On 10/11/25 15:03, Matthew Lugg wrote:
> If an address range given to `mremap` is invalid (exceeds addressing
> bounds on the guest), we were previously returning `ENOMEM`, which is
> not correct. The manpage and the Linux kernel implementation both agree
> that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
> returned, and if `new_addr`/`new_size` refer to an invalid address,
> `EINVAL` is returned.
>
> Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
> ---
> linux-user/mmap.c | 9 ++++++---
> 1 file changed, 6 insertions(+), 3 deletions(-)
>
> diff --git a/linux-user/mmap.c b/linux-user/mmap.c
> index ec8392b35b..4c5fe832ad 100644
> --- a/linux-user/mmap.c
> +++ b/linux-user/mmap.c
> @@ -1103,12 +1103,15 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
> int prot;
> void *host_addr;
>
> - if (!guest_range_valid_untagged(old_addr, old_size) ||
> - ((flags & MREMAP_FIXED) &&
> + if (!guest_range_valid_untagged(old_addr, old_size)) {
> + errno = EFAULT;
> + return -1;
> + }
> + if (((flags & MREMAP_FIXED) &&
> !guest_range_valid_untagged(new_addr, new_size)) ||
> ((flags & MREMAP_MAYMOVE) == 0 &&
> !guest_range_valid_untagged(old_addr, new_size))) {
> - errno = ENOMEM;
> + errno = EINVAL;
> return -1;
> }
>
The order of the checks here is wrong. We should match do_remap and check_mremap_params.
In particular, it appears as if all of the EINVAL checks come first.
r~