[PATCH] Fixes: failed to call mq_open/mq_unlink in qemu-arm

[PATCH] Fixes: failed to call mq_open/mq_unlink in qemu-arm

[Zhang He]

i write some bare-metal c code need mq_open/mq_unlink syscall, but
the syscall failed in passed name param check, arg1 in this scenario
is the correct address from user-space, arg1 - 1 not.
i have tested in arm cortex-m55 cpu model, maybe should add conditional compile macro?

Signed-off-by: Zhang He <zhanghe9702@163.com>
---
 linux-user/syscall.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index fc37028597..be9610176a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -13058,7 +13058,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
                 }
                 pposix_mq_attr = &posix_mq_attr;
             }
-            p = lock_user_string(arg1 - 1);
+            p = lock_user_string(arg1);
             if (!p) {
                 return -TARGET_EFAULT;
             }
@@ -13068,7 +13068,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return ret;
 
     case TARGET_NR_mq_unlink:
-        p = lock_user_string(arg1 - 1);
+        p = lock_user_string(arg1);
         if (!p) {
             return -TARGET_EFAULT;
         }
-- 
2.43.0

Re: [PATCH] Fixes: failed to call mq_open/mq_unlink in qemu-arm

[Laurent Vivier]

Le 05/06/2025 à 16:46, Zhang He a écrit :
> i write some bare-metal c code need mq_open/mq_unlink syscall, but
> the syscall failed in passed name param check, arg1 in this scenario
> is the correct address from user-space, arg1 - 1 not.
> i have tested in arm cortex-m55 cpu model, maybe should add conditional compile macro?
> 
> Signed-off-by: Zhang He <zhanghe9702@163.com>
> ---
>   linux-user/syscall.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index fc37028597..be9610176a 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -13058,7 +13058,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>                   }
>                   pposix_mq_attr = &posix_mq_attr;
>               }
> -            p = lock_user_string(arg1 - 1);
> +            p = lock_user_string(arg1);
>               if (!p) {
>                   return -TARGET_EFAULT;
>               }
> @@ -13068,7 +13068,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>           return ret;
>   
>       case TARGET_NR_mq_unlink:
> -        p = lock_user_string(arg1 - 1);
> +        p = lock_user_string(arg1);
>           if (!p) {
>               return -TARGET_EFAULT;
>           }

According to the original thread:

Re: [Qemu-devel] [linux-user] Added posix message queue syscalls except
https://mail.gnu.org/archive/html/qemu-devel/2008-12/msg00966.html

It comes from glibc:

/* Remove message queue named NAME.  */
int
__mq_unlink (const char *name)
{
   if (name[0] != '/')
     return INLINE_SYSCALL_ERROR_RETURN_VALUE (EINVAL);

   int ret = INTERNAL_SYSCALL_CALL (mq_unlink, name + 1);

   /* While unlink can return either EPERM or EACCES, mq_unlink should
      return just EACCES.  */
   if (__glibc_unlikely (INTERNAL_SYSCALL_ERROR_P (ret)))
     {
       ret = INTERNAL_SYSCALL_ERRNO (ret);
       if (ret == EPERM)
         ret = EACCES;
       return INLINE_SYSCALL_ERROR_RETURN_VALUE (ret);
     }

   return ret;
}

I think the '+' is to remove the starting '/'.

So if we call it from linux-user app, the string is '/XXXX', then into 
the linux-user glibc it becomes 'XXXX', so to pass it to the host glibc 
again we need to restore the '/' by doing '- 1'.

So I don't think your change is correct.

Thanks,
Laurent