Skip to content

`mmapInRegion` may loop infinitely

Currently mmapInRegion is susceptible to infinitely loop when the platform's mmap provides memory before the region we are trying to map into. Specifically, its current implementation is:

    bool wrapped = false;
    int prot = memoryAccessToProt(access);
    void *p = region->last;
    while (1) {
        void *result = doMmap(p, bytes, prot, flags, fd, offset);
        if (result == NULL) {
            ...
        } else if (result < region->start) {
            p = (uint8_t *) result + bytes;  // (a) mmap gave us memory too low, advance and try again
        } else if (result < region->end) {
            ...
        } else if (wrapped) {
            ...
        }

        // mmap() gave us too high an address; wrap around and try again
        munmap(result, bytes);
        wrapped = true;
        p = region->start;    // (b)
    }

Note how when result < region->start we first advance p (point (a)) and then later reset it to region->start (point (b)).

Additionally, the logic at point (a) is itself highly suspect as we reset p to an address manifestly below region->start.

Edited by Ben Gamari
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information