From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34346) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFTMN-0000eZ-6C for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:08 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WFTMM-0007nB-02 for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:07 -0500 Received: from mnementh.archaic.org.uk ([2001:8b0:1d0::1]:45982) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WFTML-0007ix-P5 for qemu-devel@nongnu.org; Mon, 17 Feb 2014 13:56:05 -0500 From: Peter Maydell Date: Mon, 17 Feb 2014 18:55:33 +0000 Message-Id: <1392663334-8555-4-git-send-email-peter.maydell@linaro.org> In-Reply-To: <1392663334-8555-1-git-send-email-peter.maydell@linaro.org> References: <1392663334-8555-1-git-send-email-peter.maydell@linaro.org> Subject: [Qemu-devel] [PATCH 3/4] linux-user: Fix error handling in lock_iovec() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Riku Voipio , patches@linaro.org In lock_iovec() if lock_user() failed we were doing an unlock_user but not a free(vec), which is the wrong way round. We were also assuming that free() and unlock_user() don't touch errno, which is not guaranteed. Fix both these problems. Signed-off-by: Peter Maydell --- linux-user/syscall.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index f370087..bb3e4b1 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -1707,6 +1707,7 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, struct iovec *vec; abi_ulong total_len, max_len; int i; + int err = 0; if (count == 0) { errno = 0; @@ -1726,7 +1727,7 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, target_vec = lock_user(VERIFY_READ, target_addr, count * sizeof(struct target_iovec), 1); if (target_vec == NULL) { - errno = EFAULT; + err = EFAULT; goto fail2; } @@ -1740,7 +1741,7 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, abi_long len = tswapal(target_vec[i].iov_len); if (len < 0) { - errno = EINVAL; + err = EINVAL; goto fail; } else if (len == 0) { /* Zero length pointer is ignored. */ @@ -1748,7 +1749,7 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, } else { vec[i].iov_base = lock_user(type, base, len, copy); if (!vec[i].iov_base) { - errno = EFAULT; + err = EFAULT; goto fail; } if (len > max_len - total_len) { @@ -1763,9 +1764,10 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, return vec; fail: - free(vec); - fail2: unlock_user(target_vec, target_addr, 0); + fail2: + free(vec); + errno = err; return NULL; } -- 1.8.5