[patch] KVM: make checks stricter in coalesced_mmio_in_range()

[patch] KVM: make checks stricter in coalesced_mmio_in_range()

[Dan Carpenter]

My testing version of Smatch complains that addr and len come from
the user and they can wrap.  The path is:
  -> kvm_vm_ioctl()
     -> kvm_vm_ioctl_unregister_coalesced_mmio()
        -> coalesced_mmio_in_range()

I don't know what the implications are of wrapping here, but we may
as well fix it, if only to silence the warning.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
index a6ec206..88b2fe3 100644
--- a/virt/kvm/coalesced_mmio.c
+++ b/virt/kvm/coalesced_mmio.c
@@ -28,9 +28,15 @@ static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev,
 	 * (addr,len) is fully included in
 	 * (zone->addr, zone->size)
 	 */
-
-	return (dev->zone.addr <= addr &&
-		addr + len <= dev->zone.addr + dev->zone.size);
+	if (len < 0)
+		return 0;
+	if (addr + len < addr)
+		return 0;
+	if (addr < dev->zone.addr)
+		return 0;
+	if (addr + len > dev->zone.addr + dev->zone.size)
+		return 0;
+	return 1;
 }
 
 static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)

Re: [patch] KVM: make checks stricter in coalesced_mmio_in_range()

[Marcelo Tosatti]

On Wed, Oct 19, 2011 at 09:15:10AM +0300, Dan Carpenter wrote:
> My testing version of Smatch complains that addr and len come from
> the user and they can wrap.  The path is:
>   -> kvm_vm_ioctl()
>      -> kvm_vm_ioctl_unregister_coalesced_mmio()
>         -> coalesced_mmio_in_range()
> 
> I don't know what the implications are of wrapping here, but we may
> as well fix it, if only to silence the warning.

There are no negative implications, if variables wrap unregistration 
fails. Applied, thanks.