nx2: make the 216 sparse request range checks overflow-safe

4d6a13e3d9 and 3d6156434a added bounds checks to the nx2:gpu 216 sparse
map path, but the region checks still compute gpu_address + size, which
wraps for a guest-controlled size. 3d6156434a only guards size == 0 and
the memory offset on the map path, so an unmap (memory handle 0) with a
huge size matches a region through the wrapped sum and reaches
Nx2SparseTile, whose own check wraps the same way, and then
smmu.Unmap(device, size) with a giant page count.

Reject a request whose end wraps the address space before it is used,
for map and unmap alike, with a warning like the existing unknown-memory
check. Also compare by subtraction in the region lookups here and in
Nx2SparseTile and Nx2BackSparse, so none of them depends on the sum.

Assisted-by: Claude Sonnet 5.5 (implementation and commit message)

0 files changed, 0 insertions, 0 deletions