Re: [Qemu-devel] [PATCH] linux-user: fix ipc(SEMCTL, ...) argument handling

[Paul Burton <paul@archlinuxmips.org>]

[-- Attachment #1: Type: text/plain, Size: 1267 bytes --]

On Mon, Jun 23, 2014 at 11:42:14PM +0100, Peter Maydell wrote:
> On 23 June 2014 23:36, Paul Burton <paul@archlinuxmips.org> wrote:
> > Actually no, I don't think you're right about that afterall. The
> > argument union itself is never modified. I imagine if it were then it
> > would be painful in the case of the semctl syscall where the union is
> > passed directly as an argument, rather than as a pointer as it is for
> > the ipc syscall.
> >
> > What may be modified is the data pointed to by the pointers within union
> > semun. That is already handled by do_semctl & the translate functions it
> > calls.
> 
> Except if you look at do_semctl you see code like:
>         case GETVAL:
>         case SETVAL:
>             arg.val = tswap32(target_su.val);
>             ret = get_errno(semctl(semid, semnum, cmd, arg));
>             target_su.val = tswap32(arg.val);
>             break;
> 
> which clearly is just modifying fields in the target_semun union.
> So something's wrong (probably that code)...

Yes, both Linux & man semctl agree that GETVAL returns the value of
the semaphore as the return value of the syscall. So I believe the
assignment to target_su.val there is (functionally harmless) garbage.

Thanks,
    Paul

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]