Commit 58fec830 authored by Alex Williamson's avatar Alex Williamson

vfio/type1: Fix unmap overflow off-by-one

The below referenced commit adds a test for integer overflow, but in
doing so prevents the unmap ioctl from ever including the last page of
the address space.  Subtract one to compare to the last address of the
unmap to avoid the overflow and wrap-around.

Fixes: 71a7d3d7 ("vfio/type1: silence integer overflow warning")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291
Cc: stable@vger.kernel.org # v4.15+
Reported-by: default avatarPei Zhang <pezhang@redhat.com>
Debugged-by: default avatarPeter Xu <peterx@redhat.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarPeter Xu <peterx@redhat.com>
Tested-by: default avatarPeter Xu <peterx@redhat.com>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Signed-off-by: default avatarAlex Williamson <alex.williamson@redhat.com>
parent d1fc1176
...@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu, ...@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu,
return -EINVAL; return -EINVAL;
if (!unmap->size || unmap->size & mask) if (!unmap->size || unmap->size & mask)
return -EINVAL; return -EINVAL;
if (unmap->iova + unmap->size < unmap->iova || if (unmap->iova + unmap->size - 1 < unmap->iova ||
unmap->size > SIZE_MAX) unmap->size > SIZE_MAX)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment