From ccc5ccc17f8cfbfd87d9aede5d12a2d47c56e712 Mon Sep 17 00:00:00 2001 From: Richard Purdie Date: Fri, 8 Jan 2021 17:42:12 +0000 Subject: [PATCH] linux-user/mmap: Avoid asserts for out of range mremap calls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If mremap() is called without the MREMAP_MAYMOVE flag with a start address just before the end of memory (reserved_va) where new_size would exceed it (and GUEST_ADDR_MAX), the assert(end - 1 <= GUEST_ADDR_MAX) in  page_set_flags() would trigger. Add an extra guard to the guest_range_valid() checks to prevent this and avoid asserting binaries when reserved_va is set. This meant a bug I was seeing locally now gives the same behaviour  regardless of whether reserved_va is set or not. Signed-off-by: Richard Purdie Message-Id: <70c46e7b999bafbb01d54bfafd44b420d0b782e9.camel@linuxfoundation.org> Signed-off-by: Laurent Vivier --- linux-user/mmap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 810653c503..1c9faef476 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -724,7 +724,9 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size, if (!guest_range_valid(old_addr, old_size) || ((flags & MREMAP_FIXED) && - !guest_range_valid(new_addr, new_size))) { + !guest_range_valid(new_addr, new_size)) || + ((flags & MREMAP_MAYMOVE) == 0 && + !guest_range_valid(old_addr, new_size))) { errno = ENOMEM; return -1; }