From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:57514)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1Z0NUI-0006S2-Ep
	for qemu-devel@nongnu.org; Thu, 04 Jun 2015 01:14:43 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1Z0NUH-0005le-Cj
	for qemu-devel@nongnu.org; Thu, 04 Jun 2015 01:14:42 -0400
Received: from hall.aurel32.net ([2001:bc8:30d7:101::1]:41760)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <aurelien@aurel32.net>) id 1Z0NUH-0005l2-6K
	for qemu-devel@nongnu.org; Thu, 04 Jun 2015 01:14:41 -0400
Date: Thu, 4 Jun 2015 07:14:37 +0200
From: Aurelien Jarno <aurelien@aurel32.net>
Message-ID: <20150604051437.GA23217@aurel32.net>
References: <1433371964-130944-1-git-send-email-agraf@suse.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1433371964-130944-1-git-send-email-agraf@suse.de>
Subject: Re: [Qemu-devel] [PATCH] target-s390x: Only access allocated
	storage keys
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Alexander Graf <agraf@suse.de>
Cc: qemu-devel@nongnu.org, rth@twiddle.net

On 2015-06-04 00:52, Alexander Graf wrote:
> We allocate ram_size / PAGE_SIZE storage keys, so we need to make sure that
> we only access that many. Unfortunately the code can overrun this array by
> one, potentially overwriting unrelated memory.
> 
> Fix it by limiting storage keys to their scope.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>
> ---
>  target-s390x/mmu_helper.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target-s390x/mmu_helper.c b/target-s390x/mmu_helper.c
> index e8dcd0c..815ff42 100644
> --- a/target-s390x/mmu_helper.c
> +++ b/target-s390x/mmu_helper.c
> @@ -358,7 +358,7 @@ int mmu_translate(CPUS390XState *env, target_ulong vaddr, int rw, uint64_t asc,
>      /* Convert real address -> absolute address */
>      *raddr = mmu_real2abs(env, *raddr);
>  
> -    if (*raddr <= ram_size) {
> +    if (*raddr < ram_size) {
>          sk = &env->storage_keys[*raddr / TARGET_PAGE_SIZE];
>          if (*flags & PAGE_READ) {
>              *sk |= SK_R;

Reviewed-by: Aurelien Jarno <aurelien@aurel32.net>

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net