crs_replace_with_free_ranges() advances its cursor past each used range by adding one to the range's limit. If the limit is UINT64_MAX, the cursor wraps to zero, potentially producing free ranges outside the requested window or overlapping used resources.
Adjust free_base and stop processing when a used range reaches or exceeds the interval's upper bound to avoid cursor wrapping and final free range insertion. Signed-off-by: Anton Kuchin <[email protected]> --- hw/acpi/aml-build.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c index 90837b513e69..b71d82b5e8a9 100644 --- a/hw/acpi/aml-build.c +++ b/hw/acpi/aml-build.c @@ -154,6 +154,12 @@ void crs_replace_with_free_ranges(GPtrArray *ranges, crs_range_insert(free_ranges, free_base, used->base - 1); } + /* avoid free_base overflow when used->limit equals UINT64_MAX */ + if (used->limit >= end) { + free_base = end; + break; + } + free_base = used->limit + 1; } -- 2.43.0
