (int128_ge(int128_make64(iova), llend)) {
+    if (int128_gt(int128_make64(iova), llend)) {
         return;
     }
     end = int128_get64(llend);
 
-    if ((iova < container->min_iova) || ((end - 1) > container->max_iova)) {
+    if ((iova < container->min_iova) || (end > container->max_iova)) {
         error_report("vfio: IOMMU container %p can't map guest IOVA region"
                      " 0x%"HWADDR_PRIx"..0x%"HWADDR_PRIx,
-                     container, iova, end - 1);
+                     container, iova, end);
         ret = -EFAULT;
         goto fail;
     }
@@ -363,7 +368,7 @@ static void vfio_listener_region_add(MemoryListener 
*listener,
     if (memory_region_is_iommu(section->mr)) {
         VFIOGuestIOMMU *giommu;
 
-        trace_vfio_listener_region_add_iommu(iova, end - 1);
+        trace_vfio_listener_region_add_iommu(iova, end);
         /*
          * FIXME: We should do some checking to see if the
          * capabilities of the host VFIO IOMMU are adequate to model
-- 
1.7.1