[PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range

[Bin Guo <guobin@linux.alibaba.com>]

virtio_iommu_map() did not check that virt_end >= virt_start.  An
inverted range corrupts the GTree comparator contract (interval_cmp
returns non-zero for a key compared with itself), causing an infinite
loop in virtio_iommu_unmap() while holding s->mutex.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4104
Cc: qemu-stable@nongnu.org
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
---
 hw/virtio/virtio-iommu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 533bd5073f..cc863e90d2 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -807,6 +807,10 @@ static int virtio_iommu_map(VirtIOIOMMU *s,
         return VIRTIO_IOMMU_S_INVAL;
     }
 
+    if (virt_end < virt_start) {
+        return VIRTIO_IOMMU_S_INVAL;
+    }
+
     domain = g_tree_lookup(s->domains, GUINT_TO_POINTER(domain_id));
     if (!domain) {
         return VIRTIO_IOMMU_S_NOENT;
-- 
2.50.1 (Apple Git-155)