[RFC QEMU PATCH 12/18] softmmu: Fix the size to map cache with xen for host virtual address

[Huang Rui]

The xen_map_cache function wants to pass offset and size of this memory
block as the input parameters to map the host virtual address. However,
block->offset is too large as 0x100000000 (4G), if we assign the size as
block->max_length (0x110000000), the mapped host address will be out of
block->max_length and easy to overflow. We have to assign the size as
(block->max_length - block->offset), then that is able to ensure the
address will be located in legal range inside of max_length.

{rcu = {next = 0x0, func = 0x0}, mr = 0x55555681b620, host = 0x0,
colo_cache = 0x0, offset = 0x100000000, used_length = 0x110000000,
max_length = 0x110000000, resized = 0x0, flags = 0x10, idstr = {0x78,
0x65, 0x6e, 0x2e, 0x72, 0x61, 0x6d, 0x0 <repeats 249 times>}, next = {
    le_next = 0x5555568c61b0, le_prev = 0x55555681c640},
ramblock_notifiers = {lh_first = 0x0}, fd = 0xffffffff, page_size =
0x1000, bmap = 0x0, receivedmap = 0x0, clear_bmap = 0x0,
clear_bmap_shift = 0x0, postcopy_length = 0x0}

Signed-off-by: Huang Rui <ray.huang@amd.com>
---
 softmmu/physmem.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index 1b606a3002..1b0bb35da9 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -2304,7 +2304,7 @@ void *qemu_map_ram_ptr(RAMBlock *ram_block, ram_addr_t 
addr)
             return xen_map_cache(addr, 0, 0, false);
         }
 
-        block->host = xen_map_cache(block->offset, block->max_length, 1, 
false);
+       block->host = xen_map_cache(block->offset, block->max_length, 1, false);
     }
     return ramblock_ptr(block, addr);
 }
@@ -2337,7 +2337,8 @@ static void *qemu_ram_ptr_length(RAMBlock *ram_block, 
ram_addr_t addr,
             return xen_map_cache(addr, *size, lock, lock);
         }
 
-        block->host = xen_map_cache(block->offset, block->max_length, 1, lock);
+       block->host = xen_map_cache(block->offset,
+                                   block->max_length - block->offset, 1, lock);
     }
 
     return ramblock_ptr(block, addr);
-- 
2.25.1