Re: [Qemu-devel] [PATCH] linux-user: fix host_to_target_cmsg in case of multiple headers

["Jonathan Neuschäfer" <j.neuschaefer@gmx.net>]

On Thu, Aug 27, 2015 at 07:06:24PM +0100, Peter Maydell wrote:
> This definitely looks like a bug, but I don't think this is
> a sufficient fix, because if DEBUG_REMAP is defined then the
> locked-memory which the target_cmsghdr* is in is not a
> simple g2h() away from the host pointer.
> 
> What you need to do is change target_to_host_cmsg and
> host_to_target_cmsg so that when at the top of the function
> we do:
>     target_cmsg_addr = tswapal(target_msgh->msg_control);
>     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);

After following your advice, I found two more bugs in related code,
which I had to fix. I probably missed something, but my test case
(wine), which receives two headers via a single recvmsg call, is now
working properly. Perhaps an isolated test case would be nice.

I'll send my new patch soon.


Regards,
Jonathan Neuschäfer