Re: [PATCH] linux-user: fix issues with mmap on 4K guest on 16K host and library load

[Andreas Kemnade <andreas@kemnade.info>]

On Fri, 7 Aug 2026 23:26:07 +0200
Helge Deller <deller@gmx.de> wrote:

> On 8/5/26 18:40, Andreas Kemnade wrote:
> > Strace in qemu:
> > 198005 openat(AT_FDCWD,"/lib/arm-linux-gnueabihf/libselinux.so.1",O_RDONLY|O_LARGEFILE|O_CLOEXEC) = 3
> > 198005 read(3,0x40802570,512) = 512
> > 198005 statx(3,"",AT_EMPTY_PATH|AT_NO_AUTOMOUNT|AT_STATX_SYNC_AS_STAT,STATX_BASIC_STATS,0x408022a8) = 0
> > 198005 mmap2(NULL,269428,PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_DENYWRITE,-1,0) = 0x40868000
> > 198005 mmap2(0x40870000,203892,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0) = 0x40870000

Size of the file: 132612: allocated: 203892

End address: 0x408a1c74

> > 198005 munmap(0x40868000,32768) = 0
> > 198005 munmap(0x408a2000,31860) = 0
> > 198005 mprotect(0x40890000,61440,PROT_NONE) = 0
which just ends at 0x4089f000 (not 16K aligned)

> > 198005 mmap2(0x4089f000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,3,0x1f) = -1 errno=14 (Bad address)
> > 
mmap2 sitting in that area mapping a part of the same file.

> > strace outside qemu:
> > [pid 195331] readlinkat(AT_FDCWD, "/usr/lib", 0x7fffd1a7fd00, 1023) = -1 EINVAL (Invalid argument)
> > [pid 195331] readlinkat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf", 0x7fffd1a7fd00, 1023) = -1 EINVAL (Invalid argument)
> > [pid 195331] readlinkat(AT_FDCWD, "/usr/lib/arm-linux-gnueabihf/libselinux.so.1", 0x7fffd1a7fd00, 1023) = -1 EINVAL (Invalid argument)
> > [pid 195331] faccessat(AT_FDCWD, "/usr/gnemul/qemu-arm/lib/arm-linux-gnueabihf/libselinux.so.1", F_OK) = -1 ENOENT (No such file or directory)
> > [pid 195331] openat(AT_FDCWD, "/lib/arm-linux-gnueabihf/libselinux.so.1", O_RDONLY|O_CLOEXEC) = 3
> > [pid 195331] read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0(\0\1\0\0\0\0\0\0\0004\0\0\0"..., 512) = 512
> > [pid 195331] statx(3, "", AT_STATX_SYNC_AS_STAT|AT_NO_AUTOMOUNT|AT_EMPTY_PATH, STATX_BASIC_STATS, {stx_mask=STATX_ALL|STATX_MNT_ID|STATX_SUBVOL, stx_attributes=0, stx_mode=S_IFREG|0644, stx_size=132612, ...}) = 0
> > [pid 195331] mmap(0x408a8000, 16384, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_DENYWRITE, -1, 0) = 0x408a8000
> > [pid 195331] mprotect(0x408a8000, 16384, PROT_WRITE) = 0
> > [pid 195331] mprotect(0x408a8000, 16384, PROT_NONE) = 0
> > [pid 195331] mmap(0x40868000, 262144, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_DENYWRITE, -1, 0) = 0x40868000
> > [pid 195331] mprotect(0x408a0000, 16384, PROT_WRITE) = 0
> > [pid 195331] pread64(3, "", 8192, 196608) = 0
> > [pid 195331] mprotect(0x408a0000, 16384, PROT_READ) = 0
> > [pid 195331] mmap(0x40870000, 196608, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x40870000
> > [pid 195331] mmap(0x40868000, 32768, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x40868000
> > [pid 195331] mmap(0x408a4000, 32768, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x408a4000
> > [pid 195331] mprotect(0x4089c000, 16384, PROT_READ) = 0
> > [pid 195331] mprotect(0x40890000, 49152, PROT_NONE) = 0

ends at 0x4089c000

> > [pid 195331] mprotect(0x4089c000, 16384, PROT_WRITE) = 0
> > [pid 195331] pread64(3, 0x4089f000, 4096, 126976) = -1 EFAULT (Bad address)
> > 
reads from write-only area created by the mprotect before. 

> > That makes simple commands like ls --version to fail.
> > Tested was arm32 on a arm64 only host.
> > 
> > Fix that issue by truncating file mapping and replacing out-of-file
> > mappings by anonymous mappings.  
> 
> Could you please explain "the issue" and not just referring to the strace?
> It's not that easy to see the problem.
> 
> Thanks!
> Helge
> 
> Btw: you patch might fix this problem, but you may run into other problems too,
> see e.g.: https://gitlab.com/qemu-project/qemu/-/work_items/3410
> 
That is correct, but at least increases the amount of platforms to be
debootstrappable. Or maybe some better chances for same bitbake run
to get through.

Regards,
Andreas