In particular, if an image has a large bss, we can hit EOF before reading all host_len bytes of the mapping.
Cc: qemu-sta...@nongnu.org Fixes: eb5027ac618 ("linux-user: Split out mmap_h_gt_g") Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2504 Signed-off-by: Richard Henderson <richard.hender...@linaro.org> --- linux-user/mmap.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/linux-user/mmap.c b/linux-user/mmap.c index 6418e811f6..de9ab13754 100644 --- a/linux-user/mmap.c +++ b/linux-user/mmap.c @@ -853,10 +853,21 @@ static abi_long mmap_h_gt_g(abi_ulong start, abi_ulong len, } if (misaligned_offset) { - /* TODO: The read could be short. */ - if (pread(fd, p, host_len, offset + real_start - start) != host_len) { - do_munmap(p, host_len); - return -1; + size_t o = 0; + while (1) { + ssize_t r = pread(fd, p + o, host_len - o, + o + offset + real_start - start); + if (likely(r == host_len - o) || r == 0) { + /* Complete or EOF */ + break; + } + if (unlikely(r == -1)) { + /* Error */ + do_munmap(p, host_len); + return -1; + } + /* Short read -- iterate */ + o += r; } if (!(host_prot & PROT_WRITE)) { mprotect(p, host_len, host_prot); -- 2.43.0