From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35194) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XELPU-0006dJ-8B for qemu-devel@nongnu.org; Mon, 04 Aug 2014 12:47:05 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XELPL-000810-82 for qemu-devel@nongnu.org; Mon, 04 Aug 2014 12:46:56 -0400 From: Tom Musta Date: Mon, 4 Aug 2014 11:45:29 -0500 Message-Id: <1407170739-12237-3-git-send-email-tommusta@gmail.com> In-Reply-To: <1407170739-12237-1-git-send-email-tommusta@gmail.com> References: <1407170739-12237-1-git-send-email-tommusta@gmail.com> Subject: [Qemu-devel] [PATCH 02/12] linux-user: Dereference Pointer Argument to ipc/semctl Sys Call List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org, qemu-ppc@nongnu.org Cc: Tom Musta , riku.voipio@linaro.org, agraf@suse.de When the ipc system call is used to wrap a semctl system call, the ptr argument to ipc needs to be dereferenced prior to passing it to the semctl handler. This is because the fourth argument to semctl is a union and not a pointer to a union. Signed-off-by: Tom Musta diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 540001c..229c482 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -3135,9 +3135,15 @@ static abi_long do_ipc(unsigned int call, int first, ret = get_errno(semget(first, second, third)); break; - case IPCOP_semctl: - ret = do_semctl(first, second, third, (union target_semun)(abi_ulong) ptr); + case IPCOP_semctl: { + /* The semun argument to semctl is passed by value, so dereference the + * ptr argument. */ + abi_ulong atptr; + get_user_ual(atptr, (abi_ulong)ptr); + ret = do_semctl(first, second, third, + (union target_semun)(abi_ulong) atptr); break; + } case IPCOP_msgget: ret = get_errno(msgget(first, second)); -- 1.7.1