From 860f8f3f5348bba50b468f50e4fb9030786d6d70 Mon Sep 17 00:00:00 2001 From: Matthew Lugg Date: Mon, 17 Nov 2025 17:09:53 +0000 Subject: [PATCH] linux-user: fix reserved_va page leak in do_munmap The old logic had an off-by-one bug. For instance, assuming 4k pages on host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then 'last = start + 4096', so 'real_last = start + 4095', so ultimately 'real_len = 4096'. I do not believe this could cause any observable bugs in guests, because `target_munmap` page-aligns the length it passes in. However, calls to this function in `target_mremap` do not page-align the length, so those calls could "drop" pages, leading to a part of the reserved region becoming unmapped. At worst, a host allocation could get mapped into that hole, then clobbered by a new guest mapping. Signed-off-by: Matthew Lugg Reviewed-by: Richard Henderson Signed-off-by: Richard Henderson Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk> (cherry picked from commit 81ceab30492ed251addae8539f7b69a069b0f984) Signed-off-by: Michael Tokarev --- linux-user/mmap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 6163f1a0d1..4bcfaf7894 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -1029,9 +1029,9 @@ static int mmap_reserve_or_unmap(abi_ulong start, abi_ulong len) void *host_start; int prot; - last = start + len - 1; + last = ROUND_UP(start + len, TARGET_PAGE_SIZE) - 1; real_start = start & -host_page_size; - real_last = ROUND_UP(last, host_page_size) - 1; + real_last = ROUND_UP(last + 1, host_page_size) - 1; /* * If guest pages remain on the first or last host pages,