[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 12/14] exec: avoid possible overwriting of mmaped are
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 12/14] exec: avoid possible overwriting of mmaped area in qemu_ram_remap |
Date: |
Thu, 26 Mar 2015 17:02:32 +0100 |
It is not necessary to munmap an area before remapping it with MAP_FIXED;
if the memory region specified by addr and len overlaps pages of any
existing mapping, then the overlapped part of the existing mapping will
be discarded.
On the other hand, if QEMU does munmap the pages, there is a small
probability that another mmap sneaks in and catches the just-freed
portion of the address space. In effect, munmap followed by
mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it
as such. Fix it.
Reviewed-by: Gonglei <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
exec.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/exec.c b/exec.c
index 8b922db..6d1e1e4 100644
--- a/exec.c
+++ b/exec.c
@@ -1638,7 +1638,6 @@ void qemu_ram_remap(ram_addr_t addr, ram_addr_t length)
abort();
} else {
flags = MAP_FIXED;
- munmap(vaddr, length);
if (block->fd >= 0) {
flags |= (block->flags & RAM_SHARED ?
MAP_SHARED : MAP_PRIVATE);
--
2.3.3
- [Qemu-devel] [PULL 00/14] Misc bugfixes for 2.3.0-rc2, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 01/14] rcu tests: fix compilation on 32-bit ppc, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 04/14] i6300esb: Fix signed integer overflow, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 05/14] cpus: Don't kick un-realized cpus., Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 02/14] fw_cfg: factor out initialization of FW_CFG_ID (rev. number), Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 07/14] vmw_pvscsi: use PCI DMA APIs, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 08/14] nbd: Fix up comment after commit e140177, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 06/14] megasas: use PCI DMA APIs, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 03/14] i6300esb: Correct endiannness, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 13/14] misc: fix typos in copyright declaration, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 12/14] exec: avoid possible overwriting of mmaped area in qemu_ram_remap,
Paolo Bonzini <=
- [Qemu-devel] [PULL 09/14] m68k: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 10/14] mips: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 11/14] sparc: memory: Replace memory_region_init_ram with memory_region_allocate_system_memory, Paolo Bonzini, 2015/03/26
- [Qemu-devel] [PULL 14/14] virtio-scsi-dataplane: fix memory leak for VirtIOSCSIVring, Paolo Bonzini, 2015/03/26
- Re: [Qemu-devel] [PULL 00/14] Misc bugfixes for 2.3.0-rc2, Peter Maydell, 2015/03/26