[PATCH 03/13] raw/ntb: fix memory window bound in address remapping
Raghavendra Ningoji
raghavendra.ningoji at amd.com
Wed Nov 4 12:19:51 CET 2026
When translating a peer address into the local mapping of a memory
window, the end of the window was included in the accepted range,
so an address one byte past the window was mapped.
Exclude the end of the window.
Fixes: 11b5c7daf019 ("raw/ntb: add enqueue and dequeue functions")
Fixes: d6dc5a7f8b06 ("raw/ntb: support AMD NTB")
Cc: stable at dpdk.org
Signed-off-by: Raghavendra Ningoji <raghavendra.ningoji at amd.com>
---
drivers/raw/ntb/ntb_hw_amd.c | 2 +-
drivers/raw/ntb/ntb_hw_intel.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/raw/ntb/ntb_hw_amd.c b/drivers/raw/ntb/ntb_hw_amd.c
index dba5b03671..64075501c2 100644
--- a/drivers/raw/ntb/ntb_hw_amd.c
+++ b/drivers/raw/ntb/ntb_hw_amd.c
@@ -166,7 +166,7 @@ amd_ntb_ioremap(const struct rte_rawdev *dev, uint64_t addr)
for (i = 0; i < ntb->peer_used_mws; i++) {
if (addr >= ntb->peer_mw_base[i] &&
- addr <= ntb->peer_mw_base[i] + ntb->mw_size[i]) {
+ addr < ntb->peer_mw_base[i] + ntb->mw_size[i]) {
base = amd_ntb_get_peer_mw_addr(dev, i);
mapped = (void *)(size_t)(addr - ntb->peer_mw_base[i] + (size_t)base);
break;
diff --git a/drivers/raw/ntb/ntb_hw_intel.c b/drivers/raw/ntb/ntb_hw_intel.c
index 78fce9ffac..47d5d39339 100644
--- a/drivers/raw/ntb/ntb_hw_intel.c
+++ b/drivers/raw/ntb/ntb_hw_intel.c
@@ -312,7 +312,7 @@ intel_ntb_ioremap(const struct rte_rawdev *dev, uint64_t addr)
for (i = 0; i < hw->peer_used_mws; i++) {
if (addr >= hw->peer_mw_base[i] &&
- addr <= hw->peer_mw_base[i] + hw->mw_size[i]) {
+ addr < hw->peer_mw_base[i] + hw->mw_size[i]) {
base = intel_ntb_get_peer_mw_addr(dev, i);
mapped = (void *)(size_t)(addr - hw->peer_mw_base[i] +
(size_t)base);
--
2.34.1
More information about the stable
mailing list