From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:34775)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <j.neuschaefer@gmx.net>) id 1ZVici-0003kM-GM
	for qemu-devel@nongnu.org; Sat, 29 Aug 2015 12:04:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <j.neuschaefer@gmx.net>) id 1ZVicf-0001Zg-Ax
	for qemu-devel@nongnu.org; Sat, 29 Aug 2015 12:04:56 -0400
Received: from mout.gmx.net ([212.227.17.21]:65248)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <j.neuschaefer@gmx.net>) id 1ZVicf-0001Z0-4X
	for qemu-devel@nongnu.org; Sat, 29 Aug 2015 12:04:53 -0400
Date: Sat, 29 Aug 2015 18:04:49 +0200
From: Jonathan =?utf-8?Q?Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>
Message-ID: <20150829160449.GB8212@latitude>
References: <20150827145035.GA13532@latitude>
	<CAFEAcA8cDsVfN-Pu8WgTvKR9SaDysWqsL8RAiDW=epD-Z+Ex7A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAFEAcA8cDsVfN-Pu8WgTvKR9SaDysWqsL8RAiDW=epD-Z+Ex7A@mail.gmail.com>
Subject: Re: [Qemu-devel] [PATCH] linux-user: fix host_to_target_cmsg in
 case of multiple headers
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Peter Maydell <peter.maydell@linaro.org>
Cc: Riku Voipio <riku.voipio@iki.fi>, Jonathan =?utf-8?Q?Neusch=C3=A4fer?= <j.neuschaefer@gmx.net>, QEMU Developers <qemu-devel@nongnu.org>

On Thu, Aug 27, 2015 at 07:06:24PM +0100, Peter Maydell wrote:
> This definitely looks like a bug, but I don't think this is
> a sufficient fix, because if DEBUG_REMAP is defined then the
> locked-memory which the target_cmsghdr* is in is not a
> simple g2h() away from the host pointer.
> 
> What you need to do is change target_to_host_cmsg and
> host_to_target_cmsg so that when at the top of the function
> we do:
>     target_cmsg_addr = tswapal(target_msgh->msg_control);
>     target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);

After following your advice, I found two more bugs in related code,
which I had to fix. I probably missed something, but my test case
(wine), which receives two headers via a single recvmsg call, is now
working properly. Perhaps an isolated test case would be nice.

I'll send my new patch soon.


Regards,
Jonathan Neuschäfer