1 files changed, 47 insertions, 0 deletions
diff --git a/libre/qemu-user-static/0004-linux-user-init_guest_space-Correctly-handle-guest_s.patch b/libre/qemu-user-static/0004-linux-user-init_guest_space-Correctly-handle-guest_s.patch
new file mode 100644
index 000000000..7f9cfc7a8
--- /dev/null
+++ b/libre/qemu-user-static/0004-linux-user-init_guest_space-Correctly-handle-guest_s.patch
@@ -0,0 +1,47 @@
+From bc26025ccc64a2a63fc58776c93e2e4392445abe Mon Sep 17 00:00:00 2001
+From: Luke Shumaker <lukeshu@parabola.nu>
+Date: Wed, 27 Dec 2017 19:44:00 -0500
+Subject: [PATCH 04/10] linux-user: init_guest_space: Correctly handle
+ guest_start in commpage initialization
+
+init_guest_commpage  needs to check if the mapped space, which ends at
+real_start+real_size overlaps with where it needs to put the commpage,
+which is (assuming sane qemu_host_page_size) guest_base + 0xffff000, where
+guest_base is real_start - guest_start.
+
+    [guest_base][       0xffff0000      ][commpage]
+    [guest_base][guest_start][real_size] [commpage]
+    [       real_start      ][real_size] [commpage]
+                                        ^
+                                 fail if this gap < 0
+
+Since init_guest_commpage wants to do everything relative to guest_base
+(rather than real_start), it obviously needs to be comparing 0xffff0000
+against guest_start+real_size, not just real_size.
+
+This bug has been present since 806d102141b99d4f1e55a97d68b7ea8c8ba3129f in
+2012, but guest_start is usually 0, and prior to v2.11 real_size was
+usually much smaller than 0xffff0000, so it was uncommon for it to have
+made a difference.
+
+Signed-off-by: Luke Shumaker <lukeshu@parabola.nu>
+---
+ linux-user/elfload.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index 1a6b660b25..f41cecc3cb 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -1882,7 +1882,7 @@ unsigned long init_guest_space(unsigned long host_start,
+ #if defined(TARGET_ARM) && !defined(TARGET_AARCH64)
+             /* On 32-bit ARM, we need to also be able to map the commpage.  */
+             int valid = init_guest_commpage(real_start - guest_start,
+-                                            real_size);
++                                            real_size + guest_start);
+             if (valid == 1) {
+                 break;
+             } else if (valid == -1) {
+-- 
+2.15.1
+