vfio/platform: check the bounds of read/write syscalls

count and offset are passed from user space and not checked, only
offset is capped to 40 bits, which can be used to read/write out of
bounds of the device.

Fixes: 6e3f26456009 (“vfio/platform: read and write support for the device fd”)
Cc: [e-mail]
Reported-by: Mostafa Saleh <[e-mail]>
Reviewed-by: Eric Auger <[e-mail]>
Reviewed-by: Mostafa Saleh <[e-mail]>
Tested-by: Mostafa Saleh <[e-mail]>
Signed-off-by: Alex Williamson <[e-mail]>

drivers/vfio/platform/vfio_platform_common.c

···
 {
 	unsigned int done = 0;
 
+	if (off >= reg->size)
+		return -EINVAL;
+
+	count = min_t(size_t, count, reg->size - off);
+
 	if (!reg->ioaddr) {
 		reg->ioaddr =
 			ioremap(reg->addr, reg->size);
···
 					loff_t off)
 {
 	unsigned int done = 0;
+
+	if (off >= reg->size)
+		return -EINVAL;
+
+	count = min_t(size_t, count, reg->size - off);
 
 	if (!reg->ioaddr) {
 		reg->ioaddr =