commit 49840a4a098149067789255bca6894645f411036
author Richard Henderson <richard.henderson@linaro.org> Mon Mar 06 01:51:09 2023 +0300
committer Richard Henderson <richard.henderson@linaro.org> Tue Mar 28 15:23:10 2023 -0700
tree 0b5cd9d9f8ef1770890352e9a58bc1e39aa89c6c
parent 2f7828b5729337c61e6c58466d0d78af079db42d

accel/tcg: Pass last not end to page_set_flags

Pass the address of the last byte to be changed, rather than
the first address past the last byte.  This avoids overflow
when the last page of the address space is involved.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1528
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

linux-user/syscall.c

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 2787164..69f740f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4595,7 +4595,7 @@
     }
     raddr=h2g((unsigned long)host_raddr);
 
-    page_set_flags(raddr, raddr + shm_info.shm_segsz,
+    page_set_flags(raddr, raddr + shm_info.shm_segsz - 1,
                    PAGE_VALID | PAGE_RESET | PAGE_READ |
                    (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
 
@@ -4625,7 +4625,7 @@
     for (i = 0; i < N_SHM_REGIONS; ++i) {
         if (shm_regions[i].in_use && shm_regions[i].start == shmaddr) {
             shm_regions[i].in_use = false;
-            page_set_flags(shmaddr, shmaddr + shm_regions[i].size, 0);
+            page_set_flags(shmaddr, shmaddr + shm_regions[i].size - 1, 0);
             break;
         }
     }