From nobody Wed Feb 11 03:24:35 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1714461459; cv=none; d=zohomail.com; s=zohoarc; b=Xn2gCjFmGZyvGMTIAaAKZidXH5AqbbxTfa4uGMcl6ZaI1N/yMBDCU5bh9BtBPIxXqKNeUkAC9ZwtHiYAmdzr2KTqceN8GEbOUpV15qQmZJwL5s0/lzmnDn/YU6ChCzCZxfOmwMZnRv0GUxtgc2iBLoxyVPHD2ilyfiGq9Ih2TdE= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1714461459; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=0wpR3AXJttXwbHCvcOqHlANvlGK7uXtvOfZt+lhMwT8=; b=TZxgaWacEeAqpUlv6DuXbKHZH5GQtuhDp7QCuqaU4uTt2q/Mpkqn3Qh1gzGeG5EcC8mcmOcY8+aVsay2P6nlfD0wc2d100wcVx6e03b09+sPtX4KXWyzV24ecyJDZye9jC4oCJrzi/LOnBerWmtBi+R4fR4o/bMoNOMnIYd+qdU= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1714461459675573.8540921407799; Tue, 30 Apr 2024 00:17:39 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1s1hgg-0000nP-1Y; Tue, 30 Apr 2024 03:14:02 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1s1hgd-0000lG-M6 for qemu-devel@nongnu.org; Tue, 30 Apr 2024 03:14:00 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1s1hgc-0008LY-3i for qemu-devel@nongnu.org; Tue, 30 Apr 2024 03:13:59 -0400 Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-591-zEi2Zs13MuOYGNVpuLK_RA-1; Tue, 30 Apr 2024 03:13:55 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 26EF329AB425; Tue, 30 Apr 2024 07:13:55 +0000 (UTC) Received: from thuth-p1g4.redhat.com (unknown [10.39.193.79]) by smtp.corp.redhat.com (Postfix) with ESMTP id B003F40C140B; Tue, 30 Apr 2024 07:13:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1714461237; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=0wpR3AXJttXwbHCvcOqHlANvlGK7uXtvOfZt+lhMwT8=; b=LETQHyyuHKJrk2yI1EFsj4MyXEAkYe353tEKuIDowVyHtQ7PXGkpRRUBW9Tp5YeBK0NhVA PTzKm9Wxffm85ciiePp5QTdOQw4xm1/WqfDLlYDXYtu0hKcQQJBKNCIsuY8SVZp3WD89LR QPQrKQ1yl9racdswwjo+Z3uLsEEEM00= X-MC-Unique: zEi2Zs13MuOYGNVpuLK_RA-1 From: Thomas Huth To: qemu-devel@nongnu.org, Richard Henderson Cc: Chris Friedt , Chris Friedt Subject: [PULL 07/19] hw: misc: edu: fix 2 off-by-one errors Date: Tue, 30 Apr 2024 09:13:28 +0200 Message-ID: <20240430071340.413305-8-thuth@redhat.com> In-Reply-To: <20240430071340.413305-1-thuth@redhat.com> References: <20240430071340.413305-1-thuth@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.2 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=thuth@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -30 X-Spam_score: -3.1 X-Spam_bar: --- X-Spam_report: (-3.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.987, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1714461460043100008 Content-Type: text/plain; charset="utf-8" From: Chris Friedt In the case that size1 was zero, because of the explicit 'end1 > addr' check, the range check would fail and the error message would read as shown below. The correct comparison is 'end1 >=3D addr'. EDU: DMA range 0x40000-0x3ffff out of bounds (0x40000-0x40fff)! Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1254 Signed-off-by: Chris Friedt [thuth: Adjust patch with regards to the "end1 <=3D end2" check] Message-ID: <20221018122551.94567-1-cfriedt@meta.com> Signed-off-by: Thomas Huth --- hw/misc/edu.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/hw/misc/edu.c b/hw/misc/edu.c index 2a976ca2b1..14250e0ac3 100644 --- a/hw/misc/edu.c +++ b/hw/misc/edu.c @@ -103,19 +103,18 @@ static void edu_lower_irq(EduState *edu, uint32_t val) } } =20 -static bool within(uint64_t addr, uint64_t start, uint64_t end) -{ - return start <=3D addr && addr < end; -} - -static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start, - uint64_t size2) +static void edu_check_range(uint64_t addr, uint64_t size1, + uint64_t start, uint64_t size2) { uint64_t end1 =3D addr + size1; uint64_t end2 =3D start + size2; =20 - if (within(addr, start, end2) && - end1 > addr && end1 <=3D end2) { + /* + * 1. ensure we aren't overflowing + * 2. ensure that [addr, end1) is within [start, size2) + */ + if (end2 >=3D start && end1 >=3D addr && + addr >=3D start && end1 <=3D end2) { return; } =20 --=20 2.44.0