aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAlex Bennée <alex.bennee@linaro.org>2018-07-30 14:43:20 +0100
committerLaurent Vivier <laurent@vivier.eu>2018-07-31 09:57:25 +0200
commit38138fab93584ad3560ddfcd70efbd5bb6b4a6f0 (patch)
tree154ade908b71f527f8853a1fa079b151b74bda31
parent6d9dd5fb9d0e9f4a174f53a0e20a39fbe809c71e (diff)
downloadqemu-arm-38138fab93584ad3560ddfcd70efbd5bb6b4a6f0.tar.gz
linux-user/mmap.c: handle invalid len maps correctly
I've slightly re-organised the check to more closely match the sequence that the kernel uses in do_mmap(). We check for both the zero case (EINVAL) and the overflow length case (ENOMEM). Signed-off-by: Alex Bennée <alex.bennee@linaro.org> Cc: umarcor <1783362@bugs.launchpad.net> Reviewed-by: Laurent Vivier <laurent@vivier.eu> Message-Id: <20180730134321.19898-2-alex.bennee@linaro.org> Signed-off-by: Laurent Vivier <laurent@vivier.eu>
-rw-r--r--linux-user/mmap.c15
1 files changed, 12 insertions, 3 deletions
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index d0c50e4888..41e0983ce8 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -391,14 +391,23 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
}
#endif
- if (offset & ~TARGET_PAGE_MASK) {
+ if (!len) {
errno = EINVAL;
goto fail;
}
+ /* Also check for overflows... */
len = TARGET_PAGE_ALIGN(len);
- if (len == 0)
- goto the_end;
+ if (!len) {
+ errno = ENOMEM;
+ goto fail;
+ }
+
+ if (offset & ~TARGET_PAGE_MASK) {
+ errno = EINVAL;
+ goto fail;
+ }
+
real_start = start & qemu_host_page_mask;
host_offset = offset & qemu_host_page_mask;