Fix wordsize-32 mmap offset for negative value (BZ#18877)

This patch fixes the default wordsize-32 mmap implementation offset
calculation for negative values.  Current code uses signed shift
operation to calculate the multiple size to use with syscall and
it is implementation defined.  Change it to use a division base
on mmap page size (default being as before, 4096).

Tested on armv7hf.

	[BZ #18877]
	* posix/Makefile (tests): Add tst-mmap-offset.
	* posix/tst-mmap.c: New file.
	* sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c (__mmap): Fix
	offset calculation for negative values.

5 files changed, 82 insertions, 6 deletions

diff --git a/ChangeLog b/ChangeLog
index 2f146bf8ce..287ab2db37 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2015-08-27  Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+	    Dmitry V. Levin  <ldv@altlinux.org>
+
+	[BZ #18877]
+	* posix/Makefile (tests): Add tst-mmap-offset.
+	* posix/tst-mmap.c: New file.
+	* sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c (__mmap): Fix
+	offset calculation for negative values.
+
 2015-08-27  H.J. Lu  <hongjiu.lu@intel.com>
 
 	* sysdeps/i386/init-arch.h: New file.
diff --git a/NEWS b/NEWS
index b69402dc71..77e65027ab 100644
--- a/NEWS
+++ b/NEWS
@@ -43,7 +43,7 @@ Version 2.22
   18533, 18534, 18536, 18539, 18540, 18542, 18544, 18545, 18546, 18547,
   18549, 18553, 18557, 18558, 18569, 18583, 18585, 18586, 18592, 18593,
   18594, 18602, 18612, 18613, 18619, 18633, 18635, 18641, 18643, 18648,
-  18657, 18676, 18694, 18696.
+  18657, 18676, 18694, 18696, 18887.
 
 * Cache information can be queried via sysconf() function on s390 e.g. with
   _SC_LEVEL1_ICACHE_SIZE as argument.
diff --git a/posix/Makefile b/posix/Makefile
index 15e8818787..39423a99b5 100644
--- a/posix/Makefile
+++ b/posix/Makefile
@@ -64,7 +64,7 @@ routines :=								      \
 aux		:= init-posix environ
 tests		:= tstgetopt testfnm runtests runptests	     \
 		   tst-preadwrite tst-preadwrite64 test-vfork regexbug1 \
-		   tst-mmap tst-getaddrinfo tst-truncate \
+		   tst-mmap tst-mmap-offset tst-getaddrinfo tst-truncate \
 		   tst-truncate64 tst-fork tst-fnmatch tst-regexloc tst-dir \
 		   tst-chmod bug-regex1 bug-regex2 bug-regex3 bug-regex4 \
 		   tst-gnuglob tst-regex bug-regex5 bug-regex6 bug-regex7 \
diff --git a/posix/tst-mmap-offset.c b/posix/tst-mmap-offset.c
new file mode 100644
index 0000000000..2af8a671c3
--- /dev/null
+++ b/posix/tst-mmap-offset.c
@@ -0,0 +1,67 @@
+/* BZ #18877 mmap offset test.
+
+   Copyright (C) 2015 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <sys/mman.h>
+
+static int
+printmsg (int rc, const char *msg)
+{
+  printf ("%s failed: %m\n", msg);
+  return rc;
+}
+
+/* Check if negative offsets are handled correctly by mmap.  */
+static int
+do_test (void)
+{
+  const int prot = PROT_READ | PROT_WRITE;
+  const int flags = MAP_SHARED;
+  const unsigned long length = 0x10000;
+  const unsigned long offset = 0xace00000;
+  const unsigned long size = offset + length;
+  void *addr;
+  int fd;
+  char fname[] = "tst-mmap-offset-XXXXXX";
+
+  fd = mkstemp64 (fname);
+  if (fd < 0)
+    return printmsg (1, "mkstemp");
+
+  if (unlink (fname))
+    return printmsg (1, "unlink");
+
+  if (ftruncate64 (fd, size))
+    return printmsg (0, "ftruncate64");
+
+  addr = mmap (NULL, length, prot, flags, fd, offset);
+  if (MAP_FAILED == addr)
+    return printmsg (1, "mmap");
+
+  /* This memcpy is likely to SIGBUS if mmap has messed up with offset.  */
+  memcpy (addr, fname, sizeof (fname));
+
+  return 0;
+}
+
+#define TEST_FUNCTION do_test ()
+#include "../test-skeleton.c"
diff --git a/sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c b/sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c
index 24835ce9cc..75790f1996 100644
--- a/sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c
+++ b/sysdeps/unix/sysv/linux/generic/wordsize-32/mmap.c
@@ -21,20 +21,20 @@
 #include <errno.h>
 #include <sysdep.h>
 
-#ifndef MMAP_PAGE_SHIFT
-#define MMAP_PAGE_SHIFT 12
+#ifndef MMAP_PAGE_UNIT
+# define MMAP_PAGE_UNIT 4096UL
 #endif
 
 __ptr_t
 __mmap (__ptr_t addr, size_t len, int prot, int flags, int fd, off_t offset)
 {
-  if (offset & ((1 << MMAP_PAGE_SHIFT) - 1))
+  if (offset & (MMAP_PAGE_UNIT - 1))
     {
       __set_errno (EINVAL);
       return MAP_FAILED;
     }
   return (__ptr_t) INLINE_SYSCALL (mmap2, 6, addr, len, prot, flags, fd,
-                                   offset >> MMAP_PAGE_SHIFT);
+                                   offset / MMAP_PAGE_UNIT);
 }
 
 weak_alias (__mmap, mmap)