From 479fd558e12f2985878d9634c6ec93304cdc2e4b Mon Sep 17 00:00:00 2001
From: Andrei Vagin <avagin@google.com>
Date: Wed, 31 Aug 2022 15:39:21 -0700
Subject: [PATCH] ring0: fix off-by-one bug in IsCanonical

PiperOrigin-RevId: 471373714
---
 pkg/ring0/kernel_amd64.go | 2 +-
 pkg/ring0/kernel_arm64.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/ring0/kernel_amd64.go b/pkg/ring0/kernel_amd64.go
index a8195508b..0d7f34106 100644
--- a/pkg/ring0/kernel_amd64.go
+++ b/pkg/ring0/kernel_amd64.go
@@ -215,7 +215,7 @@ func (c *CPU) EFER() uint64 {
 //
 //go:nosplit
 func IsCanonical(addr uint64) bool {
-	return addr <= 0x00007fffffffffff || addr > 0xffff800000000000
+	return addr <= 0x00007fffffffffff || addr >= 0xffff800000000000
 }
 
 // SwitchToUser performs either a sysret or an iret.
diff --git a/pkg/ring0/kernel_arm64.go b/pkg/ring0/kernel_arm64.go
index 187b244ee..b9f6f173d 100644
--- a/pkg/ring0/kernel_arm64.go
+++ b/pkg/ring0/kernel_arm64.go
@@ -54,7 +54,7 @@ func (c *CPU) StackTop() uint64 {
 //
 //go:nosplit
 func IsCanonical(addr uint64) bool {
-	return addr <= 0x0000ffffffffffff || addr > 0xffff000000000000
+	return addr <= 0x0000ffffffffffff || addr >= 0xffff000000000000
 }
 
 // SwitchToUser performs an eret.