From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:56226) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SuAPO-0003Bh-Hp for qemu-devel@nongnu.org; Wed, 25 Jul 2012 18:50:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SuAPN-00020R-Lc for qemu-devel@nongnu.org; Wed, 25 Jul 2012 18:50:22 -0400 From: Tyler Hall Date: Wed, 25 Jul 2012 18:45:03 -0400 Message-Id: <1343256304-32029-1-git-send-email-tylerwhall@gmail.com> Subject: [Qemu-devel] [PATCH 1/2] exec.c: Fix off-by-one error in register_subpage List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: qemu-trivial@nongnu.org, Tyler Hall subpage_register() expects "end" to be the last byte in the mapping. Registering a non-page-aligned memory region that extends up to or beyond a page boundary causes subpage_register() to silently fail through the (end >= PAGE_SIZE) check. This bug does not cause noticeable problems for mappings that do not extend to a page boundary, though they do register an extra byte. Signed-off-by: Tyler Hall --- exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exec.c b/exec.c index feb4795..27b100c 100644 --- a/exec.c +++ b/exec.c @@ -2271,7 +2271,7 @@ static void register_subpage(MemoryRegionSection *section) subpage = container_of(existing->mr, subpage_t, iomem); } start = section->offset_within_address_space & ~TARGET_PAGE_MASK; - end = start + section->size; + end = start + section->size - 1; subpage_register(subpage, start, end, phys_section_add(section)); } -- 1.7.11