All of lore.kernel.org
 help / color / mirror / Atom feed
From: Xie Yongji <xieyongji@bytedance.com>
To: mst@redhat.com, jasowang@redhat.com, dan.carpenter@oracle.com
Cc: virtualization@lists.linux-foundation.org, kvm@vger.kernel.org,
	linux-kernel@vger.kernel.org
Subject: [PATCH 2/2] vhost: Fix the calculation in vhost_overflow()
Date: Fri, 16 Jul 2021 18:22:39 +0800	[thread overview]
Message-ID: <20210716102239.96-2-xieyongji@bytedance.com> (raw)
In-Reply-To: <20210716102239.96-1-xieyongji@bytedance.com>

This fixes the incorrect calculation for integer overflow
when the last address of iova range is 0xffffffff.

Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around“)
Reported-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Xie Yongji <xieyongji@bytedance.com>
---
 drivers/vhost/vhost.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index b9e853e6094d..a9fd1b311d2f 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -738,7 +738,8 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz)
 static bool vhost_overflow(u64 uaddr, u64 size)
 {
 	/* Make sure 64 bit math will not overflow. */
-	return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size;
+	return uaddr > ULONG_MAX || size > ULONG_MAX ||
+	       uaddr - 1 > ULONG_MAX - size;
 }
 
 /* Caller should have vq mutex and device mutex. */
-- 
2.11.0


  reply	other threads:[~2021-07-16 10:23 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-16 10:22 [PATCH 1/2] vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() Xie Yongji
2021-07-16 10:22 ` Xie Yongji [this message]
2021-07-19  3:30   ` [PATCH 2/2] vhost: Fix the calculation in vhost_overflow() Jason Wang
2021-07-19  3:30     ` Jason Wang
2021-07-19  3:30 ` [PATCH 1/2] vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() Jason Wang
2021-07-19  3:30   ` Jason Wang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210716102239.96-2-xieyongji@bytedance.com \
    --to=xieyongji@bytedance.com \
    --cc=dan.carpenter@oracle.com \
    --cc=jasowang@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mst@redhat.com \
    --cc=virtualization@lists.linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.