[Qemu-devel] [PATCH] linux-user: Fix initialization of the heap contents when allocating new pages

[Qemu-devel] [PATCH] linux-user: Fix initialization of the heap contents when allocating new pages

[Cédric VINCENT]

Technically the new mmapped pages are already initialized to zero
since they are anonymous, however we have to take care with the
contents that come from the remaining part of the previous page: it
may contains garbage data due to a previous heap usage (grown then
shrunken).

This patch completes commit 55f08c84.  The problem could be reproduced
when emulating the build process of Perl 5.12.3 on ARMedSlack 13.37:

    make[1]: Entering directory `/tmp/perl-5.12.3/cpan/Compress-Raw-Bzip2'
    cc -c  -I. -fno-strict-aliasing -pipe -fstack-protector                 \
           -I/usr/local/include -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64  \
           -O2   -DVERSION=\"2.024\" -DXS_VERSION=\"2.024\" -fPIC "-I../.." \
           -DBZ_NO_STDIO  decompress.c
    decompress.c: In function 'BZ2_decompress':
    decompress.c:621:1: internal compiler error: Segmentation fault

Signed-off-by: Laurent ALFONSI <laurent.alfonsi@st.com>
Signed-off-by: Cédric VINCENT <cedric.vincent@st.com>
---
 linux-user/syscall.c |    9 +++++++++
 1 files changed, 9 insertions(+), 0 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 6bdf4e6..ae08c9e 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -797,6 +797,15 @@ abi_long do_brk(abi_ulong new_brk)
                                         MAP_ANON|MAP_PRIVATE, 0, 0));
 
     if (mapped_addr == brk_page) {
+        /* Heap contents are initialized to zero, as for anonymous
+         * mapped pages.  Technically the new pages are already
+         * initialized to zero since they *are* anonymous mapped
+         * pages, however we have to take care with the contents that
+         * come from the remaining part of the previous page: it may
+         * contains garbage data due to a previous heap usage (grown
+         * then shrunken).  */
+        memset(g2h(target_brk), 0, brk_page - target_brk);
+
         target_brk = new_brk;
         brk_page = HOST_PAGE_ALIGN(target_brk);
         DEBUGF_BRK("%#010x (mapped_addr == brk_page)\n", target_brk);
-- 
1.7.5.1