From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753801AbdHUTpK (ORCPT ); Mon, 21 Aug 2017 15:45:10 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36592 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753479AbdHUTpJ (ORCPT ); Mon, 21 Aug 2017 15:45:09 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com B972481E0E Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx01.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=mst@redhat.com Date: Mon, 21 Aug 2017 22:45:07 +0300 From: "Michael S. Tsirkin" To: linux-kernel@vger.kernel.org Cc: Koichiro Den , Jason Wang , kvm@vger.kernel.org, virtualization@lists.linux-foundation.org, netdev@vger.kernel.org, David Miller Subject: [PATCH] vhost: fix end of range for access_ok Message-ID: <1503344576-8141-1-git-send-email-mst@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Mutt-Fcc: =sent X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Mon, 21 Aug 2017 19:45:09 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org During access_ok checks, addr increases as we iterate over the data structure, thus addr + len - 1 will point beyond the end of region we are translating. Harmless since we then verify that the region covers addr, but let's not waste cpu cycles. Reported-by: Koichiro Den Signed-off-by: Michael S. Tsirkin --- Lightly tested, would appreciate an ack from reporter. drivers/vhost/vhost.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index e4613a3..ecd70e4 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1176,7 +1176,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, { const struct vhost_umem_node *node; struct vhost_umem *umem = vq->iotlb; - u64 s = 0, size, orig_addr = addr; + u64 s = 0, size, orig_addr = addr, last = addr + len - 1; if (vhost_vq_meta_fetch(vq, addr, len, type)) return true; @@ -1184,7 +1184,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq, while (len > s) { node = vhost_umem_interval_tree_iter_first(&umem->umem_tree, addr, - addr + len - 1); + last); if (node == NULL || node->start > addr) { vhost_iotlb_miss(vq, addr, access); return false; -- MST