On Wed, 9 Dec 2020 15:34:23 -0500
Matthew Rosato <mjros...@linux.ibm.com> wrote:
> In pcistb_service_handler, a call is made to validate that the memory
> region can be accessed. However, the call is made using the entire length
> of the pcistb operation, which can be larger than the allowed memory
> access size (8). Since we already know that the provided buffer is a
> multiple of 8, fix the call to memory_region_access_valid to iterate
> over the memory region in the same way as the subsequent call to
> memory_region_dispatch_write.
>
> Signed-off-by: Matthew Rosato <mjros...@linux.ibm.com>
> ---
> hw/s390x/s390-pci-inst.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
> index b07ef2a..a5270d0 100644
> --- a/hw/s390x/s390-pci-inst.c
> +++ b/hw/s390x/s390-pci-inst.c
> @@ -795,9 +795,11 @@ static int pcistb_default(S390PCIBusDevice *pbdev,
> S390CPU *cpu,
> mr = s390_get_subregion(mr, offset, len);
> offset -= mr->addr;
>
> - if (!memory_region_access_valid(mr, offset, len, true,
> - MEMTXATTRS_UNSPECIFIED)) {
> - return -EINVAL;
> + for (i = 0; i < len / 8; i++) {
> + if (!memory_region_access_valid(mr, offset + i * 8, 8, true,
> + MEMTXATTRS_UNSPECIFIED)) {
> + return -EINVAL;
> + }
> }
>
> if (s390_cpu_virt_mem_read(cpu, gaddr, ar, pbdev->pcistb_buf, len)) {
Hm, that looks like a fix that's applicable for the current code base
as well... do you want to split this out?
