Skip to content

Commit cfa8da5

Browse files
Avoid signed overflow in DBG_FlushInstructionCache (#105918)
On ARM32 Linux we can have an infinite loop because of integer overflow. For example, if DBG_FlushInstructionCache is called with the following parameters & locals: dwSize = 28 pageSize = 4096 begin = lpBaseAddress = 0x7ffff000 end = begin + dwSize = 0x7ffff01c ALIGN_UP(0x7ffff000, 4096) returns 0x80000000 which is actually a negative number because INT_PTR is just int32_t (on ARM32). And here we are getting an infinite loop because "begin" will never be greater or equal than "end". So, this issue is related to all addresses between INT32_MAX - PAGE_SIZE and INT32_MAX because ALIGN_UP returns the address of the next page which will be greater or equal to INT32_MAX Signed-off-by: Andrei Lalaev <[email protected]> Co-authored-by: Andrei Lalaev <[email protected]>
1 parent d8b910b commit cfa8da5

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

src/coreclr/pal/src/thread/context.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2068,12 +2068,12 @@ DBG_FlushInstructionCache(
20682068
// As a workaround, we call __builtin___clear_cache on each page separately.
20692069

20702070
const SIZE_T pageSize = GetVirtualPageSize();
2071-
INT_PTR begin = (INT_PTR)lpBaseAddress;
2072-
const INT_PTR end = begin + dwSize;
2071+
UINT_PTR begin = (UINT_PTR)lpBaseAddress;
2072+
const UINT_PTR end = begin + dwSize;
20732073

20742074
while (begin < end)
20752075
{
2076-
INT_PTR endOrNextPageBegin = ALIGN_UP(begin + 1, pageSize);
2076+
UINT_PTR endOrNextPageBegin = ALIGN_UP(begin + 1, pageSize);
20772077
if (endOrNextPageBegin > end)
20782078
endOrNextPageBegin = end;
20792079

0 commit comments

Comments
 (0)