fridtjof/qemu-cr16
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

linux-user: fix reserved_va page leak in do_munmap

Browse source 
The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>
(cherry picked from commit 81ceab30492ed251addae8539f7b69a069b0f984)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
This commit is contained in:
Matthew Lugg 2025-11-17 17:09:53 +00:00 • committed by Michael Tokarev
parent 5ac0811f40
commit 860f8f3f53
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
linux-user/mmap.c
View file

@ -1029,9 +1029,9 @@ static int mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
void *host_start;
int prot;
last = start + len - 1;
last = ROUND_UP(start + len, TARGET_PAGE_SIZE) - 1;
real_start = start & -host_page_size;
real_last = ROUND_UP(last, host_page_size) - 1;
real_last = ROUND_UP(last + 1, host_page_size) - 1;
/*
* If guest pages remain on the first or last host pages,