hw: misc: edu: fix 2 off-by-one errors
In the case that size1 was zero, because of the explicit 'end1 > addr' check, the range check would fail and the error message would read as shown below. The correct comparison is 'end1 >= addr'. EDU: DMA range 0x40000-0x3ffff out of bounds (0x40000-0x40fff)! Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1254 Signed-off-by: Chris Friedt <cfriedt@meta.com> [thuth: Adjust patch with regards to the "end1 <= end2" check] Message-ID: <20221018122551.94567-1-cfriedt@meta.com> Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
parent
046bf2a618
commit
6982674159
@ -103,19 +103,18 @@ static void edu_lower_irq(EduState *edu, uint32_t val)
|
||||
}
|
||||
}
|
||||
|
||||
static bool within(uint64_t addr, uint64_t start, uint64_t end)
|
||||
{
|
||||
return start <= addr && addr < end;
|
||||
}
|
||||
|
||||
static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start,
|
||||
uint64_t size2)
|
||||
static void edu_check_range(uint64_t addr, uint64_t size1,
|
||||
uint64_t start, uint64_t size2)
|
||||
{
|
||||
uint64_t end1 = addr + size1;
|
||||
uint64_t end2 = start + size2;
|
||||
|
||||
if (within(addr, start, end2) &&
|
||||
end1 > addr && end1 <= end2) {
|
||||
/*
|
||||
* 1. ensure we aren't overflowing
|
||||
* 2. ensure that [addr, end1) is within [start, size2)
|
||||
*/
|
||||
if (end2 >= start && end1 >= addr &&
|
||||
addr >= start && end1 <= end2) {
|
||||
return;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user