summaryrefslogtreecommitdiffstats
path: root/drivers/vhost
diff options
context:
space:
mode:
authorMichael S. Tsirkin <mst@redhat.com>2017-08-21 22:33:33 +0300
committerMichael S. Tsirkin <mst@redhat.com>2017-11-14 23:57:39 +0200
commitca2c5b33a285723f517fa296b76f7fd36c383dad (patch)
treea7b6258591856491ab4abd912c93b02958e81670 /drivers/vhost
parent816e85edff0f31bc8e4614eaaf9a0364406d7a8f (diff)
downloadlinux-stable-ca2c5b33a285723f517fa296b76f7fd36c383dad.tar.gz
linux-stable-ca2c5b33a285723f517fa296b76f7fd36c383dad.tar.bz2
linux-stable-ca2c5b33a285723f517fa296b76f7fd36c383dad.zip
vhost: fix end of range for access_ok
During access_ok checks, addr increases as we iterate over the data structure, thus addr + len - 1 will point beyond the end of region we are translating. Harmless since we then verify that the region covers addr, but let's not waste cpu cycles. Reported-by: Koichiro Den <den@klaipeden.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Acked-by: Koichiro Den <den@klaipeden.com>
Diffstat (limited to 'drivers/vhost')
-rw-r--r--drivers/vhost/vhost.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index d6dbb28245e6..33ac2b186b85 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1175,7 +1175,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq,
{
const struct vhost_umem_node *node;
struct vhost_umem *umem = vq->iotlb;
- u64 s = 0, size, orig_addr = addr;
+ u64 s = 0, size, orig_addr = addr, last = addr + len - 1;
if (vhost_vq_meta_fetch(vq, addr, len, type))
return true;
@@ -1183,7 +1183,7 @@ static int iotlb_access_ok(struct vhost_virtqueue *vq,
while (len > s) {
node = vhost_umem_interval_tree_iter_first(&umem->umem_tree,
addr,
- addr + len - 1);
+ last);
if (node == NULL || node->start > addr) {
vhost_iotlb_miss(vq, addr, access);
return false;