Re: [Qemu-devel] [PATCH 2/2] linux-user: Fix indirect syscall handling for MIPS

[An-Cheng Huang <ancheng@ubnt.com>]

On Fri, Aug 05, 2011 at 10:27:21AM +0100, Peter Maydell wrote:
> On 5 August 2011 01:05, An-Cheng Huang <ancheng@ubnt.com> wrote:
> > Ok the following patch changes the number of arguments for sys_syscall
> > to 8 in mips_syscall_args and also skips the do_syscall() call if any
> > of the get_user() calls fails. Do you think combining these makes sense
> > or should they be two separate patches? Thanks.
> 
> The code in this patch looks good, but yes, I think they should
> be two separate patches.

And the second patch:

This patch verifies that MIPS syscall arguments are successfully taken from the stack before proceeding to do_syscall().

Signed-off-by: An-Cheng Huang <ancheng@ubnt.com>
---
 linux-user/main.c |   22 +++++++++++++++++-----
 1 files changed, 17 insertions(+), 5 deletions(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index 9e67b24..701d96e 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -2090,11 +2090,22 @@ void cpu_loop(CPUMIPSState *env)
                 sp_reg = env->active_tc.gpr[29];
                 switch (nb_args) {
                 /* these arguments are taken from the stack */
-                /* FIXME - what to do if get_user() fails? */
-                case 8: get_user_ual(arg8, sp_reg + 28);
-                case 7: get_user_ual(arg7, sp_reg + 24);
-                case 6: get_user_ual(arg6, sp_reg + 20);
-                case 5: get_user_ual(arg5, sp_reg + 16);
+                case 8:
+                    if ((ret = get_user_ual(arg8, sp_reg + 28)) != 0) {
+                        goto done_syscall;
+                    }
+                case 7:
+                    if ((ret = get_user_ual(arg7, sp_reg + 24)) != 0) {
+                        goto done_syscall;
+                    }
+                case 6:
+                    if ((ret = get_user_ual(arg6, sp_reg + 20)) != 0) {
+                        goto done_syscall;
+                    }
+                case 5:
+                    if ((ret = get_user_ual(arg5, sp_reg + 16)) != 0) {
+                        goto done_syscall;
+                    }
                 default:
                     break;
                 }
@@ -2105,6 +2116,7 @@ void cpu_loop(CPUMIPSState *env)
                                  env->active_tc.gpr[7],
                                  arg5, arg6, arg7, arg8);
             }
+done_syscall:
             if (ret == -TARGET_QEMU_ESIGRETURN) {
                 /* Returning from a successful sigreturn syscall.
                    Avoid clobbering register state.  */