From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:49608) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fk8SN-0006KN-Jp for qemu-devel@nongnu.org; Mon, 30 Jul 2018 09:43:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fk8SL-0000yW-6I for qemu-devel@nongnu.org; Mon, 30 Jul 2018 09:43:27 -0400 Received: from mail-wr1-x441.google.com ([2a00:1450:4864:20::441]:40108) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1fk8SK-0000y0-WD for qemu-devel@nongnu.org; Mon, 30 Jul 2018 09:43:25 -0400 Received: by mail-wr1-x441.google.com with SMTP id h15-v6so12938764wrs.7 for ; Mon, 30 Jul 2018 06:43:24 -0700 (PDT) From: =?UTF-8?q?Alex=20Benn=C3=A9e?= Date: Mon, 30 Jul 2018 14:43:20 +0100 Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org> In-Reply-To: <20180730134321.19898-1-alex.bennee@linaro.org> References: <20180730134321.19898-1-alex.bennee@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Subject: [Qemu-devel] [PATCH v2 for 3.0 1/2] linux-user/mmap.c: handle invalid len maps correctly List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: 1783362@bugs.launchpad.net, =?UTF-8?q?Alex=20Benn=C3=A9e?= , Riku Voipio , Laurent Vivier I've slightly re-organised the check to more closely match the sequence that the kernel uses in do_mmap(). We check for both the zero case (EINVAL) and the overflow length case (ENOMEM). Signed-off-by: Alex Bennée Cc: umarcor <1783362@bugs.launchpad.net> --- v2 - add comment on overflow --- linux-user/mmap.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index d0c50e4888..41e0983ce8 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -391,14 +391,23 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, } #endif - if (offset & ~TARGET_PAGE_MASK) { + if (!len) { errno = EINVAL; goto fail; } + /* Also check for overflows... */ len = TARGET_PAGE_ALIGN(len); - if (len == 0) - goto the_end; + if (!len) { + errno = ENOMEM; + goto fail; + } + + if (offset & ~TARGET_PAGE_MASK) { + errno = EINVAL; + goto fail; + } + real_start = start & qemu_host_page_mask; host_offset = offset & qemu_host_page_mask; -- 2.17.1