lguest: fix out-by-one error in address checking.

PATCH New Rusty Russell 1 participant 1 message May 27, 2015

Share & tools

Rusty Russell

author

2015-05-27 01:40 UTC #0 lore raw

PATCH 1/1 lguest: fix out-by-one error in address checking.

This bug has been there since day 1; addresses in the top guest physical page weren't considered valid. You could map that page (the check in check_gpte() is correct), but if a guest tried to put a pagetable there we'd check that address manually when walking it, and kill the guest.

Signed-off-by Rusty Russell <[email protected]>

Cc [email protected]

drivers/lguest/core.c +1 -1

index 7dc93aa004c8..312ffd3d0017 100644
@@ -173,7 +173,7 @@ static void unmap_switcher(void)
 bool lguest_address_ok(const struct lguest *lg,
 		       unsigned long addr, unsigned long len)
 {
-	return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr);
+	return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr);
 }
 
 /*