From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59467) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YbAFS-0002e2-8U for qemu-devel@nongnu.org; Thu, 26 Mar 2015 12:03:11 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YbAFM-0002zs-J8 for qemu-devel@nongnu.org; Thu, 26 Mar 2015 12:03:10 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46836) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YbAFM-0002zi-Ej for qemu-devel@nongnu.org; Thu, 26 Mar 2015 12:03:04 -0400 Received: from int-mx10.intmail.prod.int.phx2.redhat.com (int-mx10.intmail.prod.int.phx2.redhat.com [10.5.11.23]) by mx1.redhat.com (Postfix) with ESMTPS id 1EE58AB120 for ; Thu, 26 Mar 2015 16:03:04 +0000 (UTC) Received: from donizetti.redhat.com (ovpn-112-86.ams2.redhat.com [10.36.112.86]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t2QG2agb031049 for ; Thu, 26 Mar 2015 12:03:03 -0400 From: Paolo Bonzini Date: Thu, 26 Mar 2015 17:02:32 +0100 Message-Id: <1427385754-13012-13-git-send-email-pbonzini@redhat.com> In-Reply-To: <1427385754-13012-1-git-send-email-pbonzini@redhat.com> References: <1427385754-13012-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 12/14] exec: avoid possible overwriting of mmaped area in qemu_ram_remap List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org It is not necessary to munmap an area before remapping it with MAP_FIXED; if the memory region specified by addr and len overlaps pages of any existing mapping, then the overlapped part of the existing mapping will be discarded. On the other hand, if QEMU does munmap the pages, there is a small probability that another mmap sneaks in and catches the just-freed portion of the address space. In effect, munmap followed by mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it as such. Fix it. Reviewed-by: Gonglei Signed-off-by: Paolo Bonzini --- exec.c | 1 - 1 file changed, 1 deletion(-) diff --git a/exec.c b/exec.c index 8b922db..6d1e1e4 100644 --- a/exec.c +++ b/exec.c @@ -1638,7 +1638,6 @@ void qemu_ram_remap(ram_addr_t addr, ram_addr_t length) abort(); } else { flags = MAP_FIXED; - munmap(vaddr, length); if (block->fd >= 0) { flags |= (block->flags & RAM_SHARED ? MAP_SHARED : MAP_PRIVATE); -- 2.3.3