[PATCH v1] mman: fix mmap pass wrong offset to kernel

[PATCH v1] mman: fix mmap pass wrong offset to kernel

[Minqiang Chen]

[-- Attachment #1: Type: text/plain, Size: 894 bytes --]

Author: Chen Minqiang <ptpt52@gmail.com>

Date:   Mon Oct 16 08:57:41 2017 +0800


    musl: fix mmap pass wrong offset to kernel



        for example off_t x=0x8d9eb000, the x/4096 result is 0xfff8d9eb,
not 0x8d9eb as expecting

        this happens on arm_cortex-a15 with gcc 6.3.x



    Signed-off-by: Chen Minqiang <ptpt52@gmail.com>


*diff --git a/src/mman/mmap.c b/src/mman/mmap.c*

*index 1592403..a09c901 100644*

*--- a/src/mman/mmap.c*

*+++ b/src/mman/mmap.c*

*@@ -27,7 +27,7 @@* void *__mmap(void *start, size_t len, int prot, int
flags, int fd, off_t off)

                __vm_wait();

        }

 #ifdef SYS_mmap2

*-       ret = __syscall(SYS_mmap2, start, len, prot, flags, fd, off/UNIT);*

*+*       *ret = __syscall(SYS_mmap2, start, len, prot, flags, fd,
(unsigned long)off/UNIT);*

 #else

        ret = __syscall(SYS_mmap, start, len, prot, flags, fd, off);

 #endif

[-- Attachment #2: Type: text/html, Size: 3093 bytes --]

Re: [PATCH v1] mman: fix mmap pass wrong offset to kernel

[Szabolcs Nagy]

* Minqiang Chen <ptpt52@gmail.com> [2017-10-16 09:09:32 +0800]:
> 
>     musl: fix mmap pass wrong offset to kernel
> 
> 
> 
>         for example off_t x=0x8d9eb000, the x/4096 result is 0xfff8d9eb,
> not 0x8d9eb as expecting
> 

off_t is 64bit, not 32bit, so x/4096 should not signextend.
you need to investigate this problem more.


>         this happens on arm_cortex-a15 with gcc 6.3.x
> 
> 
> 
>     Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
> 
> 
> *diff --git a/src/mman/mmap.c b/src/mman/mmap.c*
> 
> *index 1592403..a09c901 100644*
> 
> *--- a/src/mman/mmap.c*
> 
> *+++ b/src/mman/mmap.c*
> 
> *@@ -27,7 +27,7 @@* void *__mmap(void *start, size_t len, int prot, int
> flags, int fd, off_t off)
> 
>                 __vm_wait();
> 
>         }
> 
>  #ifdef SYS_mmap2
> 
> *-       ret = __syscall(SYS_mmap2, start, len, prot, flags, fd, off/UNIT);*
> 
> *+*       *ret = __syscall(SYS_mmap2, start, len, prot, flags, fd,
> (unsigned long)off/UNIT);*


this is wrong, off is 64bit signed int, it can have values
outside of the range of unsigned long.

(and your email client ruined the patch with random '*' and '\n')

Re: [PATCH v1] mman: fix mmap pass wrong offset to kernel

[Rich Felker]

On Mon, Oct 16, 2017 at 01:03:18PM +0200, Szabolcs Nagy wrote:
> * Minqiang Chen <ptpt52@gmail.com> [2017-10-16 09:09:32 +0800]:
> > 
> >     musl: fix mmap pass wrong offset to kernel
> > 
> > 
> > 
> >         for example off_t x=0x8d9eb000, the x/4096 result is 0xfff8d9eb,
> > not 0x8d9eb as expecting
> > 
> 
> off_t is 64bit, not 32bit, so x/4096 should not signextend.
> you need to investigate this problem more.

I suspect the calling code stored the offset 0x8d9eb000 in a signed
32-bit variable (converting it to a negative value) and then passed
the resulting negative value to mmap.

Rich

Re: [PATCH v1] mman: fix mmap pass wrong offset to kernel

[Rich Felker]

On Fri, Oct 20, 2017 at 05:06:29PM +0800, Minqiang Chen wrote:
> I don’t know why, but this is how I fix it.
> on arm_cortex-a15 it is 32bit arch

off_t is always 64-bit regardless of whether it's a 32-bit arch. This
is definitely a bug in the calling program, not musl.

> > 在 2017年10月17日，00:27，Rich Felker <dalias@libc.org> 写道：
> > 
> > On Mon, Oct 16, 2017 at 01:03:18PM +0200, Szabolcs Nagy wrote:
> >> * Minqiang Chen <ptpt52@gmail.com> [2017-10-16 09:09:32 +0800]:
> >>> 
> >>>    musl: fix mmap pass wrong offset to kernel
> >>> 
> >>> 
> >>> 
> >>>        for example off_t x=0x8d9eb000, the x/4096 result is 0xfff8d9eb,
> >>> not 0x8d9eb as expecting
> >>> 
> >> 
> >> off_t is 64bit, not 32bit, so x/4096 should not signextend.
> >> you need to investigate this problem more.
> > 
> > I suspect the calling code stored the offset 0x8d9eb000 in a signed
> > 32-bit variable (converting it to a negative value) and then passed
> > the resulting negative value to mmap.
> > 
> > Rich
>