aboutsummaryrefslogtreecommitdiff
path: root/linux-user
diff options
context:
space:
mode:
authorVincent Fazio <vfazio@gmail.com>2021-01-31 00:18:49 -0600
committerLaurent Vivier <laurent@vivier.eu>2021-03-13 10:45:11 +0100
commit7e588fbc57397daac02cf23677d1849aab7c7507 (patch)
tree37a98faff2e2a1c1a92266e6f5c1dc8686726bbb /linux-user
parent6e1c0d7b951e19c53b8467e8bc4b71ee73a394ea (diff)
linux-user/elfload: munmap proper address in pgd_find_hole_fallback
Previously, if the build host's libc did not define MAP_FIXED_NOREPLACE or if the running kernel didn't support that flag, it was possible for pgd_find_hole_fallback to munmap an incorrect address which could lead to SIGSEGV if the range happened to overlap with the mapped address of the QEMU binary. mmap(0x1000, 22261224, PROT_NONE, MAP_PRIVATE|MAP_ANONYMOUS|MAP_NORESERVE, -1, 0) = 0x7f889d331000 munmap(0x1000, 22261224) = 0 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x84b817} --- ++ killed by SIGSEGV +++ Now, always munmap the address returned by mmap. Fixes: 2667e069e7b5 ("linux-user: don't use MAP_FIXED in pgd_find_hole_fallback") Signed-off-by: Vincent Fazio <vfazio@gmail.com> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Message-Id: <20210131061849.12615-1-vfazio@xes-inc.com> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Diffstat (limited to 'linux-user')
-rw-r--r--linux-user/elfload.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 140a971632..174ee7bad6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2209,7 +2209,7 @@ static uintptr_t pgd_find_hole_fallback(uintptr_t guest_size, uintptr_t brk,
void * mmap_start = mmap((void *) align_start, guest_size,
PROT_NONE, flags, -1, 0);
if (mmap_start != MAP_FAILED) {
- munmap((void *) align_start, guest_size);
+ munmap(mmap_start, guest_size);
if (MAP_FIXED_NOREPLACE != 0 ||
mmap_start == (void *) align_start) {
return (uintptr_t) mmap_start + offset;