From 46750128631eaace54b69ddd8b63683edd4606cc Mon Sep 17 00:00:00 2001 From: David Hildenbrand Date: Mon, 26 Aug 2019 09:51:07 +0200 Subject: [PATCH] s390x/tcg: Fix length calculation in probe_write_access() Hm... how did that "-" slip in (-TAGRET_PAGE_SIZE would be correct). This currently makes us exceed one page in a single probe_write() call, essentially leaving some memory unchecked. Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper") Reviewed-by: Richard Henderson Signed-off-by: David Hildenbrand Reviewed-by: Cornelia Huck Message-Id: <20190826075112.25637-3-david@redhat.com> Signed-off-by: Richard Henderson --- target/s390x/mem_helper.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c index 7819aca15d..4b43440e89 100644 --- a/target/s390x/mem_helper.c +++ b/target/s390x/mem_helper.c @@ -2623,7 +2623,7 @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len, #else /* test the actual access, not just any access to the page due to LAP */ while (len) { - const uint64_t pagelen = -(addr | -TARGET_PAGE_MASK); + const uint64_t pagelen = -(addr | TARGET_PAGE_MASK); const uint64_t curlen = MIN(pagelen, len); probe_write(env, addr, curlen, cpu_mmu_index(env, false), ra);