From 55baec0f4c535e24a060070592b8c51d75108481 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 7 Jul 2023 21:40:41 +0100 Subject: [PATCH] linux-user: Widen target_mmap offset argument to off_t MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We build with _FILE_OFFSET_BITS=64, so off_t = off64_t = uint64_t. With an extra cast, this fixes emulation of mmap2, which could overflow the computation of the full value of offset. Reviewed-by: Alex Bennée Signed-off-by: Richard Henderson Message-Id: <20230707204054.8792-14-richard.henderson@linaro.org> --- linux-user/mmap.c | 14 ++++++++------ linux-user/syscall.c | 2 +- linux-user/user-mmap.h | 2 +- 3 files changed, 10 insertions(+), 8 deletions(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 12b1308a83..b2c2d85857 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -196,7 +196,7 @@ error: /* map an incomplete host page */ static int mmap_frag(abi_ulong real_start, abi_ulong start, abi_ulong end, - int prot, int flags, int fd, abi_ulong offset) + int prot, int flags, int fd, off_t offset) { abi_ulong real_end, addr; void *host_start; @@ -463,11 +463,12 @@ abi_ulong mmap_find_vma(abi_ulong start, abi_ulong size, abi_ulong align) /* NOTE: all the constants are the HOST ones */ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot, - int flags, int fd, abi_ulong offset) + int flags, int fd, off_t offset) { - abi_ulong ret, end, real_start, real_end, retaddr, host_offset, host_len, + abi_ulong ret, end, real_start, real_end, retaddr, host_len, passthrough_start = -1, passthrough_end = -1; int page_flags; + off_t host_offset; mmap_lock(); trace_target_mmap(start, len, target_prot, flags, fd, offset); @@ -559,7 +560,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot, } if (!(flags & (MAP_FIXED | MAP_FIXED_NOREPLACE))) { - unsigned long host_start; + uintptr_t host_start; int host_prot; void *p; @@ -578,7 +579,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot, goto fail; } /* update start so that it points to the file position at 'offset' */ - host_start = (unsigned long)p; + host_start = (uintptr_t)p; if (!(flags & MAP_ANONYMOUS)) { p = mmap(g2h_untagged(start), len, host_prot, flags | MAP_FIXED, fd, host_offset); @@ -681,7 +682,8 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot, /* map the middle (easier) */ if (real_start < real_end) { void *p; - unsigned long offset1; + off_t offset1; + if (flags & MAP_ANONYMOUS) { offset1 = 0; } else { diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 3a89f6b408..a80d33ecf2 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -10591,7 +10591,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, #endif ret = target_mmap(arg1, arg2, arg3, target_to_host_bitmask(arg4, mmap_flags_tbl), - arg5, arg6 << MMAP_SHIFT); + arg5, (off_t)(abi_ulong)arg6 << MMAP_SHIFT); return get_errno(ret); #endif case TARGET_NR_munmap: diff --git a/linux-user/user-mmap.h b/linux-user/user-mmap.h index 480ce1c114..3fc986f92f 100644 --- a/linux-user/user-mmap.h +++ b/linux-user/user-mmap.h @@ -20,7 +20,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot); abi_long target_mmap(abi_ulong start, abi_ulong len, int prot, - int flags, int fd, abi_ulong offset); + int flags, int fd, off_t offset); int target_munmap(abi_ulong start, abi_ulong len); abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size, abi_ulong new_size, unsigned long flags,