Commit 58fec830 authored Jan 07, 2019 by Alex Williamson

vfio/type1: Fix unmap overflow off-by-one

The below referenced commit adds a test for integer overflow, but in
doing so prevents the unmap ioctl from ever including the last page of
the address space.  Subtract one to compare to the last address of the
unmap to avoid the overflow and wrap-around.

Fixes: 71a7d3d7 ("vfio/type1: silence integer overflow warning")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291


Cc: stable@vger.kernel.org # v4.15+
Reported-by: Pei Zhang <pezhang@redhat.com>
Debugged-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Tested-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

parent d1fc1176

drivers/vfio/vfio_iommu_type1.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -878,7 +878,7 @@ static int vfio_dma_do_unmap(struct vfio_iommu *iommu,
		return -EINVAL;
		if (!unmap->size \|\| unmap->size & mask)
		return -EINVAL;
		if (unmap->iova + unmap->size < unmap->iova \|\|
		if (unmap->iova + unmap->size - 1 < unmap->iova \|\|
		unmap->size > SIZE_MAX)
		return -EINVAL;

Admin message