Re: [Qemu-devel] [PATCH resent] linux-user: in poll(), if nfds is 0, pfd can be NULL

[Riku Voipio]

On tiistaina 6. lokakuuta 2015 2.20.48 EEST, Laurent Vivier wrote:
> This problem appears with yum in Fedora 20 / PPC64 container.
>
> test case:
>
>     #include <stdio.h>
>     #include <poll.h>
>
>     int main(void)
>     {
>         int ret;
>
>         ret = poll(NULL, 0, 1000);
>         printf("%d\n", ret);
>     }
>
> target test environment: Fedora 20 / PPC64
> host test environment: Ubuntu 14.0.2 / x86_64
>
> original test result: -1
>
>     13451 poll(0,0,1000,274886297496,268566664,268566648) = -1 
> errno=14 (Bad address)
>
> patched test result: 0
>
>     13536 poll(0,0,1000,274886297496,268566664,268566648) = 0
>
> Signed-off-by: Laurent Vivier <address@hidden>
> ---
> This patch has already been sent in April, this version is just 
> rebased on master.
> https://patchwork.ozlabs.org/patch/460950/

Applied to linux-user, thanks


>  linux-user/syscall.c | 20 +++++++++++++-------
>  1 file changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index 98b5766..9cdb2a2 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -7893,14 +7893,20 @@ abi_long do_syscall(void *cpu_env, int 
> num, abi_long arg1,
>              struct pollfd *pfd;
>              unsigned int i;
>  
> -            target_pfd = lock_user(VERIFY_WRITE, arg1, 
> sizeof(struct target_pollfd) * nfds, 1);
> -            if (!target_pfd)
> -                goto efault;
> +            pfd = NULL;
> +            target_pfd = NULL;
> +            if (nfds) {
> +                target_pfd = lock_user(VERIFY_WRITE, arg1,
> +                                       sizeof(struct 
> target_pollfd) * nfds, 1);
> +                if (!target_pfd) {
> +                    goto efault;
> +                }
>  
> -            pfd = alloca(sizeof(struct pollfd) * nfds);
> -            for(i = 0; i < nfds; i++) {
> -                pfd[i].fd = tswap32(target_pfd[i].fd);
> -                pfd[i].events = tswap16(target_pfd[i].events);
> +                pfd = alloca(sizeof(struct pollfd) * nfds);
> +                for (i = 0; i < nfds; i++) {
> +                    pfd[i].fd = tswap32(target_pfd[i].fd);
> +                    pfd[i].events = tswap16(target_pfd[i].events);
> +                }
>              }
>  
>  # ifdef TARGET_NR_ppoll