Date: Sun, 25 Dec 2022 07:02:05 GMT From: Doug Moore <dougm@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 8765df60dc26 - stable/13 - iommu_gas: avoid overflow in bounds check Message-ID: <202212250702.2BP7255T014460@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch stable/13 has been updated by dougm: URL: https://cgit.FreeBSD.org/src/commit/?id=8765df60dc26bad9d363a57a88ecfdd3fdbaf603 commit 8765df60dc26bad9d363a57a88ecfdd3fdbaf603 Author: Doug Moore <dougm@FreeBSD.org> AuthorDate: 2022-12-22 20:31:57 +0000 Commit: Doug Moore <dougm@FreeBSD.org> CommitDate: 2022-12-25 07:01:16 +0000 iommu_gas: avoid overflow in bounds check Change the range test in iommu_gas_match_one from '< ubound' to '<= ubound', and pass a smaller-by-one ubound parameter to it, to avoid overflow in ubound calculation. Reported by: andrew Reviewed by: andrew (previous version) MFC after: 3 days Differential Revision: https://reviews.freebsd.org/D37764 (cherry picked from commit 5b9b55fbc43261fc1467caaf7f2b70b8f752e479) --- sys/dev/iommu/iommu_gas.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/sys/dev/iommu/iommu_gas.c b/sys/dev/iommu/iommu_gas.c index 5654bc7ed8de..86fc3bfa093c 100644 --- a/sys/dev/iommu/iommu_gas.c +++ b/sys/dev/iommu/iommu_gas.c @@ -309,7 +309,7 @@ struct iommu_gas_match_args { /* * The interval [beg, end) is a free interval between two iommu_map_entries. - * Addresses can be allocated only in the range [lbound, ubound). Try to + * Addresses can be allocated only in the range [lbound, ubound]. Try to * allocate space in the free interval, subject to the conditions expressed by * a, and return 'true' if and only if the allocation attempt succeeds. */ @@ -332,10 +332,10 @@ iommu_gas_match_one(struct iommu_gas_match_args *a, iommu_gaddr_t beg, start = roundup2(beg, a->common->alignment); if (start < beg) return (false); - end = MIN(end - IOMMU_PAGE_SIZE, ubound); + end = MIN(end - IOMMU_PAGE_SIZE - 1, ubound); offset = a->offset; size = a->size; - if (start + offset + size > end) + if (start + offset + size - 1 > end) return (false); /* Check for and try to skip past boundary crossing. */ @@ -349,7 +349,7 @@ iommu_gas_match_one(struct iommu_gas_match_args *a, iommu_gaddr_t beg, beg = roundup2(start + offset + 1, a->common->boundary); start = roundup2(beg, a->common->alignment); - if (start + offset + size > end || + if (start + offset + size - 1 > end || !vm_addr_bound_ok(start + offset, size, a->common->boundary)) { /* @@ -453,7 +453,7 @@ iommu_gas_find_space(struct iommu_domain *domain, * Walk the big-enough ranges tree until one satisfies alignment * requirements, or violates lowaddr address requirement. */ - addr = a->common->lowaddr + 1; + addr = a->common->lowaddr; for (curr = first; curr != NULL; curr = iommu_gas_next(curr, min_free)) { if ((first = RB_LEFT(curr, rb_entry)) != NULL && @@ -464,7 +464,7 @@ iommu_gas_find_space(struct iommu_domain *domain, return (0); } if (curr->end >= addr) { - /* All remaining ranges >= addr */ + /* All remaining ranges > addr */ break; } if ((first = RB_RIGHT(curr, rb_entry)) != NULL && @@ -502,14 +502,14 @@ iommu_gas_find_space(struct iommu_domain *domain, curr = iommu_gas_next(curr, min_free)) { if ((first = RB_LEFT(curr, rb_entry)) != NULL && iommu_gas_match_one(a, first->last, curr->start, - addr + 1, domain->end)) { + addr + 1, domain->end - 1)) { RB_INSERT_PREV(iommu_gas_entries_tree, &domain->rb_root, curr, a->entry); return (0); } if ((first = RB_RIGHT(curr, rb_entry)) != NULL && iommu_gas_match_one(a, curr->end, first->first, - addr + 1, domain->end)) { + addr + 1, domain->end - 1)) { RB_INSERT_NEXT(iommu_gas_entries_tree, &domain->rb_root, curr, a->entry); return (0);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202212250702.2BP7255T014460>