edu: fix DMA range upper bound check

[PATCH] edu: fix DMA range upper bound check

Posted by Max Erenberg 11 months ago

The edu_check_range function checks that start <= end1 < end2, where
end1 is the upper bound (exclusive) of the guest-supplied DMA range and
end2 is the upper bound (exclusive) of the device's allowed DMA range.
When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1
will be equal to end2, so the check fails and QEMU aborts with this
puzzling error message (newlines added for formatting):

  qemu: hardware error: EDU: DMA range
    0x0000000000040000-0x0000000000040fff out of bounds
   (0x0000000000040000-0x0000000000040fff)!

By checking end1 <= end2 instead, guests will be allowed to transfer
exactly 4096 bytes. It is not necessary to explicitly check for
start <= end1 because the previous two checks (within(addr, start, end2)
and end1 > addr) imply start < end1.

Signed-off-by: Max Erenberg <merenber@uwaterloo.ca>
---
 hw/misc/edu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/edu.c b/hw/misc/edu.c
index a1f8bc7..e64a246 100644
--- a/hw/misc/edu.c
+++ b/hw/misc/edu.c
@@ -115,7 +115,7 @@ static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start,
     uint64_t end2 = start + size2;
 
     if (within(addr, start, end2) &&
-            end1 > addr && within(end1, start, end2)) {
+            end1 > addr && end1 <= end2) {
         return;
     }
 
-- 
2.39.2

Re: [PATCH] edu: fix DMA range upper bound check

Posted by Michael Tokarev 10 months, 4 weeks ago

26.12.2023 02:44, Max Erenberg:
> The edu_check_range function checks that start <= end1 < end2, where
> end1 is the upper bound (exclusive) of the guest-supplied DMA range and
> end2 is the upper bound (exclusive) of the device's allowed DMA range.
> When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1
> will be equal to end2, so the check fails and QEMU aborts with this
> puzzling error message (newlines added for formatting):
> 
>    qemu: hardware error: EDU: DMA range
>      0x0000000000040000-0x0000000000040fff out of bounds
>     (0x0000000000040000-0x0000000000040fff)!
> 
> By checking end1 <= end2 instead, guests will be allowed to transfer
> exactly 4096 bytes. It is not necessary to explicitly check for
> start <= end1 because the previous two checks (within(addr, start, end2)
> and end1 > addr) imply start < end1.

Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21)

Applied to trivial-patches tree, and queued for -stable.

Thanks,

/mjt