Commit 38138fab authored Jul 30, 2018 by Alex Bennée Committed by Laurent Vivier Jul 31, 2018

linux-user/mmap.c: handle invalid len maps correctly



I've slightly re-organised the check to more closely match the
sequence that the kernel uses in do_mmap(). We check for both the zero
case (EINVAL) and the overflow length case (ENOMEM).

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Cc: umarcor <1783362@bugs.launchpad.net>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>

parent 6d9dd5fb

linux-user/mmap.c

+12 −3

Original line number	Diff line number	Diff line
		@@ -391,14 +391,23 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
		}
		#endif

		if (offset & ~TARGET_PAGE_MASK) {
		if (!len) {
		errno = EINVAL;
		goto fail;
		}

		/* Also check for overflows... */
		len = TARGET_PAGE_ALIGN(len);
		if (len == 0)
		goto the_end;
		if (!len) {
		errno = ENOMEM;
		goto fail;
		}

		if (offset & ~TARGET_PAGE_MASK) {
		errno = EINVAL;
		goto fail;
		}

		real_start = start & qemu_host_page_mask;
		host_offset = offset & qemu_host_page_mask;