qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [Patch] Resend: linux-user/syscall.c - don't add GUEST_


From: Jan-Simon Möller
Subject: Re: [Qemu-devel] [Patch] Resend: linux-user/syscall.c - don't add GUEST_BASE to NULL pointer
Date: Sat, 17 Oct 2009 19:45:21 +0200
User-agent: KMail/1.10.3 (Linux/2.6.27.29-0.1-default; KDE/4.1.3; x86_64; ; )

This patch fixes the mount call. GUEST_BASE shouldn't be added to a NULL 
pointer on arg5 .
failing call: 
mount("rootfs", "/", 0x47a78, MS_MGC_VAL|MS_REMOUNT, 0x10000) = -1 EFAULT (Bad 
address)

correct call:
mount("rootfs", "/", 0x37ab0, MS_MGC_VAL|MS_REMOUNT, NULL) = 0


Signed-off-by:  Jan-Simon Möller  <address@hidden>
---
 linux-user/syscall.c |    8 ++++++--
 1 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 673eed4..5b2ec4f 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -4445,12 +4445,16 @@ abi_long do_syscall(void *cpu_env, int num, abi_long 
arg1,
                        p3 = lock_user_string(arg3);
                         if (!p || !p2 || !p3)
                             ret = -TARGET_EFAULT;
-                        else
+                        else {
                             /* FIXME - arg5 should be locked, but it isn't 
clear how to
                              * do that since it's not guaranteed to be a 
NULL-terminated
                              * string.
                              */
-                            ret = get_errno(mount(p, p2, p3, (unsigned 
long)arg4, g2h(arg5)));
+                            if ( ! arg5 )
+                                ret = get_errno(mount(p, p2, p3, (unsigned 
long)arg4, NULL));
+                            else
+                                ret = get_errno(mount(p, p2, p3, (unsigned 
long)arg4, g2h(arg5)));
+                        }
                         unlock_user(p, arg1, 0);
                         unlock_user(p2, arg2, 0);
                         unlock_user(p3, arg3, 0);

reply via email to

[Prev in Thread] Current Thread [Next in Thread]