From: Rich Felker <dalias@libc.org>
To: "Minqiang Chen (ptpt52)" <ptpt52@gmail.com>
Cc: musl@lists.openwall.com
Subject: Re: [musl] BUG fix: mmap pass wrong offset to kernel
Date: Sun, 9 Jan 2022 01:00:03 -0500 [thread overview]
Message-ID: <20220109060003.GR7074@brightrain.aerifal.cx> (raw)
In-Reply-To: <20211116161817.GP7074@brightrain.aerifal.cx>
On Tue, Nov 16, 2021 at 11:18:17AM -0500, Rich Felker wrote:
> On Tue, Nov 16, 2021 at 11:56:57AM +0800, Minqiang Chen (ptpt52) wrote:
> > From 146066a9794b8e39c53337b71a8476b86e79e7d4 Mon Sep 17 00:00:00 2001
> > From: Chen Minqiang <ptpt52@gmail.com>
> > Date: Mon, 16 Oct 2017 08:57:41 +0800
> > Subject: [PATCH] musl: fix mmap pass wrong offset to kernel
> >
> > on 32bit platform for example off_t x=0x8d9eb000, the x/4096 result
> > is 0xfff8d9eb, but the sys_mmap2() is expecting 0x8d9eb to be pass to
> >
> > this happens on 32bit platform or 64bit platform when
> > x > = 0x80000000 (32bit platform)
> > or
> > x > = 0x8000000000000000 (64bit platform)
> >
> > Signed-off-by: Chen Minqiang <ptpt52@gmail.com>
> > ---
> > src/mman/mmap.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/mman/mmap.c b/src/mman/mmap.c
> > index eff88d82..f225cdbb 100644
> > --- a/src/mman/mmap.c
> > +++ b/src/mman/mmap.c
> > @@ -26,7 +26,7 @@ void *__mmap(void *start, size_t len, int prot, int flags, int fd, off_t off)
> > __vm_wait();
> > }
> > #ifdef SYS_mmap2
> > - ret = __syscall(SYS_mmap2, start, len, prot, flags, fd, off/UNIT);
> > + ret = __syscall(SYS_mmap2, start, len, prot, flags, fd, (unsigned long)off/UNIT);
> > #else
> > ret = __syscall(SYS_mmap, start, len, prot, flags, fd, off);
> > #endif
> > --
> > 2.17.1
>
> This patch is wrong and truncates offsets over 32-bit (drops all the
> high bits). There is a bug here, but it's just that UNIT has the wrong
> type. commit b5bbe797493ea732d4cac15619753c545ed392af introduced the
> regression by making UNIT have type unsigned long long. It should have
> a small signed type; just int is fine.
Following up on this again: there isn't actually a bug here. All valid
offsets to mmap are non-negative off_t values, so coercion to unsigned
long long does not alter the value. If the offset is negative, it was
already caught by the mask against OFF_MASK in the first if statement.
Rich
prev parent reply other threads:[~2022-01-09 6:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-16 3:56 Minqiang Chen (ptpt52)
2021-11-16 16:18 ` Rich Felker
2022-01-09 6:00 ` Rich Felker [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220109060003.GR7074@brightrain.aerifal.cx \
--to=dalias@libc.org \
--cc=musl@lists.openwall.com \
--cc=ptpt52@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.vuxu.org/mirror/musl/
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).