From nobody Tue Feb 10 17:14:21 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1591357848; cv=none; d=zohomail.com; s=zohoarc; b=CELnkg0Dmrb04jNKxFRS5F6WOTT4g2oGzN24UKFDVBaEHNQqQoI0mDg4JFvwXTVbBRjTnsbB6rlUOcAOts1238fjZXKc8WTuxSyGNJtM4OSrQk+Iup7Nv7IYbDgnIKdWvmuAKJO1UihfaUtyeiSMTGCn6Y0KuIAtIXH4l5RhFJk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1591357848; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=E2UUsXvpLs9h5Bhi1JYmDOLsAVJHwH1wFi6AUmfWX58=; b=FiWfcs5L0yorP0Ehrsi+D40h4qzWdNr/HBRQ/MLEgwio60K59/aclIIr3k9w+Q2QgKoqv3FDN+QK5dEmuyxZ7DjuWCpjfIYCTQNyjJwqR6ToxI0SnrccgHuCod6xqKBF3yKljfsqENvErRcqW+EnhsQe/tZfhoF6xCCXxVGHkcY= ARC-Authentication-Results: i=1; mx.zohomail.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1591357848086944.4214967601544; Fri, 5 Jun 2020 04:50:48 -0700 (PDT) Received: from localhost ([::1]:41434 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jhAs2-0005L8-QW for importer@patchew.org; Fri, 05 Jun 2020 07:50:46 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:54836) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jhAoi-0008Gm-Gf for qemu-devel@nongnu.org; Fri, 05 Jun 2020 07:47:20 -0400 Received: from mout.kundenserver.de ([217.72.192.75]:42897) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jhAoh-0006iw-1K for qemu-devel@nongnu.org; Fri, 05 Jun 2020 07:47:20 -0400 Received: from localhost.localdomain ([82.252.135.106]) by mrelayeu.kundenserver.de (mreue106 [212.227.15.183]) with ESMTPSA (Nemesis) id 1N4Q4m-1izu7J2HVm-011VBZ; Fri, 05 Jun 2020 13:47:07 +0200 From: Laurent Vivier To: qemu-devel@nongnu.org Subject: [PULL 05/19] linux-user/mmap.c: fix integer underflow in target_mremap Date: Fri, 5 Jun 2020 13:46:46 +0200 Message-Id: <20200605114700.1052050-6-laurent@vivier.eu> X-Mailer: git-send-email 2.26.2 In-Reply-To: <20200605114700.1052050-1-laurent@vivier.eu> References: <20200605114700.1052050-1-laurent@vivier.eu> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Provags-ID: V03:K1:ga9jgcQO+kjdoOyWdWYM+CF0HEBsS0q9SxmybE2WV2mpG8z0Tnm q7tH18xVoj77aWbFCpvPmbqpzpdbGBGFAm8DLE4u9slcTmhh6qu0ZP+sjDF6wMEDTbI3iqR YSnhwKzuEJvGBVpH1WAvGvJjsPbdQr6/ujR7xxGuz8+3D5k1WAz6Pq7C4aXX6eY2a2hp4mJ S3u3CPE7r5XjVyvw5FD5A== X-UI-Out-Filterresults: notjunk:1;V03:K0:CYjl3Us4nIw=:8d2MiDOkbv1i/MkGhLxav3 xeubtyWPGDyJmTnOAd1vP56SaWK4HRq0oB4Wh2h4qQ9zF/1iQUDXDKlu6v8ZkXafHV4CeVpYe 0jgIzAswb+fd1xsIV6kxV6Dzvl4ogwJxbVu5mR3r0rfylAZBq5ImS2DIYx+6xEBZ2/V/kZuDf xbQoGj5aLVzCdkMlWtJcngc3fMHTSb2+eSzOj7dFp5kBtNT9NfEYZ3Cd5A9xJELldmx+oBLvC nc1+OPdQpFEMtnjpY59GByG0LGs9wPQfm/V22FmbnK97i+G5wUR040PugWK8mVe/W/3zxLXEX 5L0aYGZqnmceV6QdLj62FSXbNnp/Gk0zAnbS9fBXMpRYWjBv8qn/DYzgGauzlxS+ABcQ8pe2U ueDOh8mQGbN/VZpFPEUZxpOlPBh+R/PMqgL/pBPdgC59UIoh5UyZu6UxrFLVS1VplHTOJrnx2 A1af3+PvwfCesQ3fZWYlHv+p8J3Efk4EQCtdCYm5gj61g7nQhAyuhfPlLCMphmv/JhHcVRLqc VcxrLVWJvd6YknK+MJ3zK4WXonvIb+mJHBsBhVbo4jTCggGEhFi0PTXkWm6cUFceqqHhvx56G jpOCiYg2zZHx0U7zDZuF6PDuLapaFKhsX/sus5u3eXX4lEQstnnxwfNkInClw+eS2s/eeEqyQ GVzkzmTdCR0oVwPUgpQMgvw2ckInTRUbt4cnYZKGMjH7Wgfg6JS+K3NrCP5wLQrAsGu/XT2jN 27uqFKMGQduHh4OEQK3jR+vYWCCZkvB46X31Pyz7tJmkydE11JQq2suMvUkmND8uPfeew30/v 1xg5WllMrvzVRrAy0wSqgT+LadkKt+MiM7YZG4rk4waMTXGJ4IqVXczj065HxsVE1HPUf4L Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: none client-ip=217.72.192.75; envelope-from=laurent@vivier.eu; helo=mout.kundenserver.de X-detected-operating-system: by eggs.gnu.org: First seen = 2020/06/05 07:47:15 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] X-Spam_score_int: -18 X-Spam_score: -1.9 X-Spam_bar: - X-Spam_report: (-1.9 / 5.0 requ) BAYES_00=-1.9, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001, URIBL_BLOCKED=0.001 autolearn=_AUTOLEARN X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Riku Voipio , Jonathan Marler , Laurent Vivier Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" Content-Type: text/plain; charset="utf-8" From: Jonathan Marler Fixes: https://bugs.launchpad.net/bugs/1876373 This code path in mmap occurs when a page size is decreased with mremap. W= hen a section of pages is shrunk, qemu calls mmap_reserve on the pages that= were released. However, it has the diff operation reversed, subtracting t= he larger old_size from the smaller new_size. Instead, it should be subtra= cting the smaller new_size from the larger old_size. You can also see in t= he previous line of the change that this mmap_reserve call only occurs when= old_size > new_size. Bug: https://bugs.launchpad.net/qemu/+bug/1876373 Signed-off-by: Jonathan Marler Reviewded-by: Laurent Vivier Message-Id: <20200502161225.14346-1-johnnymarler@gmail.com> Signed-off-by: Laurent Vivier --- linux-user/mmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index e37803379747..caab62909eb1 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -708,7 +708,7 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong ol= d_size, if (prot =3D=3D 0) { host_addr =3D mremap(g2h(old_addr), old_size, new_size, flags); if (host_addr !=3D MAP_FAILED && reserved_va && old_size > new= _size) { - mmap_reserve(old_addr + old_size, new_size - old_size); + mmap_reserve(old_addr + old_size, old_size - new_size); } } else { errno =3D ENOMEM; --=20 2.26.2