| From 83a35114d0e4583e6b0ca39502e68b6a92e2910c Mon Sep 17 00:00:00 2001 |
| From: Rusty Russell <rusty@rustcorp.com.au> |
| Date: Wed, 27 May 2015 10:59:26 +0930 |
| Subject: lguest: fix out-by-one error in address checking. |
| |
| From: Rusty Russell <rusty@rustcorp.com.au> |
| |
| commit 83a35114d0e4583e6b0ca39502e68b6a92e2910c upstream. |
| |
| This bug has been there since day 1; addresses in the top guest physical |
| page weren't considered valid. You could map that page (the check in |
| check_gpte() is correct), but if a guest tried to put a pagetable there |
| we'd check that address manually when walking it, and kill the guest. |
| |
| Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/lguest/core.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/lguest/core.c |
| +++ b/drivers/lguest/core.c |
| @@ -176,7 +176,7 @@ static void unmap_switcher(void) |
| bool lguest_address_ok(const struct lguest *lg, |
| unsigned long addr, unsigned long len) |
| { |
| - return (addr+len) / PAGE_SIZE < lg->pfn_limit && (addr+len >= addr); |
| + return addr+len <= lg->pfn_limit * PAGE_SIZE && (addr+len >= addr); |
| } |
| |
| /* |
