From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:48302) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TqAyZ-0001Tz-Sk for qemu-devel@nongnu.org; Tue, 01 Jan 2013 18:10:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TqAyV-0000HJ-9F for qemu-devel@nongnu.org; Tue, 01 Jan 2013 18:10:27 -0500 Received: from moutng.kundenserver.de ([212.227.17.8]:52295) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TqAyU-0000HC-Vf for qemu-devel@nongnu.org; Tue, 01 Jan 2013 18:10:23 -0500 Message-ID: <1357081815.31530.9.camel@Quad> From: Laurent Vivier Date: Wed, 02 Jan 2013 00:10:15 +0100 In-Reply-To: <1356037136-19479-1-git-send-email-laurent@vivier.eu> References: <1356037136-19479-1-git-send-email-laurent@vivier.eu> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH] linux-user: correct semctl() and shmctl() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Riku Voipio Ping ! Le jeudi 20 d=C3=A9cembre 2012 =C3=A0 21:58 +0100, Laurent Vivier a =C3=A9c= rit : > The parameter "union semun" of semctl() is not a value > but a pointer to the value. >=20 > Moreover, all fields of target_su must be swapped (if needed). >=20 > The third argument of shmctl is a pointer. >=20 > WITHOUT this patch: >=20 > $ ipcs >=20 > kernel not configured for shared memory >=20 > qemu: uncaught target signal 11 (Segmentation fault) - core dumped >=20 > WITH this patch: >=20 > $ ipcs >=20 > ------ Shared Memory Segments -------- > key shmid owner perms bytes nattch status > 0x4e545030 0 root 600 96 1 > 0x4e545031 32769 root 600 96 1 > 0x4e545032 65538 root 666 96 1 > 0x4e545033 98307 root 666 96 1 > 0x47505344 131076 root 666 8240 1 > 0x3c81b7f5 163845 laurent 666 4096 0 > 0x00000000 729513990 laurent 600 393216 2 dest > 0x00000000 729546759 laurent 600 393216 2 dest > 0x00000000 1879179273 laurent 600 393216 2 dest >=20 > ------ Semaphore Arrays -------- > key semid owner perms nsems > 0x3c81b7f6 32768 laurent 666 1 > 0x1c44ac47 6586369 laurent 600 1 >=20 > ------ Message Queues -------- > key msqid owner perms used-bytes messages > 0x1c44ac45 458752 laurent 600 0 0 > 0x1c44ac46 491521 laurent 600 0 0 >=20 > Signed-off-by: Laurent Vivier > --- > linux-user/syscall.c | 37 ++++++++++++++++++++++++++----------- > 1 file changed, 26 insertions(+), 11 deletions(-) >=20 > diff --git a/linux-user/syscall.c b/linux-user/syscall.c > index c2a2343..7bab006 100644 > --- a/linux-user/syscall.c > +++ b/linux-user/syscall.c > @@ -2656,24 +2656,26 @@ static inline abi_long do_semctl(int semid, int s= emnum, int cmd, > break; > case GETALL: > case SETALL: > - err =3D target_to_host_semarray(semid, &array, target_su.arr= ay); > + err =3D target_to_host_semarray(semid, &array, > + tswapal(target_su.array)); > if (err) > return err; > arg.array =3D array; > ret =3D get_errno(semctl(semid, semnum, cmd, arg)); > - err =3D host_to_target_semarray(semid, target_su.array, &arr= ay); > + err =3D host_to_target_semarray(semid, tswapal(target_su.arr= ay), > + &array); > if (err) > return err; > break; > case IPC_STAT: > case IPC_SET: > case SEM_STAT: > - err =3D target_to_host_semid_ds(&dsarg, target_su.buf); > + err =3D target_to_host_semid_ds(&dsarg, tswapal(target_su.bu= f)); > if (err) > return err; > arg.buf =3D &dsarg; > ret =3D get_errno(semctl(semid, semnum, cmd, arg)); > - err =3D host_to_target_semid_ds(target_su.buf, &dsarg); > + err =3D host_to_target_semid_ds(tswapal(target_su.buf), &dsa= rg); > if (err) > return err; > break; > @@ -2681,7 +2683,7 @@ static inline abi_long do_semctl(int semid, int sem= num, int cmd, > case SEM_INFO: > arg.__buf =3D &seminfo; > ret =3D get_errno(semctl(semid, semnum, cmd, arg)); > - err =3D host_to_target_seminfo(target_su.__buf, &seminfo); > + err =3D host_to_target_seminfo(tswapal(target_su.__buf), &se= minfo); > if (err) > return err; > break; > @@ -3161,10 +3163,16 @@ static abi_long do_ipc(unsigned int call, int fir= st, > ret =3D get_errno(semget(first, second, third)); > break; > =20 > - case IPCOP_semctl: > - ret =3D do_semctl(first, second, third, (union target_semun)(abi= _ulong) ptr); > + case IPCOP_semctl: { > + union target_semun *target_su; > + if (!lock_user_struct(VERIFY_READ, target_su, ptr, 1)) { > + ret =3D -TARGET_EFAULT; > + break; > + } > + ret =3D do_semctl(first, second, third, *target_su); > + unlock_user_struct(target_su, ptr, 0); > break; > - > + } > case IPCOP_msgget: > ret =3D get_errno(msgget(first, second)); > break; > @@ -3229,7 +3237,7 @@ static abi_long do_ipc(unsigned int call, int first= , > =20 > /* IPC_* and SHM_* command values are the same on all linux platforms *= / > case IPCOP_shmctl: > - ret =3D do_shmctl(first, second, third); > + ret =3D do_shmctl(first, second, ptr); > break; > default: > gemu_log("Unsupported ipc call: %d (version %d)\n", call, version); > @@ -6996,9 +7004,16 @@ abi_long do_syscall(void *cpu_env, int num, abi_lo= ng arg1, > break; > #endif > #ifdef TARGET_NR_semctl > - case TARGET_NR_semctl: > - ret =3D do_semctl(arg1, arg2, arg3, (union target_semun)(abi_ulo= ng)arg4); > + case TARGET_NR_semctl: { > + union target_semun *target_su; > + if (!lock_user_struct(VERIFY_READ, target_su, arg4, 1)) { > + ret =3D -TARGET_EFAULT; > + break; > + } > + ret =3D do_semctl(arg1, arg2, arg3, *target_su); > + unlock_user_struct(target_su, ptr, 0); > break; > + } > #endif > #ifdef TARGET_NR_msgctl > case TARGET_NR_msgctl: --=20 "Just play. Have fun. Enjoy the game." - Michael Jordan "Just play. Have fun. Enjoy the game." - Michael Jordan