| Message ID | 20200605154929.26910-15-alex.bennee@linaro.org |
|---|---|
| State | New |
| Headers | show |
| Series | various fixes for next PR (testing, vhost, guest_base fixes) | expand |
On 6/5/20 5:49 PM, Alex Bennée wrote: > Relaxing the restrictions on 64 bit guests leads to the user being > able to attempt to map right at the edge of addressable memory. This > in turn lead to address overflow tripping the assert in page_set_flags > when the end address wrapped around. > > Detect the wrap earlier and correctly -ENOMEM the guest (in the > reported case LTP mmap15). > > Fixes: 7d8cbbabcb Reported-by: Laurent Vivier <laurent@vivier.eu> > Signed-off-by: Alex Bennée <alex.bennee@linaro.org> > --- > linux-user/mmap.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/linux-user/mmap.c b/linux-user/mmap.c > index e3780337974..2e05bd499e6 100644 > --- a/linux-user/mmap.c > +++ b/linux-user/mmap.c > @@ -467,7 +467,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, > * It can fail only on 64-bit host with 32-bit target. > * On any other target/host host mmap() handles this error correctly. > */ > - if (!guest_range_valid(start, len)) { > + if (end < start || !guest_range_valid(start, len)) { > errno = ENOMEM; > goto fail; > } >
diff --git a/linux-user/mmap.c b/linux-user/mmap.c index e3780337974..2e05bd499e6 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -467,7 +467,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, * It can fail only on 64-bit host with 32-bit target. * On any other target/host host mmap() handles this error correctly. */ - if (!guest_range_valid(start, len)) { + if (end < start || !guest_range_valid(start, len)) { errno = ENOMEM; goto fail; }
Relaxing the restrictions on 64 bit guests leads to the user being able to attempt to map right at the edge of addressable memory. This in turn lead to address overflow tripping the assert in page_set_flags when the end address wrapped around. Detect the wrap earlier and correctly -ENOMEM the guest (in the reported case LTP mmap15). Fixes: 7d8cbbabcb Signed-off-by: Alex Bennée <alex.bennee@linaro.org> --- linux-user/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)