From ba7b07d51ad65d9a2d38e08799525c7716c77825 Mon Sep 17 00:00:00 2001
From: cinap_lenrek <cinap_lenrek@felloff.net>
Date: Sun, 9 Sep 2018 01:41:35 +0200
Subject: [PATCH] devarch: restrict i/o port access to 64K, disallow msr 32-bit
 wrap arround (thanks aiju)

---
 sys/src/9/pc/devarch.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/sys/src/9/pc/devarch.c b/sys/src/9/pc/devarch.c
index 561e441ab..55d41cdf8 100644
--- a/sys/src/9/pc/devarch.c
+++ b/sys/src/9/pc/devarch.c
@@ -309,8 +309,11 @@ iounused(int start, int end)
 }
 
 static void
-checkport(int start, int end)
+checkport(uint start, uint end)
 {
+	if(end < start || end > 0x10000)
+		error(Ebadarg);
+
 	/* standard vga regs are OK */
 	if(start >= 0x2b0 && end <= 0x2df+1)
 		return;
@@ -356,12 +359,12 @@ archread(Chan *c, void *a, long n, vlong offset)
 {
 	char buf[32], *p;
 	uint port, end;
-	int i;
 	ushort *sp;
 	ulong *lp;
 	vlong *vp;
 	IOMap *m;
 	Rdwrfn *fn;
+	int i;
 
 	port = offset;
 	end = port+n;
@@ -394,6 +397,8 @@ archread(Chan *c, void *a, long n, vlong offset)
 	case Qmsr:
 		if(n & 7)
 			error(Ebadarg);
+		if((uint)n/8 > -port)
+			error(Ebadarg);
 		end = port+(n/8);
 		for(vp = a; port < end; port++)
 			if(rdmsr(port, vp++) < 0)
@@ -465,6 +470,8 @@ archwrite(Chan *c, void *a, long n, vlong offset)
 	case Qmsr:
 		if(n & 7)
 			error(Ebadarg);
+		if((uint)n/8 > -port)
+			error(Ebadarg);
 		end = port+(n/8);
 		for(vp = a; port < end; port++)
 			if(wrmsr(port, *vp++) < 0)