From 71beea204ce5134232cca7c1d1d33a5c1a2da2db Mon Sep 17 00:00:00 2001 From: Paolo Bonzini Date: Sun, 18 Feb 2018 19:09:34 -0500 Subject: [PATCH] exec: avoid possible overwriting of mmaped area in qemu_ram_remap It is not necessary to munmap an area before remapping it with MAP_FIXED; if the memory region specified by addr and len overlaps pages of any existing mapping, then the overlapped part of the existing mapping will be discarded. On the other hand, if QEMU does munmap the pages, there is a small probability that another mmap sneaks in and catches the just-freed portion of the address space. In effect, munmap followed by mmap(MAP_FIXED) is a use-after-free error, and Coverity flags it as such. Fix it. Backports commit f18c69cfc554cf9776eb3c35b7510e17541afacb from qemu --- qemu/exec.c | 1 - 1 file changed, 1 deletion(-) diff --git a/qemu/exec.c b/qemu/exec.c index f1af72ca..5c9418d3 100644 --- a/qemu/exec.c +++ b/qemu/exec.c @@ -1242,7 +1242,6 @@ void qemu_ram_remap(struct uc_struct *uc, ram_addr_t addr, ram_addr_t length) ; } else { flags = MAP_FIXED; - munmap(vaddr, length); if (block->fd >= 0) { flags |= (block->flags & RAM_SHARED ? MAP_SHARED : MAP_PRIVATE);