From: Chris Friedt <chrisfriedt@gmail.com>
In the case that size1 was zero, because of the explicit
'end1 > addr' check, the range check would fail and the error
message would read as shown below. The correct comparison
is 'end1 >= addr'.
EDU: DMA range 0x40000-0x3ffff out of bounds (0x40000-0x40fff)!
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1254
Signed-off-by: Chris Friedt <cfriedt@meta.com>
[thuth: Adjust patch with regards to the "end1 <= end2" check]
Message-ID: <20221018122551.94567-1-cfriedt@meta.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
hw/misc/edu.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index 2a976ca2b1..14250e0ac3 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -103,19 +103,18 @@ static void edu_lower_irq(EduState *edu, uint32_t val)
}
}
-static bool within(uint64_t addr, uint64_t start, uint64_t end)
-{
- return start <= addr && addr < end;
-}
-
-static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start,
- uint64_t size2)
+static void edu_check_range(uint64_t addr, uint64_t size1,
+ uint64_t start, uint64_t size2)
{
uint64_t end1 = addr + size1;
uint64_t end2 = start + size2;
- if (within(addr, start, end2) &&
- end1 > addr && end1 <= end2) {
+ /*
+ * 1. ensure we aren't overflowing
+ * 2. ensure that [addr, end1) is within [start, size2)
+ */
+ if (end2 >= start && end1 >= addr &&
+ addr >= start && end1 <= end2) {
return;
}
--
2.44.0