Re: [Qemu-devel] [PATCH v2 for 3.0 1/2] linux-user/mmap.c: handle invalid len maps correctly

[Alex Bennée]

Laurent Vivier <address@hidden> writes:

> Le 30/07/2018 à 15:43, Alex Bennée a écrit:
>> I've slightly re-organised the check to more closely match the
>> sequence that the kernel uses in do_mmap(). We check for both the zero
>> case (EINVAL) and the overflow length case (ENOMEM).
>>
>> Signed-off-by: Alex Bennée <address@hidden>
>> Cc: umarcor <address@hidden>
>>
>> ---
>> v2
>>   - add comment on overflow
>> ---
>>  linux-user/mmap.c | 15 ++++++++++++---
>>  1 file changed, 12 insertions(+), 3 deletions(-)
>>
>> diff --git a/linux-user/mmap.c b/linux-user/mmap.c
>> index d0c50e4888..41e0983ce8 100644
>> --- a/linux-user/mmap.c
>> +++ b/linux-user/mmap.c
>> @@ -391,14 +391,23 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, 
>> int prot,
>>      }
>>  #endif
>>
>> -    if (offset & ~TARGET_PAGE_MASK) {
>> +    if (!len) {
>>          errno = EINVAL;
>>          goto fail;
>>      }
>>
>> +    /* Also check for overflows... */
>>      len = TARGET_PAGE_ALIGN(len);
>> -    if (len == 0)
>> -        goto the_end;
>> +    if (!len) {
>> +        errno = ENOMEM;
>> +        goto fail;
>> +    }
>> +
>> +    if (offset & ~TARGET_PAGE_MASK) {
>> +        errno = EINVAL;
>> +        goto fail;
>> +    }
>> +
>>      real_start = start & qemu_host_page_mask;
>>      host_offset = offset & qemu_host_page_mask;
>>
>>
>
> Reviewed-by: Laurent Vivier <address@hidden>

Are you going to take this via your queue or do you want me to re-post
with the r-b?

--
Alex Bennée