Skip to content

Commit d6b1f7d

Browse files
mikdusanmikdusan
committed
patch: linux-user: fix several mremap bugs
- https://lists.gnu.org/archive/html/qemu-devel/2025-10/msg02738.html
1 parent c52fbf8 commit d6b1f7d

File tree

5 files changed

+126
-1
lines changed

5 files changed

+126
-1
lines changed

‎command/base‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ QEMU_REV="10.1.1"
1313
QEMU_GIT_COMMIT=""
1414

1515
# reset to blank when QEMU_REV/GIT_COMMIT bumps, otherwise begin count from 1
16-
QEMU_REV_ZIG_SERIAL=
16+
QEMU_REV_ZIG_SERIAL=1
1717

1818
if [ -n "$QEMU_GIT_COMMIT" ]; then
1919
QEMU_SRC_BASENAME="${QEMU_NAME}-${QEMU_REV}-${QEMU_GIT_COMMIT}"

‎command/patch‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,6 @@ set -e
77
WORKDIR "/work/src/${QEMU_SRC_BASENAME}"
88
RUN patch -p1 -i "${WORK_ROOT}/patch/linux-user__signal.diff"
99
RUN patch -p1 -i "${WORK_ROOT}/patch/linux-user__syscall.diff"
10+
RUN patch -p1 -i "${WORK_ROOT}/patch/linux-user__mlugg1.diff"
11+
RUN patch -p1 -i "${WORK_ROOT}/patch/linux-user__mlugg2.diff"
12+
RUN patch -p1 -i "${WORK_ROOT}/patch/linux-user__mlugg3.diff"

‎patch/linux-user__mlugg1.diff‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
2+
index 847092a28a..ec8392b35b 100644
3+
--- a/linux-user/mmap.c
4+
+++ b/linux-user/mmap.c
5+
@@ -1164,7 +1164,8 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
6+
errno = ENOMEM;
7+
host_addr = MAP_FAILED;
8+
} else if (reserved_va && old_size > new_size) {
9+
- mmap_reserve_or_unmap(old_addr + old_size,
10+
+ /* Re-reserve pages we just shrunk out of the mapping */
11+
+ mmap_reserve_or_unmap(old_addr + new_size,
12+
old_size - new_size);
13+
}
14+
}

‎patch/linux-user__mlugg2.diff‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
2+
index ec8392b35b..4c5fe832ad 100644
3+
--- a/linux-user/mmap.c
4+
+++ b/linux-user/mmap.c
5+
@@ -1103,12 +1103,15 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
6+
int prot;
7+
void *host_addr;
8+
9+
- if (!guest_range_valid_untagged(old_addr, old_size) ||
10+
- ((flags & MREMAP_FIXED) &&
11+
+ if (!guest_range_valid_untagged(old_addr, old_size)) {
12+
+ errno = EFAULT;
13+
+ return -1;
14+
+ }
15+
+ if (((flags & MREMAP_FIXED) &&
16+
!guest_range_valid_untagged(new_addr, new_size)) ||
17+
((flags & MREMAP_MAYMOVE) == 0 &&
18+
!guest_range_valid_untagged(old_addr, new_size))) {
19+
- errno = ENOMEM;
20+
+ errno = EINVAL;
21+
return -1;
22+
}
23+

‎patch/linux-user__mlugg3.diff‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
2+
index 4c5fe832ad..e1ed9085c7 100644
3+
--- a/linux-user/mmap.c
4+
+++ b/linux-user/mmap.c
5+
@@ -1014,59 +1014,38 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
6+
static int mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
7+
{
8+
int host_page_size = qemu_real_host_page_size();
9+
+ abi_ulong end;
10+
abi_ulong real_start;
11+
- abi_ulong real_last;
12+
- abi_ulong real_len;
13+
- abi_ulong last;
14+
- abi_ulong a;
15+
+ abi_ulong real_end;
16+
+ abi_ulong off;
17+
void *host_start;
18+
int prot;
19+
20+
- last = start + len - 1;
21+
+ end = ROUND_UP(start + len, TARGET_PAGE_SIZE);
22+
+
23+
real_start = start & -host_page_size;
24+
- real_last = ROUND_UP(last, host_page_size) - 1;
25+
+ real_end = ROUND_UP(end, host_page_size);
26+
27+
- /*
28+
- * If guest pages remain on the first or last host pages,
29+
- * adjust the deallocation to retain those guest pages.
30+
- * The single page special case is required for the last page,
31+
- * lest real_start overflow to zero.
32+
- */
33+
- if (real_last - real_start < host_page_size) {
34+
- prot = 0;
35+
- for (a = real_start; a < start; a += TARGET_PAGE_SIZE) {
36+
- prot |= page_get_flags(a);
37+
- }
38+
- for (a = last; a < real_last; a += TARGET_PAGE_SIZE) {
39+
- prot |= page_get_flags(a + 1);
40+
- }
41+
- if (prot != 0) {
42+
- return 0;
43+
- }
44+
- } else {
45+
- for (prot = 0, a = real_start; a < start; a += TARGET_PAGE_SIZE) {
46+
- prot |= page_get_flags(a);
47+
- }
48+
- if (prot != 0) {
49+
- real_start += host_page_size;
50+
- }
51+
+ /* end or real_end may have overflowed to 0, but that's okay. */
52+
53+
- for (prot = 0, a = last; a < real_last; a += TARGET_PAGE_SIZE) {
54+
- prot |= page_get_flags(a + 1);
55+
- }
56+
- if (prot != 0) {
57+
- real_last -= host_page_size;
58+
- }
59+
+ /* If [real_start,start) contains a mapped guest page, retain the first page. */
60+
+ for (prot = 0, off = 0; off < start - real_start; off += TARGET_PAGE_SIZE) {
61+
+ prot |= page_get_flags(real_start + off);
62+
+ }
63+
+ if (prot != 0) {
64+
+ real_start += host_page_size;
65+
+ }
66+
67+
- if (real_last < real_start) {
68+
- return 0;
69+
- }
70+
+ /* If [end,real_end) contains a mapped guest page, retain the last page. */
71+
+ for (prot = 0, off = 0; off < real_end - end; off += TARGET_PAGE_SIZE) {
72+
+ prot |= page_get_flags(end + off);
73+
+ }
74+
+ if (prot != 0) {
75+
+ real_end -= host_page_size;
76+
}
77+
78+
- real_len = real_last - real_start + 1;
79+
host_start = g2h_untagged(real_start);
80+
-
81+
- return do_munmap(host_start, real_len);
82+
+ return do_munmap(host_start, real_end - real_start);
83+
}
84+
85+
int target_munmap(abi_ulong start, abi_ulong len)

0 commit comments

Comments
 (0)