From 2c5107e1b455d4a157124f021826ead4e04b4aea Mon Sep 17 00:00:00 2001 From: Max Erenberg Date: Mon, 25 Dec 2023 18:44:32 -0500 Subject: [PATCH] edu: fix DMA range upper bound check The edu_check_range function checks that start <= end1 < end2, where end1 is the upper bound (exclusive) of the guest-supplied DMA range and end2 is the upper bound (exclusive) of the device's allowed DMA range. When the guest tries to transfer exactly DMA_SIZE (4096) bytes, end1 will be equal to end2, so the check fails and QEMU aborts with this puzzling error message (newlines added for formatting): qemu: hardware error: EDU: DMA range 0x0000000000040000-0x0000000000040fff out of bounds (0x0000000000040000-0x0000000000040fff)! By checking end1 <= end2 instead, guests will be allowed to transfer exactly 4096 bytes. It is not necessary to explicitly check for start <= end1 because the previous two checks (within(addr, start, end2) and end1 > addr) imply start < end1. Fixes: b30934cb52a7 ("hw: misc, add educational driver", 2015-01-21) Signed-off-by: Max Erenberg Signed-off-by: Michael Tokarev --- hw/misc/edu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hw/misc/edu.c b/hw/misc/edu.c index a1f8bc77e7..e64a246d3f 100644 --- a/hw/misc/edu.c +++ b/hw/misc/edu.c @@ -115,7 +115,7 @@ static void edu_check_range(uint64_t addr, uint64_t size1, uint64_t start, uint64_t end2 = start + size2; if (within(addr, start, end2) && - end1 > addr && within(end1, start, end2)) { + end1 > addr && end1 <= end2) { return; }