Teach mmap to not overwrite reserved pages and fix brk return value (Richard Purdie).

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4255 c046a42c-6fe2-441c-8c8c-71466251a162

Teach mmap to not overwrite reserved pages and fix brk return value (Richard Purdie).
git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4255 c046a42c-6fe2-441c-8c8c-71466251a162
balrog
1 parent 662caa6f
Showing 2 changed files with 17 additions and 7 deletions
linux-user/mmap.c
linux-user/syscall.c
@@ -259,13 +259,24 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
             host_start += offset - host_offset;
         start = h2g(host_start);
     } else {
+        int flg;
+        target_ulong addr;
+
         if (start & ~TARGET_PAGE_MASK) {
             errno = EINVAL;
             return -1;
         }
         end = start + len;
         real_end = HOST_PAGE_ALIGN(end);
-        
+
+        for(addr = real_start; addr < real_end; addr += TARGET_PAGE_SIZE) {
+            flg = page_get_flags(addr);
+            if (flg & PAGE_RESERVED) {
+                errno = ENXIO;
+                return -1;
+            }
+        }
+
         /* worst case: we cannot map the file because the offset is not
            aligned, so we read it */
         if (!(flags & MAP_ANONYMOUS) &&
@@ -420,7 +420,7 @@ abi_long do_brk(abi_ulong new_brk)
     if (!new_brk)
         return target_brk;
     if (new_brk < target_original_brk)
-        return -TARGET_ENOMEM;
+        return target_brk;
     brk_page = HOST_PAGE_ALIGN(target_brk);
@@ -435,12 +435,11 @@ abi_long do_brk(abi_ulong new_brk)
     mapped_addr = get_errno(target_mmap(brk_page, new_alloc_size,
                                         PROT_READ|PROT_WRITE,
                                         MAP_ANON|MAP_FIXED|MAP_PRIVATE, 0, 0));
-    if (is_error(mapped_addr)) {
-	return mapped_addr;
-    } else {
+
+    if (!is_error(mapped_addr))
 	target_brk = new_brk;
-    	return target_brk;
-    }
+    
+    return target_brk;
 }
 static inline abi_long copy_from_user_fdset(fd_set *fds,