Re: [Qemu-devel] [Qemu-trivial] [PATCH 1/2] exec.c: Fix off-by-one error in register_subpage

[Stefan Hajnoczi]

On Wed, Jul 25, 2012 at 06:45:03PM -0400, Tyler Hall wrote:
> subpage_register() expects "end" to be the last byte in the mapping.
> Registering a non-page-aligned memory region that extends up to or
> beyond a page boundary causes subpage_register() to silently fail
> through the (end >= PAGE_SIZE) check.
> 
> This bug does not cause noticeable problems for mappings that do not
> extend to a page boundary, though they do register an extra byte.
> 
> Signed-off-by: Tyler Hall <address@hidden>
> ---
>  exec.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/exec.c b/exec.c
> index feb4795..27b100c 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -2271,7 +2271,7 @@ static void register_subpage(MemoryRegionSection 
> *section)
>          subpage = container_of(existing->mr, subpage_t, iomem);
>      }
>      start = section->offset_within_address_space & ~TARGET_PAGE_MASK;
> -    end = start + section->size;
> +    end = start + section->size - 1;
>      subpage_register(subpage, start, end, phys_section_add(section));
>  }

I would really like to see an Acked-by: or Signed-off-by: from Avi or
someone else who is familiar with the memory regions code.  Especially
for Patch 2/2.

Stefan