diff options
| author | David Hildenbrand <david@redhat.com> | 2019-08-26 09:51:07 +0200 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2019-09-03 08:34:18 -0700 |
| commit | 46750128631eaace54b69ddd8b63683edd4606cc (patch) | |
| tree | 30d2582988ba04806cb204c639a2a3d9809e400c /target/s390x/mem_helper.c | |
| parent | 9e5bef4920b85f30e6f1588b742abb10bc840c93 (diff) | |
s390x/tcg: Fix length calculation in probe_write_access()
Hm... how did that "-" slip in (-TAGRET_PAGE_SIZE would be correct). This
currently makes us exceed one page in a single probe_write() call,
essentially leaving some memory unchecked.
Fixes: c5a7392cfb96 ("s390x/tcg: Provide probe_write_access helper")
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Message-Id: <20190826075112.25637-3-david@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'target/s390x/mem_helper.c')
| -rw-r--r-- | target/s390x/mem_helper.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/target/s390x/mem_helper.c b/target/s390x/mem_helper.c index 7819aca15d..4b43440e89 100644 --- a/target/s390x/mem_helper.c +++ b/target/s390x/mem_helper.c @@ -2623,7 +2623,7 @@ void probe_write_access(CPUS390XState *env, uint64_t addr, uint64_t len, #else /* test the actual access, not just any access to the page due to LAP */ while (len) { - const uint64_t pagelen = -(addr | -TARGET_PAGE_MASK); + const uint64_t pagelen = -(addr | TARGET_PAGE_MASK); const uint64_t curlen = MIN(pagelen, len); probe_write(env, addr, curlen, cpu_mmu_index(env, false), ra); |