[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH] linux-user/elfload: munmap proper address in pgd_find_hole_fallb
From: |
Vincent Fazio |
Subject: |
[PATCH] linux-user/elfload: munmap proper address in pgd_find_hole_fallback |
Date: |
Sun, 31 Jan 2021 00:18:49 -0600 |
From: Vincent Fazio <vfazio@gmail.com>
Previously, if the build host's libc did not define MAP_FIXED_NOREPLACE
or if the running kernel didn't support that flag, it was possible for
pgd_find_hole_fallback to munmap an incorrect address which could lead to
SIGSEGV if the range happened to overlap with the mapped address of the
QEMU binary.
mmap(0x1000, 22261224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE,
-1, 0) = 0x7f889d331000
munmap(0x1000, 22261224) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x84b817} ---
++ killed by SIGSEGV +++
Now, always munmap the address returned by mmap.
Fixes: 2667e069e7b5 ("linux-user: don't use MAP_FIXED in
pgd_find_hole_fallback")
Signed-off-by: Vincent Fazio <vfazio@gmail.com>
---
linux-user/elfload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a64050713f..5f5f23d2e5 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2216,7 +2216,7 @@ static uintptr_t pgd_find_hole_fallback(uintptr_t
guest_size, uintptr_t brk,
void * mmap_start = mmap((void *) align_start, guest_size,
PROT_NONE, flags, -1, 0);
if (mmap_start != MAP_FAILED) {
- munmap((void *) align_start, guest_size);
+ munmap(mmap_start, guest_size);
if (MAP_FIXED_NOREPLACE != 0 ||
mmap_start == (void *) align_start) {
return (uintptr_t) mmap_start + offset;
--
2.30.0
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- [PATCH] linux-user/elfload: munmap proper address in pgd_find_hole_fallback,
Vincent Fazio <=